toolroll 0.9.36 → 0.9.38

package/dist/contracts/chat-tables.js

@@ -0,0 +1,136 @@
+/**
+ * The Slack, Discord and Teams receipt tables (chat-delivery-state.ts keeps their rows). A leaf: it imports nothing, so
+ * the store can create these tables without loading the chat state modules that themselves import the store.
+ */
+const CHAT_SCHEMA = `
+CREATE TABLE IF NOT EXISTS chat_binding (
+ id INTEGER PRIMARY KEY AUTOINCREMENT, installation TEXT NOT NULL,
+ team TEXT NOT NULL, app TEXT NOT NULL, member TEXT NOT NULL, channel TEXT NOT NULL,
+ approver TEXT NOT NULL, generation INTEGER NOT NULL, created TEXT NOT NULL, revoked TEXT
+);
+CREATE UNIQUE INDEX IF NOT EXISTS chat_one_binding_member ON chat_binding(installation, member) WHERE revoked IS NULL;
+CREATE TABLE IF NOT EXISTS chat_pair (
+ hash TEXT PRIMARY KEY, installation TEXT NOT NULL, approver TEXT NOT NULL,
+ generation INTEGER NOT NULL, expires TEXT NOT NULL, consumed TEXT
+);
+CREATE TABLE IF NOT EXISTS chat_event (
+ id TEXT PRIMARY KEY, installation TEXT NOT NULL, binding INTEGER REFERENCES chat_binding(id),
+ kind TEXT NOT NULL CHECK(kind IN ('message','action','pair','notice')),
+ channel TEXT NOT NULL, member TEXT NOT NULL, ts TEXT NOT NULL, thread TEXT NOT NULL,
+ payload TEXT NOT NULL, created TEXT NOT NULL,
+ session INTEGER REFERENCES mate_session(id), state TEXT NOT NULL DEFAULT 'queued' CHECK(state IN ('queued','done','dropped')),
+ next_at TEXT, problem TEXT
+);
+CREATE INDEX IF NOT EXISTS chat_pending_event ON chat_event(installation,state,next_at);
+CREATE TABLE IF NOT EXISTS chat_part (
+ id INTEGER PRIMARY KEY AUTOINCREMENT, event TEXT NOT NULL REFERENCES chat_event(id), ordinal INTEGER NOT NULL,
+ payload TEXT NOT NULL, state TEXT NOT NULL DEFAULT 'pending' CHECK(state IN ('pending','sent','dropped')),
+ message TEXT, file TEXT, uploaded INTEGER NOT NULL DEFAULT 0, attempts INTEGER NOT NULL DEFAULT 0,
+ uncertain INTEGER NOT NULL DEFAULT 0, next_at TEXT, problem TEXT, created TEXT NOT NULL,
+ UNIQUE(event,ordinal)
+);
+CREATE TABLE IF NOT EXISTS chat_action (
+ token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES chat_part(id),
+ proposal INTEGER NOT NULL REFERENCES mate_proposal(id), phase TEXT NOT NULL CHECK(phase IN ('confirm','dismiss','yes','cancel')),
+ expires TEXT NOT NULL, consumed TEXT
+);
+CREATE TABLE IF NOT EXISTS chat_progress (
+ binding INTEGER NOT NULL REFERENCES chat_binding(id), run INTEGER NOT NULL REFERENCES run(id),
+ part INTEGER NOT NULL REFERENCES chat_part(id), digest TEXT NOT NULL,
+ PRIMARY KEY(binding,run)
+);
+CREATE TABLE IF NOT EXISTS chat_runtime (
+ installation TEXT PRIMARY KEY, owner TEXT, lease_until TEXT, connected TEXT,
+ problem TEXT, retry_at TEXT, notification INTEGER NOT NULL DEFAULT 0
+);
+`;
+/** v73: a chat's place in the shared team conversations — a channel follows one
+ * conversation, a DM may select one. Rows are revoked, never deleted. */
+const CHAT_ROOM_SCHEMA = `
+CREATE TABLE IF NOT EXISTS chat_room (
+ id INTEGER PRIMARY KEY AUTOINCREMENT, installation TEXT NOT NULL, chat TEXT NOT NULL,
+ kind TEXT NOT NULL CHECK(kind IN ('group','private')), conversation TEXT NOT NULL,
+ binding INTEGER NOT NULL REFERENCES chat_binding(id),
+ bound_by TEXT NOT NULL, bound TEXT NOT NULL, cursor INTEGER NOT NULL DEFAULT 0,
+ revoked TEXT, revoked_by TEXT
+);
+CREATE UNIQUE INDEX IF NOT EXISTS chat_room_live ON chat_room(installation, chat) WHERE revoked IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS chat_room_group ON chat_room(conversation) WHERE revoked IS NULL AND kind='group';
+CREATE TABLE IF NOT EXISTS chat_meta (
+ installation TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, updated TEXT NOT NULL,
+ PRIMARY KEY(installation, key)
+);
+`;
+/** v88: flow decisions in the chat app, as on Telegram (telegram-flow.ts).
+ * A button is one opaque token for one visit (card, entry) of one card, on
+ * the part it rides; Edit and Send back open a prompt the person's next
+ * message in their DM answers. */
+const CHAT_FLOW_SCHEMA = `
+CREATE TABLE IF NOT EXISTS chat_flow_action (
+ token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES chat_part(id),
+ card INTEGER NOT NULL REFERENCES flow_card(id), entry INTEGER NOT NULL,
+ action TEXT NOT NULL CHECK(action IN ('approve','edit','send-back')), expires TEXT NOT NULL, consumed TEXT
+);
+CREATE INDEX IF NOT EXISTS chat_flow_action_visit ON chat_flow_action(card, entry);
+CREATE TABLE IF NOT EXISTS chat_flow_prompt (
+ id INTEGER PRIMARY KEY AUTOINCREMENT, binding INTEGER NOT NULL REFERENCES chat_binding(id),
+ card INTEGER NOT NULL REFERENCES flow_card(id), entry INTEGER NOT NULL,
+ mode TEXT NOT NULL CHECK(mode IN ('edit','send-back')), created TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT
+);
+CREATE INDEX IF NOT EXISTS chat_flow_prompt_open ON chat_flow_prompt(binding, consumed);
+`;
+/** A flow's "Person chooses" zone in the chat app (flow-send.ts): one button per option (choice is its index, label its words
+ * when sent) for one visit of one card, on the part it rides. A reply in that notice's thread is the note; chat_flow_note
+ * is "Use this as your note?" Yes / No about one other message (held: its event; words: what it said, kept only until
+ * answered, as an event's own payload is cleared once it is handled), asked once per visit.
+ * Never in CHAT_TABLES: an older database has no such table until this schema creates it. */
+const CHAT_FLOW_CHOICE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS chat_flow_choice (
+ token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES chat_part(id),
+ card INTEGER NOT NULL REFERENCES flow_card(id), entry INTEGER NOT NULL,
+ choice INTEGER NOT NULL, label TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT
+);
+CREATE INDEX IF NOT EXISTS chat_flow_choice_visit ON chat_flow_choice(card, entry);
+CREATE TABLE IF NOT EXISTS chat_flow_note (
+ token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES chat_part(id),
+ card INTEGER NOT NULL REFERENCES flow_card(id), entry INTEGER NOT NULL,
+ held TEXT NOT NULL, words TEXT, answer TEXT NOT NULL CHECK(answer IN ('yes','no')), expires TEXT NOT NULL, consumed TEXT
+);
+CREATE INDEX IF NOT EXISTS chat_flow_note_visit ON chat_flow_note(card, entry);
+`;
+/** v93: a teammate's question in the chat app. One button per option (choice)
+ * and one to answer in words (choice NULL); that one opens a prompt the
+ * person's next message in their DM answers. Never in CHAT_TABLES: an older
+ * database has no such tables until this schema creates them. */
+const CHAT_QUESTION_SCHEMA = `
+CREATE TABLE IF NOT EXISTS chat_question_action (
+ token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES chat_part(id),
+ question INTEGER NOT NULL REFERENCES teammate_question(id), choice TEXT, expires TEXT NOT NULL, consumed TEXT
+);
+CREATE INDEX IF NOT EXISTS chat_question_action_question ON chat_question_action(question);
+CREATE TABLE IF NOT EXISTS chat_question_prompt (
+ id INTEGER PRIMARY KEY AUTOINCREMENT, binding INTEGER NOT NULL REFERENCES chat_binding(id),
+ question INTEGER NOT NULL REFERENCES teammate_question(id), created TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT
+);
+CREATE INDEX IF NOT EXISTS chat_question_prompt_open ON chat_question_prompt(binding, consumed);
+`;
+/** The lead's question to its owner (ask_owner) in the chat app: one button per option (choice is its index) and one for
+ * "Something else" (choice NULL). A tap sends the option as the owner's next message. Never in CHAT_TABLES. */
+const CHAT_ASK_SCHEMA = `
+CREATE TABLE IF NOT EXISTS chat_ask_action (
+ token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES chat_part(id) ON DELETE CASCADE,
+ turn INTEGER NOT NULL, choice INTEGER, expires TEXT NOT NULL, consumed TEXT
+);
+CREATE INDEX IF NOT EXISTS chat_ask_action_turn ON chat_ask_action(turn);
+`;
+const CHAT_TABLES = [
+    "chat_binding",
+    "chat_pair",
+    "chat_event",
+    "chat_part",
+    "chat_action",
+    "chat_progress",
+    "chat_runtime",
+];
+export const chatSchema = (channel) => (CHAT_SCHEMA + CHAT_ROOM_SCHEMA + CHAT_FLOW_SCHEMA + CHAT_FLOW_CHOICE_SCHEMA + CHAT_QUESTION_SCHEMA + CHAT_ASK_SCHEMA).replaceAll("chat_", `${channel}_`);
+export const chatTables = (channel) => CHAT_TABLES.map((name) => name.replace("chat_", `${channel}_`));

package/dist/contracts/coding-context.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The managed context a desktop coding session captures once (`prepareCodingContext` in coding-context.ts): the
+ * frozen text the agent is given, what it was selected from, and the digest that ties the two together. It is saved
+ * inside the session's workspace record and checked again (`verifyCodingContext`) before every resume.
+ *
+ * `metadata` keeps its own `version: 1` because it is part of the digest; its keys are listed in the order the digest
+ * was taken in, so a parsed capture digests exactly as it was saved. Repository identity, digest and the materialized
+ * skill files are checked in plain code after parsing.
+ */
+import { z } from "zod";
+import { type ContractResult } from "./contract.js";
+export declare const codingContextMetadataSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    repo: z.ZodString;
+    identity: z.ZodString;
+    baseRevision: z.ZodString;
+    knowledge: z.ZodObject<{
+        revision: z.ZodInt;
+        selectionSha256: z.ZodString;
+        references: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            title: z.ZodString;
+            path: z.ZodNullable<z.ZodString>;
+            sourceSha: z.ZodNullable<z.ZodString>;
+            sourceRevision: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+        omitted: z.ZodArray<z.ZodObject<{
+            title: z.ZodString;
+            reason: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    skills: z.ZodObject<{
+        revision: z.ZodInt;
+        packages: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            sha256: z.ZodString;
+            skillFile: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    directory: z.ZodNullable<z.ZodString>;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const CODING_CONTEXT_VERSION = 1;
+export declare const codingContextSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    text: z.ZodString;
+    metadata: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        repo: z.ZodString;
+        identity: z.ZodString;
+        baseRevision: z.ZodString;
+        knowledge: z.ZodObject<{
+            revision: z.ZodInt;
+            selectionSha256: z.ZodString;
+            references: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                title: z.ZodString;
+                path: z.ZodNullable<z.ZodString>;
+                sourceSha: z.ZodNullable<z.ZodString>;
+                sourceRevision: z.ZodNullable<z.ZodString>;
+            }, z.core.$strict>>;
+            omitted: z.ZodArray<z.ZodObject<{
+                title: z.ZodString;
+                reason: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        skills: z.ZodObject<{
+            revision: z.ZodInt;
+            packages: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                sha256: z.ZodString;
+                skillFile: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        directory: z.ZodNullable<z.ZodString>;
+        files: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            sha256: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    sha256: z.ZodString;
+}, z.core.$strict>;
+export type CodingContextMetadata = z.infer<typeof codingContextMetadataSchema>;
+export type CodingContext = z.infer<typeof codingContextSchema>;
+/**
+ * A capture saved before the envelope carried `version` (every session through 0.9.36), as version 1. Readers then
+ * read only these three fields; the metadata is kept exactly as saved, since its bytes are what the digest covers.
+ */
+export declare function upgradeUnversionedContext(body: Record<string, unknown>): Record<string, unknown>;
+export declare const CODING_CONTEXT_UPGRADES: {
+    readonly 0: typeof upgradeUnversionedContext;
+};
+/** Read a saved capture: version 1 as itself, an unversioned one upgraded, a newer one refused plainly. */
+export declare function readCodingContext(input: unknown): ContractResult<CodingContext>;

package/dist/contracts/coding-context.js

@@ -0,0 +1,60 @@
+/**
+ * The managed context a desktop coding session captures once (`prepareCodingContext` in coding-context.ts): the
+ * frozen text the agent is given, what it was selected from, and the digest that ties the two together. It is saved
+ * inside the session's workspace record and checked again (`verifyCodingContext`) before every resume.
+ *
+ * `metadata` keeps its own `version: 1` because it is part of the digest; its keys are listed in the order the digest
+ * was taken in, so a parsed capture digests exactly as it was saved. Repository identity, digest and the materialized
+ * skill files are checked in plain code after parsing.
+ */
+import { z } from "zod";
+import { readVersioned, versioned } from "./contract.js";
+export const codingContextMetadataSchema = z.strictObject({
+    version: z.literal(1),
+    repo: z.string(),
+    identity: z.string(),
+    baseRevision: z.string(),
+    knowledge: z.strictObject({
+        revision: z.int(),
+        selectionSha256: z.string(),
+        references: z.array(z.strictObject({
+            id: z.string(),
+            title: z.string(),
+            path: z.string().nullable(),
+            sourceSha: z.string().nullable(),
+            sourceRevision: z.string().nullable(),
+        })),
+        omitted: z.array(z.strictObject({ title: z.string(), reason: z.string() })),
+    }),
+    skills: z.strictObject({
+        revision: z.int(),
+        packages: z.array(z.strictObject({ name: z.string(), sha256: z.string(), skillFile: z.string() })),
+    }),
+    directory: z.string().nullable(),
+    files: z.array(z.strictObject({ path: z.string(), sha256: z.string() })),
+});
+export const CODING_CONTEXT_VERSION = 1;
+export const codingContextSchema = versioned(CODING_CONTEXT_VERSION, {
+    text: z.string(),
+    metadata: codingContextMetadataSchema,
+    /** learningSha of `{ text, metadata }`. */
+    sha256: z.string(),
+});
+const CONTEXT_FIELDS = ["text", "metadata", "sha256"];
+/**
+ * A capture saved before the envelope carried `version` (every session through 0.9.36), as version 1. Readers then
+ * read only these three fields; the metadata is kept exactly as saved, since its bytes are what the digest covers.
+ */
+export function upgradeUnversionedContext(body) {
+    const out = { version: CODING_CONTEXT_VERSION };
+    for (const field of CONTEXT_FIELDS) {
+        if (Object.prototype.hasOwnProperty.call(body, field) && body[field] !== undefined)
+            out[field] = body[field];
+    }
+    return out;
+}
+export const CODING_CONTEXT_UPGRADES = { 0: upgradeUnversionedContext };
+/** Read a saved capture: version 1 as itself, an unversioned one upgraded, a newer one refused plainly. */
+export function readCodingContext(input) {
+    return readVersioned(codingContextSchema, input, CODING_CONTEXT_UPGRADES, { distinguishNull: true });
+}

package/dist/contracts/coding-handoff.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The coding handoff receipt: the immutable terms under which a committed desktop coding session became an ordinary
+ * review task (`coding_handoff.payload`, coding-handoff.ts). Its bytes are hashed and sealed, and its id is the hash of
+ * its terms, so the keys are listed in the order the receipt has always been written in — `version` after the
+ * preview — and a parsed receipt serializes to exactly the bytes it was read from. The saved hash, derived identity,
+ * branch and scope seal are checked in plain code: the hash before parsing, the rest after.
+ */
+import { z } from "zod";
+import { type ContractResult } from "./contract.js";
+export declare const CODING_HANDOFF_VERSION = 1;
+export declare const codingHandoffReceiptSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    repo: z.ZodString;
+    base: z.ZodString;
+    candidate: z.ZodString;
+    title: z.ZodString;
+    originalPrompt: z.ZodString;
+    changedPaths: z.ZodArray<z.ZodString>;
+    version: z.ZodLiteral<1>;
+    identity: z.ZodString;
+    actor: z.ZodString;
+    generation: z.ZodInt;
+    goal: z.ZodString;
+    acceptance: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        statement: z.ZodString;
+        how: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        evidence: z.ZodArray<z.ZodEnum<{
+            "changed-path": "changed-path";
+            check: "check";
+            "manual-review": "manual-review";
+            screenshot: "screenshot";
+        }>>;
+    }, z.core.$strict>>;
+    outOfScope: z.ZodString;
+    id: z.ZodString;
+    taskId: z.ZodString;
+    branch: z.ZodString;
+}, z.core.$strict>;
+export type CodingHandoffReceipt = z.infer<typeof codingHandoffReceiptSchema>;
+/** Read a receipt: version 1 as itself, a newer one refused plainly. Receipts have always carried `version`. */
+export declare function readCodingHandoffReceipt(input: unknown): ContractResult<CodingHandoffReceipt>;
+/** Read a receipt's saved bytes: JSON first, then the schema. */
+export declare function parseCodingHandoffReceipt(raw: string): ContractResult<CodingHandoffReceipt>;

package/dist/contracts/coding-handoff.js

@@ -0,0 +1,47 @@
+/**
+ * The coding handoff receipt: the immutable terms under which a committed desktop coding session became an ordinary
+ * review task (`coding_handoff.payload`, coding-handoff.ts). Its bytes are hashed and sealed, and its id is the hash of
+ * its terms, so the keys are listed in the order the receipt has always been written in — `version` after the
+ * preview — and a parsed receipt serializes to exactly the bytes it was read from. The saved hash, derived identity,
+ * branch and scope seal are checked in plain code: the hash before parsing, the rest after.
+ */
+import { z } from "zod";
+import { readVersioned } from "./contract.js";
+import { acceptanceCriterionSchema } from "./plan.js";
+export const CODING_HANDOFF_VERSION = 1;
+export const codingHandoffReceiptSchema = z.strictObject({
+    sessionId: z.string(),
+    repo: z.string(),
+    base: z.string(),
+    candidate: z.string(),
+    title: z.string(),
+    /** The session's first message, as the person wrote it. */
+    originalPrompt: z.string(),
+    changedPaths: z.array(z.string()),
+    version: z.literal(CODING_HANDOFF_VERSION),
+    identity: z.string(),
+    actor: z.string(),
+    generation: z.int(),
+    goal: z.string(),
+    acceptance: z.array(acceptanceCriterionSchema),
+    outOfScope: z.string(),
+    /** The first 32 hex of learningSha over every field above, in this order. */
+    id: z.string(),
+    taskId: z.string(),
+    branch: z.string(),
+});
+/** Read a receipt: version 1 as itself, a newer one refused plainly. Receipts have always carried `version`. */
+export function readCodingHandoffReceipt(input) {
+    return readVersioned(codingHandoffReceiptSchema, input, {}, { distinguishNull: true });
+}
+/** Read a receipt's saved bytes: JSON first, then the schema. */
+export function parseCodingHandoffReceipt(raw) {
+    let body;
+    try {
+        body = JSON.parse(raw);
+    }
+    catch {
+        return { ok: false, issues: [{ path: "payload", kind: "invalid", line: "payload: not JSON" }] };
+    }
+    return readCodingHandoffReceipt(body);
+}

package/dist/contracts/coding-workspace.d.ts

@@ -0,0 +1,165 @@
+/**
+ * The workspace record: one desktop coding session as the coding catalog saves it (`coding_session.document`). The
+ * session itself is what the console, chat and the coding handoff read; the record is that session with its
+ * `version`. Row ownership, generation and recovery state are checked in plain code by the workspace after parsing.
+ */
+import { z } from "zod";
+import { type ContractResult } from "./contract.js";
+export declare const CODING_STATUSES: readonly ["starting", "ready", "working", "needs-input", "stopping", "interrupted", "failed", "uncertain", "closed"];
+export declare const codingSessionSchema: z.ZodObject<{
+    id: z.ZodString;
+    owner: z.ZodString;
+    generation: z.ZodInt;
+    repo: z.ZodString;
+    title: z.ZodString;
+    provider: z.ZodLiteral<"codex">;
+    model: z.ZodNullable<z.ZodString>;
+    branch: z.ZodString;
+    base: z.ZodString;
+    worktree: z.ZodString;
+    nativeThreadId: z.ZodNullable<z.ZodString>;
+    turnId: z.ZodNullable<z.ZodString>;
+    status: z.ZodEnum<{
+        closed: "closed";
+        failed: "failed";
+        interrupted: "interrupted";
+        "needs-input": "needs-input";
+        ready: "ready";
+        starting: "starting";
+        stopping: "stopping";
+        uncertain: "uncertain";
+        working: "working";
+    }>;
+    error: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    deliveryReviewRequired: z.ZodOptional<z.ZodBoolean>;
+    initialRequest: z.ZodOptional<z.ZodObject<{
+        requestId: z.ZodString;
+        prompt: z.ZodString;
+    }, z.core.$strict>>;
+    context: z.ZodOptional<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        text: z.ZodString;
+        metadata: z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            repo: z.ZodString;
+            identity: z.ZodString;
+            baseRevision: z.ZodString;
+            knowledge: z.ZodObject<{
+                revision: z.ZodInt;
+                selectionSha256: z.ZodString;
+                references: z.ZodArray<z.ZodObject<{
+                    id: z.ZodString;
+                    title: z.ZodString;
+                    path: z.ZodNullable<z.ZodString>;
+                    sourceSha: z.ZodNullable<z.ZodString>;
+                    sourceRevision: z.ZodNullable<z.ZodString>;
+                }, z.core.$strict>>;
+                omitted: z.ZodArray<z.ZodObject<{
+                    title: z.ZodString;
+                    reason: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+            skills: z.ZodObject<{
+                revision: z.ZodInt;
+                packages: z.ZodArray<z.ZodObject<{
+                    name: z.ZodString;
+                    sha256: z.ZodString;
+                    skillFile: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+            directory: z.ZodNullable<z.ZodString>;
+            files: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                sha256: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const CODING_SESSION_VERSION = 1;
+export declare const codingSessionRecordSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    id: z.ZodString;
+    owner: z.ZodString;
+    generation: z.ZodInt;
+    repo: z.ZodString;
+    title: z.ZodString;
+    provider: z.ZodLiteral<"codex">;
+    model: z.ZodNullable<z.ZodString>;
+    branch: z.ZodString;
+    base: z.ZodString;
+    worktree: z.ZodString;
+    nativeThreadId: z.ZodNullable<z.ZodString>;
+    turnId: z.ZodNullable<z.ZodString>;
+    status: z.ZodEnum<{
+        closed: "closed";
+        failed: "failed";
+        interrupted: "interrupted";
+        "needs-input": "needs-input";
+        ready: "ready";
+        starting: "starting";
+        stopping: "stopping";
+        uncertain: "uncertain";
+        working: "working";
+    }>;
+    error: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    deliveryReviewRequired: z.ZodOptional<z.ZodBoolean>;
+    initialRequest: z.ZodOptional<z.ZodObject<{
+        requestId: z.ZodString;
+        prompt: z.ZodString;
+    }, z.core.$strict>>;
+    context: z.ZodOptional<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        text: z.ZodString;
+        metadata: z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            repo: z.ZodString;
+            identity: z.ZodString;
+            baseRevision: z.ZodString;
+            knowledge: z.ZodObject<{
+                revision: z.ZodInt;
+                selectionSha256: z.ZodString;
+                references: z.ZodArray<z.ZodObject<{
+                    id: z.ZodString;
+                    title: z.ZodString;
+                    path: z.ZodNullable<z.ZodString>;
+                    sourceSha: z.ZodNullable<z.ZodString>;
+                    sourceRevision: z.ZodNullable<z.ZodString>;
+                }, z.core.$strict>>;
+                omitted: z.ZodArray<z.ZodObject<{
+                    title: z.ZodString;
+                    reason: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+            skills: z.ZodObject<{
+                revision: z.ZodInt;
+                packages: z.ZodArray<z.ZodObject<{
+                    name: z.ZodString;
+                    sha256: z.ZodString;
+                    skillFile: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+            directory: z.ZodNullable<z.ZodString>;
+            files: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                sha256: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type CodingStatus = z.infer<typeof codingSessionSchema>["status"];
+export type CodingSession = z.infer<typeof codingSessionSchema>;
+/**
+ * Unversioned records were read as a cast, including partial fields, nulls and unknown nested keys. Preserve that
+ * boundary exactly; only records explicitly written as version 1 are subject to its strict schema.
+ */
+export declare function readCodingSessionRecord(input: unknown): ContractResult<CodingSession>;
+/** Read a saved `coding_session.document`, throwing a path-named refusal; the catalog was written by Toolroll alone. */
+export declare function parseCodingSessionDocument(document: string): CodingSession;
+/** Stamp the current version only if the entire record fits, without dropping any legacy fields. */
+export declare function codingSessionDocument(session: CodingSession): string;

package/dist/contracts/coding-workspace.js

@@ -0,0 +1,71 @@
+/**
+ * The workspace record: one desktop coding session as the coding catalog saves it (`coding_session.document`). The
+ * session itself is what the console, chat and the coding handoff read; the record is that session with its
+ * `version`. Row ownership, generation and recovery state are checked in plain code by the workspace after parsing.
+ */
+import { z } from "zod";
+import { readVersioned, versioned } from "./contract.js";
+import { CODING_CONTEXT_VERSION, codingContextSchema } from "./coding-context.js";
+export const CODING_STATUSES = ["starting", "ready", "working", "needs-input", "stopping", "interrupted", "failed", "uncertain", "closed"];
+export const codingSessionSchema = z.strictObject({
+    id: z.string(),
+    owner: z.string(),
+    generation: z.int(),
+    repo: z.string(),
+    title: z.string(),
+    provider: z.literal("codex"),
+    model: z.string().nullable(),
+    branch: z.string(),
+    base: z.string(),
+    worktree: z.string(),
+    nativeThreadId: z.string().nullable(),
+    turnId: z.string().nullable(),
+    status: z.enum(CODING_STATUSES),
+    error: z.string().nullable(),
+    createdAt: z.string(),
+    updatedAt: z.string(),
+    /** Set once startup or the last message could not be confirmed; absent on sessions that never needed it. */
+    deliveryReviewRequired: z.boolean().optional(),
+    /** The request the session started with, kept so it is never resent. */
+    initialRequest: z.strictObject({ requestId: z.string(), prompt: z.string() }).optional(),
+    /** Absent when no managed context was captured. */
+    context: codingContextSchema.optional(),
+});
+export const CODING_SESSION_VERSION = 1;
+export const codingSessionRecordSchema = versioned(CODING_SESSION_VERSION, codingSessionSchema.shape);
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+ * Unversioned records were read as a cast, including partial fields, nulls and unknown nested keys. Preserve that
+ * boundary exactly; only records explicitly written as version 1 are subject to its strict schema.
+ */
+export function readCodingSessionRecord(input) {
+    if (isRecord(input) && !Object.prototype.hasOwnProperty.call(input, "version"))
+        return { ok: true, value: input };
+    const read = readVersioned(codingSessionRecordSchema, input, {}, { distinguishNull: true });
+    if (!read.ok)
+        return read;
+    const { version: _version, ...session } = read.value;
+    return { ok: true, value: session };
+}
+/** Read a saved `coding_session.document`, throwing a path-named refusal; the catalog was written by Toolroll alone. */
+export function parseCodingSessionDocument(document) {
+    let body;
+    try {
+        body = JSON.parse(document);
+    }
+    catch {
+        throw Error("A saved coding session could not be read: payload: not JSON");
+    }
+    const read = readCodingSessionRecord(body);
+    if (!read.ok)
+        throw Error(`A saved coding session could not be read: ${read.issues.map(issue => issue.line).join("; ")}`);
+    return read.value;
+}
+/** Stamp the current version only if the entire record fits, without dropping any legacy fields. */
+export function codingSessionDocument(session) {
+    const record = { version: CODING_SESSION_VERSION, ...session };
+    if (isRecord(record.context) && !Object.prototype.hasOwnProperty.call(record.context, "version")) {
+        record.context = { ...record.context, version: CODING_CONTEXT_VERSION };
+    }
+    return JSON.stringify(codingSessionRecordSchema.safeParse(record).success ? record : session);
+}

package/dist/contracts/contract.d.ts

@@ -12,9 +12,12 @@ import { type TextLimitKey } from "../text-limits.js";
  * A string bounded by its TEXT_LIMITS entry, never a literal. The limit rule rides along as the field's description,
  * so a model reads the bound before it writes. Zod counts UTF-16 code units; for a limit named in bytes this is the
  * schema's necessary bound (a string within N bytes is within N code units), and the byte count itself is checked in
- * plain code after parsing.
+ * plain code after parsing. `shorten: false` is for a contract with no shorten turn (a parked decision): its
+ * description states the bound without promising one.
  */
-export declare function limited(field: string, limitKey: TextLimitKey): z.ZodString;
+export declare function limited(field: string, limitKey: TextLimitKey, options?: {
+    shorten?: boolean;
+}): z.ZodString;
 /** A versioned payload envelope: a strict object whose `version` is exactly `version`. */
 export declare function versioned<V extends number, S extends z.ZodRawShape>(version: V, shape: S): z.ZodObject<{
     version: z.ZodLiteral<V>;
@@ -36,6 +39,8 @@ export declare function pathOf(path: readonly PropertyKey[]): string;
  */
 export type ContractOptions = {
     aliases?: Readonly<Record<string, readonly string[]>>;
+    /** Report explicit null as a wrong value; omitted keeps the historical wording for existing contracts. */
+    distinguishNull?: boolean;
 };
 type Where = {
     schema?: z.ZodType;