pwragent 1.3.7 → 1.3.9

package/README.md

@@ -26,12 +26,12 @@ Use an exact version to match a desktop installation. See the
 and publication verification.
 
 ```sh
-npm install --global pwragent@next
+npm install --global pwragent@latest
 pwragent --help
-# Update to the newest headless prerelease:
+# Or choose a reproducible version that matches your desktop:
+npm install --global pwragent@1.3.7
+# Prerelease desktop versions publish to next, once one has shipped:
 npm install --global pwragent@next
-# Or choose a reproducible version:
-npm install --global pwragent@1.3.6
 ```
 
 Provide **Node >=22 and npm separately**, on Linux (macOS is also supported for
@@ -70,7 +70,7 @@ shell's Node version-manager initialization does not run under systemd.
 After publication, install a pinned version into the service prefix:
 
 ```sh
-sudo npm install --prefix /opt/pwragent --omit=dev --ignore-scripts pwragent@1.3.6
+sudo npm install --prefix /opt/pwragent --omit=dev --ignore-scripts pwragent@1.3.7
 sudo install -m 0644 /opt/pwragent/node_modules/pwragent/examples/pwragent-headless.service /etc/systemd/system/pwragent-headless.service
 # Review the account, paths, profile and Codex configuration before enabling:
 sudo systemctl daemon-reload
@@ -90,7 +90,7 @@ sudo -u pwragent env PWRAGENT_HOME=/var/lib/pwragent PWRAGENT_PROFILE=outpost \
 
 For a service update, finish or interrupt active work, run
 `sudo systemctl stop pwragent-headless.service`, repeat the prefix installation
-with the chosen new version (or `pwragent@next`), then run
+with the chosen new version (or `pwragent@latest`), then run
 `sudo systemctl start pwragent-headless.service`. Compare the new example unit
 with the installed one before deliberately updating it; npm does not overwrite
 `/etc/systemd/system`. Stopping during a turn can leave its outcome `unknown`.
@@ -280,6 +280,15 @@ its `directoryKey`/`cwd`; omitting it selects the configured workspace root. Sel
 the defaults remain local and read-only. Launchpad requests for worktrees,
 grouping, environments or provider extensions are rejected before creation.
 
+A new thread is named from its first user message, shortened the way desktop
+names a thread before any helper-model title. The outpost has no helper model.
+The name is stored in `threads.json`, and subscribed viewers receive
+`thread/name/updated` with `titleSource: derived`, followed by a navigation
+invalidation. A later turn never renames a thread. An explicit `renameThread`
+always wins and is never replaced. A thread that still has a placeholder name,
+such as one created before this release, takes Codex's `preview` the next time
+it is read. The outpost does not set the Codex thread name.
+
 ## Identity, compute lifetime and remaining scope
 
 The private `federation.json` stores the retained peer ID, signing/Noise keys,
@@ -349,6 +358,7 @@ register a project. Enrollment and Git intake do not import the sender's Git or
 
 | Service | Required grants | Supported behavior |
 | --- | --- | --- |
+| `backend.*` | Per method, from desktop's owner table in `@pwragent/federation` | Navigation reads need `thread_navigation`; thread detail, queue projection, launchpad config and `listBackends` need `thread_detail`; turns need `turn_control`; launchpads need `environment_actions` |
 | `outpost.projects.list` | `thread_navigation` | Owner project inventory |
 | `outpost.projects.create/add/remove` | `environment_actions` | Create/clone, register and unregister projects |
 | `pty.*` | `remote_pty` | Input, resize, ack flow control, snapshots, history and close |
@@ -465,6 +475,18 @@ against the daemon. External providers and Codex are mocked; no live peers,
 operator projects, credentials or compute machines are used. Ubuntu CI runs the
 Node suite; the desktop contract test runs on POSIX lanes.
 
+The owner conformance suite
+(`apps/desktop/src/main/__tests__/owner-conformance.test.ts`) runs one thread's
+life through the owner methods both hosts implement. It runs on this daemon and
+on desktop's real owner, and compares each response and event. Each known
+difference is a line in `owner-conformance-baseline.json` beside it, so the
+suite fails on any new difference and names its method. After fixing a
+difference, or changing the contract on purpose, record the result:
+
+```sh
+UPDATE_OWNER_CONFORMANCE=1 pnpm test apps/desktop/src/main/__tests__/owner-conformance.test.ts
+```
+
 A separate live smoke test installed the packed tarball and official Codex
 0.159.2 in a Node 24 Debian Linux arm64 Docker image. It used an unprivileged
 user, a read-only authentication-file mount, container-owned state and workspace,

package/dist/federation-core.js

@@ -9200,6 +9200,7 @@ var FEDERATION_CAPABILITIES = [
   "navigation_snapshot_deltas",
   "navigation_group_invalidations",
   "thread_grouping",
+  "archive_subthread_promotion_v1",
   "thread_parent_mutation_v1",
   "thread_detail",
   "turn_control",
@@ -9254,6 +9255,8 @@ var FEDERATION_CAPABILITIES = [
    * card with its model chip only.
    */
   "thread_todo_dispatch_target",
+  /** The owner accepts messageTarget on a handoff instead of starting a thread. */
+  "thread_todo_message",
   /**
    * The owner answers `threadTodos.raisePlan`, raising a handoff card's
    * steps as the started thread's own `plan` card. A viewer starting a
@@ -9281,7 +9284,21 @@ var FEDERATION_CAPABILITIES = [
    * turn's reply, its images materialized. A messaging gateway without it
    * reads a transcript page at every bound turn end.
    */
-  "turn_assistant_reply"
+  "turn_assistant_reply",
+  /**
+   * The owner answers `backend.manageThreadPrWatchesV1`: a viewer reads a
+   * thread's watch history, stops a watch, and arms Watch CI there. Its
+   * navigation rows also carry `prCiWatches`. A viewer shows an older
+   * owner's watches read-only.
+   */
+  "thread_pr_watch_control_v1",
+  /**
+   * The owner sends each of its Directories projects' Forge Automation on
+   * its rows and answers `backend.setProjectForgeAutomation`,
+   * `backend.listProjectHeldWakeups` and `backend.resolveProjectHeldWakeups`.
+   * A viewer offers no Forge Automation menu items without it.
+   */
+  "project_forge_automation"
 ];
 var FEDERATION_ENDPOINT_SCHEMES = ["ws", "wss", "ssh"];
 function parseFederationGatewayEndpoint(value) {
@@ -9355,6 +9372,19 @@ var PWRAGENT_MESSAGING_CALLABLE_OPERATION_NAMES = [
   ...PWRAGENT_MESSAGING_LEGACY_OPERATION_NAMES
 ];
 
+// ../shared/src/contracts/thread-todos.ts
+var THREAD_TODO_TITLE_MAX_LENGTH = 120;
+var THREAD_TODO_ORIGIN_ID_MAX_LENGTH = 200;
+function threadTodoMessageOriginFromUnknown(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const record = value;
+  if (typeof record.id !== "string") return void 0;
+  const id = record.id.trim();
+  if (!id || id.length > THREAD_TODO_ORIGIN_ID_MAX_LENGTH) return void 0;
+  const title = typeof record.title === "string" ? record.title.trim().slice(0, THREAD_TODO_TITLE_MAX_LENGTH).trim() : "";
+  return { id, ...title ? { title } : {} };
+}
+
 // ../shared/src/directory-navigation.ts
 function normalizeGitOriginUrl(value) {
   const trimmed = value?.trim();
@@ -9456,6 +9486,61 @@ async function readStatusWithoutNestedWorktrees(options) {
   return await options.git([...options.statusArgs, ...nestedWorktreePathspecArgs(excludes)]);
 }
 
+// ../shared/src/thread-titles.ts
+var MAX_DERIVED_THREAD_TITLE_LENGTH = 72;
+var MIN_PREFERRED_BREAK_INDEX = 36;
+var LEADING_SKILL_LINK_RE = /^(?:\[\$[^\]]+\]\([^)]+\)\s*)+/i;
+var LEADING_SKILL_TOKEN_RE = /^(?:\$[\w:-]+\s+)+/i;
+var LEADING_REQUEST_PREFIX_RE = /^(?:i need(?: you to)?|can you|could you|would you|please|help me|let's|show me|tell me)\s+/i;
+function trimTrailingPunctuation(value) {
+  return value.replace(/[\s,;:.-]+$/g, "").trim();
+}
+function uppercaseFirstLetter(value) {
+  if (!value) {
+    return value;
+  }
+  return value[0].toUpperCase() + value.slice(1);
+}
+function normalizeTitleInput(value) {
+  const trimmed = value?.replace(/\s+/g, " ").trim();
+  if (!trimmed) {
+    return void 0;
+  }
+  const withoutSkillLinks = trimmed.replace(LEADING_SKILL_LINK_RE, "");
+  const withoutSkillTokens = withoutSkillLinks.replace(LEADING_SKILL_TOKEN_RE, "");
+  return withoutSkillTokens || trimmed;
+}
+function shortenDerivedThreadTitle(value) {
+  const normalized = normalizeTitleInput(value);
+  if (!normalized) {
+    return void 0;
+  }
+  const requestTrimmed = normalized.replace(LEADING_REQUEST_PREFIX_RE, "");
+  const candidateBase = requestTrimmed && requestTrimmed.length < normalized.length ? uppercaseFirstLetter(requestTrimmed) : normalized;
+  const candidate = trimTrailingPunctuation(candidateBase);
+  if (candidate.length <= MAX_DERIVED_THREAD_TITLE_LENGTH) {
+    return candidate;
+  }
+  const breakpointWindow = candidate.slice(0, MAX_DERIVED_THREAD_TITLE_LENGTH + 1);
+  const punctuationBreaks = [
+    breakpointWindow.lastIndexOf(". "),
+    breakpointWindow.lastIndexOf("? "),
+    breakpointWindow.lastIndexOf("! "),
+    breakpointWindow.lastIndexOf(": "),
+    breakpointWindow.lastIndexOf("; "),
+    breakpointWindow.lastIndexOf(", ")
+  ];
+  const punctuationBreak = Math.max(...punctuationBreaks);
+  if (punctuationBreak >= MIN_PREFERRED_BREAK_INDEX) {
+    return `${trimTrailingPunctuation(candidate.slice(0, punctuationBreak))}...`;
+  }
+  const wordBreak = breakpointWindow.lastIndexOf(" ");
+  if (wordBreak >= MIN_PREFERRED_BREAK_INDEX) {
+    return `${trimTrailingPunctuation(candidate.slice(0, wordBreak))}...`;
+  }
+  return `${trimTrailingPunctuation(candidate.slice(0, MAX_DERIVED_THREAD_TITLE_LENGTH))}...`;
+}
+
 // ../shared/src/messaging-causal-context.ts
 function mergeCausalMessagingContext(origins) {
   const sources = origins.flatMap((origin) => origin?.causalMessagingSource ? [origin.causalMessagingSource] : []);
@@ -9465,6 +9550,215 @@ function mergeCausalMessagingContext(origins) {
   return ambiguous ? { causalMessagingSource: void 0, causalMessagingAmbiguous: true } : { causalMessagingSource: sources[sources.length - 1], causalMessagingAmbiguous: void 0 };
 }
 
+// ../shared/src/thread-replay-paging.ts
+function pageThreadReplay(replay, options, hooks = {}) {
+  if (options.includeTurns === false) {
+    return {
+      ...replay,
+      entries: [],
+      messages: [],
+      lastUserMessage: void 0,
+      lastAssistantMessage: void 0,
+      pagination: {
+        supportsPagination: false,
+        hasPreviousPage: false
+      }
+    };
+  }
+  if (options.limit === void 0 && options.before === void 0) {
+    return replay;
+  }
+  const beforeIndex = options.before !== void 0 ? replay.entries.findIndex((entry) => entry.id === options.before) : replay.entries.length;
+  if (beforeIndex < 0) {
+    hooks.onUnresolvedCursor?.();
+    return {
+      ...replay,
+      entries: [],
+      messages: [],
+      lastUserMessage: void 0,
+      lastAssistantMessage: void 0,
+      pagination: {
+        supportsPagination: true,
+        hasPreviousPage: false
+      }
+    };
+  }
+  const limit = options.limit === void 0 ? void 0 : Math.max(0, Math.floor(options.limit));
+  const startIndex = limit === void 0 ? 0 : findTurnPageStartIndex(replay.entries, beforeIndex, limit);
+  const entries = replay.entries.slice(startIndex, beforeIndex);
+  return replayWithEntries(
+    replay,
+    entries,
+    mintEntryCursorPagination(entries, startIndex > 0, hooks.isCursorEntry)
+  );
+}
+function findTurnPageStartIndex(entries, endIndex, limit) {
+  if (limit === 0) {
+    return endIndex;
+  }
+  for (let index = 0; index < endIndex; index += 1) {
+    if (!entries[index]?.turn?.id) {
+      return Math.max(0, endIndex - limit);
+    }
+  }
+  const turnIds = /* @__PURE__ */ new Set();
+  let oldestRetainedTurnId;
+  for (let index = endIndex - 1; index >= 0; index -= 1) {
+    const turnId = entries[index]?.turn?.id;
+    if (!turnId || turnIds.has(turnId)) {
+      continue;
+    }
+    if (turnIds.size >= limit) {
+      break;
+    }
+    turnIds.add(turnId);
+    oldestRetainedTurnId = turnId;
+  }
+  if (!oldestRetainedTurnId) {
+    return Math.max(0, endIndex - limit);
+  }
+  if (turnIds.size < limit) {
+    return 0;
+  }
+  const firstTurnEntryIndex = entries.findIndex(
+    (entry, index) => index < endIndex && entry.turn?.id === oldestRetainedTurnId
+  );
+  return firstTurnEntryIndex >= 0 ? firstTurnEntryIndex : 0;
+}
+function mintEntryCursorPagination(entries, hasPreviousPage, isCursorEntry = () => true) {
+  const cursorEntry = hasPreviousPage ? entries.find(isCursorEntry) : void 0;
+  return {
+    supportsPagination: true,
+    hasPreviousPage: cursorEntry !== void 0,
+    ...cursorEntry ? { previousCursor: cursorEntry.id } : {}
+  };
+}
+function replayWithEntries(replay, entries, pagination) {
+  const messages = entries.flatMap(
+    (entry) => entry.type === "message" ? [
+      {
+        id: entry.id,
+        role: entry.role,
+        text: entry.text,
+        ...entry.parts ? { parts: entry.parts } : {},
+        ...entry.origin ? { origin: entry.origin } : {},
+        ...entry.createdAt ? { createdAt: entry.createdAt } : {}
+      }
+    ] : []
+  );
+  const lastUserMessage = messages.findLast((message) => message.role === "user")?.text;
+  const lastAssistantMessage = messages.findLast(
+    (message) => message.role === "assistant"
+  )?.text;
+  return {
+    ...replay,
+    entries,
+    messages,
+    lastUserMessage,
+    lastAssistantMessage,
+    pagination
+  };
+}
+var FEDERATION_OMITTED_ENTRY_TEXT = "Content omitted because this page exceeded the federation frame limit.";
+function fitThreadReplayWithinByteBudget(params) {
+  if (params.measureBytes(params.replay) <= params.maxBytes) {
+    return params.replay;
+  }
+  if (params.cursorIdSpace === "provider-cursor") {
+    return compactReplayWithinByteBudget(params);
+  }
+  let entries = params.replay.entries;
+  while (entries.length > 1) {
+    entries = entries.slice(1);
+    const candidate = replayWithEntries(
+      params.replay,
+      entries,
+      mintEntryCursorPagination(entries, true, params.isCursorEntry)
+    );
+    if (params.measureBytes(candidate) <= params.maxBytes) {
+      return candidate;
+    }
+  }
+  const oversizedEntry = entries[0];
+  if (oversizedEntry) {
+    const candidate = replayWithEntries(
+      params.replay,
+      [compactOversizedEntry(oversizedEntry)],
+      // Classify the entry as it arrived. Compaction rewrites an activity's
+      // summary, and a usage row matched by summary rather than by id would
+      // read as provider-owned afterwards — the overlay-id cursor this module
+      // exists to prevent.
+      mintEntryCursorPagination(
+        [oversizedEntry],
+        params.replay.pagination.hasPreviousPage || params.replay.entries.length > 1,
+        params.isCursorEntry
+      )
+    );
+    if (params.measureBytes(candidate) <= params.maxBytes) {
+      return candidate;
+    }
+  }
+  return replayWithEntries(params.replay, [], mintEntryCursorPagination([], false));
+}
+function compactReplayWithinByteBudget(params) {
+  const entries = [...params.replay.entries];
+  for (let index = 0; index < entries.length; index += 1) {
+    entries[index] = compactOversizedEntry(entries[index]);
+    const candidate = replayWithEntries(
+      params.replay,
+      [...entries],
+      params.replay.pagination
+    );
+    if (params.measureBytes(candidate) <= params.maxBytes) {
+      return candidate;
+    }
+  }
+  return replayWithEntries(params.replay, [], params.replay.pagination);
+}
+function compactOversizedEntry(entry) {
+  switch (entry.type) {
+    case "message":
+      return {
+        type: "message",
+        id: entry.id,
+        role: entry.role,
+        text: FEDERATION_OMITTED_ENTRY_TEXT,
+        ...entry.createdAt ? { createdAt: entry.createdAt } : {},
+        ...entry.phase ? { phase: entry.phase } : {},
+        ...entry.turn ? { turn: entry.turn } : {}
+      };
+    case "activity":
+      return {
+        type: "activity",
+        id: entry.id,
+        summary: FEDERATION_OMITTED_ENTRY_TEXT,
+        details: [],
+        ...entry.createdAt ? { createdAt: entry.createdAt } : {},
+        ...entry.tone ? { tone: entry.tone } : {},
+        ...entry.status ? { status: entry.status } : {},
+        ...entry.turn ? { turn: entry.turn } : {}
+      };
+    case "plan":
+      return {
+        type: "plan",
+        id: entry.id,
+        markdown: FEDERATION_OMITTED_ENTRY_TEXT,
+        steps: [],
+        ...entry.createdAt ? { createdAt: entry.createdAt } : {},
+        ...entry.turn ? { turn: entry.turn } : {}
+      };
+    case "review":
+      return {
+        type: "review",
+        id: entry.id,
+        review: FEDERATION_OMITTED_ENTRY_TEXT,
+        ...entry.createdAt ? { createdAt: entry.createdAt } : {},
+        ...entry.status ? { status: entry.status } : {},
+        ...entry.turn ? { turn: entry.turn } : {}
+      };
+  }
+}
+
 // ../federation/src/federation-identity.ts
 import {
   createPrivateKey,
@@ -12424,6 +12718,9 @@ var TerminalReplay = class {
   parsedTail = "";
   seq = 0;
   updatedAt = 0;
+  /** The last serialized screen, until a write or resize changes it. A thread
+   *  view remount attaches every pane at once, and most panes are idle. */
+  serialized;
   pendingCharacters = 0;
   whenDrained() {
     return this.queue;
@@ -12453,6 +12750,7 @@ var TerminalReplay = class {
     }
     this.queue = this.queue.then(() => new Promise((resolve) => {
       this.terminal.write(data, () => {
+        this.serialized = void 0;
         this.pendingCharacters -= data.length;
         this.parsedTail = tail;
         this.parsedSeq = frame.seq;
@@ -12464,34 +12762,42 @@ var TerminalReplay = class {
   }
   resize(cols, rows) {
     this.queue = this.queue.then(() => {
+      const { cols: beforeCols, rows: beforeRows } = this.terminal;
       this.terminal.resize(clampTerminalColumns(cols), clampTerminalRows(rows));
+      if (this.terminal.cols !== beforeCols || this.terminal.rows !== beforeRows) this.serialized = void 0;
     });
   }
   snapshot() {
     const result = this.queue.then(() => {
-      let scrollback = 2e3;
-      let data = this.serializer.serialize({ scrollback });
-      while (Buffer.byteLength(data) > TERMINAL_SNAPSHOT_LIMIT && scrollback > 0) {
-        scrollback = Math.floor(scrollback / 2);
-        data = this.serializer.serialize({ scrollback });
-      }
-      const truncated = scrollback < 2e3;
-      if (Buffer.byteLength(data) > TERMINAL_SNAPSHOT_LIMIT) {
-        data = this.plainText().slice(-64 * 1024).replace(/\n/g, "\r\n");
-      }
-      return {
-        data,
-        pendingEscape: this.parsedTail || void 0,
-        seq: this.parsedSeq,
-        timestamp: this.updatedAt,
-        cols: this.terminal.cols,
-        rows: this.terminal.rows,
-        truncated
-      };
+      this.serialized ??= this.serialize();
+      return { ...this.serialized };
     });
-    this.queue = result.then(() => void 0);
+    this.queue = result.then(() => void 0, () => void 0);
     return result;
   }
+  serialize() {
+    let scrollback = 2e3;
+    let data = this.serializer.serialize({ scrollback });
+    let bytes = Buffer.byteLength(data);
+    while (bytes > TERMINAL_SNAPSHOT_LIMIT && scrollback > 0) {
+      scrollback = Math.floor(scrollback / 2);
+      data = this.serializer.serialize({ scrollback });
+      bytes = Buffer.byteLength(data);
+    }
+    const truncated = scrollback < 2e3;
+    if (bytes > TERMINAL_SNAPSHOT_LIMIT) {
+      data = this.plainText().slice(-64 * 1024).replace(/\n/g, "\r\n");
+    }
+    return {
+      data,
+      pendingEscape: this.parsedTail || void 0,
+      seq: this.parsedSeq,
+      timestamp: this.updatedAt,
+      cols: this.terminal.cols,
+      rows: this.terminal.rows,
+      truncated
+    };
+  }
   /** Raw reads are event deltas. Plain reads are screen snapshots, not deltas. */
   read(afterSeq = 0, maxChars = 16384) {
     const limit = Math.max(1, Math.min(64 * 1024, Math.floor(maxChars) || 16384));
@@ -12520,7 +12826,7 @@ var TerminalReplay = class {
       seq: this.parsedSeq,
       timestamp: this.updatedAt
     }));
-    this.queue = result.then(() => void 0);
+    this.queue = result.then(() => void 0, () => void 0);
     return result;
   }
   plainText() {
@@ -13518,7 +13824,8 @@ function agentToolFailure(params) {
 }
 
 // ../agent-tools/src/agent-tool-router.ts
-var PWRAGENT_AGENT_TOOL_NAMESPACE_DESCRIPTION = "PwrAgent tools manage threads, delegated work, messaging, apps, automations, and connected instances. Prefer these tools to backend tools when both can do the task.";
+var PWRAGENT_IMAGE_REPLY_GUIDANCE = "Show images as ![Preview](/absolute/path/image.png) or image tool results. Approved worktree/temp images preview. Code paths do not. Avoid shell open commands.";
+var PWRAGENT_AGENT_TOOL_NAMESPACE_DESCRIPTION = "PwrAgent manages threads, delegation, messaging, apps, automations, and instances. Prefer its tools to backend tools. " + PWRAGENT_IMAGE_REPLY_GUIDANCE;
 var AgentToolRouter = class {
   definitions;
   unsupportedMessage;
@@ -18941,15 +19248,20 @@ var FederationFilePushReceipts = class {
 function authenticateMessageOrigin(params) {
   const sourceThread = params.messageOrigin?.sourceThread;
   if (!params.messageOrigin || !sourceThread) {
-    return params.messageOrigin;
+    if (params.messageOrigin?.threadTodo === void 0) return params.messageOrigin;
+    const { threadTodo: _threadTodo, ...messageOrigin2 } = params.messageOrigin;
+    return messageOrigin2;
   }
   let sourceInstance;
   try {
     sourceInstance = params.resolveSourceInstance?.(params.sourceInstanceId);
   } catch {
   }
+  const { threadTodo: rawThreadTodo, ...messageOrigin } = params.messageOrigin;
+  const threadTodo = messageOrigin.kind === "agent" ? threadTodoMessageOriginFromUnknown(rawThreadTodo) : void 0;
   return {
-    ...params.messageOrigin,
+    ...messageOrigin,
+    ...threadTodo ? { threadTodo } : {},
     sourceThread: {
       backend: sourceThread.backend,
       instanceId: params.sourceInstanceId,
@@ -19482,8 +19794,318 @@ var FederationReplacementReceiver = class {
     return pending.entries;
   }
 };
+
+// ../federation/src/federation-backend-methods.ts
+var FEDERATION_BACKEND_METHODS = {
+  getNavigationQueryPage: "backend.getNavigationQueryPage",
+  removeNavigationDirectory: "backend.removeNavigationDirectory",
+  archiveNavigationDirectory: "backend.archiveNavigationDirectory",
+  markNavigationDirectorySeen: "backend.markNavigationDirectorySeen",
+  releaseNavigationAttentionView: "backend.releaseNavigationAttentionView",
+  getNavigationLaunchpadConfig: "backend.getNavigationLaunchpadConfig",
+  getNavigationSelectedDetail: "backend.getNavigationSelectedDetail",
+  getNavigationQueueProjection: "backend.getNavigationQueueProjection",
+  getProjectPage: "backend.getProjectPage",
+  getNavigationDescendantPage: "backend.getNavigationDescendantPage",
+  lookupArchivedThreads: "backend.lookupArchivedThreads",
+  /** @deprecated Alpha collection contract; migrate per docs/federation-navigation-v2.md before removal. */
+  getNavigationSnapshot: "backend.getNavigationSnapshot",
+  searchNavigationThreads: "backend.searchNavigationThreads",
+  searchFederatedThreads: "backend.searchFederatedThreads",
+  searchThreadContent: "backend.searchThreadContent",
+  cancelThreadContentSearch: "backend.cancelThreadContentSearch",
+  /** @deprecated Collection enumeration; use bounded queries or exact-ID archive lookup. */
+  listThreads: "backend.listThreads",
+  resolveThread: "backend.resolveThread",
+  resolveThreadAdmissionState: "backend.resolveThreadAdmissionState",
+  readThread: "backend.readThread",
+  readTurnAssistantReply: "backend.readTurnAssistantReply",
+  readUsageActivity: "backend.readUsageActivity",
+  readThreadFamilyPricing: "backend.readThreadFamilyPricing",
+  analyzeUsageActivity: "backend.analyzeUsageActivity",
+  inspectTokenMiserOutput: "backend.inspectTokenMiserOutput",
+  analyzeThreadToolHistory: "backend.analyzeThreadToolHistory",
+  readTranscriptImage: "backend.readTranscriptImage",
+  listSkills: "backend.listSkills",
+  supportsMessagingPdfTools: "backend.supportsMessagingPdfTools",
+  listBackends: "backend.listBackends",
+  markThreadSeen: "backend.markThreadSeen",
+  continueThreadEnvironmentStartup: "backend.continueThreadEnvironmentStartup",
+  acknowledgeThreadEnvironmentFailure: "backend.acknowledgeThreadEnvironmentFailure",
+  setThreadReaction: "backend.setThreadReaction",
+  setThreadLock: "backend.setThreadLock",
+  setThreadPin: "backend.setThreadPin",
+  reorderThreadPins: "backend.reorderThreadPins",
+  mountRemoteChild: "backend.mountRemoteChild",
+  setThreadParent: "backend.setThreadParent",
+  mutateThreadParentV1: "backend.mutateThreadParentV1",
+  updateSubthreadOrder: "backend.updateSubthreadOrder",
+  setSubthreadsCollapsed: "backend.setSubthreadsCollapsed",
+  readForge: "backend.readForge",
+  detachThreadPullRequest: "backend.detachThreadPullRequest",
+  setThreadPrAutoDispatch: "backend.setThreadPrAutoDispatch",
+  cancelThreadPrAutoDispatch: "backend.cancelThreadPrAutoDispatch",
+  sendThreadPrAutoDispatchNow: "backend.sendThreadPrAutoDispatchNow",
+  // A new method, so an owner that predates it answers method_not_found.
+  manageThreadPrWatchesV1: "backend.manageThreadPrWatchesV1",
+  setProjectForgeAutomation: "backend.setProjectForgeAutomation",
+  listProjectHeldWakeups: "backend.listProjectHeldWakeups",
+  resolveProjectHeldWakeups: "backend.resolveProjectHeldWakeups",
+  archiveThread: "backend.archiveThread",
+  restoreThread: "backend.restoreThread",
+  startThread: "backend.startThread",
+  forkThread: "backend.forkThread",
+  startTurn: "backend.startTurn",
+  submitTurnRequest: "backend.submitTurnRequest",
+  getTurnRequest: "backend.getTurnRequest",
+  submitSteerRequest: "backend.submitSteerRequest",
+  getSteerRequest: "backend.getSteerRequest",
+  replaceQueuedMessage: "backend.replaceQueuedMessage",
+  readQueuedTurn: "backend.readQueuedTurn",
+  cancelQueuedTurn: "backend.cancelQueuedTurn",
+  releaseQueuedTurn: "backend.releaseQueuedTurn",
+  moveQueuedTurn: "backend.moveQueuedTurn",
+  setQueuedTurnPaused: "backend.setQueuedTurnPaused",
+  startReview: "backend.startReview",
+  startPullRequestReview: "backend.startPullRequestReview",
+  listScheduledThreadActions: "backend.listScheduledThreadActions",
+  createScheduledThreadAction: "backend.createScheduledThreadAction",
+  createScheduledPullRequestReview: "backend.createScheduledPullRequestReview",
+  updateScheduledThreadAction: "backend.updateScheduledThreadAction",
+  updateScheduledPullRequestReview: "backend.updateScheduledPullRequestReview",
+  cancelScheduledThreadAction: "backend.cancelScheduledThreadAction",
+  sendScheduledThreadActionNow: "backend.sendScheduledThreadActionNow",
+  compactThread: "backend.compactThread",
+  rewindThread: "backend.rewindThread",
+  previewThreadRewind: "backend.previewThreadRewind",
+  undoThreadRewind: "backend.undoThreadRewind",
+  listMcpConnections: "backend.listMcpConnections",
+  readThreadMcpConnections: "backend.readThreadMcpConnections",
+  setThreadMcpConnections: "backend.setThreadMcpConnections",
+  describeThreadMcpConnections: "backend.describeThreadMcpConnections",
+  listThreadMcpServers: "backend.listThreadMcpServers",
+  reloadCodexMcpConfig: "backend.reloadCodexMcpConfig",
+  controlActiveTurn: "backend.controlActiveTurn",
+  resolveActiveTurn: "backend.resolveActiveTurn",
+  interruptTurn: "backend.interruptTurn",
+  stopSubAgent: "backend.stopSubAgent",
+  steerTurn: "backend.steerTurn",
+  setThreadExecutionMode: "backend.setThreadExecutionMode",
+  queueThreadExecutionMode: "backend.queueThreadExecutionMode",
+  cancelThreadExecutionModeQueue: "backend.cancelThreadExecutionModeQueue",
+  setAcpSessionRuntimeOption: "backend.setAcpSessionRuntimeOption",
+  setThreadAgent: "backend.setThreadAgent",
+  setThreadTokenMiser: "backend.setThreadTokenMiser",
+  setThreadModelSettings: "backend.setThreadModelSettings",
+  checkThreadBranchDrift: "backend.checkThreadBranchDrift",
+  updateThreadExpectedBranch: "backend.updateThreadExpectedBranch",
+  retainThreadBranchDrift: "backend.retainThreadBranchDrift",
+  submitServerRequest: "backend.submitServerRequest",
+  runCodexEnvironmentAction: "backend.runCodexEnvironmentAction",
+  stopCodexEnvironmentAction: "backend.stopCodexEnvironmentAction",
+  listBackgroundTerminals: "backend.listBackgroundTerminals",
+  terminateBackgroundTerminal: "backend.terminateBackgroundTerminal",
+  setCodexThreadEnvironment: "backend.setCodexThreadEnvironment",
+  refreshThreadPullRequests: "backend.refreshThreadPullRequests",
+  refreshDirectoryGitStatuses: "backend.refreshDirectoryGitStatuses",
+  refreshThreadGitWorkingState: "backend.refreshThreadGitWorkingState",
+  ensureDirectoryLaunchpad: "backend.ensureDirectoryLaunchpad",
+  listRecentFileReferences: "backend.listRecentFileReferences",
+  recordRecentFileReferences: "backend.recordRecentFileReferences",
+  listModelSettingsRecents: "backend.listModelSettingsRecents",
+  recordModelSettingsRecent: "backend.recordModelSettingsRecent",
+  attachDirectoryToThread: "backend.attachDirectoryToThread",
+  detachDirectoryFromThread: "backend.detachDirectoryFromThread",
+  listWorktreeUnpublishedCommits: "backend.listWorktreeUnpublishedCommits",
+  getWorktreeUnpublishedCommitDiff: "backend.getWorktreeUnpublishedCommitDiff",
+  materializeDirectoryLaunchpad: "backend.materializeDirectoryLaunchpad",
+  manageLaunchpadCreation: "backend.manageLaunchpadCreation",
+  handoffThreadWorkspace: "backend.handoffThreadWorkspace",
+  // Separate so an owner that predates these moves answers method_not_found.
+  // It would read an unknown direction as Handoff to Local and ignore baseRef.
+  handoffThreadWorkspaceToNewWorktree: "backend.handoffThreadWorkspaceToNewWorktree",
+  recreateThreadWorktree: "backend.recreateThreadWorktree",
+  moveThreadToMainCheckout: "backend.moveThreadToMainCheckout",
+  renameThread: "backend.renameThread",
+  readApplications: "backend.readApplications",
+  openApplication: "backend.openApplication",
+  readMessagingPlatformStatuses: "backend.readMessagingPlatformStatuses",
+  readPwrSnapConnectionStatus: "backend.readPwrSnapConnectionStatus",
+  getLoadStatus: "backend.getLoadStatus",
+  trustCodexProject: "backend.trustCodexProject",
+  setCelestialIcon: "backend.setCelestialIcon",
+  setFederationShortName: "backend.setFederationShortName",
+  starMapIntake: "backend.starMapIntake"
+};
+var FEDERATION_BACKEND_METHOD_CAPABILITIES = {
+  [FEDERATION_BACKEND_METHODS.getNavigationQueryPage]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.removeNavigationDirectory]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.archiveNavigationDirectory]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.markNavigationDirectorySeen]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.releaseNavigationAttentionView]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.getNavigationLaunchpadConfig]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.getNavigationSelectedDetail]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.getNavigationQueueProjection]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.getProjectPage]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.getNavigationDescendantPage]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.lookupArchivedThreads]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.getNavigationSnapshot]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.searchNavigationThreads]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.searchFederatedThreads]: "federated_search",
+  [FEDERATION_BACKEND_METHODS.searchThreadContent]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.cancelThreadContentSearch]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.listThreads]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.resolveThread]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.resolveThreadAdmissionState]: "messaging_route",
+  [FEDERATION_BACKEND_METHODS.readThread]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.readTurnAssistantReply]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.readForge]: "thread_detail",
+  /* Reads the thread's own transcript history; same data class as reading it. */
+  [FEDERATION_BACKEND_METHODS.readUsageActivity]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.readThreadFamilyPricing]: "thread_detail",
+  // Starts a paid helper turn on the owner; transcript-read permission is insufficient.
+  [FEDERATION_BACKEND_METHODS.analyzeUsageActivity]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.inspectTokenMiserOutput]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.analyzeThreadToolHistory]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.readTranscriptImage]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.listSkills]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.supportsMessagingPdfTools]: "messaging_route",
+  [FEDERATION_BACKEND_METHODS.listBackends]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.markThreadSeen]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.continueThreadEnvironmentStartup]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.acknowledgeThreadEnvironmentFailure]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.setThreadReaction]: "thread_navigation",
+  // A lock refuses every turn on the owner's thread, so it takes the same
+  // capability as starting one.
+  [FEDERATION_BACKEND_METHODS.setThreadLock]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setThreadPin]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.reorderThreadPins]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.mountRemoteChild]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.setThreadParent]: "thread_grouping",
+  [FEDERATION_BACKEND_METHODS.mutateThreadParentV1]: "thread_grouping",
+  [FEDERATION_BACKEND_METHODS.updateSubthreadOrder]: "thread_grouping",
+  [FEDERATION_BACKEND_METHODS.setSubthreadsCollapsed]: "thread_grouping",
+  // PR detach cancels pending auto-dispatch work and auto-dispatch arms
+  // automatic repair turns, so both sit with the turn-control grants
+  // (like archiveThread) rather than the browse-level navigation grants.
+  [FEDERATION_BACKEND_METHODS.detachThreadPullRequest]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setThreadPrAutoDispatch]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.cancelThreadPrAutoDispatch]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.sendThreadPrAutoDispatchNow]: "turn_control",
+  // A watch wakes the thread with an agent turn, and stopping one cancels
+  // that wake, so both sit with Auto-fix under turn control.
+  [FEDERATION_BACKEND_METHODS.manageThreadPrWatchesV1]: "turn_control",
+  // A project's Forge Automation decides which turns the owner starts on its
+  // own, and a held wake-up's Send starts one, so all three take the
+  // turn-control grant. Listing rides with them: only the resume flow asks.
+  [FEDERATION_BACKEND_METHODS.setProjectForgeAutomation]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.listProjectHeldWakeups]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.resolveProjectHeldWakeups]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.archiveThread]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.restoreThread]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.startThread]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.forkThread]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.startTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.submitTurnRequest]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.getTurnRequest]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.submitSteerRequest]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.getSteerRequest]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.replaceQueuedMessage]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.readQueuedTurn]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.cancelQueuedTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.releaseQueuedTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.moveQueuedTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setQueuedTurnPaused]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.startReview]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.startPullRequestReview]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.listScheduledThreadActions]: "scheduled_actions",
+  [FEDERATION_BACKEND_METHODS.createScheduledThreadAction]: "scheduled_actions",
+  [FEDERATION_BACKEND_METHODS.createScheduledPullRequestReview]: "scheduled_actions",
+  [FEDERATION_BACKEND_METHODS.updateScheduledThreadAction]: "scheduled_actions",
+  [FEDERATION_BACKEND_METHODS.updateScheduledPullRequestReview]: "scheduled_actions",
+  [FEDERATION_BACKEND_METHODS.cancelScheduledThreadAction]: "scheduled_actions",
+  [FEDERATION_BACKEND_METHODS.sendScheduledThreadActionNow]: "scheduled_actions",
+  [FEDERATION_BACKEND_METHODS.compactThread]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.rewindThread]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.previewThreadRewind]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.undoThreadRewind]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.listMcpConnections]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.readThreadMcpConnections]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.setThreadMcpConnections]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.describeThreadMcpConnections]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.listThreadMcpServers]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.reloadCodexMcpConfig]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.controlActiveTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.resolveActiveTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.interruptTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.stopSubAgent]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.steerTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setThreadExecutionMode]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.queueThreadExecutionMode]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.cancelThreadExecutionModeQueue]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setAcpSessionRuntimeOption]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setThreadAgent]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setThreadTokenMiser]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setThreadModelSettings]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.checkThreadBranchDrift]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.updateThreadExpectedBranch]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.retainThreadBranchDrift]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.submitServerRequest]: "pending_request_control",
+  [FEDERATION_BACKEND_METHODS.runCodexEnvironmentAction]: "environment_actions",
+  [FEDERATION_BACKEND_METHODS.stopCodexEnvironmentAction]: "environment_actions",
+  [FEDERATION_BACKEND_METHODS.listBackgroundTerminals]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.terminateBackgroundTerminal]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setCodexThreadEnvironment]: "environment_actions",
+  [FEDERATION_BACKEND_METHODS.refreshThreadPullRequests]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.refreshDirectoryGitStatuses]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.refreshThreadGitWorkingState]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.ensureDirectoryLaunchpad]: "launchpad_metadata",
+  [FEDERATION_BACKEND_METHODS.listRecentFileReferences]: "remote_window",
+  [FEDERATION_BACKEND_METHODS.recordRecentFileReferences]: "remote_window",
+  // Reviewer/composer model-settings history is read-only preference data at
+  // the same sensitivity tier as the recent-file list it sits beside.
+  [FEDERATION_BACKEND_METHODS.listModelSettingsRecents]: "remote_window",
+  [FEDERATION_BACKEND_METHODS.recordModelSettingsRecent]: "remote_window",
+  [FEDERATION_BACKEND_METHODS.attachDirectoryToThread]: "environment_actions",
+  [FEDERATION_BACKEND_METHODS.detachDirectoryFromThread]: "environment_actions",
+  [FEDERATION_BACKEND_METHODS.listWorktreeUnpublishedCommits]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.getWorktreeUnpublishedCommitDiff]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.materializeDirectoryLaunchpad]: "environment_actions",
+  [FEDERATION_BACKEND_METHODS.manageLaunchpadCreation]: "environment_actions",
+  [FEDERATION_BACKEND_METHODS.handoffThreadWorkspace]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.handoffThreadWorkspaceToNewWorktree]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.recreateThreadWorktree]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.moveThreadToMainCheckout]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.renameThread]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.readApplications]: "remote_window",
+  [FEDERATION_BACKEND_METHODS.openApplication]: "remote_window",
+  // Read-only peer messaging health for the remote window's MSG chip.
+  // messaging_route stays reserved for messaging-originated remote control.
+  [FEDERATION_BACKEND_METHODS.readMessagingPlatformStatuses]: "remote_window",
+  [FEDERATION_BACKEND_METHODS.readPwrSnapConnectionStatus]: "pwrsnap_connection",
+  // On-demand load readings (CPU load averages, available RAM, free
+  // disk) are read-only health facts at the same sensitivity tier as
+  // the browse-level grants, and the Star Map surface that polls them
+  // already rides thread_navigation for its event class. A dedicated
+  // capability would buy no isolation and cost every peer a handshake
+  // re-advertisement.
+  [FEDERATION_BACKEND_METHODS.getLoadStatus]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.trustCodexProject]: "environment_actions",
+  // Celestial icon overrides are directed at the gateway (the assignment
+  // coordinator). No dedicated capability exists for federation-level
+  // cosmetic state; thread_navigation is the least-privileged grant every
+  // browsing peer already holds.
+  [FEDERATION_BACKEND_METHODS.setCelestialIcon]: "thread_navigation",
+  // Short-name overrides go to the gateway for the same reason, under the
+  // same least-privileged grant.
+  [FEDERATION_BACKEND_METHODS.setFederationShortName]: "thread_navigation",
+  // Intake creates a thread and starts its first turn on the owning
+  // instance — the same trust the materialize-launchpad path carries.
+  [FEDERATION_BACKEND_METHODS.starMapIntake]: "environment_actions"
+};
 export {
   AgentToolRouter,
+  FEDERATION_BACKEND_METHOD_CAPABILITIES,
   FEDERATION_CLOSE_REPLACED_CODE,
   FEDERATION_CLOSE_REVOKED_CODE,
   FEDERATION_INVITE_VERSION,
@@ -19543,6 +20165,7 @@ export {
   decodeFederationInvite,
   encodeFederationInvite,
   federationTransportCodecForTest,
+  fitThreadReplayWithinByteBudget,
   generateFederationIdentityKeyPair,
   generateFederationNoiseStaticKeyPair,
   generateNoiseStaticKeyPair,
@@ -19554,6 +20177,7 @@ export {
   mergeCausalMessagingContext,
   noiseKeyPairFromRawPrivate,
   noisePublicKeyBase64FromPrivateBase64,
+  pageThreadReplay,
   publicKeyPemFromPrivateKey,
   pushFederationFile,
   rawPrivateKey,
@@ -19562,6 +20186,7 @@ export {
   registerFederationPtyHandlers,
   registerFilePushHandlers,
   resolveMessagingOutboundFile,
+  shortenDerivedThreadTitle,
   signFederationMessage,
   validateMessagingFileMetadata,
   verifyFederationMessageSignature,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pwragent",
-  "version": "1.3.7",
+  "version": "1.3.9",
   "private": false,
   "type": "module",
   "description": "Experimental headless PwrAgent daemon and command-line client.",
@@ -63,7 +63,7 @@
     "node-pty"
   ],
   "pwragentRelease": {
-    "tag": "v1.3.7",
-    "commit": "e5a9fab9c90daa2f0bed661768969dc5c5301415"
+    "tag": "v1.3.9",
+    "commit": "0fc28acd4318e55e172427b5a694c1a1dd096c15"
   }
 }

package/src/federation-backend.js

@@ -1,16 +1,27 @@
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import path from "node:path";
-import { mergeCausalMessagingContext } from "../dist/federation-core.js";
+import { FEDERATION_BACKEND_METHOD_CAPABILITIES, FEDERATION_MAX_FRAME_BYTES, fitThreadReplayWithinByteBudget, mergeCausalMessagingContext, pageThreadReplay, shortenDerivedThreadTitle } from "../dist/federation-core.js";
 import { ACTIVE, atomicJson, digest } from "./store.js";
 
-export const METHOD_CAPABILITIES = Object.fromEntries([
-  ["backend.resolveThreadAdmissionState", "messaging_route"],
-  ["backend.supportsMessagingPdfTools", "messaging_route"],
-  ...["getNavigationQueryPage", "getNavigationLaunchpadConfig", "getNavigationSelectedDetail", "getNavigationQueueProjection", "releaseNavigationAttentionView", "listThreads", "listBackends", "resolveThread", "markThreadSeen", "getProjectPage", "lookupArchivedThreads"].map((method) => [`backend.${method}`, "thread_navigation"]),
-  ...["readThread", "readTurnAssistantReply", "listSkills", "listThreadMcpServers"].map((method) => [`backend.${method}`, "thread_detail"]),
-  ...["startThread", "materializeDirectoryLaunchpad", "startTurn", "interruptTurn", "steerTurn", "controlActiveTurn", "renameThread", "setThreadModelSettings", "setThreadExecutionMode"].map((method) => [`backend.${method}`, "turn_control"]),
-]);
+// The owner methods this outpost serves. Each one's capability comes from the
+// shared owner contract, so a grant means the same here as on desktop.
+const OWNER_METHODS = [
+  "resolveThreadAdmissionState", "supportsMessagingPdfTools",
+  "getNavigationQueryPage", "getNavigationLaunchpadConfig", "getNavigationSelectedDetail", "getNavigationQueueProjection",
+  "releaseNavigationAttentionView", "listThreads", "listBackends", "resolveThread", "markThreadSeen", "getProjectPage", "lookupArchivedThreads",
+  "readThread", "readTurnAssistantReply", "listSkills", "listThreadMcpServers",
+  "startThread", "materializeDirectoryLaunchpad", "startTurn", "interruptTurn", "steerTurn", "controlActiveTurn", "renameThread",
+  "setThreadModelSettings", "setThreadExecutionMode",
+];
+export function ownerMethodCapabilities(methods, contract = FEDERATION_BACKEND_METHOD_CAPABILITIES) {
+  return Object.fromEntries(methods.map((name) => {
+    const method = `backend.${name}`;
+    if (!Object.hasOwn(contract, method)) throw new Error(`${method} is not in the shared owner contract`);
+    return [method, contract[method]];
+  }));
+}
+export const METHOD_CAPABILITIES = ownerMethodCapabilities(OWNER_METHODS);
 
 function mode(sandbox) { return sandbox === "workspace-write" ? "auto" : "default"; }
 function sandboxFor(params, fallback = "read-only") {
@@ -33,6 +44,8 @@ export class HeadlessBackend {
     this.runtime = runtime;
     this.publish = publish;
     this.epoch = randomUUID();
+    // Same headroom as desktop's FEDERATION_RESPONSE_BYTE_BUDGET.
+    this.replayByteBudget = FEDERATION_MAX_FRAME_BYTES - 64 * 1024;
     this.attentionViews = new Map();
     this.file = path.join(path.dirname(runtime.store.directory), "threads.json");
     try {
@@ -94,6 +107,10 @@ export class HeadlessBackend {
   }
 
   event(message) {
+    if (message.method === "headless/turnStarted") {
+      this.titleFromFirstPrompt(message.params);
+      return;
+    }
     if (message.method === "headless/jobChanged") {
       this.syncJobs([message.params]);
       if (message.params.threadId) this.forgetSeenAttentionMember(message.params.threadId);
@@ -149,7 +166,14 @@ export class HeadlessBackend {
         const messages = history.replay.messages.filter((message) => message.role === "assistant" && message.turn?.id === params.turnId);
         return { message: messages.find((message) => params.itemId ? message.id === params.itemId : message.text === params.text) || null };
       }
-      case "readThread": return this.readThread(params.threadId);
+      case "readThread": {
+        // Viewers take the newest page as returned. Page and fit it to one
+        // frame here, as desktop owners do.
+        const history = await this.readThread(params.threadId);
+        return { ...history, replay: fitThreadReplayWithinByteBudget({ cursorIdSpace: "entry-id",
+          replay: pageThreadReplay(history.replay, params), maxBytes: this.replayByteBudget,
+          measureBytes: (replay) => Buffer.byteLength(JSON.stringify({ ...history, replay }), "utf8") }) };
+      }
       case "supportsMessagingPdfTools": return params.backend === "codex" && this.owned(params.threadId).messagingFileTools === true;
       case "startThread": return this.startThread(params);
       case "materializeDirectoryLaunchpad": return this.materializeLaunchpad(params, envelope);
@@ -186,9 +210,8 @@ export class HeadlessBackend {
         const thread = this.owned(params.threadId);
         const title = params.title || params.name;
         if (typeof title !== "string" || !title.trim() || title.length > 200) throw new Error("Invalid title");
-        Object.assign(thread, { title: title.trim(), titleSource: "explicit", updatedAt: Date.now() });
-        this.persist();
-        this.invalidate(thread.id);
+        thread.updatedAt = Date.now();
+        this.setTitle(thread, title.trim(), "explicit");
         return { backend: "codex", threadId: thread.id, title: thread.title };
       }
       case "markThreadSeen": {
@@ -226,7 +249,35 @@ export class HeadlessBackend {
     }
   }
 
-  invalidate(threadId) { this.publish({ backend: "codex", notification: { method: "navigation/invalidated", params: { threadId } } }, "navigation"); }
+  invalidate(threadId, sourceMethod) {
+    this.publish({ backend: "codex", notification: { method: "navigation/invalidated", params: { threadId, ...(sourceMethod ? { sourceMethod } : {}) } } }, "navigation");
+  }
+
+  // threads.json is the only store for a title. The outpost never sets the
+  // Codex thread name.
+  setTitle(thread, title, titleSource) {
+    Object.assign(thread, { title, titleSource });
+    this.persist();
+    this.publish({ backend: "codex", notification: { method: "thread/name/updated",
+      params: { threadId: thread.id, threadName: title, titleSource } } }, "transcript");
+    this.invalidate(thread.id, "thread/name/updated");
+  }
+
+  // The outpost has no helper model, so a thread is named as desktop first
+  // names one: the shortened first user message. Any rename wins over it.
+  deriveTitle(id, text) {
+    const thread = this.threads.get(id);
+    if (!thread || thread.archived || thread.titleSource !== "fallback" || typeof text !== "string") return;
+    const title = shortenDerivedThreadTitle(text)?.slice(0, 200);
+    if (title) this.setTitle(thread, title, "derived");
+  }
+
+  titleFromFirstPrompt({ threadId, jobId, prompt }) {
+    // A later turn is not the first message. readThread names that thread
+    // from Codex's preview instead.
+    const earlier = [...this.runtime.store.jobs.values()].some((job) => job.threadId === threadId && job.id !== jobId && job.turnId);
+    if (!earlier) this.deriveTitle(threadId, prompt);
+  }
 
   async materializeLaunchpad(params, envelope) {
     const cwd = this.runtime.projects.resolve(params.directoryKey);
@@ -328,6 +379,9 @@ export class HeadlessBackend {
       }
     }
     const messages = entries.filter((entry) => entry.type === "message");
+    // Names threads created before derived titles, and imported threads.
+    this.deriveTitle(id, typeof result.thread?.preview === "string" && result.thread.preview.trim()
+      ? result.thread.preview : messages.find((item) => item.role === "user")?.text);
     return { backend: "codex", threadId: id, fetchedAt: Date.now(), threadStatus: this.summary(this.owned(id)).threadStatus,
       replay: { entries, messages, lastUserMessage: messages.filter((item) => item.role === "user").at(-1)?.text,
         lastAssistantMessage: messages.filter((item) => item.role === "assistant").at(-1)?.text,

package/src/federation-core.ts

@@ -16,9 +16,10 @@ export * from "@pwragent/federation/git-instance-handoff";
 export * from "@pwragent/federation/federation-file-push";
 
 export { AgentToolRouter } from "@pwragent/agent-tools/agent-tool-router";
-export { mergeCausalMessagingContext } from "@pwragent/shared";
+export { fitThreadReplayWithinByteBudget, mergeCausalMessagingContext, pageThreadReplay, shortenDerivedThreadTitle } from "@pwragent/shared";
 export { authenticateMessageOrigin } from "@pwragent/federation/federation-message-origin";
 
 export { resolveMessagingOutboundFile, validateMessagingFileMetadata } from "@pwragent/agent-tools/messaging-outbound-file";
 
 export * from "@pwragent/federation/federation-replacement-receiver";
+export { FEDERATION_BACKEND_METHOD_CAPABILITIES } from "@pwragent/federation/federation-backend-methods";

package/src/handoffs.js

@@ -77,7 +77,9 @@ export function setupHandoffs(federation, directory) {
         const file = await runtime.codex.request("fs/readFile", { path: result.thread.path });
         if (typeof file.dataBase64 !== "string") throw new Error("Codex protocol thread export is unavailable");
         return { rolloutBase64: file.dataBase64, replay: (await backend.readThread(id)).replay,
-          cwd: runtime.projects.resolve(owned.cwd || runtime.workspace), title: owned.title };
+          cwd: runtime.projects.resolve(owned.cwd || runtime.workspace),
+          // A placeholder would become the destination's explicit name.
+          ...(owned.titleSource === "fallback" ? {} : { title: owned.title }) };
       },
       forkThread: async (request) => {
         if (runtime.active || backend.creating) throw new Error("Outpost is busy");

package/src/runtime.js

@@ -151,6 +151,8 @@ export class Runtime {
       return;
     }
     this.save({ ...this.store.get(job.id), turnId: turn.turn.id, status: "running" });
+    // The prompt stays in memory: job records never store it.
+    this.onEvent?.({ method: "headless/turnStarted", params: { threadId: result.thread.id, jobId: job.id, prompt } });
     if (this.earlyCompletion?.turn?.id === turn.turn.id) {
       this.complete(this.earlyCompletion);
     } else if (["completed", "failed", "interrupted"].includes(turn.turn.status)) {