parallel-codex-tui 0.1.4 → 0.1.5

package/.parallel-codex/config.example.toml

@@ -30,6 +30,8 @@ fallback = "simple"
 # Maximum isolated Actor or Critic feature workers running at the same time (1..8).
 # Each feature receives its own snapshot; a combined Wave Critic approves staged changes before atomic live commit.
 maxParallelFeatures = 3
+# Maximum Actor/Critic revision rounds before the task is stopped for manual intervention (1..10).
+maxRevisionRounds = 3
 
 [workers.codex]
 command = "codex"
@@ -63,6 +65,8 @@ freshSessionArgs = []
 [workers.codex.interactive]
 command = "codex"
 args = ["resume", "{sessionId}"]
+# Used by the Task session detail view when branching from a recorded native session.
+forkArgs = ["fork", "{sessionId}"]
 
 [workers.codex.nativeSession]
 fallback = "new"
@@ -93,6 +97,7 @@ freshSessionArgs = ["--session-id", "{sessionId}"]
 [workers.claude.interactive]
 command = "claude"
 args = ["--resume", "{sessionId}"]
+forkArgs = ["--resume", "{sessionId}", "--fork-session"]
 
 [workers.claude.nativeSession]
 fallback = "new"
@@ -106,6 +111,47 @@ profile = "generic"
 writableDirArgs = []
 freshSessionArgs = []
 
+# Add any number of named Worker providers. IDs use lowercase letters, digits, or _.
+# A profile can inherit the Codex/Claude command protocol and override only role-specific values.
+# [workers.openai_compat]
+# extends = "codex"
+# command = "openai-compatible-coder"
+# assignable = true
+#
+# [workers.openai_compat.model]
+# name = "third-party-model"
+# provider = "openai-compatible"
+# args = ["--model", "{model}", "--provider", "{provider}"]
+#
+# [workers.openai_compat.model.env]
+# OPENAI_API_KEY = "{env:OPENAI_COMPAT_API_KEY}"
+# OPENAI_BASE_URL = "{env:OPENAI_COMPAT_BASE_URL}"
+#
+# [workers.openai_compat.interactive]
+# command = "openai-compatible-coder"
+#
+# [workers.anthropic_compat]
+# extends = "claude"
+# command = "anthropic-compatible-coder"
+#
+# [workers.anthropic_compat.model]
+# name = "third-party-claude-model"
+# provider = "anthropic-compatible"
+#
+# [workers.anthropic_compat.model.env]
+# ANTHROPIC_API_KEY = "{env:ANTHROPIC_COMPAT_API_KEY}"
+# ANTHROPIC_BASE_URL = "{env:ANTHROPIC_COMPAT_BASE_URL}"
+#
+# [workers.anthropic_compat.interactive]
+# command = "anthropic-compatible-coder"
+
+# A custom CLI starts from conservative generic defaults: isolated cwd, no injected
+# vendor flags, and native resume disabled until explicitly configured.
+# [workers.vendor]
+# extends = "generic"
+# command = "vendor-coder"
+# args = ["run", "--stdin"]
+
 [pairing]
 main = "claude"
 judge = "codex"

package/README.md

@@ -39,6 +39,7 @@ Startup resolves the worker project before routing:
 - Without `--workspace`, an interactive terminal shows remembered projects from `.parallel-codex/workspaces.json`; use Up/Down and Enter, a displayed number, or `N` to enter a new folder path. The picker clears before the main chat opens.
 - In non-interactive startup, the CLI reuses the last remembered workspace, falls back to the current directory if none was saved, and creates an explicit `--workspace` path if needed.
 - The selected workspace is prepared before any router or worker process starts.
+- Every interactive open and in-place workspace switch runs a quota-free startup preflight before the TUI accepts work. It checks workspace read/write/search access, every CLI required by the active route and role configuration, referenced model environment variables, each named Worker's Codex, Claude, or declared generic CLI capabilities, configured proxy endpoint reachability, and native workspace trust policy. Healthy checks stay quiet; warnings and failures appear in chat with the `parallel-codex-tui --doctor` action. Live model requests remain opt-in through `--probe-agents` and `--probe-router`.
 - While the TUI is idle, press `Ctrl+P` to open the same project picker without exiting. `Esc` returns with the unsent draft intact; selecting or creating a folder locks duplicate picker input, shows the project being opened, rebuilds the runtime in place, and restores that workspace's latest task, route, workers, and chat. A failed open returns to the original view without replacing its runtime or draft.
 - Workspace chat, task files, and `session-index.sqlite` stay isolated under each project. Router configuration and `router/routes.jsonl` remain shared under the app root, so classifications across projects use one global Router audit.
 
@@ -68,7 +69,7 @@ parallel-codex-tui --doctor --probe-router
 parallel-codex-tui --version
 ```
 
-`--doctor` checks configured automated and interactive commands, `{env:NAME}` references, and the CLI help surfaces required for Codex exec/resume sandboxing and Claude print/resume permissions before workers start. Recognized standard CLI help that lacks a required option fails the check; an opaque wrapper keeps the compatible built-in profile's unverified warning, while an explicit `generic` capability contract is validated without guessing vendor-specific help. Doctor also rejects an explicitly read-only Codex interactive sandbox because feature attach requires its recorded writable roots, and reminds you that native workspace trust remains an interactive decision. It reports proxy host/port reachability as a local-endpoint check, not as proof that the proxy upstream or model API is healthy. Add `--probe-agents` to make one minimal fresh request and one same-session resume request through every configured Codex or Claude worker engine. This explicit probe uses model quota, removes successful probe artifacts, preserves failed artifacts under `.parallel-codex/probes/`, and exits non-zero when a fresh or resumed request cannot be proven. Fresh sessions use the configured `freshSessionArgs`; Claude defaults to a generated native `--session-id`, persisted only after the process emits output, so a silent failed launch cannot create a false resumable session. Add `--probe-router` to run one real classification through the configured Codex Router; the command exits non-zero when that live request falls back or fails. Doctor also reports the loaded TUI theme, core palette values, ANSI swatch previews, and color override values, including any temporary `--theme` override.
+`--doctor` checks configured automated and interactive commands, `{env:NAME}` references, and the CLI help surfaces required for Codex exec/resume sandboxing and Claude print/resume permissions before workers start. Recognized standard CLI help that lacks a required option fails the check; an opaque wrapper keeps the compatible built-in profile's unverified warning, while an explicit `generic` capability contract is validated without guessing vendor-specific help. Doctor performs these checks for every named Worker Provider used by the active route, rejects an explicitly read-only Codex-compatible interactive sandbox when feature attach needs writable roots, and reminds you that native workspace trust remains an interactive decision. It reports proxy host/port reachability as a local-endpoint check, not as proof that the proxy upstream or model API is healthy. Add `--probe-agents` to make one minimal fresh request and, when configured, one same-session resume request through every active process Worker Provider. This explicit probe uses model quota, removes successful probe artifacts, preserves failed artifacts under `.parallel-codex/probes/`, and exits non-zero when a fresh or resumed request cannot be proven. Fresh sessions use the configured `freshSessionArgs`; Claude-compatible profiles default to a generated native `--session-id`, persisted only after the process emits output, so a silent failed launch cannot create a false resumable session. Add `--probe-router` to run one real classification through the configured Codex Router; the command exits non-zero when that live request falls back or fails. Doctor also reports the loaded TUI theme, core palette values, ANSI swatch previews, and color override values, including any temporary `--theme` override.
 
 ## Quick Start
 
@@ -107,10 +108,13 @@ Limit how many feature-level Actor or Critic agents may run at once:
 ```toml
 [orchestration]
 maxParallelFeatures = 3 # 1..8
+maxRevisionRounds = 3   # 1..10
 ```
 
 Judge may plan up to eight dependency-aware features. The orchestrator keeps dependency order while running at most this many agents concurrently. When one worker fails, already-running peers are allowed to finish cleanly and queued features are not started.
 
+Actor and Critic reuse their native sessions across revision rounds. Blocking findings and Actor replies remain in the Feature JSONL mailbox; the task stops with an explicit error when `maxRevisionRounds` is exhausted.
+
 Queued Feature workers remain `queued` until they acquire a concurrency slot. Their persisted state changes to `actor_running` or `critic_running` only after the Worker is registered as cancellable, then to `actor_done` or `critic_done` before that active registration is removed. As a result, only `actor_running` and `critic_running` expose Feature cancellation; queued and role-complete Features cannot present a cancel action that has no live process behind it.
 
 ## Theme
@@ -262,7 +266,7 @@ ALL_PROXY = "socks5h://127.0.0.1:7890"
 NO_PROXY = "localhost,127.0.0.1"
 ```
 
-`router.codex.env` applies only to semantic classification. `workers.codex.model.env` applies to fresh/resumed Codex workers and embedded native attach sessions. Keep these values in local `config.toml`, which is ignored by Git.
+`router.codex.env` applies only to semantic classification. `workers.<id>.model.env` applies to fresh/resumed runs and embedded native attach for that named Worker Provider. Keep these values in local `config.toml`, which is ignored by Git.
 
 Run `parallel-codex-tui --doctor` after changing proxy settings. Doctor checks referenced environment variables, reports when a macOS system proxy is not inherited by Codex subprocesses, and labels configured proxy host/port checks as local-endpoint reachability without printing credentials. Then run `parallel-codex-tui --doctor --probe-router` when you also need to verify the real Codex Router path through that proxy; this explicit probe can take up to `router.codex.timeoutMs`. A timed-out request is identified as `first output timeout`, `idle timeout after stdout/stderr`, or `total timeout`; `via <proxy-host:port>` remains context, not a claim that the proxy caused the failure. The audit never exposes the proxy URL or credentials.
 
@@ -302,6 +306,7 @@ freshSessionArgs = []
 [workers.codex.interactive]
 command = "codex"
 args = ["resume", "{sessionId}"]
+forkArgs = ["fork", "{sessionId}"]
 
 [workers.claude]
 command = "claude"
@@ -315,31 +320,81 @@ freshSessionArgs = ["--session-id", "{sessionId}"]
 [workers.claude.interactive]
 command = "claude"
 args = ["--resume", "{sessionId}"]
+forkArgs = ["--resume", "{sessionId}", "--fork-session"]
 ```
 
 `model.args` and `model.env` apply to both automated worker runs and embedded native attach sessions. Native attach appends the rendered model arguments after `interactive.args`, so third-party `{model}` and `{provider}` selections remain active when you press `Ctrl+O`.
 
-`model.provider` names the remote model service; `capabilities.profile` describes the local CLI protocol. Keep the built-in `codex` or `claude` profile when a wrapper accepts that CLI's normal flags. For a third-party command with its own syntax, declare `generic` so parallel-codex-tui does not inject `--sandbox`, `--permission-mode`, or other built-in-only flags:
+`model.provider` names the remote model service; `capabilities.profile` describes the local CLI protocol. Worker Provider IDs are lowercase names using letters, digits, or `_`; excluding `-` keeps generated Worker directory names unambiguous. Existing `codex`, `claude`, and `mock` IDs remain compatible, while additional profiles can inherit `codex`, `claude`, another named profile, or conservative `generic` defaults.
+
+Each role can select an independent command, model, environment, and permission contract through `[pairing]`. This example uses an OpenAI-compatible coding CLI for Judge/Actor and an Anthropic-compatible coding CLI for Main/Critic:
 
 ```toml
-[workers.codex]
+[workers.openai_compat]
+extends = "codex"
+command = "openai-compatible-coder"
+args = ["exec", "--sandbox", "workspace-write", "-"]
+
+[workers.openai_compat.model]
+name = "third-party-code-model"
+provider = "openai-compatible"
+args = ["--model", "{model}", "--provider", "{provider}"]
+
+[workers.openai_compat.model.env]
+OPENAI_API_KEY = "{env:OPENAI_COMPAT_API_KEY}"
+OPENAI_BASE_URL = "{env:OPENAI_COMPAT_BASE_URL}"
+
+[workers.openai_compat.interactive]
+command = "openai-compatible-coder"
+
+[workers.anthropic_compat]
+extends = "claude"
+command = "anthropic-compatible-coder"
+
+[workers.anthropic_compat.model]
+name = "third-party-claude-model"
+provider = "anthropic-compatible"
+
+[workers.anthropic_compat.model.env]
+ANTHROPIC_API_KEY = "{env:ANTHROPIC_COMPAT_API_KEY}"
+ANTHROPIC_BASE_URL = "{env:ANTHROPIC_COMPAT_BASE_URL}"
+
+[workers.anthropic_compat.interactive]
+command = "anthropic-compatible-coder"
+
+[pairing]
+main = "anthropic_compat"
+judge = "openai_compat"
+actor = "openai_compat"
+critic = "anthropic_compat"
+```
+
+`extends` inherits the complete command protocol, including capabilities, native-session behavior, watchdogs, and interactive arguments. Override both `command` and `interactive.command` when a wrapper replaces both executables. `assignable = true` exposes a profile to Feature-level Provider cycling; custom profiles default to true, while the reserved deterministic `mock` profile defaults to false. Pairing an unknown profile, unsafe profile IDs, and inheritance cycles fail config validation before startup.
+
+For a third-party command with its own syntax, inherit `generic` so parallel-codex-tui does not inject `--sandbox`, `--permission-mode`, or other built-in-only flags:
+
+```toml
+[workers.vendor]
+extends = "generic"
 command = "vendor-coder"
 args = ["run", "--stdin"]
 
-[workers.codex.capabilities]
+[workers.vendor.capabilities]
 profile = "generic"
 writableDirArgs = ["--allow-root", "{dir}"]
 freshSessionArgs = ["--new-session", "{sessionId}"]
 
-[workers.codex.nativeSession]
+[workers.vendor.nativeSession]
+enabled = true
 resumeArgs = ["run", "--resume", "{sessionId}", "--stdin"]
 
-[workers.codex.interactive]
+[workers.vendor.interactive]
 command = "vendor-coder"
 args = ["resume", "{sessionId}"]
+forkArgs = ["branch", "{sessionId}"]
 ```
 
-Set either capability argument list to `[]` when the wrapper needs no extra argument. A non-empty `writableDirArgs` must include `{dir}`, and a non-empty `freshSessionArgs` must include `{sessionId}`. Doctor validates this declared contract without guessing the wrapper's `--help` format; `--doctor --probe-agents` remains the end-to-end fresh/resume check.
+Generic profiles start with native resume disabled, no vendor flags, and the isolated Worker cwd. Set either capability argument list to `[]` when the wrapper needs no extra argument. A non-empty `writableDirArgs` must include `{dir}`, while non-empty `freshSessionArgs` and `interactive.forkArgs` must include `{sessionId}`. Set `forkArgs = []` when a generic CLI cannot fork a native conversation. Doctor validates the declared capability contract without guessing the wrapper's `--help` format; `--doctor --probe-agents` remains the end-to-end fresh/resume check. Every new Worker status records the actual profile ID plus its rendered model/provider snapshot, so later config changes do not relabel historical runs.
 
 Customize each role independently; the main role is applied to simple chat, while Judge, Actor, and Critic receive their configured instructions during complex work:
 
@@ -357,19 +412,23 @@ Keep `[router.codex]` on `read-only`; routing only classifies requests and does
 
 The process adapter sends each role prompt to stdin and records stdout/stderr in `output.log`. Worker success is separate from the operating-system exit code: a total, first-output, idle, or stdin watchdog failure remains failed even when the terminated CLI handles `SIGTERM` and exits with code `0`, so the next role never starts from a timed-out checkpoint. `firstOutputTimeoutMs` owns silent startup, `idleTimeoutMs` starts only after real stdout/stderr activity, and `timeoutMs` remains the hard ceiling; equal or longer secondary watchdogs do not race the total deadline.
 
-In chat, scroll long conversation history with the mouse wheel or PageUp/PageDown; sending a new message returns to the latest reply. After a complex task completes, use the same controls to move through its structured result and press `Ctrl+D` to toggle details. Press `Ctrl+N` to preserve the current session and start a new task, `Ctrl+W` to open worker logs, and `Tab` to cycle the selected worker when workers exist. While a request is running, press `Esc` to stop it. After a failed or cancelled task, press `Ctrl+R` to retry the same turn or `Ctrl+N` to start independently. In worker-log views, scroll with the mouse wheel or PageUp/PageDown, press `Tab` to cycle workers, `Ctrl+N` to start a new task, and `Esc` to return to chat.
+In chat, scroll long conversation history with the mouse wheel or PageUp/PageDown; sending a new message returns to the latest reply. After a complex task completes, use the same controls to move through its structured result and press `Ctrl+D` to toggle details. Press `Ctrl+N` to preserve the current session and start a new task, `Ctrl+W` to open worker logs, and `Tab` to cycle the selected worker when workers exist. `Ctrl+S` opens the same status detail view from chat, logs, Worker overview, or an embedded native session; it keeps the footer compact while exposing the complete route, reason, selected Provider/model, phase, activity timestamp, and native session. Press `Ctrl+S` or `Esc` to return without interrupting the underlying Worker. While a request is running, press `Esc` to stop it. After a failed or cancelled task, press `Ctrl+R` to retry the same turn or `Ctrl+N` to start independently. In worker-log views, scroll with the mouse wheel or PageUp/PageDown, press `Tab` to cycle workers, `Ctrl+N` to start a new task, and `Esc` to return to chat.
 
-`Ctrl+B` opens a live Worker overview without replacing the `Ctrl+W` log shortcut. It summarizes every Judge, Actor, and Critic by engine, state, phase, latest summary, and native-session availability. The selected active worker gets a live activity line showing its first-output deadline while starting and its idle deadline after output begins. The line stays muted while healthy, changes to warning for the final 20% and danger once overdue. Up/Down, PageUp/PageDown, the mouse wheel, or `Tab` changes the selected worker; Enter or `Ctrl+W` opens its rendered log, `Ctrl+O` attaches to its native session, and `Esc` returns to the originating chat or log view. Router diagnostics and the project picker also return to the overview when opened from there.
+`Ctrl+B` opens a live Worker overview without replacing the `Ctrl+W` log shortcut. It summarizes every Judge, Actor, and Critic by turn, role, named Provider, persisted model, state, phase, latest summary, and native-session availability. The selected active worker gets a live activity line showing its first-output deadline while starting and its idle deadline after output begins. The line stays muted while healthy, changes to warning for the final 20% and danger once overdue. Up/Down, PageUp/PageDown, the mouse wheel, or `Tab` changes the selected worker; Enter or `Ctrl+W` opens its rendered log, `Ctrl+O` attaches to its native session, and `Esc` returns to the originating chat or log view. Router diagnostics and the project picker also return to the overview when opened from there.
 
-From Worker overview, press `F` to open the file-backed Feature board. It summarizes every planned feature by turn, state, blocked dependencies and open Critic findings while preserving descriptions and Actor replies from the same collaboration files. Use Up/Down, PageUp/PageDown, the mouse wheel, or `Tab` to select a feature; Enter opens the selected feature's collaboration timeline; `R` refreshes immediately; and `Esc` returns to Worker overview. When a timeline was opened from this board, `Esc` returns to the Feature board instead of skipping back to Workers. While the selected feature is running, press `X` twice to cancel only its active Actor or Critic process; the first press opens a confirmation and `Esc` keeps it running. After confirmation, already-running peers finish, queued workers stop, and integration remains blocked, so a partial wave never reaches the live workspace. Once the task settles as cancelled, `Ctrl+R` retries the cancelled task with persisted worker sessions; completed peers are loaded from their same-wave checkpoints instead of running again. Checkpoint load, reuse, and recovery events appear in the collaboration timeline.
+From Worker overview, press `F` to open the file-backed Feature board. It summarizes every planned feature by turn, state, blocked dependencies and open Critic findings while preserving descriptions and Actor replies from the same collaboration files. Use Up/Down, PageUp/PageDown, the mouse wheel, or `Tab` to select a feature; Enter opens the selected feature's collaboration timeline; `R` refreshes immediately; and `Esc` returns to Worker overview. When a timeline was opened from this board, `Esc` returns to the Feature board instead of skipping back to Workers. While the selected feature is running, press `P` twice to pause only its active Actor or Critic process, or press `X` twice to cancel it; the first press opens a confirmation and `Esc` keeps it running. A paused feature preserves completed peers and same-wave checkpoints; select it and press `Ctrl+R` to resume the same task, turn, and native Worker session. After cancellation, already-running peers finish, queued workers stop, and integration remains blocked, so a partial wave never reaches the live workspace. Once the task settles as cancelled, `Ctrl+R` retries the cancelled task with persisted worker sessions; completed peers are loaded from their same-wave checkpoints instead of running again. Checkpoint load, reuse, and recovery events appear in the collaboration timeline.
+
+For a failed, cancelled, or paused task, select an unfinished Feature and press `M` to edit its Provider assignment. `A` cycles that Feature's Actor through every `assignable` Worker Provider, `C` cycles its Critic, and `M` or `Esc` closes the assignment prompt. The choice is persisted in `features/<turn>-<feature>/assignment.json`, appears on the Feature board and collaboration artifacts, and takes effect on the next `Ctrl+R` retry. A changed role starts a new Provider-specific Worker while every previous Worker log and native-session record remains available. Assignment writes hold the same task lease as execution, so another live TUI cannot change a Feature while it is resuming.
 
 From Worker overview, press `C` to open the file-backed Actor/Critic collaboration timeline. It merges `dialogue/actor-critic.jsonl`, feature status, Critic findings, Actor replies, finding resolution, and Wave events into one chronological view. The timeline follows new file evidence automatically and shows verified `fixed`/`open` counts when resolution evidence exists. Up/Down selects a collaboration event; `Enter` opens its complete event detail, including artifact paths from dialogue, status, Critic findings, Actor replies, and finding resolution; `U` filters to unresolved feature evidence; `Tab` cycles all features and each individual feature; `R` refreshes immediately; the mouse wheel or PageUp/PageDown scrolls history; and `Esc` returns to Worker overview.
 
-`Ctrl+T` opens the workspace's persisted Task sessions without exiting the outer TUI. The list shows status, creation time, turn and worker counts, plus the number of distinct native sessions after deduplicating reused `engine + session_id` bindings; `>` marks the selected row and `*` marks the active task. Use Up/Down, PageUp/PageDown, the mouse wheel, or `Tab` to select, Enter to restore, `R` to rename with Unicode-safe cursor editing, `A` to archive or unarchive, `D` twice to confirm deletion, `E` to export, `H` to show or hide archived sessions, `Ctrl+N` to start with an empty task context, and `Esc` to return without losing the chat draft. Archived sessions are hidden by default, cannot be restored until unarchived, and are excluded from automatic startup selection. Archive, delete, and export require a terminal task with no live task lease; the active task cannot be archived or deleted. Exports are complete file-backed snapshots under `.parallel-codex/exports/<task>-<timestamp>/` with a versioned manifest and without transient lease files. Restoring a task reloads its route, workers, retry state, and recorded native session ids. The selected active task is stored in `session-index.sqlite` and survives process and workspace switches; `Ctrl+N` persists an intentionally empty active-task context instead of reopening an older task on restart. Existing SQLite catalogs gain the nullable archive column automatically, while `meta.json` remains the rebuild authority.
+`Ctrl+T` opens the workspace's persisted Task sessions without exiting the outer TUI. The list shows status, creation time, turn and worker counts, plus the number of distinct native sessions after deduplicating reused `engine + session_id` bindings; `>` marks the selected row and `*` marks the active task. Use Up/Down, PageUp/PageDown, the mouse wheel, or `Tab` to select, Enter to restore, `I` to inspect the complete session hierarchy, `R` to rename with Unicode-safe cursor editing, `A` to archive or unarchive, `D` twice to confirm deletion, `E` to export, `H` to show or hide archived sessions, `Ctrl+N` to start with an empty task context, and `Esc` to return without losing the chat draft. Archived sessions are hidden by default, cannot be restored until unarchived, and are excluded from automatic startup selection. Archive, delete, and export require a terminal task with no live task lease; the active task cannot be archived or deleted. Exports are complete file-backed snapshots under `.parallel-codex/exports/<task>-<timestamp>/` with a versioned manifest and without transient lease files. Restoring a task reloads its route, workers, retry state, and recorded native session ids. The selected active task is stored in `session-index.sqlite` and survives process and workspace switches; `Ctrl+N` persists an intentionally empty active-task context instead of reopening an older task on restart. SQLite schema changes run as ordered, transactional migrations. Existing catalogs receive a pre-migration snapshot, each successful startup/reindex refreshes a healthy backup, and an integrity failure restores that backup or rebuilds the catalog from authoritative task files while preserving the corrupt copy for inspection. `meta.json` and the Worker files remain the rebuild authority.
+
+The Task detail view reads authoritative task files and presents `Project -> Task -> Turn -> Worker -> Native session`, including each request, role, engine, configured model, Worker state, native session id, working directory, and last activity time. Historical Workers from earlier turns remain selectable after same-task follow-ups. Use Up/Down or `Tab` to select a Worker, Enter to open its retained log, `C` or `Ctrl+O` to continue the original native session, `B` to ask the native CLI to fork it, `R` to refresh, and `Esc` to return to the Task list. Continue and fork restore the selected Worker's recorded cwd and writable roots while the outer TUI stays open. Codex and Claude have built-in fork commands; a generic CLI exposes `B` only when `interactive.forkArgs` is configured. The child fork is owned and persisted by the native CLI; the indexed parent session remains unchanged.
 
 In a Worker log, `Ctrl+F` searches the final rendered Worker log rather than raw file offsets. Type Unicode text normally; Enter moves to the next match and Up/Down moves backward or forward. `Esc` closes search. The current match is marked with `>` without shifting Diff or source line-number columns. With search closed, press `E` to cycle rendered error lines or `D` to cycle Diff files and hunks.
 
-In chat or worker-log views, press `Ctrl+O` to attach to the selected worker's native session inside `parallel-codex-tui`. Native attach runs through a PTY, so full-screen CLIs such as `codex resume {sessionId}` receive a real terminal instead of pipe stdin. Native attach follows outer terminal resize, updating both the rendered screen and child PTY so Codex or Claude reflows at the current dimensions. Input is forwarded to the configured interactive command and output is shown in the native attach panel. When a Codex feature session needs its recorded worker, turn, or feature directories and the interactive command does not already choose a sandbox, native attach adds `--sandbox workspace-write` before its `--add-dir` arguments; an explicitly configured native sandbox remains unchanged. Overlapping attach preparations keep only the latest request. Press `Ctrl+]` to return to worker logs; this and closing the outer App terminate the active PTY. An attach preparation that finishes after App shutdown is discarded instead of starting a detached agent. `Ctrl+C` is forwarded to the native agent while attached. In chat and worker-log views, press `Ctrl+C` to exit the outer TUI. An operating-system SIGINT first asks the App to abort its Router or Worker and clean up any PTY; a second SIGINT restores terminal modes and forces exit.
+In chat or worker-log views, press `Ctrl+O` to attach to the selected worker's native session inside `parallel-codex-tui`. Native attach runs through a PTY, so full-screen CLIs such as `codex resume {sessionId}` receive a real terminal instead of pipe stdin. Native attach follows outer terminal resize, updating both the rendered screen and child PTY so Codex or Claude reflows at the current dimensions. Input is forwarded to the configured interactive command and output is shown in the native attach panel. When a Codex feature session needs its recorded worker, turn, or feature directories and the interactive command does not already choose a sandbox, native attach adds `--sandbox workspace-write` before its `--add-dir` arguments; an explicitly configured native sandbox remains unchanged. A non-zero native exit recognizes read-only sandbox/add-dir conflicts, untrusted directories, misplaced `--skip-git-repo-check`, missing PTY input, and host permission failures, then appends the exact configuration or terminal action before the exit line scrolls away. Overlapping attach preparations keep only the latest request. Press `Ctrl+]` to return to worker logs; this and closing the outer App terminate the active PTY. An attach preparation that finishes after App shutdown is discarded instead of starting a detached agent. `Ctrl+C` is forwarded to the native agent while attached. In chat and worker-log views, press `Ctrl+C` to exit the outer TUI. An operating-system SIGINT first asks the App to abort its Router or Worker and clean up any PTY; a second SIGINT restores terminal modes and forces exit.
 
 If a native resume fails because the underlying CLI reports that its context window is full, configure `fallback = "new"` under `[workers.<engine>.nativeSession]`. The old native session is archived as `native-session.retired.json`, removed from active use, and the worker is retried once with the normal fresh-session command. A valid retirement tombstone is also a cross-turn inheritance barrier: a retry or later turn cannot resurrect the same session from an older worker copy, while a newer replacement session remains reusable. A `process-cleanup-error` or `process-ownership-error` always blocks native-session fallback, even when the CLI output also mentions a full context window, so a fresh Worker cannot overlap an untracked or still-running resume process.
 
@@ -387,16 +446,16 @@ npm trust github parallel-codex-tui --repo allendred/parallel-codex-tui --file r
 
 Creating or listing trusted publishers may require npm two-factor authentication in the browser.
 
-The release job installs npm `^11.5.1`, runs on Node `26.x`, publishes the prepared tarball through OIDC, waits for the package to become visible on npm, installs it globally in a temporary prefix, and checks `parallel-codex-tui --version` before creating the GitHub Release. If npm returns `ENEEDAUTH` or `E401`, fix the npm Trusted Publishing package settings rather than adding a token fallback.
+The release job installs npm `^11.5.1`, runs on Node `24.15.x`, publishes the prepared tarball through OIDC, waits for the package to become visible on npm, installs it globally in a temporary prefix, and checks `parallel-codex-tui --version` before creating the GitHub Release. If npm returns `ENEEDAUTH` or `E401`, fix the npm Trusted Publishing package settings rather than adding a token fallback.
 
 To publish a release, update `package.json` and `src/version.ts` to the same version, then push a matching tag:
 
 ```bash
-git tag v0.1.4
-git push origin v0.1.4
+git tag v0.1.5
+git push origin v0.1.5
 ```
 
-You can also run the Release workflow manually and enter the same tag value. The release tag must match `package.json`; for example, package version `0.1.4` requires tag `v0.1.4`.
+You can also run the Release workflow manually and enter the same tag value. The release tag must match `package.json`; for example, package version `0.1.5` requires tag `v0.1.5`.
 
 ## Publishing Hygiene
 

package/dist/cli-startup-preflight.js

@@ -0,0 +1,18 @@
+export function startupPreflightMessages(preflight) {
+    if (preflight.ok) {
+        return [];
+    }
+    const issues = preflight.lines.filter(isStartupPreflightIssue);
+    if (issues.length === 0) {
+        return [];
+    }
+    const summary = issues.slice(0, 4).join(" · ");
+    const remainder = issues.length > 4 ? ` · ${issues.length - 4} more` : "";
+    return [{
+            from: "system",
+            text: `Startup preflight needs attention · ${summary}${remainder} · run parallel-codex-tui --doctor before starting workers`
+        }];
+}
+function isStartupPreflightIssue(line) {
+    return /(?:^|: )(?:warning\b|missing\b|incompatible\b|unreachable\b|invalid\b|denied\b|failed\b)/i.test(line);
+}

package/dist/cli-startup-recovery.js

@@ -1,9 +1,21 @@
-export function startupRecoveryMessages(recoveredTasks, activeTaskId, pendingTaskCreations) {
+export function startupRecoveryMessages(recoveredTasks, activeTaskId, pendingTaskCreations, sessionIndexRecovery) {
     return [
+        ...sessionIndexRecoveryMessages(sessionIndexRecovery),
         ...interruptedTaskRecoveryMessages(recoveredTasks, activeTaskId),
         ...pendingTaskCreationMessages(pendingTaskCreations)
     ];
 }
+function sessionIndexRecoveryMessages(recovery) {
+    if (!recovery) {
+        return [];
+    }
+    return [{
+            from: "system",
+            text: recovery.source === "backup"
+                ? `Recovered session catalog from the last healthy SQLite backup · task files reindexed · corrupt copy kept at ${recovery.quarantinedPath}`
+                : `Rebuilt session catalog from task files after SQLite integrity failure · corrupt copy kept at ${recovery.quarantinedPath}`
+        }];
+}
 function interruptedTaskRecoveryMessages(recoveredTasks, activeTaskId) {
     if (recoveredTasks.length === 0) {
         return [];

package/dist/cli.js

@@ -8,14 +8,16 @@ import { selectWorkspaceForCli } from "./cli-workspace.js";
 import { commitWorkspaceTransition } from "./cli-workspace-transition.js";
 import { WorkspaceSelectionCancelledError } from "./cli-workspace-picker.js";
 import { startupRecoveryMessages } from "./cli-startup-recovery.js";
+import { startupPreflightMessages } from "./cli-startup-preflight.js";
 import { createRuntime } from "./bootstrap.js";
 import { prepareAppRoot } from "./core/app-root.js";
 import { formatConfigErrorMessage } from "./core/config-errors.js";
 import { configPath, loadConfig, withUiThemeOverride, writeDefaultConfig } from "./core/config.js";
 import { pathExists } from "./core/file-store.js";
 import { readRouterAudit } from "./core/router-audit.js";
+import { loadTaskSessionDetails as loadPersistedTaskSessionDetails } from "./core/task-session-details.js";
 import { listWorkspaceChoices } from "./core/workspace.js";
-import { runDoctor } from "./doctor.js";
+import { runDoctor, runRuntimePreflight } from "./doctor.js";
 import { helpText } from "./cli-help.js";
 import { App } from "./tui/App.js";
 import { formatTuiThemeCatalog } from "./tui/theme-preview.js";
@@ -102,7 +104,11 @@ async function main() {
                     records,
                     policy: routerDiagnosticsPolicy(latestConfig.router)
                 };
-            }, loadTaskSessions: (options) => state.runtime.index.listTasks(100, options), renameTaskSession: async (taskId, title) => {
+            }, loadTaskSessions: (options) => state.runtime.index.listTasks(100, options), loadTaskSessionDetails: (task) => loadPersistedTaskSessionDetails({
+                task,
+                taskDir: state.runtime.sessions.taskFromId(task.id).dir,
+                modelNames: Object.fromEntries(Object.entries(state.runtime.config.workers).map(([id, worker]) => [id, worker.model.name]))
+            }), renameTaskSession: async (taskId, title) => {
                 await state.runtime.sessions.renameTask(taskId, title);
             }, setTaskSessionArchived: async (taskId, archived) => {
                 await state.runtime.sessions.setTaskArchived(taskId, archived);
@@ -165,6 +171,10 @@ async function main() {
 async function loadInteractiveWorkspace(appRoot, workspaceRoot, requestedTaskId) {
     const runtime = await createRuntime(appRoot, workspaceRoot);
     try {
+        const preflightPromise = runRuntimePreflight(runtime.config, runtime.workspaceRoot, process.env).catch((error) => ({
+            ok: false,
+            lines: [`preflight: failed (${error instanceof Error ? error.message : String(error)})`]
+        }));
         if (requestedTaskId) {
             if (!(await runtime.sessions.hasTask(requestedTaskId))) {
                 throw new Error(`Task session not found in workspace ${runtime.workspaceRoot}: ${requestedTaskId}`);
@@ -200,16 +210,17 @@ async function loadInteractiveWorkspace(appRoot, workspaceRoot, requestedTaskId)
         else if (!initialTaskId && typeof rememberedTaskId === "string") {
             await runtime.index.setActiveTaskId(null);
         }
-        const [initialRoute, initialWorkers, initialCanRetryTask, initialHistory, workspaceChoices] = await Promise.all([
+        const [initialRoute, initialWorkers, initialCanRetryTask, initialHistory, workspaceChoices, preflight] = await Promise.all([
             initialTaskId
                 ? runtime.sessions.readLatestRoute(runtime.sessions.taskFromId(initialTaskId))
                 : null,
             initialTaskId ? runtime.orchestrator.listTaskWorkers(initialTaskId) : [],
             initialTaskId ? runtime.orchestrator.canRetryTask(initialTaskId) : false,
             runtime.sessions.readChatHistory(),
-            listWorkspaceChoices(appRoot)
+            listWorkspaceChoices(appRoot),
+            preflightPromise
         ]);
-        const recoveryMessages = startupRecoveryMessages(runtime.recoveredTasks, initialTaskId, runtime.pendingTaskCreations);
+        const recoveryMessages = startupRecoveryMessages(runtime.recoveredTasks, initialTaskId, runtime.pendingTaskCreations, runtime.index.recovery);
         return {
             runtime,
             initialTaskId,
@@ -222,7 +233,8 @@ async function loadInteractiveWorkspace(appRoot, workspaceRoot, requestedTaskId)
                     text,
                     ...(task_id ? { taskId: task_id } : {})
                 })),
-                ...recoveryMessages
+                ...recoveryMessages,
+                ...startupPreflightMessages(preflight)
             ],
             workspaceChoices
         };

package/dist/core/collaboration-timeline.js

@@ -1,7 +1,7 @@
 import { readdir } from "node:fs/promises";
 import { join } from "node:path";
 import { z } from "zod";
-import { EventRecordSchema, FeatureStatusSchema } from "../domain/schemas.js";
+import { EventRecordSchema, FeatureAssignmentSchema, FeatureStatusSchema } from "../domain/schemas.js";
 import { readTextIfExists } from "./file-store.js";
 const FeatureDialogueSchema = z.object({
     time: z.string().datetime(),
@@ -107,8 +107,9 @@ async function readCollaborationFeatures(taskDir) {
         .filter((entry) => entry.isDirectory())
         .map(async (entry) => {
         const dir = join(root, entry.name);
-        const [statusText, spec, findings, replies, resolutionText] = await Promise.all([
+        const [statusText, assignmentText, spec, findings, replies, resolutionText] = await Promise.all([
             readTextIfExists(join(dir, "status.json")),
+            readTextIfExists(join(dir, "assignment.json")),
             readTextIfExists(join(dir, "spec.md")),
             readTextIfExists(join(dir, "critic-findings.jsonl")),
             readTextIfExists(join(dir, "actor-replies.jsonl")),
@@ -121,6 +122,7 @@ async function readCollaborationFeatures(taskDir) {
         const findingEvidence = readMailboxEvidence(findings);
         const replyEvidence = readMailboxEvidence(replies);
         const resolution = parseJsonValue(resolutionText, FindingResolutionSchema);
+        const assignment = parseJsonValue(assignmentText, FeatureAssignmentSchema);
         return {
             id: status.feature_id,
             title: status.title?.trim() || featureSpecTitle(spec) || status.feature_id,
@@ -129,11 +131,16 @@ async function readCollaborationFeatures(taskDir) {
             turnId: status.turn_id,
             state: status.state,
             updatedAt: status.updated_at,
+            ...(assignment ? {
+                actorEngine: assignment.actor_engine,
+                criticEngine: assignment.critic_engine
+            } : {}),
             findings: findingEvidence.count,
             replies: replyEvidence.count,
             artifactRefs: [
                 { label: "status", path: join(dir, "status.json") },
                 { label: "spec", path: join(dir, "spec.md") },
+                ...(assignment ? [{ label: "assignment", path: join(dir, "assignment.json") }] : []),
                 { label: "critic findings", path: join(dir, "critic-findings.jsonl") },
                 { label: "actor replies", path: join(dir, "actor-replies.jsonl") },
                 ...(resolution ? [{ label: "finding resolution", path: join(dir, "finding-resolution.json") }] : [])