spexcode 0.7.0-next.6 → 0.7.0-next.8

package/node_modules/@spexcode/session-application/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/session-application",
-  "version": "0.7.0-next.6",
+  "version": "0.7.0-next.8",
   "publishConfig": { "access": "public" },
   "type": "module",
   "description": "Adopter-owned composition of session protocol and topology transactions.",
@@ -16,10 +16,10 @@
     "test": "npm run build && tsx --import ../../scripts/test-home.mjs --test src/*.test.ts"
   },
   "dependencies": {
-    "@spexcode/session-events": "0.7.0-next.6",
-    "@spexcode/session-protocol": "0.7.0-next.6",
-    "@spexcode/session-runtime": "0.7.0-next.6",
-    "@spexcode/session-topology": "0.7.0-next.6"
+    "@spexcode/session-events": "0.7.0-next.8",
+    "@spexcode/session-protocol": "0.7.0-next.8",
+    "@spexcode/session-runtime": "0.7.0-next.8",
+    "@spexcode/session-topology": "0.7.0-next.8"
   },
   "devDependencies": {
     "@types/node": "^20.16.0",

package/node_modules/@spexcode/session-events/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/session-events",
-  "version": "0.7.0-next.6",
+  "version": "0.7.0-next.8",
   "publishConfig": { "access": "public" },
   "type": "module",
   "description": "Append-only session facts and deterministic ordered replay inputs.",
@@ -15,7 +15,7 @@
     "prepublishOnly": "node ../../scripts/release-publish.mjs --from-package-publish",
     "test": "npm run build && tsx --import ../../scripts/test-home.mjs --test src/*.test.ts"
   },
-  "dependencies": { "@spexcode/session-protocol": "0.7.0-next.6" },
+  "dependencies": { "@spexcode/session-protocol": "0.7.0-next.8" },
   "devDependencies": {
     "@types/node": "^20.16.0",
     "tsx": "^4.19.2",

package/node_modules/@spexcode/session-protocol/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/session-protocol",
-  "version": "0.7.0-next.6",
+  "version": "0.7.0-next.8",
   "type": "module",
   "description": "A durable SQLite session message protocol.",
   "files": [

package/node_modules/@spexcode/session-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/session-runtime",
-  "version": "0.7.0-next.6",
+  "version": "0.7.0-next.8",
   "publishConfig": { "access": "public" },
   "type": "module",
   "description": "Adopter-owned bindings between protocol addresses and native runtime identities.",
@@ -15,7 +15,7 @@
     "prepublishOnly": "node ../../scripts/release-publish.mjs --from-package-publish",
     "test": "npm run build && tsx --import ../../scripts/test-home.mjs --test src/*.test.ts"
   },
-  "dependencies": { "@spexcode/session-protocol": "0.7.0-next.6" },
+  "dependencies": { "@spexcode/session-protocol": "0.7.0-next.8" },
   "devDependencies": {
     "@types/node": "^20.16.0",
     "tsx": "^4.19.2",

package/node_modules/@spexcode/session-selflaunch/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/session-selflaunch",
-  "version": "0.7.0-next.6",
+  "version": "0.7.0-next.8",
   "publishConfig": { "access": "public" },
   "type": "module",
   "description": "A fail-closed self-launch adopter for the SpexCode session protocol.",
@@ -24,8 +24,8 @@
     "test": "npm run build && tsx --import ../../scripts/test-home.mjs --test src/*.test.ts"
   },
   "dependencies": {
-    "@spexcode/session-protocol": "0.7.0-next.6",
-    "@spexcode/session-runtime": "0.7.0-next.6"
+    "@spexcode/session-protocol": "0.7.0-next.8",
+    "@spexcode/session-runtime": "0.7.0-next.8"
   },
   "devDependencies": {
     "@types/node": "^20.16.0",

package/node_modules/@spexcode/session-topology/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/session-topology",
-  "version": "0.7.0-next.6",
+  "version": "0.7.0-next.8",
   "publishConfig": { "access": "public" },
   "type": "module",
   "description": "A neutral SQLite relation model for session addresses.",
@@ -15,7 +15,7 @@
     "prepublishOnly": "node ../../scripts/release-publish.mjs --from-package-publish",
     "test": "npm run build && tsx --import ../../scripts/test-home.mjs --test src/*.test.ts"
   },
-  "dependencies": { "@spexcode/session-protocol": "0.7.0-next.6" },
+  "dependencies": { "@spexcode/session-protocol": "0.7.0-next.8" },
   "devDependencies": {
     "@types/node": "^20.16.0",
     "tsx": "^4.19.2",

package/node_modules/@spexcode/spec-cli/dist/harness.d.ts

@@ -206,6 +206,7 @@ export type DispatchResult = {
 };
 export type HarnessDeliveryRecord = {
     session: string;
+    harness?: string;
     stopped?: boolean;
     archived?: boolean;
     worktreePath?: string;

package/node_modules/@spexcode/spec-cli/dist/harness.js

@@ -18,7 +18,8 @@ import { runtimeRoot, mainCheckout, readConfig, sessionArtifactPath, spexcodeHom
 import { git } from '@spexcode/spec-core';
 import { shQuote } from './sh.js';
 import { detachedRuntimeGenerationToken, migrateLegacyDetachedRuntimeReceipt, processStartToken, verifyDetachedRuntime } from '@spexcode/spec-core';
-import { codexGenerationEndpoints, codexGenerationSocketPath, currentCodexGeneration, legacyCodexGenerationEndpoint, readCodexGenerationLedger, prepareCodexGenerationClose, resolveCodexGenerationForClose, resolveCodexGenerationForSession } from './codex-runtime-generations.js';
+import { codexGenerationEndpoints, codexGenerationSocketPath, currentCodexGeneration, legacyCodexGenerationEndpoint, readCodexGenerationLedger, prepareCodexGenerationClose, resolveCodexGenerationForClose, resolveCodexGenerationForResume, resolveCodexGenerationForSession } from './codex-runtime-generations.js';
+import { spawnDetachedRuntime } from './runtime-ownership.js';
 import { writeFileIfChanged } from './file-write.js';
 import { claudeTranscript, codexRolloutPath, codexTranscript, opencodeTranscript, piTranscript, unsupportedTranscript } from '@spexcode/transcript';
 import { harnessIdentity, HARNESS_IDENTITIES } from '@spexcode/spec-core';
@@ -2282,7 +2283,21 @@ async function deliverViaCodexAppServer(rec, text) {
     // the socket is PER-PROJECT (the runtime root), shared by every worktree's thread; the owned thread id on
     // the record picks out THIS session's thread.
     const runtimeDir = rec.runtimeDir ?? runtimeRoot();
-    const endpoint = rec.harnessSessionId ? codexEndpointForRecord(rec, runtimeDir) : currentCodexGeneration(runtimeDir);
+    let endpoint = rec.harnessSessionId ? codexEndpointForRecord(rec, runtimeDir) : currentCodexGeneration(runtimeDir);
+    // A generation may be reclaimed after rotation or a host restart while the session record remains valid.
+    // Repair that stale route at the delivery boundary using the same exact-thread re-pin used by resume, so an
+    // accepted message is not left indefinitely in the queue just because no later human resume was requested.
+    if ((!endpoint || !existsSync(endpoint.socketPath)) && rec.harnessSessionId) {
+        const command = codexBaseCmd(rec.launchCmd || 'codex');
+        const env = { ...process.env };
+        for (const key of sessionIdentityEnvVars())
+            delete env[key];
+        const start = async (candidate) => {
+            await spawnDetachedRuntime({ cwd: runtimeDir, logFile: candidate.logFile, pidFile: candidate.pidFile,
+                receiptFile: candidate.receiptFile, command, args: ['app-server', '--listen', `unix://${candidate.socketPath}`], env });
+        };
+        endpoint = await resolveCodexGenerationForResume(runtimeDir, rec.session, rec.harnessSessionId, start);
+    }
     if (!endpoint)
         return { ok: false, error: `no exact Codex generation binding for session ${rec.session} — immediate poke unavailable` };
     const sock = endpoint.socketPath;
@@ -2297,6 +2312,14 @@ async function deliverViaCodexAppServer(rec, text) {
             return { ok: false, error: `${r.error} — immediate poke unavailable` };
         threadId = r.threadId;
     }
+    const delivered = await sendCodexAppServerTurn(sock, threadId, text, rec.worktreePath, rec.mid);
+    if (delivered.ok || rec.harness !== 'codex-headless' || !/not loaded in the app-server/u.test(delivered.error || ''))
+        return delivered;
+    // Headless Codex has no TUI resume step. An idle thread can be evicted from the shared server's loaded set;
+    // reload the exact rollout, then retry the same turn once. This is idempotent and does not create a new thread.
+    const reopened = await codexReopenThread(sock, threadId);
+    if (!reopened.ok)
+        return { ok: false, error: `${delivered.error}; ${reopened.error}` };
     return sendCodexAppServerTurn(sock, threadId, text, rec.worktreePath, rec.mid);
 }
 // idempotent replace of the content between sentinels; the user's own content above/below is preserved. The

package/node_modules/@spexcode/spec-cli/dist/materialize.js

@@ -1,4 +1,4 @@
-import { writeFileSync, mkdirSync, readFileSync, existsSync, readdirSync, renameSync, rmSync, rmdirSync } from 'node:fs';
+import { writeFileSync, mkdirSync, readFileSync, existsSync, readdirSync, renameSync, rmSync, rmdirSync, copyFileSync, chmodSync } from 'node:fs';
 import { join, dirname, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
@@ -37,6 +37,58 @@ const DISPATCH = join(PKG, 'hooks', 'dispatch.sh');
 // CLI code and keeps the source-workspace mid-merge guard (one line + exit 75), so every hook callback
 // inherits both.
 const SPEX = join(PKG, 'bin', 'spex.mjs');
+const CORE_TEMPLATE = join(PKG, 'templates', 'spec', 'project', '.plugins', 'core');
+// Core hook handlers are shipped executable protocol, not adopter-owned plugin variants. Reconcile only the
+// known `core/` subtree before compiling the manifest so a project seeded by an older toolchain cannot keep
+// invoking a retired lifecycle writer. User plugins live outside this allowlist and are never enumerated.
+function refreshCorePluginHandlers(proj) {
+    if (!existsSync(CORE_TEMPLATE))
+        return [];
+    const specDir = join(proj, '.spec');
+    const roots = existsSync(specDir)
+        ? readdirSync(specDir, { withFileTypes: true })
+            .filter((entry) => entry.isDirectory() && existsSync(join(specDir, entry.name, '.plugins', 'core')))
+            .map((entry) => join(specDir, entry.name, '.plugins', 'core'))
+        : [];
+    const handlers = [];
+    const walk = (dir, prefix = '') => {
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            const rel = join(prefix, entry.name);
+            if (entry.isDirectory())
+                walk(join(dir, entry.name), rel);
+            else if (entry.isFile() && entry.name.endsWith('.sh'))
+                handlers.push(rel);
+        }
+    };
+    walk(CORE_TEMPLATE);
+    const refreshed = [];
+    for (const root of roots)
+        for (const rel of handlers) {
+            const source = join(CORE_TEMPLATE, rel);
+            const dest = join(root, rel);
+            let current = null;
+            try {
+                current = readFileSync(dest);
+            }
+            catch { }
+            if (current?.equals(readFileSync(source)))
+                continue;
+            mkdirSync(dirname(dest), { recursive: true });
+            const temp = `${dest}.spexcode-${process.pid}`;
+            try {
+                copyFileSync(source, temp);
+                chmodSync(temp, 0o755);
+                renameSync(temp, dest);
+                refreshed.push(relative(proj, dest));
+            }
+            finally {
+                rmSync(temp, { force: true });
+            }
+        }
+    if (refreshed.length)
+        console.log(`✓ refreshed core plugin handlers (${refreshed.join(', ')})`);
+    return refreshed;
+}
 // the manifest + content-hash marker + plugin-folder ledger land in the materialized TREE's own slot of the
 // GLOBAL per-project store (layout.treeSlotDir — trees/<enc-worktree>), NOT the worktree and NOT one shared
 // per-project file: each is a pure function of ONE tree's .plugins, and the old single slot let the last-
@@ -321,6 +373,7 @@ export function dematerialize(proj = process.cwd(), arts = { skills: [], agents:
 // the whole pay-per-change materialize. proj defaults to cwd. Its receipt is populated at each successful
 // write so callers report the actual selected footprint instead of maintaining a second artifact inventory.
 export function materialize(proj = process.cwd()) {
+    refreshCorePluginHandlers(proj);
     const rt = treeSlotDir(proj); // this tree's slot in the global store, not the worktree
     mkdirSync(rt, { recursive: true });
     const planted = [];

package/node_modules/@spexcode/spec-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/spec-cli",
-  "version": "0.7.0-next.6",
+  "version": "0.7.0-next.8",
   "type": "module",
   "description": "SpexCode CLI + server. The root spexcode package delegates to this compiled package; dashboard assets live in @spexcode/spec-dashboard.",
   "bin": {
@@ -35,12 +35,12 @@
     "test": "tsx --import ../scripts/test-home.mjs --test src/*.test.ts"
   },
   "dependencies": {
-    "@spexcode/session-application": "0.7.0-next.6",
-    "@spexcode/session-selflaunch": "0.7.0-next.6",
-    "@spexcode/spec-core": "0.7.0-next.6",
-    "@spexcode/spec-eval": "0.7.0-next.6",
-    "@spexcode/spec-forge": "0.7.0-next.6",
-    "@spexcode/transcript": "0.7.0-next.6",
+    "@spexcode/session-application": "0.7.0-next.8",
+    "@spexcode/session-selflaunch": "0.7.0-next.8",
+    "@spexcode/spec-core": "0.7.0-next.8",
+    "@spexcode/spec-eval": "0.7.0-next.8",
+    "@spexcode/spec-forge": "0.7.0-next.8",
+    "@spexcode/transcript": "0.7.0-next.8",
     "smol-toml": "^1.8.0"
   },
   "devDependencies": {

package/node_modules/@spexcode/spec-cli/templates/spec/project/.plugins/skills/merge/spec.md

@@ -19,9 +19,15 @@ Land the current SpexCode session's branch; do not dispatch another merge reques
 3. Immediately before landing, verify
    `git merge-base --is-ancestor <source-head> <session-head>`. If it fails, sync again. A clean textual merge
    is not product proof.
-4. In the source-of-truth checkout, make one `--no-ff` merge of the already-synced session tip. Do not resolve
-   conflicts there. If unrelated dirty work prevents the merge, preserve it byte-for-byte and report the exact
-   overlap rather than forcing, resetting, or committing it.
+4. Land with one `--no-ff` merge of the already-synced session tip, without touching the source checkout's
+   dirty work. Git refuses a merge over a dirty index, so do NOT clear it: add a temporary detached worktree of
+   the source head (`git worktree add --detach <tmp> <source-branch>`), make the `--no-ff` merge there, then
+   fast-forward the source checkout to that commit (`git merge --ff-only <tmp-head>`) and remove the temporary
+   worktree. A fast-forward never rewrites a path the merge did not change, so user-owned dirty files keep
+   their bytes and their staged/unstaged state. Never `git restore`, `reset`, `checkout`, `stash`, or overwrite
+   a user-owned path — an unstaged edit has no blob anywhere, so "save and put back" loses it, and a copy of the
+   same path from another worktree is a different version, not a restoration. Do not resolve conflicts in the
+   source checkout; if the merge genuinely overlaps a user-owned path, stop and report the exact overlap.
 5. Verify the source checkout has no `MERGE_HEAD`, the session tip is its ancestor, unrelated dirty
    fingerprints are unchanged, and the post-merge gates pass. Push the source-of-truth branch only after
    those checks.

package/node_modules/@spexcode/spec-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/spec-core",
-  "version": "0.7.0-next.6",
+  "version": "0.7.0-next.8",
   "type": "module",
   "description": "SpexCode's dependency-minimal spec graph core.",
   "files": [

package/node_modules/@spexcode/spec-eval/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/spec-eval",
-  "version": "0.7.0-next.6",
+  "version": "0.7.0-next.8",
   "type": "module",
   "exports": {
     ".": "./dist/index.js",
@@ -26,7 +26,7 @@
     "test": "tsx --import ../scripts/test-home.mjs --test src/*.test.ts"
   },
   "dependencies": {
-    "@spexcode/spec-core": "0.7.0-next.6"
+    "@spexcode/spec-core": "0.7.0-next.8"
   },
   "devDependencies": {
     "@types/node": "^20.16.0",

package/node_modules/@spexcode/spec-forge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/spec-forge",
-  "version": "0.7.0-next.6",
+  "version": "0.7.0-next.8",
   "type": "module",
   "exports": {
     ".": "./dist/index.js",
@@ -22,7 +22,7 @@
     "test": "tsx --test src/*.test.ts"
   },
   "dependencies": {
-    "@spexcode/spec-core": "0.7.0-next.6"
+    "@spexcode/spec-core": "0.7.0-next.8"
   },
   "devDependencies": {
     "@types/node": "^20.16.0",

package/node_modules/@spexcode/transcript/dist/parsers.js

@@ -50,6 +50,30 @@ const compact = (value) => {
         return String(value);
     }
 };
+// A RESULT IS WHAT THE TOOL SAID, NOT ITS WIRE SHAPE. Every harness that records a result as content blocks
+// (Claude's tool_result content, Codex's input_text output blocks, MCP results everywhere) means the text of
+// those blocks, with their line breaks; encoding the block list itself as JSON would show the reader escaped
+// newlines inside a JSON shell. A block that is not text — an image, a reference — is named, not dumped.
+const resultText = (value) => {
+    if (typeof value === 'string')
+        return value;
+    if (!Array.isArray(value))
+        return compact(value);
+    return value.map((blockValue) => {
+        const block = object(blockValue);
+        if (!block)
+            return compact(blockValue);
+        const text = string(block.text);
+        if (text !== null)
+            return text;
+        const type = string(block.type);
+        if (type === 'image')
+            return '[image]';
+        if (type)
+            return `[${type}]`;
+        return compact(blockValue);
+    }).join('\n');
+};
 const lineCount = (value) => value ? value.split(/\r?\n/).length : 0;
 // --- the seven native shapes -------------------------------------------------------------------------------
 export function claudeEvent(value) {
@@ -82,7 +106,7 @@ export function claudeEvent(value) {
         const outputs = blocks.flatMap((block) => {
             const b = object(block);
             const id = string(b?.tool_use_id);
-            return b?.type === 'tool_result' && id ? [{ id, text: compact(b?.content ?? ''), ...(b?.is_error === true ? { outcome: 'failed' } : {}) }] : [];
+            return b?.type === 'tool_result' && id ? [{ id, text: resultText(b?.content ?? ''), ...(b?.is_error === true ? { outcome: 'failed' } : {}) }] : [];
         });
         if (outputs.length)
             return { at: eventAt, turn: null, toolOutputs: outputs };
@@ -142,7 +166,7 @@ export function codexEvent(value) {
     if (entry.type === 'response_item' && (type === 'custom_tool_call_output' || type === 'function_call_output')) {
         const id = string(payload.call_id ?? payload.id);
         const output = payload.output ?? payload.result ?? '';
-        return id ? { at: eventAt, turn: null, toolOutputs: [{ id, text: compact(output) }] } : null;
+        return id ? { at: eventAt, turn: null, toolOutputs: [{ id, text: resultText(output) }] } : null;
     }
     return null;
 }
@@ -211,7 +235,7 @@ export function codexAppServerEvent(value) {
     if (output === undefined || output === null) {
         return outcome ? { at: eventAt, turn: null, toolOutputs: [{ id, text: '', outcome }] } : { at: eventAt, turn: null };
     }
-    return { at: eventAt, turn: null, toolOutputs: [{ id, text: compact(output), ...(outcome ? { outcome } : {}) }] };
+    return { at: eventAt, turn: null, toolOutputs: [{ id, text: resultText(output), ...(outcome ? { outcome } : {}) }] };
 }
 // Agent-message deltas are fragments of one native item. The closure remembers only that item's text and
 // re-emits its native id, allowing IntervalCollector to replace the earlier turn in place.

package/node_modules/@spexcode/transcript/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/transcript",
-  "version": "0.7.0-next.6",
+  "version": "0.7.0-next.8",
   "type": "module",
   "description": "Normalized agent transcripts: one parser per harness, a bounded interval reader over a native thread file or an in-memory event stream, and the full/delta frame protocol every transport and renderer share.",
   "files": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spexcode",
-  "version": "0.7.0-next.6",
+  "version": "0.7.0-next.8",
   "type": "module",
   "description": "SpexCode — a spec-driven, self-developing dev tool. The `spex` CLI + spec server reads the .spec tree and its git history, and serves the dashboard.",
   "license": "MIT",
@@ -44,7 +44,7 @@
     "prepack": "node scripts/sync-init-plugins.mjs --check && node scripts/prepack.mjs"
   },
   "dependencies": {
-    "@spexcode/spec-cli": "0.7.0-next.6"
+    "@spexcode/spec-cli": "0.7.0-next.8"
   },
   "publishConfig": {
     "access": "public"