pwragent 1.3.8 → 1.3.10

package/README.md

@@ -26,12 +26,12 @@ Use an exact version to match a desktop installation. See the
 and publication verification.
 
 ```sh
-npm install --global pwragent@next
+npm install --global pwragent@latest
 pwragent --help
-# Update to the newest headless prerelease:
+# Or choose a reproducible version that matches your desktop:
+npm install --global pwragent@1.3.7
+# Prerelease desktop versions publish to next, once one has shipped:
 npm install --global pwragent@next
-# Or choose a reproducible version:
-npm install --global pwragent@1.3.6
 ```
 
 Provide **Node >=22 and npm separately**, on Linux (macOS is also supported for
@@ -50,6 +50,19 @@ stop the daemon, install the selected version, and start it again. Do not remove
 the PwrAgent root, Codex home or workspace during updates. There is no automatic
 CLI updater or automatic systemd enablement.
 
+`pwragent --version` prints the installed package version. A published package
+also prints its release tag and source commit, for example
+`pwragent 1.3.8 (v1.3.8, commit 0123…)`. `pwragent version` prints the same
+fields as JSON. Neither needs a running daemon.
+
+`pwragent status` reports the daemon's version as `running`, read when that
+daemon started, and the package files as `installed`. `restartRequired` is
+`true` when they differ, so the update has not taken effect yet. A daemon
+started before version reporting has no `running` field and also reports
+`true`. Run `status` from the same installation as the daemon, such as the
+`/opt/pwragent` path in the systemd example; another installation compares its
+own files.
+
 ## systemd installation example
 
 On a Linux host with systemd, an administrator must first create the dedicated
@@ -70,7 +83,7 @@ shell's Node version-manager initialization does not run under systemd.
 After publication, install a pinned version into the service prefix:
 
 ```sh
-sudo npm install --prefix /opt/pwragent --omit=dev --ignore-scripts pwragent@1.3.6
+sudo npm install --prefix /opt/pwragent --omit=dev --ignore-scripts pwragent@1.3.7
 sudo install -m 0644 /opt/pwragent/node_modules/pwragent/examples/pwragent-headless.service /etc/systemd/system/pwragent-headless.service
 # Review the account, paths, profile and Codex configuration before enabling:
 sudo systemctl daemon-reload
@@ -90,8 +103,9 @@ sudo -u pwragent env PWRAGENT_HOME=/var/lib/pwragent PWRAGENT_PROFILE=outpost \
 
 For a service update, finish or interrupt active work, run
 `sudo systemctl stop pwragent-headless.service`, repeat the prefix installation
-with the chosen new version (or `pwragent@next`), then run
-`sudo systemctl start pwragent-headless.service`. Compare the new example unit
+with the chosen new version (or `pwragent@latest`), then run
+`sudo systemctl start pwragent-headless.service`. Run the `status` command above
+and check that `restartRequired` is `false`. Compare the new example unit
 with the installed one before deliberately updating it; npm does not overwrite
 `/etc/systemd/system`. Stopping during a turn can leave its outcome `unknown`.
 
@@ -280,6 +294,15 @@ its `directoryKey`/`cwd`; omitting it selects the configured workspace root. Sel
 the defaults remain local and read-only. Launchpad requests for worktrees,
 grouping, environments or provider extensions are rejected before creation.
 
+A new thread is named from its first user message, shortened the way desktop
+names a thread before any helper-model title. The outpost has no helper model.
+The name is stored in `threads.json`, and subscribed viewers receive
+`thread/name/updated` with `titleSource: derived`, followed by a navigation
+invalidation. A later turn never renames a thread. An explicit `renameThread`
+always wins and is never replaced. A thread that still has a placeholder name,
+such as one created before this release, takes Codex's `preview` the next time
+it is read. The outpost does not set the Codex thread name.
+
 ## Identity, compute lifetime and remaining scope
 
 The private `federation.json` stores the retained peer ID, signing/Noise keys,
@@ -349,6 +372,7 @@ register a project. Enrollment and Git intake do not import the sender's Git or
 
 | Service | Required grants | Supported behavior |
 | --- | --- | --- |
+| `backend.*` | Per method, from desktop's owner table in `@pwragent/federation` | Navigation reads need `thread_navigation`; thread detail, queue projection, launchpad config and `listBackends` need `thread_detail`; turns need `turn_control`; launchpads need `environment_actions` |
 | `outpost.projects.list` | `thread_navigation` | Owner project inventory |
 | `outpost.projects.create/add/remove` | `environment_actions` | Create/clone, register and unregister projects |
 | `pty.*` | `remote_pty` | Input, resize, ack flow control, snapshots, history and close |
@@ -465,6 +489,18 @@ against the daemon. External providers and Codex are mocked; no live peers,
 operator projects, credentials or compute machines are used. Ubuntu CI runs the
 Node suite; the desktop contract test runs on POSIX lanes.
 
+The owner conformance suite
+(`apps/desktop/src/main/__tests__/owner-conformance.test.ts`) runs one thread's
+life through the owner methods both hosts implement. It runs on this daemon and
+on desktop's real owner, and compares each response and event. Each known
+difference is a line in `owner-conformance-baseline.json` beside it, so the
+suite fails on any new difference and names its method. After fixing a
+difference, or changing the contract on purpose, record the result:
+
+```sh
+UPDATE_OWNER_CONFORMANCE=1 pnpm test apps/desktop/src/main/__tests__/owner-conformance.test.ts
+```
+
 A separate live smoke test installed the packed tarball and official Codex
 0.159.2 in a Node 24 Debian Linux arm64 Docker image. It used an unprivileged
 user, a read-only authentication-file mount, container-owned state and workspace,

package/dist/federation-core.js

@@ -9284,7 +9284,21 @@ var FEDERATION_CAPABILITIES = [
    * turn's reply, its images materialized. A messaging gateway without it
    * reads a transcript page at every bound turn end.
    */
-  "turn_assistant_reply"
+  "turn_assistant_reply",
+  /**
+   * The owner answers `backend.manageThreadPrWatchesV1`: a viewer reads a
+   * thread's watch history, stops a watch, and arms Watch CI there. Its
+   * navigation rows also carry `prCiWatches`. A viewer shows an older
+   * owner's watches read-only.
+   */
+  "thread_pr_watch_control_v1",
+  /**
+   * The owner sends each of its Directories projects' Forge Automation on
+   * its rows and answers `backend.setProjectForgeAutomation`,
+   * `backend.listProjectHeldWakeups` and `backend.resolveProjectHeldWakeups`.
+   * A viewer offers no Forge Automation menu items without it.
+   */
+  "project_forge_automation"
 ];
 var FEDERATION_ENDPOINT_SCHEMES = ["ws", "wss", "ssh"];
 function parseFederationGatewayEndpoint(value) {
@@ -9358,6 +9372,19 @@ var PWRAGENT_MESSAGING_CALLABLE_OPERATION_NAMES = [
   ...PWRAGENT_MESSAGING_LEGACY_OPERATION_NAMES
 ];
 
+// ../shared/src/contracts/thread-todos.ts
+var THREAD_TODO_TITLE_MAX_LENGTH = 120;
+var THREAD_TODO_ORIGIN_ID_MAX_LENGTH = 200;
+function threadTodoMessageOriginFromUnknown(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const record = value;
+  if (typeof record.id !== "string") return void 0;
+  const id = record.id.trim();
+  if (!id || id.length > THREAD_TODO_ORIGIN_ID_MAX_LENGTH) return void 0;
+  const title = typeof record.title === "string" ? record.title.trim().slice(0, THREAD_TODO_TITLE_MAX_LENGTH).trim() : "";
+  return { id, ...title ? { title } : {} };
+}
+
 // ../shared/src/directory-navigation.ts
 function normalizeGitOriginUrl(value) {
   const trimmed = value?.trim();
@@ -9459,6 +9486,61 @@ async function readStatusWithoutNestedWorktrees(options) {
   return await options.git([...options.statusArgs, ...nestedWorktreePathspecArgs(excludes)]);
 }
 
+// ../shared/src/thread-titles.ts
+var MAX_DERIVED_THREAD_TITLE_LENGTH = 72;
+var MIN_PREFERRED_BREAK_INDEX = 36;
+var LEADING_SKILL_LINK_RE = /^(?:\[\$[^\]]+\]\([^)]+\)\s*)+/i;
+var LEADING_SKILL_TOKEN_RE = /^(?:\$[\w:-]+\s+)+/i;
+var LEADING_REQUEST_PREFIX_RE = /^(?:i need(?: you to)?|can you|could you|would you|please|help me|let's|show me|tell me)\s+/i;
+function trimTrailingPunctuation(value) {
+  return value.replace(/[\s,;:.-]+$/g, "").trim();
+}
+function uppercaseFirstLetter(value) {
+  if (!value) {
+    return value;
+  }
+  return value[0].toUpperCase() + value.slice(1);
+}
+function normalizeTitleInput(value) {
+  const trimmed = value?.replace(/\s+/g, " ").trim();
+  if (!trimmed) {
+    return void 0;
+  }
+  const withoutSkillLinks = trimmed.replace(LEADING_SKILL_LINK_RE, "");
+  const withoutSkillTokens = withoutSkillLinks.replace(LEADING_SKILL_TOKEN_RE, "");
+  return withoutSkillTokens || trimmed;
+}
+function shortenDerivedThreadTitle(value) {
+  const normalized = normalizeTitleInput(value);
+  if (!normalized) {
+    return void 0;
+  }
+  const requestTrimmed = normalized.replace(LEADING_REQUEST_PREFIX_RE, "");
+  const candidateBase = requestTrimmed && requestTrimmed.length < normalized.length ? uppercaseFirstLetter(requestTrimmed) : normalized;
+  const candidate = trimTrailingPunctuation(candidateBase);
+  if (candidate.length <= MAX_DERIVED_THREAD_TITLE_LENGTH) {
+    return candidate;
+  }
+  const breakpointWindow = candidate.slice(0, MAX_DERIVED_THREAD_TITLE_LENGTH + 1);
+  const punctuationBreaks = [
+    breakpointWindow.lastIndexOf(". "),
+    breakpointWindow.lastIndexOf("? "),
+    breakpointWindow.lastIndexOf("! "),
+    breakpointWindow.lastIndexOf(": "),
+    breakpointWindow.lastIndexOf("; "),
+    breakpointWindow.lastIndexOf(", ")
+  ];
+  const punctuationBreak = Math.max(...punctuationBreaks);
+  if (punctuationBreak >= MIN_PREFERRED_BREAK_INDEX) {
+    return `${trimTrailingPunctuation(candidate.slice(0, punctuationBreak))}...`;
+  }
+  const wordBreak = breakpointWindow.lastIndexOf(" ");
+  if (wordBreak >= MIN_PREFERRED_BREAK_INDEX) {
+    return `${trimTrailingPunctuation(candidate.slice(0, wordBreak))}...`;
+  }
+  return `${trimTrailingPunctuation(candidate.slice(0, MAX_DERIVED_THREAD_TITLE_LENGTH))}...`;
+}
+
 // ../shared/src/messaging-causal-context.ts
 function mergeCausalMessagingContext(origins) {
   const sources = origins.flatMap((origin) => origin?.causalMessagingSource ? [origin.causalMessagingSource] : []);
@@ -9468,6 +9550,215 @@ function mergeCausalMessagingContext(origins) {
   return ambiguous ? { causalMessagingSource: void 0, causalMessagingAmbiguous: true } : { causalMessagingSource: sources[sources.length - 1], causalMessagingAmbiguous: void 0 };
 }
 
+// ../shared/src/thread-replay-paging.ts
+function pageThreadReplay(replay, options, hooks = {}) {
+  if (options.includeTurns === false) {
+    return {
+      ...replay,
+      entries: [],
+      messages: [],
+      lastUserMessage: void 0,
+      lastAssistantMessage: void 0,
+      pagination: {
+        supportsPagination: false,
+        hasPreviousPage: false
+      }
+    };
+  }
+  if (options.limit === void 0 && options.before === void 0) {
+    return replay;
+  }
+  const beforeIndex = options.before !== void 0 ? replay.entries.findIndex((entry) => entry.id === options.before) : replay.entries.length;
+  if (beforeIndex < 0) {
+    hooks.onUnresolvedCursor?.();
+    return {
+      ...replay,
+      entries: [],
+      messages: [],
+      lastUserMessage: void 0,
+      lastAssistantMessage: void 0,
+      pagination: {
+        supportsPagination: true,
+        hasPreviousPage: false
+      }
+    };
+  }
+  const limit = options.limit === void 0 ? void 0 : Math.max(0, Math.floor(options.limit));
+  const startIndex = limit === void 0 ? 0 : findTurnPageStartIndex(replay.entries, beforeIndex, limit);
+  const entries = replay.entries.slice(startIndex, beforeIndex);
+  return replayWithEntries(
+    replay,
+    entries,
+    mintEntryCursorPagination(entries, startIndex > 0, hooks.isCursorEntry)
+  );
+}
+function findTurnPageStartIndex(entries, endIndex, limit) {
+  if (limit === 0) {
+    return endIndex;
+  }
+  for (let index = 0; index < endIndex; index += 1) {
+    if (!entries[index]?.turn?.id) {
+      return Math.max(0, endIndex - limit);
+    }
+  }
+  const turnIds = /* @__PURE__ */ new Set();
+  let oldestRetainedTurnId;
+  for (let index = endIndex - 1; index >= 0; index -= 1) {
+    const turnId = entries[index]?.turn?.id;
+    if (!turnId || turnIds.has(turnId)) {
+      continue;
+    }
+    if (turnIds.size >= limit) {
+      break;
+    }
+    turnIds.add(turnId);
+    oldestRetainedTurnId = turnId;
+  }
+  if (!oldestRetainedTurnId) {
+    return Math.max(0, endIndex - limit);
+  }
+  if (turnIds.size < limit) {
+    return 0;
+  }
+  const firstTurnEntryIndex = entries.findIndex(
+    (entry, index) => index < endIndex && entry.turn?.id === oldestRetainedTurnId
+  );
+  return firstTurnEntryIndex >= 0 ? firstTurnEntryIndex : 0;
+}
+function mintEntryCursorPagination(entries, hasPreviousPage, isCursorEntry = () => true) {
+  const cursorEntry = hasPreviousPage ? entries.find(isCursorEntry) : void 0;
+  return {
+    supportsPagination: true,
+    hasPreviousPage: cursorEntry !== void 0,
+    ...cursorEntry ? { previousCursor: cursorEntry.id } : {}
+  };
+}
+function replayWithEntries(replay, entries, pagination) {
+  const messages = entries.flatMap(
+    (entry) => entry.type === "message" ? [
+      {
+        id: entry.id,
+        role: entry.role,
+        text: entry.text,
+        ...entry.parts ? { parts: entry.parts } : {},
+        ...entry.origin ? { origin: entry.origin } : {},
+        ...entry.createdAt ? { createdAt: entry.createdAt } : {}
+      }
+    ] : []
+  );
+  const lastUserMessage = messages.findLast((message) => message.role === "user")?.text;
+  const lastAssistantMessage = messages.findLast(
+    (message) => message.role === "assistant"
+  )?.text;
+  return {
+    ...replay,
+    entries,
+    messages,
+    lastUserMessage,
+    lastAssistantMessage,
+    pagination
+  };
+}
+var FEDERATION_OMITTED_ENTRY_TEXT = "Content omitted because this page exceeded the federation frame limit.";
+function fitThreadReplayWithinByteBudget(params) {
+  if (params.measureBytes(params.replay) <= params.maxBytes) {
+    return params.replay;
+  }
+  if (params.cursorIdSpace === "provider-cursor") {
+    return compactReplayWithinByteBudget(params);
+  }
+  let entries = params.replay.entries;
+  while (entries.length > 1) {
+    entries = entries.slice(1);
+    const candidate = replayWithEntries(
+      params.replay,
+      entries,
+      mintEntryCursorPagination(entries, true, params.isCursorEntry)
+    );
+    if (params.measureBytes(candidate) <= params.maxBytes) {
+      return candidate;
+    }
+  }
+  const oversizedEntry = entries[0];
+  if (oversizedEntry) {
+    const candidate = replayWithEntries(
+      params.replay,
+      [compactOversizedEntry(oversizedEntry)],
+      // Classify the entry as it arrived. Compaction rewrites an activity's
+      // summary, and a usage row matched by summary rather than by id would
+      // read as provider-owned afterwards — the overlay-id cursor this module
+      // exists to prevent.
+      mintEntryCursorPagination(
+        [oversizedEntry],
+        params.replay.pagination.hasPreviousPage || params.replay.entries.length > 1,
+        params.isCursorEntry
+      )
+    );
+    if (params.measureBytes(candidate) <= params.maxBytes) {
+      return candidate;
+    }
+  }
+  return replayWithEntries(params.replay, [], mintEntryCursorPagination([], false));
+}
+function compactReplayWithinByteBudget(params) {
+  const entries = [...params.replay.entries];
+  for (let index = 0; index < entries.length; index += 1) {
+    entries[index] = compactOversizedEntry(entries[index]);
+    const candidate = replayWithEntries(
+      params.replay,
+      [...entries],
+      params.replay.pagination
+    );
+    if (params.measureBytes(candidate) <= params.maxBytes) {
+      return candidate;
+    }
+  }
+  return replayWithEntries(params.replay, [], params.replay.pagination);
+}
+function compactOversizedEntry(entry) {
+  switch (entry.type) {
+    case "message":
+      return {
+        type: "message",
+        id: entry.id,
+        role: entry.role,
+        text: FEDERATION_OMITTED_ENTRY_TEXT,
+        ...entry.createdAt ? { createdAt: entry.createdAt } : {},
+        ...entry.phase ? { phase: entry.phase } : {},
+        ...entry.turn ? { turn: entry.turn } : {}
+      };
+    case "activity":
+      return {
+        type: "activity",
+        id: entry.id,
+        summary: FEDERATION_OMITTED_ENTRY_TEXT,
+        details: [],
+        ...entry.createdAt ? { createdAt: entry.createdAt } : {},
+        ...entry.tone ? { tone: entry.tone } : {},
+        ...entry.status ? { status: entry.status } : {},
+        ...entry.turn ? { turn: entry.turn } : {}
+      };
+    case "plan":
+      return {
+        type: "plan",
+        id: entry.id,
+        markdown: FEDERATION_OMITTED_ENTRY_TEXT,
+        steps: [],
+        ...entry.createdAt ? { createdAt: entry.createdAt } : {},
+        ...entry.turn ? { turn: entry.turn } : {}
+      };
+    case "review":
+      return {
+        type: "review",
+        id: entry.id,
+        review: FEDERATION_OMITTED_ENTRY_TEXT,
+        ...entry.createdAt ? { createdAt: entry.createdAt } : {},
+        ...entry.status ? { status: entry.status } : {},
+        ...entry.turn ? { turn: entry.turn } : {}
+      };
+  }
+}
+
 // ../federation/src/federation-identity.ts
 import {
   createPrivateKey,
@@ -12427,6 +12718,9 @@ var TerminalReplay = class {
   parsedTail = "";
   seq = 0;
   updatedAt = 0;
+  /** The last serialized screen, until a write or resize changes it. A thread
+   *  view remount attaches every pane at once, and most panes are idle. */
+  serialized;
   pendingCharacters = 0;
   whenDrained() {
     return this.queue;
@@ -12456,6 +12750,7 @@ var TerminalReplay = class {
     }
     this.queue = this.queue.then(() => new Promise((resolve) => {
       this.terminal.write(data, () => {
+        this.serialized = void 0;
         this.pendingCharacters -= data.length;
         this.parsedTail = tail;
         this.parsedSeq = frame.seq;
@@ -12467,34 +12762,42 @@ var TerminalReplay = class {
   }
   resize(cols, rows) {
     this.queue = this.queue.then(() => {
+      const { cols: beforeCols, rows: beforeRows } = this.terminal;
       this.terminal.resize(clampTerminalColumns(cols), clampTerminalRows(rows));
+      if (this.terminal.cols !== beforeCols || this.terminal.rows !== beforeRows) this.serialized = void 0;
     });
   }
   snapshot() {
     const result = this.queue.then(() => {
-      let scrollback = 2e3;
-      let data = this.serializer.serialize({ scrollback });
-      while (Buffer.byteLength(data) > TERMINAL_SNAPSHOT_LIMIT && scrollback > 0) {
-        scrollback = Math.floor(scrollback / 2);
-        data = this.serializer.serialize({ scrollback });
-      }
-      const truncated = scrollback < 2e3;
-      if (Buffer.byteLength(data) > TERMINAL_SNAPSHOT_LIMIT) {
-        data = this.plainText().slice(-64 * 1024).replace(/\n/g, "\r\n");
-      }
-      return {
-        data,
-        pendingEscape: this.parsedTail || void 0,
-        seq: this.parsedSeq,
-        timestamp: this.updatedAt,
-        cols: this.terminal.cols,
-        rows: this.terminal.rows,
-        truncated
-      };
+      this.serialized ??= this.serialize();
+      return { ...this.serialized };
     });
-    this.queue = result.then(() => void 0);
+    this.queue = result.then(() => void 0, () => void 0);
     return result;
   }
+  serialize() {
+    let scrollback = 2e3;
+    let data = this.serializer.serialize({ scrollback });
+    let bytes = Buffer.byteLength(data);
+    while (bytes > TERMINAL_SNAPSHOT_LIMIT && scrollback > 0) {
+      scrollback = Math.floor(scrollback / 2);
+      data = this.serializer.serialize({ scrollback });
+      bytes = Buffer.byteLength(data);
+    }
+    const truncated = scrollback < 2e3;
+    if (bytes > TERMINAL_SNAPSHOT_LIMIT) {
+      data = this.plainText().slice(-64 * 1024).replace(/\n/g, "\r\n");
+    }
+    return {
+      data,
+      pendingEscape: this.parsedTail || void 0,
+      seq: this.parsedSeq,
+      timestamp: this.updatedAt,
+      cols: this.terminal.cols,
+      rows: this.terminal.rows,
+      truncated
+    };
+  }
   /** Raw reads are event deltas. Plain reads are screen snapshots, not deltas. */
   read(afterSeq = 0, maxChars = 16384) {
     const limit = Math.max(1, Math.min(64 * 1024, Math.floor(maxChars) || 16384));
@@ -12523,7 +12826,7 @@ var TerminalReplay = class {
       seq: this.parsedSeq,
       timestamp: this.updatedAt
     }));
-    this.queue = result.then(() => void 0);
+    this.queue = result.then(() => void 0, () => void 0);
     return result;
   }
   plainText() {
@@ -18945,15 +19248,20 @@ var FederationFilePushReceipts = class {
 function authenticateMessageOrigin(params) {
   const sourceThread = params.messageOrigin?.sourceThread;
   if (!params.messageOrigin || !sourceThread) {
-    return params.messageOrigin;
+    if (params.messageOrigin?.threadTodo === void 0) return params.messageOrigin;
+    const { threadTodo: _threadTodo, ...messageOrigin2 } = params.messageOrigin;
+    return messageOrigin2;
   }
   let sourceInstance;
   try {
     sourceInstance = params.resolveSourceInstance?.(params.sourceInstanceId);
   } catch {
   }
+  const { threadTodo: rawThreadTodo, ...messageOrigin } = params.messageOrigin;
+  const threadTodo = messageOrigin.kind === "agent" ? threadTodoMessageOriginFromUnknown(rawThreadTodo) : void 0;
   return {
-    ...params.messageOrigin,
+    ...messageOrigin,
+    ...threadTodo ? { threadTodo } : {},
     sourceThread: {
       backend: sourceThread.backend,
       instanceId: params.sourceInstanceId,
@@ -19486,8 +19794,318 @@ var FederationReplacementReceiver = class {
     return pending.entries;
   }
 };
+
+// ../federation/src/federation-backend-methods.ts
+var FEDERATION_BACKEND_METHODS = {
+  getNavigationQueryPage: "backend.getNavigationQueryPage",
+  removeNavigationDirectory: "backend.removeNavigationDirectory",
+  archiveNavigationDirectory: "backend.archiveNavigationDirectory",
+  markNavigationDirectorySeen: "backend.markNavigationDirectorySeen",
+  releaseNavigationAttentionView: "backend.releaseNavigationAttentionView",
+  getNavigationLaunchpadConfig: "backend.getNavigationLaunchpadConfig",
+  getNavigationSelectedDetail: "backend.getNavigationSelectedDetail",
+  getNavigationQueueProjection: "backend.getNavigationQueueProjection",
+  getProjectPage: "backend.getProjectPage",
+  getNavigationDescendantPage: "backend.getNavigationDescendantPage",
+  lookupArchivedThreads: "backend.lookupArchivedThreads",
+  /** @deprecated Alpha collection contract; migrate per docs/federation-navigation-v2.md before removal. */
+  getNavigationSnapshot: "backend.getNavigationSnapshot",
+  searchNavigationThreads: "backend.searchNavigationThreads",
+  searchFederatedThreads: "backend.searchFederatedThreads",
+  searchThreadContent: "backend.searchThreadContent",
+  cancelThreadContentSearch: "backend.cancelThreadContentSearch",
+  /** @deprecated Collection enumeration; use bounded queries or exact-ID archive lookup. */
+  listThreads: "backend.listThreads",
+  resolveThread: "backend.resolveThread",
+  resolveThreadAdmissionState: "backend.resolveThreadAdmissionState",
+  readThread: "backend.readThread",
+  readTurnAssistantReply: "backend.readTurnAssistantReply",
+  readUsageActivity: "backend.readUsageActivity",
+  readThreadFamilyPricing: "backend.readThreadFamilyPricing",
+  analyzeUsageActivity: "backend.analyzeUsageActivity",
+  inspectTokenMiserOutput: "backend.inspectTokenMiserOutput",
+  analyzeThreadToolHistory: "backend.analyzeThreadToolHistory",
+  readTranscriptImage: "backend.readTranscriptImage",
+  listSkills: "backend.listSkills",
+  supportsMessagingPdfTools: "backend.supportsMessagingPdfTools",
+  listBackends: "backend.listBackends",
+  markThreadSeen: "backend.markThreadSeen",
+  continueThreadEnvironmentStartup: "backend.continueThreadEnvironmentStartup",
+  acknowledgeThreadEnvironmentFailure: "backend.acknowledgeThreadEnvironmentFailure",
+  setThreadReaction: "backend.setThreadReaction",
+  setThreadLock: "backend.setThreadLock",
+  setThreadPin: "backend.setThreadPin",
+  reorderThreadPins: "backend.reorderThreadPins",
+  mountRemoteChild: "backend.mountRemoteChild",
+  setThreadParent: "backend.setThreadParent",
+  mutateThreadParentV1: "backend.mutateThreadParentV1",
+  updateSubthreadOrder: "backend.updateSubthreadOrder",
+  setSubthreadsCollapsed: "backend.setSubthreadsCollapsed",
+  readForge: "backend.readForge",
+  detachThreadPullRequest: "backend.detachThreadPullRequest",
+  setThreadPrAutoDispatch: "backend.setThreadPrAutoDispatch",
+  cancelThreadPrAutoDispatch: "backend.cancelThreadPrAutoDispatch",
+  sendThreadPrAutoDispatchNow: "backend.sendThreadPrAutoDispatchNow",
+  // A new method, so an owner that predates it answers method_not_found.
+  manageThreadPrWatchesV1: "backend.manageThreadPrWatchesV1",
+  setProjectForgeAutomation: "backend.setProjectForgeAutomation",
+  listProjectHeldWakeups: "backend.listProjectHeldWakeups",
+  resolveProjectHeldWakeups: "backend.resolveProjectHeldWakeups",
+  archiveThread: "backend.archiveThread",
+  restoreThread: "backend.restoreThread",
+  startThread: "backend.startThread",
+  forkThread: "backend.forkThread",
+  startTurn: "backend.startTurn",
+  submitTurnRequest: "backend.submitTurnRequest",
+  getTurnRequest: "backend.getTurnRequest",
+  submitSteerRequest: "backend.submitSteerRequest",
+  getSteerRequest: "backend.getSteerRequest",
+  replaceQueuedMessage: "backend.replaceQueuedMessage",
+  readQueuedTurn: "backend.readQueuedTurn",
+  cancelQueuedTurn: "backend.cancelQueuedTurn",
+  releaseQueuedTurn: "backend.releaseQueuedTurn",
+  moveQueuedTurn: "backend.moveQueuedTurn",
+  setQueuedTurnPaused: "backend.setQueuedTurnPaused",
+  startReview: "backend.startReview",
+  startPullRequestReview: "backend.startPullRequestReview",
+  listScheduledThreadActions: "backend.listScheduledThreadActions",
+  createScheduledThreadAction: "backend.createScheduledThreadAction",
+  createScheduledPullRequestReview: "backend.createScheduledPullRequestReview",
+  updateScheduledThreadAction: "backend.updateScheduledThreadAction",
+  updateScheduledPullRequestReview: "backend.updateScheduledPullRequestReview",
+  cancelScheduledThreadAction: "backend.cancelScheduledThreadAction",
+  sendScheduledThreadActionNow: "backend.sendScheduledThreadActionNow",
+  compactThread: "backend.compactThread",
+  rewindThread: "backend.rewindThread",
+  previewThreadRewind: "backend.previewThreadRewind",
+  undoThreadRewind: "backend.undoThreadRewind",
+  listMcpConnections: "backend.listMcpConnections",
+  readThreadMcpConnections: "backend.readThreadMcpConnections",
+  setThreadMcpConnections: "backend.setThreadMcpConnections",
+  describeThreadMcpConnections: "backend.describeThreadMcpConnections",
+  listThreadMcpServers: "backend.listThreadMcpServers",
+  reloadCodexMcpConfig: "backend.reloadCodexMcpConfig",
+  controlActiveTurn: "backend.controlActiveTurn",
+  resolveActiveTurn: "backend.resolveActiveTurn",
+  interruptTurn: "backend.interruptTurn",
+  stopSubAgent: "backend.stopSubAgent",
+  steerTurn: "backend.steerTurn",
+  setThreadExecutionMode: "backend.setThreadExecutionMode",
+  queueThreadExecutionMode: "backend.queueThreadExecutionMode",
+  cancelThreadExecutionModeQueue: "backend.cancelThreadExecutionModeQueue",
+  setAcpSessionRuntimeOption: "backend.setAcpSessionRuntimeOption",
+  setThreadAgent: "backend.setThreadAgent",
+  setThreadTokenMiser: "backend.setThreadTokenMiser",
+  setThreadModelSettings: "backend.setThreadModelSettings",
+  checkThreadBranchDrift: "backend.checkThreadBranchDrift",
+  updateThreadExpectedBranch: "backend.updateThreadExpectedBranch",
+  retainThreadBranchDrift: "backend.retainThreadBranchDrift",
+  submitServerRequest: "backend.submitServerRequest",
+  runCodexEnvironmentAction: "backend.runCodexEnvironmentAction",
+  stopCodexEnvironmentAction: "backend.stopCodexEnvironmentAction",
+  listBackgroundTerminals: "backend.listBackgroundTerminals",
+  terminateBackgroundTerminal: "backend.terminateBackgroundTerminal",
+  setCodexThreadEnvironment: "backend.setCodexThreadEnvironment",
+  refreshThreadPullRequests: "backend.refreshThreadPullRequests",
+  refreshDirectoryGitStatuses: "backend.refreshDirectoryGitStatuses",
+  refreshThreadGitWorkingState: "backend.refreshThreadGitWorkingState",
+  ensureDirectoryLaunchpad: "backend.ensureDirectoryLaunchpad",
+  listRecentFileReferences: "backend.listRecentFileReferences",
+  recordRecentFileReferences: "backend.recordRecentFileReferences",
+  listModelSettingsRecents: "backend.listModelSettingsRecents",
+  recordModelSettingsRecent: "backend.recordModelSettingsRecent",
+  attachDirectoryToThread: "backend.attachDirectoryToThread",
+  detachDirectoryFromThread: "backend.detachDirectoryFromThread",
+  listWorktreeUnpublishedCommits: "backend.listWorktreeUnpublishedCommits",
+  getWorktreeUnpublishedCommitDiff: "backend.getWorktreeUnpublishedCommitDiff",
+  materializeDirectoryLaunchpad: "backend.materializeDirectoryLaunchpad",
+  manageLaunchpadCreation: "backend.manageLaunchpadCreation",
+  handoffThreadWorkspace: "backend.handoffThreadWorkspace",
+  // Separate so an owner that predates these moves answers method_not_found.
+  // It would read an unknown direction as Handoff to Local and ignore baseRef.
+  handoffThreadWorkspaceToNewWorktree: "backend.handoffThreadWorkspaceToNewWorktree",
+  recreateThreadWorktree: "backend.recreateThreadWorktree",
+  moveThreadToMainCheckout: "backend.moveThreadToMainCheckout",
+  renameThread: "backend.renameThread",
+  readApplications: "backend.readApplications",
+  openApplication: "backend.openApplication",
+  readMessagingPlatformStatuses: "backend.readMessagingPlatformStatuses",
+  readPwrSnapConnectionStatus: "backend.readPwrSnapConnectionStatus",
+  getLoadStatus: "backend.getLoadStatus",
+  trustCodexProject: "backend.trustCodexProject",
+  setCelestialIcon: "backend.setCelestialIcon",
+  setFederationShortName: "backend.setFederationShortName",
+  starMapIntake: "backend.starMapIntake"
+};
+var FEDERATION_BACKEND_METHOD_CAPABILITIES = {
+  [FEDERATION_BACKEND_METHODS.getNavigationQueryPage]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.removeNavigationDirectory]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.archiveNavigationDirectory]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.markNavigationDirectorySeen]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.releaseNavigationAttentionView]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.getNavigationLaunchpadConfig]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.getNavigationSelectedDetail]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.getNavigationQueueProjection]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.getProjectPage]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.getNavigationDescendantPage]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.lookupArchivedThreads]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.getNavigationSnapshot]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.searchNavigationThreads]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.searchFederatedThreads]: "federated_search",
+  [FEDERATION_BACKEND_METHODS.searchThreadContent]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.cancelThreadContentSearch]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.listThreads]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.resolveThread]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.resolveThreadAdmissionState]: "messaging_route",
+  [FEDERATION_BACKEND_METHODS.readThread]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.readTurnAssistantReply]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.readForge]: "thread_detail",
+  /* Reads the thread's own transcript history; same data class as reading it. */
+  [FEDERATION_BACKEND_METHODS.readUsageActivity]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.readThreadFamilyPricing]: "thread_detail",
+  // Starts a paid helper turn on the owner; transcript-read permission is insufficient.
+  [FEDERATION_BACKEND_METHODS.analyzeUsageActivity]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.inspectTokenMiserOutput]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.analyzeThreadToolHistory]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.readTranscriptImage]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.listSkills]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.supportsMessagingPdfTools]: "messaging_route",
+  [FEDERATION_BACKEND_METHODS.listBackends]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.markThreadSeen]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.continueThreadEnvironmentStartup]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.acknowledgeThreadEnvironmentFailure]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.setThreadReaction]: "thread_navigation",
+  // A lock refuses every turn on the owner's thread, so it takes the same
+  // capability as starting one.
+  [FEDERATION_BACKEND_METHODS.setThreadLock]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setThreadPin]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.reorderThreadPins]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.mountRemoteChild]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.setThreadParent]: "thread_grouping",
+  [FEDERATION_BACKEND_METHODS.mutateThreadParentV1]: "thread_grouping",
+  [FEDERATION_BACKEND_METHODS.updateSubthreadOrder]: "thread_grouping",
+  [FEDERATION_BACKEND_METHODS.setSubthreadsCollapsed]: "thread_grouping",
+  // PR detach cancels pending auto-dispatch work and auto-dispatch arms
+  // automatic repair turns, so both sit with the turn-control grants
+  // (like archiveThread) rather than the browse-level navigation grants.
+  [FEDERATION_BACKEND_METHODS.detachThreadPullRequest]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setThreadPrAutoDispatch]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.cancelThreadPrAutoDispatch]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.sendThreadPrAutoDispatchNow]: "turn_control",
+  // A watch wakes the thread with an agent turn, and stopping one cancels
+  // that wake, so both sit with Auto-fix under turn control.
+  [FEDERATION_BACKEND_METHODS.manageThreadPrWatchesV1]: "turn_control",
+  // A project's Forge Automation decides which turns the owner starts on its
+  // own, and a held wake-up's Send starts one, so all three take the
+  // turn-control grant. Listing rides with them: only the resume flow asks.
+  [FEDERATION_BACKEND_METHODS.setProjectForgeAutomation]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.listProjectHeldWakeups]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.resolveProjectHeldWakeups]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.archiveThread]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.restoreThread]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.startThread]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.forkThread]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.startTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.submitTurnRequest]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.getTurnRequest]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.submitSteerRequest]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.getSteerRequest]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.replaceQueuedMessage]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.readQueuedTurn]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.cancelQueuedTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.releaseQueuedTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.moveQueuedTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setQueuedTurnPaused]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.startReview]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.startPullRequestReview]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.listScheduledThreadActions]: "scheduled_actions",
+  [FEDERATION_BACKEND_METHODS.createScheduledThreadAction]: "scheduled_actions",
+  [FEDERATION_BACKEND_METHODS.createScheduledPullRequestReview]: "scheduled_actions",
+  [FEDERATION_BACKEND_METHODS.updateScheduledThreadAction]: "scheduled_actions",
+  [FEDERATION_BACKEND_METHODS.updateScheduledPullRequestReview]: "scheduled_actions",
+  [FEDERATION_BACKEND_METHODS.cancelScheduledThreadAction]: "scheduled_actions",
+  [FEDERATION_BACKEND_METHODS.sendScheduledThreadActionNow]: "scheduled_actions",
+  [FEDERATION_BACKEND_METHODS.compactThread]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.rewindThread]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.previewThreadRewind]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.undoThreadRewind]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.listMcpConnections]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.readThreadMcpConnections]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.setThreadMcpConnections]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.describeThreadMcpConnections]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.listThreadMcpServers]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.reloadCodexMcpConfig]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.controlActiveTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.resolveActiveTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.interruptTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.stopSubAgent]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.steerTurn]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setThreadExecutionMode]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.queueThreadExecutionMode]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.cancelThreadExecutionModeQueue]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setAcpSessionRuntimeOption]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setThreadAgent]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setThreadTokenMiser]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setThreadModelSettings]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.checkThreadBranchDrift]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.updateThreadExpectedBranch]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.retainThreadBranchDrift]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.submitServerRequest]: "pending_request_control",
+  [FEDERATION_BACKEND_METHODS.runCodexEnvironmentAction]: "environment_actions",
+  [FEDERATION_BACKEND_METHODS.stopCodexEnvironmentAction]: "environment_actions",
+  [FEDERATION_BACKEND_METHODS.listBackgroundTerminals]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.terminateBackgroundTerminal]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.setCodexThreadEnvironment]: "environment_actions",
+  [FEDERATION_BACKEND_METHODS.refreshThreadPullRequests]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.refreshDirectoryGitStatuses]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.refreshThreadGitWorkingState]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.ensureDirectoryLaunchpad]: "launchpad_metadata",
+  [FEDERATION_BACKEND_METHODS.listRecentFileReferences]: "remote_window",
+  [FEDERATION_BACKEND_METHODS.recordRecentFileReferences]: "remote_window",
+  // Reviewer/composer model-settings history is read-only preference data at
+  // the same sensitivity tier as the recent-file list it sits beside.
+  [FEDERATION_BACKEND_METHODS.listModelSettingsRecents]: "remote_window",
+  [FEDERATION_BACKEND_METHODS.recordModelSettingsRecent]: "remote_window",
+  [FEDERATION_BACKEND_METHODS.attachDirectoryToThread]: "environment_actions",
+  [FEDERATION_BACKEND_METHODS.detachDirectoryFromThread]: "environment_actions",
+  [FEDERATION_BACKEND_METHODS.listWorktreeUnpublishedCommits]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.getWorktreeUnpublishedCommitDiff]: "thread_detail",
+  [FEDERATION_BACKEND_METHODS.materializeDirectoryLaunchpad]: "environment_actions",
+  [FEDERATION_BACKEND_METHODS.manageLaunchpadCreation]: "environment_actions",
+  [FEDERATION_BACKEND_METHODS.handoffThreadWorkspace]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.handoffThreadWorkspaceToNewWorktree]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.recreateThreadWorktree]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.moveThreadToMainCheckout]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.renameThread]: "turn_control",
+  [FEDERATION_BACKEND_METHODS.readApplications]: "remote_window",
+  [FEDERATION_BACKEND_METHODS.openApplication]: "remote_window",
+  // Read-only peer messaging health for the remote window's MSG chip.
+  // messaging_route stays reserved for messaging-originated remote control.
+  [FEDERATION_BACKEND_METHODS.readMessagingPlatformStatuses]: "remote_window",
+  [FEDERATION_BACKEND_METHODS.readPwrSnapConnectionStatus]: "pwrsnap_connection",
+  // On-demand load readings (CPU load averages, available RAM, free
+  // disk) are read-only health facts at the same sensitivity tier as
+  // the browse-level grants, and the Star Map surface that polls them
+  // already rides thread_navigation for its event class. A dedicated
+  // capability would buy no isolation and cost every peer a handshake
+  // re-advertisement.
+  [FEDERATION_BACKEND_METHODS.getLoadStatus]: "thread_navigation",
+  [FEDERATION_BACKEND_METHODS.trustCodexProject]: "environment_actions",
+  // Celestial icon overrides are directed at the gateway (the assignment
+  // coordinator). No dedicated capability exists for federation-level
+  // cosmetic state; thread_navigation is the least-privileged grant every
+  // browsing peer already holds.
+  [FEDERATION_BACKEND_METHODS.setCelestialIcon]: "thread_navigation",
+  // Short-name overrides go to the gateway for the same reason, under the
+  // same least-privileged grant.
+  [FEDERATION_BACKEND_METHODS.setFederationShortName]: "thread_navigation",
+  // Intake creates a thread and starts its first turn on the owning
+  // instance — the same trust the materialize-launchpad path carries.
+  [FEDERATION_BACKEND_METHODS.starMapIntake]: "environment_actions"
+};
 export {
   AgentToolRouter,
+  FEDERATION_BACKEND_METHOD_CAPABILITIES,
   FEDERATION_CLOSE_REPLACED_CODE,
   FEDERATION_CLOSE_REVOKED_CODE,
   FEDERATION_INVITE_VERSION,
@@ -19547,6 +20165,7 @@ export {
   decodeFederationInvite,
   encodeFederationInvite,
   federationTransportCodecForTest,
+  fitThreadReplayWithinByteBudget,
   generateFederationIdentityKeyPair,
   generateFederationNoiseStaticKeyPair,
   generateNoiseStaticKeyPair,
@@ -19558,6 +20177,7 @@ export {
   mergeCausalMessagingContext,
   noiseKeyPairFromRawPrivate,
   noisePublicKeyBase64FromPrivateBase64,
+  pageThreadReplay,
   publicKeyPemFromPrivateKey,
   pushFederationFile,
   rawPrivateKey,
@@ -19566,6 +20186,7 @@ export {
   registerFederationPtyHandlers,
   registerFilePushHandlers,
   resolveMessagingOutboundFile,
+  shortenDerivedThreadTitle,
   signFederationMessage,
   validateMessagingFileMetadata,
   verifyFederationMessageSignature,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pwragent",
-  "version": "1.3.8",
+  "version": "1.3.10",
   "private": false,
   "type": "module",
   "description": "Experimental headless PwrAgent daemon and command-line client.",
@@ -53,7 +53,7 @@
   "devDependencies": {
     "@pwragent/federation": "workspace:*",
     "@pwragent/shared": "workspace:*",
-    "esbuild": "0.28.1",
+    "esbuild": "0.28.2",
     "@pwragent/agent-tools": "workspace:*"
   },
   "dependencies": {
@@ -63,7 +63,7 @@
     "node-pty"
   ],
   "pwragentRelease": {
-    "tag": "v1.3.8",
-    "commit": "76f9b95a24db2bc64d9a444805da009974bcbccb"
+    "tag": "v1.3.10",
+    "commit": "ff9b702144786e162b3e91c78d79791761944350"
   }
 }

package/src/cli.js

@@ -6,6 +6,7 @@ import { setTimeout as delay } from "node:timers/promises";
 import { call } from "./client.js";
 import { serve } from "./daemon.js";
 import { ACTIVE } from "./store.js";
+import { formatVersion, installedVersion, packageVersion, restartRequired } from "./version.js";
 
 const help = `PwrAgent Headless (experimental, Linux/macOS, Node >=22)
 
@@ -16,6 +17,7 @@ const help = `PwrAgent Headless (experimental, Linux/macOS, Node >=22)
   pwragent project-add|project-remove --path /workspace/project
   pwragent git-auth-configure --config-file /outpost/git-auth-settings.json
   pwragent status | list
+  pwragent --version | version
   pwragent submit --id JOB --prompt-file /task.txt [--sandbox read-only|workspace-write]
                   [--model MODEL] [--thread THREAD_ID] [--cwd /workspace/project]
   pwragent show|read|interrupt|wait --id JOB
@@ -36,6 +38,7 @@ No provisioning, login, queue, automatic replay, or local messaging providers.
 export async function main(args) {
   const { values, positionals } = parseArgs({ args, allowPositionals: true, strict: true, options: {
     help: { type: "boolean", short: "h" },
+    version: { type: "boolean" },
     profile: { type: "string" },
     workspace: { type: "string" },
     "codex-home": { type: "string" },
@@ -52,7 +55,9 @@ export async function main(args) {
     peer: { type: "string" },
     name: { type: "string" }, remote: { type: "string" }, path: { type: "string" }, cwd: { type: "string" }, "config-file": { type: "string" },
   } });
-  if (values.help || !positionals.length) { console.log(help); return 0; }
+  if (values.help) { console.log(help); return 0; }
+  if (values.version) { console.log(formatVersion(packageVersion())); return 0; }
+  if (!positionals.length) { console.log(help); return 0; }
   if (positionals.length !== 1) throw new Error("Expected one command; see --help");
   const command = positionals[0];
   const allowed = {
@@ -60,7 +65,7 @@ export async function main(args) {
     submit: ["id", "prompt-file", "thread", "model", "sandbox", "cwd"],
     "project-list": [], "project-create": ["name", "label"], "project-clone": ["name", "remote", "label"],
     "project-add": ["path", "label"], "project-remove": ["path"], "git-auth-configure": ["config-file"],
-    show: ["id"], read: ["id"], interrupt: ["id"], wait: ["id"], status: [], list: [],
+    show: ["id"], read: ["id"], interrupt: ["id"], wait: ["id"], status: [], list: [], version: [],
     "federation-join": ["invite-file", "gateway", "label"],
     "federation-invite": ["port", "label"],
     "federation-status": [], "federation-leave": [], "federation-revoke": ["peer"],
@@ -69,6 +74,7 @@ export async function main(args) {
   for (const option of Object.keys(values)) {
     if (option !== "profile" && !allowed[command].includes(option)) throw new Error(`--${option} does not apply to ${command}`);
   }
+  if (command === "version") { console.log(JSON.stringify(packageVersion())); return 0; }
   const profile = values.profile || process.env.PWRAGENT_PROFILE || "default";
   if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(profile)) throw new Error("Invalid profile name");
   const root = process.env.PWRAGENT_HOME || path.join(homedir(), ".pwragent");
@@ -118,6 +124,12 @@ export async function main(args) {
       await delay(1000);
     }
   }
+  if (command === "status") {
+    const status = await call(directory, "status", {});
+    const installed = installedVersion();
+    console.log(JSON.stringify({ ...status, installed, restartRequired: restartRequired(status.running, installed) }));
+    return 0;
+  }
   console.log(JSON.stringify(await call(directory, command, { id: values.id })));
   return 0;
 }

package/src/daemon.js

@@ -116,7 +116,7 @@ export async function serve({ directory, workspace, home, command, profile }) {
     });
     if (shutdown) { server.close(); return await done; }
     server.on("error", (error) => { void stop(error); });
-    console.log(JSON.stringify({ ready: true, socket: socketPath, pid: process.pid }));
+    console.log(JSON.stringify({ ready: true, socket: socketPath, pid: process.pid, running: runtime.running }));
     return await done;
   } catch (error) {
     await stop(error);

package/src/federation-backend.js

@@ -1,16 +1,32 @@
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import path from "node:path";
-import { mergeCausalMessagingContext } from "../dist/federation-core.js";
+import { FEDERATION_BACKEND_METHOD_CAPABILITIES, FEDERATION_MAX_FRAME_BYTES, fitThreadReplayWithinByteBudget, mergeCausalMessagingContext, pageThreadReplay, shortenDerivedThreadTitle } from "../dist/federation-core.js";
 import { ACTIVE, atomicJson, digest } from "./store.js";
 
-export const METHOD_CAPABILITIES = Object.fromEntries([
-  ["backend.resolveThreadAdmissionState", "messaging_route"],
-  ["backend.supportsMessagingPdfTools", "messaging_route"],
-  ...["getNavigationQueryPage", "getNavigationLaunchpadConfig", "getNavigationSelectedDetail", "getNavigationQueueProjection", "releaseNavigationAttentionView", "listThreads", "listBackends", "resolveThread", "markThreadSeen", "getProjectPage", "lookupArchivedThreads"].map((method) => [`backend.${method}`, "thread_navigation"]),
-  ...["readThread", "readTurnAssistantReply", "listSkills", "listThreadMcpServers"].map((method) => [`backend.${method}`, "thread_detail"]),
-  ...["startThread", "materializeDirectoryLaunchpad", "startTurn", "interruptTurn", "steerTurn", "controlActiveTurn", "renameThread", "setThreadModelSettings", "setThreadExecutionMode"].map((method) => [`backend.${method}`, "turn_control"]),
-]);
+// The owner methods this outpost serves. Each one's capability comes from the
+// shared owner contract, so a grant means the same here as on desktop.
+const OWNER_METHODS = [
+  "resolveThreadAdmissionState", "supportsMessagingPdfTools",
+  "getNavigationQueryPage", "getNavigationLaunchpadConfig", "getNavigationSelectedDetail", "getNavigationQueueProjection",
+  "releaseNavigationAttentionView", "listThreads", "listBackends", "resolveThread", "markThreadSeen", "getProjectPage", "lookupArchivedThreads",
+  "readThread", "readTurnAssistantReply", "listSkills", "listThreadMcpServers",
+  "startThread", "materializeDirectoryLaunchpad", "startTurn", "interruptTurn", "steerTurn", "controlActiveTurn", "renameThread",
+  "setThreadModelSettings", "setThreadExecutionMode",
+];
+export function ownerMethodCapabilities(methods, contract = FEDERATION_BACKEND_METHOD_CAPABILITIES) {
+  return Object.fromEntries(methods.map((name) => {
+    const method = `backend.${name}`;
+    if (!Object.hasOwn(contract, method)) throw new Error(`${method} is not in the shared owner contract`);
+    return [method, contract[method]];
+  }));
+}
+export const METHOD_CAPABILITIES = ownerMethodCapabilities(OWNER_METHODS);
+
+// The placeholder title desktop gives a new thread. Viewers recognize this
+// exact text as "no name yet".
+export const PLACEHOLDER_THREAD_TITLE = "Untitled thread";
+const LEGACY_PLACEHOLDER_THREAD_TITLE = "New outpost thread";
 
 function mode(sandbox) { return sandbox === "workspace-write" ? "auto" : "default"; }
 function sandboxFor(params, fallback = "read-only") {
@@ -33,12 +49,16 @@ export class HeadlessBackend {
     this.runtime = runtime;
     this.publish = publish;
     this.epoch = randomUUID();
+    // Same headroom as desktop's FEDERATION_RESPONSE_BYTE_BUDGET.
+    this.replayByteBudget = FEDERATION_MAX_FRAME_BYTES - 64 * 1024;
     this.attentionViews = new Map();
     this.file = path.join(path.dirname(runtime.store.directory), "threads.json");
     try {
       const data = JSON.parse(readFileSync(this.file, "utf8"));
       if (data.version !== 1 || !Array.isArray(data.threads)) throw new Error("Invalid headless thread registry");
-      this.threads = new Map(data.threads.map((thread) => [thread.id, thread]));
+      this.threads = new Map(data.threads.map((thread) => [thread.id,
+        thread.titleSource === "fallback" && thread.title === LEGACY_PLACEHOLDER_THREAD_TITLE
+          ? { ...thread, title: PLACEHOLDER_THREAD_TITLE } : thread]));
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
       this.threads = new Map();
@@ -94,6 +114,10 @@ export class HeadlessBackend {
   }
 
   event(message) {
+    if (message.method === "headless/turnStarted") {
+      this.titleFromFirstPrompt(message.params);
+      return;
+    }
     if (message.method === "headless/jobChanged") {
       this.syncJobs([message.params]);
       if (message.params.threadId) this.forgetSeenAttentionMember(message.params.threadId);
@@ -149,7 +173,14 @@ export class HeadlessBackend {
         const messages = history.replay.messages.filter((message) => message.role === "assistant" && message.turn?.id === params.turnId);
         return { message: messages.find((message) => params.itemId ? message.id === params.itemId : message.text === params.text) || null };
       }
-      case "readThread": return this.readThread(params.threadId);
+      case "readThread": {
+        // Viewers take the newest page as returned. Page and fit it to one
+        // frame here, as desktop owners do.
+        const history = await this.readThread(params.threadId);
+        return { ...history, replay: fitThreadReplayWithinByteBudget({ cursorIdSpace: "entry-id",
+          replay: pageThreadReplay(history.replay, params), maxBytes: this.replayByteBudget,
+          measureBytes: (replay) => Buffer.byteLength(JSON.stringify({ ...history, replay }), "utf8") }) };
+      }
       case "supportsMessagingPdfTools": return params.backend === "codex" && this.owned(params.threadId).messagingFileTools === true;
       case "startThread": return this.startThread(params);
       case "materializeDirectoryLaunchpad": return this.materializeLaunchpad(params, envelope);
@@ -186,9 +217,8 @@ export class HeadlessBackend {
         const thread = this.owned(params.threadId);
         const title = params.title || params.name;
         if (typeof title !== "string" || !title.trim() || title.length > 200) throw new Error("Invalid title");
-        Object.assign(thread, { title: title.trim(), titleSource: "explicit", updatedAt: Date.now() });
-        this.persist();
-        this.invalidate(thread.id);
+        thread.updatedAt = Date.now();
+        this.setTitle(thread, title.trim(), "explicit");
         return { backend: "codex", threadId: thread.id, title: thread.title };
       }
       case "markThreadSeen": {
@@ -196,13 +226,18 @@ export class HeadlessBackend {
         for (const key of ["seenAt", "seenUpdatedAt"]) {
           if (params[key] !== undefined && (!Number.isFinite(params[key]) || params[key] < 0)) throw new Error(`Invalid ${key}`);
         }
-        const seenUpdatedAt = params.seenUpdatedAt ?? this.summary(thread).updatedAt;
+        // An omitted watermark keeps the stored one (see MarkThreadSeenRequest).
+        // A thread never given one is pinned to the seenAt it was judged by,
+        // so recording a new seenAt cannot change its unread state.
+        thread.seenUpdatedAt = params.seenUpdatedAt ?? thread.seenUpdatedAt ?? thread.seenAt ?? 0;
         thread.seenAt = params.seenAt ?? Date.now();
-        thread.seenUpdatedAt = seenUpdatedAt;
         this.persist();
         this.forgetSeenAttentionMember(thread.id);
-        this.invalidate(thread.id);
-        return { backend: "codex", threadId: thread.id, seenAt: thread.seenAt, seenUpdatedAt };
+        this.publish({ backend: "codex", notification: { method: "navigation/thread/seen",
+          params: { threadId: thread.id, ...(params.seenUpdatedAt !== undefined ? { seenUpdatedAt: params.seenUpdatedAt } : {}) } } }, "transcript");
+        this.invalidate(thread.id, "navigation/thread/seen");
+        return { backend: "codex", threadId: thread.id, seenAt: thread.seenAt,
+          ...(params.seenUpdatedAt !== undefined ? { seenUpdatedAt: params.seenUpdatedAt } : {}) };
       }
       case "setThreadExecutionMode": {
         const thread = this.owned(params.threadId);
@@ -226,7 +261,35 @@ export class HeadlessBackend {
     }
   }
 
-  invalidate(threadId) { this.publish({ backend: "codex", notification: { method: "navigation/invalidated", params: { threadId } } }, "navigation"); }
+  invalidate(threadId, sourceMethod) {
+    this.publish({ backend: "codex", notification: { method: "navigation/invalidated", params: { threadId, ...(sourceMethod ? { sourceMethod } : {}) } } }, "navigation");
+  }
+
+  // threads.json is the only store for a title. The outpost never sets the
+  // Codex thread name.
+  setTitle(thread, title, titleSource) {
+    Object.assign(thread, { title, titleSource });
+    this.persist();
+    this.publish({ backend: "codex", notification: { method: "thread/name/updated",
+      params: { threadId: thread.id, threadName: title, titleSource } } }, "transcript");
+    this.invalidate(thread.id, "thread/name/updated");
+  }
+
+  // The outpost has no helper model, so a thread is named as desktop first
+  // names one: the shortened first user message. Any rename wins over it.
+  deriveTitle(id, text) {
+    const thread = this.threads.get(id);
+    if (!thread || thread.archived || thread.titleSource !== "fallback" || typeof text !== "string") return;
+    const title = shortenDerivedThreadTitle(text)?.slice(0, 200);
+    if (title) this.setTitle(thread, title, "derived");
+  }
+
+  titleFromFirstPrompt({ threadId, jobId, prompt }) {
+    // A later turn is not the first message. readThread names that thread
+    // from Codex's preview instead.
+    const earlier = [...this.runtime.store.jobs.values()].some((job) => job.threadId === threadId && job.id !== jobId && job.turnId);
+    if (!earlier) this.deriveTitle(threadId, prompt);
+  }
 
   async materializeLaunchpad(params, envelope) {
     const cwd = this.runtime.projects.resolve(params.directoryKey);
@@ -264,11 +327,11 @@ export class HeadlessBackend {
       const result = await this.runtime.codex.request("thread/start", { cwd, dynamicTools: this.runtime.messagingTools.buildDynamicToolSpecs(), approvalPolicy: "never", sandbox, ...(params.model ? { model: params.model } : {}), ephemeral: false });
       if (!result?.thread?.id || typeof result.thread.id !== "string" || result.thread.id.length > 256) throw new Error("Invalid thread/start response");
       this.runtime.loadedThreads.add(result.thread.id);
-      const thread = { id: result.thread.id, messagingFileTools: true, title: "New outpost thread", titleSource: "fallback", createdAt: Date.now(), cwd, sandbox,
+      const thread = { id: result.thread.id, messagingFileTools: true, title: PLACEHOLDER_THREAD_TITLE, titleSource: "fallback", createdAt: Date.now(), cwd, sandbox,
         model: params.model, reasoningEffort: params.reasoningEffort, serviceTier: params.serviceTier };
       this.threads.set(thread.id, thread);
       this.persist();
-      this.invalidate(thread.id);
+      this.invalidate(thread.id, "thread/started");
       return { backend: "codex", threadId: thread.id, executionMode: mode(sandbox) };
     } finally { this.creating = false; }
   }
@@ -328,6 +391,9 @@ export class HeadlessBackend {
       }
     }
     const messages = entries.filter((entry) => entry.type === "message");
+    // Names threads created before derived titles, and imported threads.
+    this.deriveTitle(id, typeof result.thread?.preview === "string" && result.thread.preview.trim()
+      ? result.thread.preview : messages.find((item) => item.role === "user")?.text);
     return { backend: "codex", threadId: id, fetchedAt: Date.now(), threadStatus: this.summary(this.owned(id)).threadStatus,
       replay: { entries, messages, lastUserMessage: messages.filter((item) => item.role === "user").at(-1)?.text,
         lastAssistantMessage: messages.filter((item) => item.role === "assistant").at(-1)?.text,

package/src/federation-core.ts

@@ -16,9 +16,10 @@ export * from "@pwragent/federation/git-instance-handoff";
 export * from "@pwragent/federation/federation-file-push";
 
 export { AgentToolRouter } from "@pwragent/agent-tools/agent-tool-router";
-export { mergeCausalMessagingContext } from "@pwragent/shared";
+export { fitThreadReplayWithinByteBudget, mergeCausalMessagingContext, pageThreadReplay, shortenDerivedThreadTitle } from "@pwragent/shared";
 export { authenticateMessageOrigin } from "@pwragent/federation/federation-message-origin";
 
 export { resolveMessagingOutboundFile, validateMessagingFileMetadata } from "@pwragent/agent-tools/messaging-outbound-file";
 
 export * from "@pwragent/federation/federation-replacement-receiver";
+export { FEDERATION_BACKEND_METHOD_CAPABILITIES } from "@pwragent/federation/federation-backend-methods";

package/src/handoffs.js

@@ -77,7 +77,9 @@ export function setupHandoffs(federation, directory) {
         const file = await runtime.codex.request("fs/readFile", { path: result.thread.path });
         if (typeof file.dataBase64 !== "string") throw new Error("Codex protocol thread export is unavailable");
         return { rolloutBase64: file.dataBase64, replay: (await backend.readThread(id)).replay,
-          cwd: runtime.projects.resolve(owned.cwd || runtime.workspace), title: owned.title };
+          cwd: runtime.projects.resolve(owned.cwd || runtime.workspace),
+          // A placeholder would become the destination's explicit name.
+          ...(owned.titleSource === "fallback" ? {} : { title: owned.title }) };
       },
       forkThread: async (request) => {
         if (runtime.active || backend.creating) throw new Error("Outpost is busy");

package/src/runtime.js

@@ -3,12 +3,16 @@ import path from "node:path";
 import { readFileSync, readdirSync } from "node:fs";
 import { AgentToolRouter, buildPwrAgentMessagingToolDefinitions, readPwrAgentMessagingDynamicToolCall, resolveMessagingOutboundFile, validateMessagingFileMetadata, FILE_PUSH_MAX_BYTES } from "../dist/federation-core.js";
 import { Codex } from "./codex.js";
+import { installedVersion } from "./version.js";
 import { ACTIVE, atomicJson, digest, privateDirectory, validId } from "./store.js";
 
 export class Runtime {
   constructor({ store, workspace, home, command, onFailure }) {
     this.store = store;
     this.workspace = workspace;
+    // Snapshot at startup: upgrading the package files does not change the
+    // code this process is running.
+    this.running = installedVersion();
     this.projects = new OutpostProjects(path.dirname(store.directory), workspace);
     this.messagingTools = new AgentToolRouter(buildPwrAgentMessagingToolDefinitions((request) => this.messagingRequest(request), { nativeDynamicPdfImages: true }));
     this.fileAccess = { privateStorageRoots: [home, process.env.PWRAGENT_HOME].filter(Boolean),
@@ -41,7 +45,7 @@ export class Runtime {
   async handle(method, params = {}) {
     if (this.stopping) throw new Error("Daemon is stopping");
     switch (method) {
-      case "status": return { version: 1, ready: true, pid: process.pid, activeJob: this.active || null, workspace: this.workspace };
+      case "status": return { version: 1, ready: true, pid: process.pid, running: this.running, activeJob: this.active || null, workspace: this.workspace };
       case "project-list": return this.projects.list();
       case "project-create": case "project-clone": return this.projects.create(params);
       case "project-add": return this.projects.add(params);
@@ -151,6 +155,8 @@ export class Runtime {
       return;
     }
     this.save({ ...this.store.get(job.id), turnId: turn.turn.id, status: "running" });
+    // The prompt stays in memory: job records never store it.
+    this.onEvent?.({ method: "headless/turnStarted", params: { threadId: result.thread.id, jobId: job.id, prompt } });
     if (this.earlyCompletion?.turn?.id === turn.turn.id) {
       this.complete(this.earlyCompletion);
     } else if (["completed", "failed", "interrupted"].includes(turn.turn.status)) {

package/src/version.js

@@ -0,0 +1,36 @@
+import { readFileSync } from "node:fs";
+
+// The release writes pwragentRelease: { tag, commit } into the published
+// manifest. A checkout has none, so only string fields are reported.
+export function versionInfo(pkg) {
+  const source = pkg.pwragentRelease;
+  const release = {};
+  if (typeof source?.tag === "string") release.tag = source.tag;
+  if (typeof source?.commit === "string") release.commit = source.commit;
+  return { name: pkg.name, version: pkg.version, ...(Object.keys(release).length ? { release } : {}) };
+}
+
+// Read on each call from this package's own manifest, so the CLI reports the
+// files currently installed. The daemon reads it once at startup instead.
+export function packageVersion() {
+  return versionInfo(JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")));
+}
+
+// The version fields that status compares, without the package name.
+export function installedVersion() {
+  const { name: _name, ...fields } = packageVersion();
+  return fields;
+}
+
+export function formatVersion({ name, version, release }) {
+  const details = [release?.tag, release?.commit && `commit ${release.commit}`].filter(Boolean);
+  return details.length ? `${name} ${version} (${details.join(", ")})` : `${name} ${version}`;
+}
+
+// A daemon that predates version reporting returns no running version. It is
+// older than this installation, so it needs a restart too.
+export function restartRequired(running, installed) {
+  return !running
+    || running.version !== installed.version
+    || running.release?.commit !== installed.release?.commit;
+}