usebeeline 0.1.21 → 0.1.23

package/dist/usebeeline.mjs

@@ -13722,7 +13722,38 @@ function squireApprovalFromMcp(request, response) {
   if (!link2)
     return void 0;
   const args = record(params?.arguments) ?? {};
-  return { tool, ...squireApprovalCopy(tool, args), ...link2 };
+  const expiresAt = approvalExpiryIn(response.result);
+  return {
+    tool,
+    ...squireApprovalCopy(tool, args),
+    ...link2,
+    ...expiresAt !== void 0 ? { expiresAt } : {}
+  };
+}
+function approvalExpiryIn(value, depth = 0) {
+  if (depth > 6)
+    return void 0;
+  if (typeof value === "string") {
+    if (value.length > 2e4 || !/^[{[]/.test(value.trim()))
+      return void 0;
+    try {
+      return approvalExpiryIn(JSON.parse(value), depth + 1);
+    } catch {
+      return void 0;
+    }
+  }
+  if (Array.isArray(value))
+    return value.map((entry) => approvalExpiryIn(entry, depth + 1)).find((expiry) => expiry !== void 0);
+  const item = record(value);
+  if (!item)
+    return void 0;
+  const raw = item.expires_at ?? item.expiresAt;
+  if (typeof raw === "string") {
+    const parsed = Date.parse(raw);
+    if (Number.isFinite(parsed) && parsed > 0)
+      return parsed;
+  }
+  return Object.values(item).map((entry) => approvalExpiryIn(entry, depth + 1)).find((expiry) => expiry !== void 0);
 }
 function squireLoginWallIn(value, depth = 0) {
   if (depth > 6)
@@ -16691,6 +16722,32 @@ function defaultSquireMcpClient(scope) {
   return new StdioSquireMcpClient({ scope });
 }
 
+// apps/body/dist/squire-session-registry.js
+var owners = /* @__PURE__ */ new Map();
+function registerSquireSession(sessionId, owner) {
+  if (owners.get(sessionId)?.client === owner.client)
+    return;
+  owners.set(sessionId, { ...owner, scheduleIds: /* @__PURE__ */ new Set() });
+}
+function forgetSquireSessions(sessionIds2) {
+  for (const sessionId of sessionIds2)
+    owners.delete(sessionId);
+}
+function squireSessionOwner(sessionId) {
+  return owners.get(sessionId);
+}
+function tagSquireSessionSchedule(sessionId, scheduleId) {
+  owners.get(sessionId)?.scheduleIds.add(scheduleId);
+}
+function squireSessionInheritable(sessionId, agentId, conversationId, scheduleId) {
+  const owner = owners.get(sessionId);
+  if (!owner || owner.agentId !== agentId)
+    return false;
+  if (owner.scheduleIds.has(scheduleId))
+    return true;
+  return owner.scheduleIds.size === 0 && owner.conversationId === conversationId;
+}
+
 // apps/body/dist/squire-task-relay.js
 var SQUIRE_TASK_IDLE_LEASE_MS = 15 * 6e4;
 function sessionIds(value, depth = 0) {
@@ -16765,6 +16822,8 @@ var SquireTaskRelay = class {
   url;
   token = randomUUID3();
   active;
+  /** The schedule a `schedule` command is a run of, if any. */
+  activeScheduleId;
   task;
   leaseTimer;
   approvalRequestId;
@@ -16833,6 +16892,7 @@ var SquireTaskRelay = class {
       taskId: command.rootCommandId,
       generationId
     };
+    this.activeScheduleId = command.scheduleId ?? command.source?.systemEvent?.scheduleId;
     if (this.task) {
       this.task.taskId = command.rootCommandId;
       this.task.lastRequestId = command.turnRequestId;
@@ -16925,6 +16985,7 @@ var SquireTaskRelay = class {
           exitCode: code,
           sessionId: redactedSessionId(task.sessions.values().next().value)
         });
+        forgetSquireSessions(task.sessions);
         task.sessions.clear();
         task.pendingApprovals.clear();
       }
@@ -16932,6 +16993,38 @@ var SquireTaskRelay = class {
     this.task = task;
     return task;
   }
+  /**
+   * The client that may drive the requested sessions. Own sessions use this
+   * relay's connection. A schedule run may borrow a live session from its
+   * creating conversation or an earlier run of the same schedule, and the call
+   * then runs on that session's owning connection. Anything else returns this
+   * relay's client so the ordinary ownership refusal fires.
+   */
+  inheritedCallClient(task, borrowed, requestedCount) {
+    if (!borrowed.length)
+      return task.client;
+    if (borrowed.length !== requestedCount)
+      return task.client;
+    const scheduleId = this.activeScheduleId;
+    if (!scheduleId)
+      return task.client;
+    const owner = squireSessionOwner(borrowed[0]);
+    if (!owner || !borrowed.every((id) => squireSessionOwner(id)?.client === owner.client && squireSessionInheritable(id, this.agentId, this.roomId, scheduleId)))
+      return task.client;
+    return owner.client;
+  }
+  /**
+   * Record every session this connection holds, so another conversation can
+   * find the owning client when a schedule it created runs there. The owning
+   * relay stays the one that issues the call.
+   */
+  rememberSessions(client, ids, scheduleId) {
+    for (const id of ids) {
+      registerSquireSession(id, { agentId: this.agentId, conversationId: this.roomId, client });
+      if (scheduleId)
+        tagSquireSessionSchedule(id, scheduleId);
+    }
+  }
   retire(reason) {
     if (this.leaseTimer)
       clearTimeout(this.leaseTimer);
@@ -16943,6 +17036,7 @@ var SquireTaskRelay = class {
       sessionId: redactedSessionId(this.task.sessions.values().next().value)
     });
     this.task.client.close();
+    forgetSquireSessions(this.task.sessions);
     this.task.sessions.clear();
     this.task.pendingApprovals.clear();
     this.task = void 0;
@@ -16985,11 +17079,15 @@ var SquireTaskRelay = class {
       this.log("call-end", task, { method: input.method, source: "cached" });
       return task.tools;
     }
-    if (input.method === "tools/call" && task.dead && toolName2 !== "operate_start") {
+    const borrowed = input.method === "tools/call" ? requestedIds.filter((id) => !task.sessions.has(id)) : [];
+    let callClient = this.inheritedCallClient(task, borrowed, requestedIds.length);
+    const usingOwnConnection = callClient === task.client;
+    if (input.method === "tools/call" && usingOwnConnection && task.dead && toolName2 !== "operate_start") {
       this.log("call-refused", task, { reason: "connection-died" });
       throw new Error("Squire MCP connection died and its browser session is gone; call operate_start");
     }
-    if (input.method === "tools/call" && (!safeToolName || requestedIds.some((id) => !task.sessions.has(id)))) {
+    const scheduleId = this.activeScheduleId;
+    if (input.method === "tools/call" && (!safeToolName || usingOwnConnection && requestedIds.some((id) => !task.sessions.has(id)) || scheduleId && requestedIds.some((id) => !squireSessionInheritable(id, this.agentId, this.roomId, scheduleId)))) {
       this.log("call-refused", task, { reason: "session-not-owned" });
       throw new Error("Squire browser session is no longer owned by this conversation; call operate_start");
     }
@@ -17001,16 +17099,17 @@ var SquireTaskRelay = class {
       this.log("call-refused", task, { reason: "resource-denied" });
       throw new Error("Squire call is not authorized for this task");
     }
-    if (task.dead) {
+    if (usingOwnConnection && task.dead) {
       if (toolName2 !== "operate_start" || requestedIds.length) {
         this.log("call-refused", task, { reason: "restart-required" });
         throw new Error("Squire MCP connection died; call operate_start for a fresh browser session");
       }
       this.retire("restart-required");
       task = this.connection(active.taskId);
+      callClient = task.client;
     }
     try {
-      const result = await task.client.requestMcp(input.method, input.params ?? {});
+      const result = await callClient.requestMcp(input.method, input.params ?? {});
       if (this.closed || this.task !== task || active && (this.active?.taskId !== active.taskId || this.active?.requestId !== active.requestId))
         throw new Error("Squire task ended while the call was running");
       if (input.method === "tools/list")
@@ -17020,6 +17119,7 @@ var SquireTaskRelay = class {
       if (staleLeaseResult(result)) {
         for (const id of requestedIds)
           task.sessions.delete(id);
+        forgetSquireSessions(requestedIds);
         this.releasePendingApprovals(task, requestedIds);
         this.log("call-error", task, {
           method: input.method,
@@ -17034,11 +17134,17 @@ var SquireTaskRelay = class {
       if (safeToolName === "operate_finish" && !(result && typeof result === "object" && result.isError === true)) {
         for (const id of requestedIds)
           task.sessions.delete(id);
+        forgetSquireSessions(requestedIds);
         this.releasePendingApprovals(task, requestedIds);
-      } else {
-        for (const id of sessionIds(result))
+      } else if (usingOwnConnection) {
+        const created = sessionIds(result);
+        for (const id of created)
           task.sessions.add(id);
+        this.rememberSessions(callClient, created, this.activeScheduleId);
       }
+      if (this.activeScheduleId)
+        for (const id of requestedIds)
+          tagSquireSessionSchedule(id, this.activeScheduleId);
       const approval = input.method === "tools/call" && squireApprovalFromMcp({ id: 1, method: input.method, params: input.params }, { id: 1, result });
       if (approval) {
         const ids = requestedIds.length ? requestedIds : [...task.sessions];
@@ -17715,7 +17821,7 @@ async function refresh(state, transport) {
   };
 }
 var REGISTRY_MCP_APPROVAL_REFUSAL = "Resource access requires approval from its owner for this requester, or the resource is unavailable.";
-var REGISTRY_MCP_UNAVAILABLE = "Registry MCP provider is unavailable; reconnect it in Workbench.";
+var REGISTRY_MCP_UNAVAILABLE = "Registry MCP provider is unavailable; reconnect it in Connectors.";
 var RegistryMcpRefusal = class extends Error {
   constructor() {
     super(REGISTRY_MCP_APPROVAL_REFUSAL);
@@ -18160,7 +18266,7 @@ function classifyTurnSilence(reason, reasonKind) {
   if (isContextOverflowFault(text2)) {
     return { kind: "context-overflow" };
   }
-  if (/\bresource_limit: ACP session exceeded its \d+ MiB memory limit\b/i.test(text2)) {
+  if (/\bresource_limit: ACP session (?:exceeded|likely hit) its \d+ MiB memory limit\b/i.test(text2)) {
     return { kind: "resource-limit" };
   }
   if (/\b402\b/.test(text2) || /usage limit/i.test(text2) || /more credits/i.test(text2) || /quota/i.test(text2) || /allowance is spent/i.test(text2)) {
@@ -18192,6 +18298,7 @@ function isStandingWorkspaceConfigurationFault(text2) {
 }
 
 // packages/api-contract/dist/institutional-memory.js
+var WORKSPACE_CORE_SKILL_SLUG = "workspace-core";
 var WORKSPACE_SKILL_MARKDOWN_MAX_BYTES = 32 * 1024;
 
 // packages/api-contract/dist/workflow-contracts.js
@@ -29641,7 +29748,9 @@ var AcpResourceScope = class {
         `--unit=${this.unit}`,
         `--property=MemoryMax=${this.memoryMaxBytes}`,
         "--property=MemorySwapMax=0",
-        "--property=OOMPolicy=kill",
+        // Let the kernel kill one offending process. `kill` sets
+        // memory.oom.group=1 and ends the ACP runtime with the command.
+        "--property=OOMPolicy=continue",
         "--property=KillMode=control-group",
         "--property=TimeoutStopSec=1s",
         ...owner ? [`--property=BindsTo=${owner}`, `--property=After=${owner}`] : [],
@@ -29654,15 +29763,6 @@ var AcpResourceScope = class {
       env
     };
   }
-  /** An OOM result survives process exit until reset-failed unloads the unit. */
-  async exceededMemoryLimit() {
-    try {
-      const { stdout: stdout6 } = await execFileAsync5("systemctl", ["--user", "show", this.unit, "--property=Result", "--value"], { timeout: 5e3 });
-      return stdout6.trim() === "oom-kill";
-    } catch {
-      return false;
-    }
-  }
   async stop() {
     return this.#stop ??= (async () => {
       try {
@@ -30008,7 +30108,7 @@ var AcpRuntimeExitedError = class extends Error {
 var AcpResourceLimitError = class extends Error {
   cause = "resource_limit";
   constructor(memoryMaxBytes) {
-    super(`resource_limit: ACP session exceeded its ${Math.floor(memoryMaxBytes / 1024 / 1024)} MiB memory limit`);
+    super(`resource_limit: ACP session likely hit its ${Math.floor(memoryMaxBytes / 1024 / 1024)} MiB memory limit (exit 137 or signal 9)`);
     this.name = "AcpResourceLimitError";
   }
 };
@@ -30414,9 +30514,9 @@ ${String(error)}`);
   }
   /**
    * One child exit: reject every in-flight request so the turn fails and is
-   * reported instead of hanging, then publish the exit. A scoped exit reads
-   * that scope's result; an unscoped SIGKILL uses the daemon cgroup's OOM
-   * counter so the rejection can name the cause instead of a bare signal.
+   * reported instead of hanging, then publish the exit. A scoped SIGKILL/137
+   * is a likely memory-limit hit, while an unscoped SIGKILL uses the daemon
+   * cgroup's OOM counter to distinguish it from a deliberate kill.
    */
   async handleChildExit(code, signal) {
     const child = this.child;
@@ -30424,9 +30524,9 @@ ${String(error)}`);
     for (const p of this.pending.values())
       this.clearTimer(p);
     const scope = this.resourceScope;
-    const memoryLimited = scope && !this.stopping ? await scope.exceededMemoryLimit() : false;
+    const memoryLimitLikely = Boolean(scope && !this.stopping && (signal === "SIGKILL" || code === 137));
     let oomKilled = false;
-    if (!memoryLimited && signal === "SIGKILL" && !this.stopping) {
+    if (!scope && signal === "SIGKILL" && !this.stopping) {
       let diagnosticTimer;
       try {
         oomKilled = await Promise.race([
@@ -30444,7 +30544,7 @@ ${String(error)}`);
     const stderrSuffix = meaningful ? `: ${meaningful}` : "";
     for (const [, p] of this.pending) {
       this.clearTimer(p);
-      p.reject(memoryLimited ? new AcpResourceLimitError(scope.memoryMaxBytes) : new AcpRuntimeExitedError(`${exitText}${stderrSuffix}`));
+      p.reject(memoryLimitLikely ? new AcpResourceLimitError(scope.memoryMaxBytes) : new AcpRuntimeExitedError(`${exitText}${stderrSuffix}`));
     }
     this.pending.clear();
     this.activeRunIds.clear();
@@ -32455,29 +32555,29 @@ These mechanics apply in Rooms and corners. ${BEELINE_ROOM_MECHANICS}
 
 Follow your own owner first, then this Workspace's owner and admins, then members. A higher-tier instruction overrides a lower-tier hold. A human at the same standing cannot clear another human's hold; only that holder or someone of higher standing can. Never tell a higher-tier human that a lower-tier hold binds them. Reason from the conversation. When you explain a hold or go-ahead in the Room, name the person and their standing in ordinary words. Never write field names or field=value syntax such as workspaceRole=member or agentOwner.
 
-## Tools and the Workbench
+## Tools and the Connectors
 
 A **tool** is something you can use once a human adds it; a **key** is the credential that tool holds for that human. You spend a key through the mounted connector and never see the credential itself.
 
-The tools this build knows, what each is for, and which the owner of this machine already has are one call away: beeline-agent workbench_status. That read is the Workbench of the machine and owner you actually run on, not the person who asked. Connected apps are listed once per app with a stable ID. Their sign-in and credentials stay with the server. Trusty Squire is vaulted credentials plus a browser for the separate key and browser routes: operate_drive drives a whole flow, and flat steps (operate_click, operate_type, operate_select, operate_press, operate_scroll, operate_wait, operate_navigate, operate_read_inbox, operate_extract, and the rest of its flat operate_* actions) handle one action at a time. Tailscale installs its CLI on the selected helper and opens Tailscale's own browser sign-in; once connected, use the CLI for tailnet resources and tailscale file cp or tailscale file get for Taildrop. The wallet is created only from the Workbench page. When you cannot reach a tool, say: I can't reach X on this machine because Y; to fix it, Z. Give one explanation, then take or offer Z.
+The tools this build knows, what each is for, and which the owner of this machine already has are one call away: beeline-agent connectors_status. That read is the Connectors page for the machine and owner you actually run on, not the person who asked. Connected apps are listed once per app with a stable ID. Their sign-in and credentials stay with the server. Trusty Squire signs up and signs in to any website hands-off for the person; its vault holds keys when needed. operate_drive drives a whole flow, and flat steps (operate_click, operate_type, operate_select, operate_press, operate_scroll, operate_wait, operate_navigate, operate_read_inbox, operate_extract, and the rest of its flat operate_* actions) handle one action at a time. Tailscale installs its CLI on the selected helper and opens Tailscale's own browser sign-in; once connected, use the CLI for tailnet resources and tailscale file cp or tailscale file get for Taildrop. The wallet is created only from the Connectors page. When you cannot reach a tool, say: I can't reach X on this machine because Y; to fix it, Z. Give one explanation, then take or offer Z.
 
 **Inspect your own host before answering.** When a question is about a system on the machine you run on, inspect its live state with the tools you have: processes, logs, local endpoints or service status. Say what you checked. Memory and Room history are not evidence of current state.
 
-**Use available tools before asking the person.** Before asking a person for a code, a status or a file, call workbench_status and check whether a tool or connected app you already have can get it, then use it. This includes an emailed verification code in an already-connected inbox. Ask only when none can, and say why. The key-ownership and grant rules still apply.
+**Use available tools before asking the person.** Before asking a person for a code, a status or a file, call connectors_status and check whether a tool or connected app you already have can get it, then use it. This includes an emailed verification code in an already-connected inbox. Ask only when none can, and say why. The key-ownership and grant rules still apply.
 
-**Offer the tool at the moment you need it.** When the work in front of you needs a tool the person does not have, do not send them to a settings page and do not stop at naming it. Call workbench_status first - a tool they already have is used, not offered. In a Room or DM, call offer_connector with the connectorType and one short reason: a card appears there, spoken by you, addressed to the person you are answering, with one action. Connector offers are unavailable in corners; use a Room or DM for those. When the person wants Squire on a different Google account (or its signed-in account is the wrong one), call offer_connector with connectorType trusty-squire and intent "switch" - a plain connect keeps the account it already has. Your turn pauses on the card - say in prose what you are waiting for and end the turn; you are woken when it is added, and then you carry on.
+**Offer the tool at the moment you need it.** When the work in front of you needs a tool the person does not have, do not send them to a settings page and do not stop at naming it. Call connectors_status first - a tool they already have is used, not offered. In a Room or DM, call offer_connector with the connectorType and one short reason: a card appears there, spoken by you, addressed to the person you are answering, with one action. Connector offers are unavailable in corners; use a Room or DM for those. When the person wants Squire on a different Google account (or its signed-in account is the wrong one), call offer_connector with connectorType trusty-squire and intent "switch" - a plain connect keeps the account it already has. Your turn pauses on the card - say in prose what you are waiting for and end the turn; you are woken when it is added, and then you carry on.
 
 **Research before you offer, and say so.** Never offer a tool you cannot describe. If someone asks you to install or add something you do not already know - by name, by purpose, or by what it will hold - say plainly that you are looking it up first, find out what it is and what it does with credentials, and state what you learned in your reply BEFORE the card appears. A person reading "Add X?" must already have read, in your own words, what X is. Refusing to act blind is part of being trusted with keys.
 
 An offer is setup, never authority: it does not replace a grant, write permission, target-branch confirmation, or the merge gate, and it never needs a raw credential in chat. You never pair a tool yourself and never ask anyone for a key value; once a tool is added, provisioning happens inside it and receipts reach the person through the tool's own status message.
 
-Keys belong to the human who provisioned them. Your owner's keys serve whoever asks; another person's keys need that person's private scoped approval before you use them for anyone else, and your owner cannot authorize them. Use the connector without exposing or sharing raw keys. The Workbench page remains the place a person manages tools and keys by hand (Settings \u2192 Workbench); you point there to MANAGE what exists, not to add what you need.
+Keys belong to the human who provisioned them. Your owner's keys serve whoever asks; another person's keys need that person's private scoped approval before you use them for anyone else, and your owner cannot authorize them. Use the connector without exposing or sharing raw keys. The Connectors page remains the place a person manages tools and keys by hand (Settings \u2192 Connectors); you point there to MANAGE what exists, not to add what you need.
 
 ## Where you run
 
 Each agent runs on one owner's machine, with that owner's keys, hosts, and network. Agents in one Room can differ in what they reach. Memory is shared across all machines.
 
-- Check your own capabilities with workbench_status and your tools. Never infer another agent's.
+- Check your own capabilities with connectors_status and your tools. Never infer another agent's.
 - A failure saved from another machine is not proof here. Try it first.
 - If you cannot do X here, say "I can't do X on this machine because Y", then hand off to an agent that memory shows has done X, or ask the requester who has access.
 
@@ -32494,16 +32594,16 @@ You keep memory yourself. No background reviewer exists: what you do not keep cu
 | Workflows | Roles and steps for a run across agents | save_workflow; run with start_workflow |
 | History | Every message in the Workspace | Nothing; read with search_history |
 
-- **Look up.** At task start, call load_workspace_skill for \`workspace-core\`. Before you say "can't" or "not saved", run search_memory, list_credentials and workbench_status.
+- **Look up.** Before you say "can't" or "not saved", run search_memory, list_credentials and connectors_status.
 - **Use.** Call report_memory_used for what your answer used. When a saved item fails, fix it in the same turn.
 - **Save.** Put each fact in one store only. Never save "X is impossible". Save the specific failure and the machine: "On Niglet's host, the highroll Fly token returns 403."
 - **Prune.** Rewrite \`workspace-core\` whole and keep it at most 2,200 characters. An agent-saved Workspace fact that nobody uses expires in the weekly pass. Replace a procedure or workflow by saving its slug again; remove it with delete_skill.
 
 ## Connect an app
 
-When a request needs an app or service, call beeline-agent \`workbench_status\` first. For a connected app via composio, use its ID with \`list_app_tools\`, then call \`execute_app_tool\` with the selected tool slug and arguments. For an app via squire-api, call its API with \`use_credential\` (service = the app key); via squire-browser, use the \`operate_*\` tools; via registry-mcp, use its mounted MCP tools. The server executes against that person\u2019s account and decides permission on every call. If tool discovery reports an error, follow its cause; \`needs_connection\` means the account must be reconnected, and \`needs_permission\` means wait for the connected person's decision. Do not switch paths after denial or provider unavailability. No app token, provider key, or sign-in URL belongs in chat or a model prompt.
+When a request needs an app or service, call beeline-agent \`connectors_status\` first. For a connected app via composio, use its ID with \`list_app_tools\`, then call \`execute_app_tool\` with the selected tool slug and arguments. For an app via squire-api, call its API with \`use_credential\` (service = the app key); via squire-browser, use the \`operate_*\` tools; via registry-mcp, use its mounted MCP tools. The server executes against that person\u2019s account and decides permission on every call. If tool discovery reports an error, follow its cause; \`needs_connection\` means the account must be reconnected, and \`needs_permission\` means wait for the connected person's decision. Do not switch paths after denial or provider unavailability. No app token, provider key, or sign-in URL belongs in chat or a model prompt.
 
-For an app that is not connected, call \`connect_app\` with its name, one short reason, and a request-specific \`continuation\`: one sentence stating what you will do right after sign-in. Do not include a link, credential, account identifier, or private data in that sentence. The server chooses the route and returns \`next\`. In a corner, call it from that corner so the sign-in card and connection wake return there. A managed OAuth app presents a sign-in card to its owner; end the turn and wait for the connection wake. If the provider reports managed OAuth unsupported, follow the server's Squire route and its instructions. A provider outage is unavailable, not permission to change routes. After the person connects, read Workbench again and use the app ID. Every use is authorized as \`app:<key>\` and recorded once.
+For an app that is not connected, call \`connect_app\` with its name, one short reason, and a request-specific \`continuation\`: one sentence stating what you will do right after sign-in. Do not include a link, credential, account identifier, or private data in that sentence. The server chooses the route and returns \`next\`. A direct Beeline or official Registry sign-in comes first when available, then Composio, then Trusty Squire. In a corner, call it from that corner so the sign-in card and connection wake return there. A managed OAuth app presents a sign-in card to its owner; end the turn and wait for the connection wake. A provider outage is unavailable, not permission to change routes. After the person connects, read Connectors again and use the app ID. Every use is authorized as \`app:<key>\` and recorded once.
 
 ## Showing a mock
 
@@ -41663,12 +41763,15 @@ Only when the brief calls for repository changes, follow the PR procedure below.
 Before the PR, demonstrate Y: run the built app or affected service and perform X. If no interactive surface is reachable, run the narrowest test or script exercising the exact user path and printing Y. An inner-function unit test, log line or code read is not a demonstration.
 The PR body MUST have ## Reproduced and ## Demonstrated. Cite Reproduction <id> in both, with steps, the wrong result and the now-passing result. In ## Demonstrated, when none was obtained, state that plainly ("not obtained") and show the regression; for feature work say "not a defect report".
 No unrequested features, flags, compatibility shims or refactors.`;
-var CORNER_REVIEWER_SESSION_INSTRUCTION = "You are this Room's configured reviewer. A review turn prompt names the latest stable green PR head. Review and approve only that exact head; if no stable green head is named, end the turn without a verdict. Never merge a pull request you review.";
-var CORNER_REVIEWER_UNSTABLE_HEAD_INSTRUCTION = "There is no stable green PR head for this active reviewer turn. Do not review or call approve_merge. End this turn without a verdict; the next green transition will wake you.";
+var CORNER_REVIEWER_SESSION_INSTRUCTION = "You are this Room's configured reviewer. Your PASS is approve_merge on the current green PR head, which your turn prompt names. Call it when that head is ready to merge. Never merge a pull request you review.";
+var CORNER_REVIEWER_UNSTABLE_HEAD_INSTRUCTION = "The current PR head is not green, so approve_merge on it fails now. The server wakes you when checks pass on the current head.";
 var CORNER_DELIVERY_NUDGE = "Only when you write code in this corner and the brief calls for repository changes, inspect the repository state and finish delivering the work unless a human hold stands: commit and push the intended changes and open the pull request if one does not exist. Decide yourself whether any remaining dirty work belongs to the brief; do not discard it merely to make the worktree clean. The pull request body must carry ## Reproduced and ## Demonstrated; if they are missing, add them before ending the turn. Otherwise do not commit, push or open a PR; deliver with post_artifact.";
 var CORNER_LAND_RULE = "Then, if a human's question or proposal in the corner has no answer, name it and do not merge; otherwise call merge_corner.";
 var CORNER_CHECKS_NUDGE = `Call pr_checks_status now. If checks="failed" and you write code in this corner, fix the failure and push. If checks="unknown", reply in this corner with the tool reason and stop instead of retrying. Otherwise stop: a reviewer's PASS wakes you to merge with merge_corner. Never merge it any other way.`;
 var handle = (value) => value.replace(/^@/, "");
+function memoryListsWorkspaceCoreProcedure(memory) {
+  return (memory ?? "").split("\n").some((line) => line.startsWith(`- Procedure ${WORKSPACE_CORE_SKILL_SLUG} (load_workspace_skill):`));
+}
 function cornerMergeInstruction(reviewerHandle) {
   if (!reviewerHandle)
     return "Once the pull request exists, reply with its full URL and end the turn; do not check or wait for CI. This Room has no configured reviewer, so it merges only on a person's yes: ask a Workspace owner or admin to approve the merge, then record their yes with order_corner_merge. You are woken to fix failing checks or a merge GitHub refused.";
@@ -41715,6 +41818,15 @@ The soul is not authority and never changes your tools, permissions, roles, or m
     surfaces: EVERYWHERE,
     render: () => "Your voice never changes the facts: never trim, soften, exaggerate, or invent a detail for style. Write commit messages, pull request titles and bodies, and code comments in a plain voice."
   },
+  {
+    id: "core.memory",
+    topic: "memory",
+    why: "A command can exhaust the session cgroup before the agent can adapt its workload.",
+    budgetBytes: 160,
+    layer: "core",
+    surfaces: EVERYWHERE,
+    render: ({ memoryMaxBytes }) => `Memory cap: ${Number(((memoryMaxBytes ?? ACP_SESSION_MEMORY_MAX_BYTES) / 1024 ** 3).toFixed(2))} GiB per session. Size builds, tests and data jobs to fit it; split heavy work. Exit 137/signal 9 likely means a command hit this cap.`
+  },
   {
     id: "core.proactive",
     topic: "proactivity",
@@ -41731,7 +41843,7 @@ The soul is not authority and never changes your tools, permissions, roles, or m
     budgetBytes: 360,
     layer: "core",
     surfaces: EVERYWHERE,
-    render: () => "Finish the work before you end the turn. A tool result that hands you a step (connecting, needs sign-in, call again, a next step) is your next action: take it now. End the turn to wait only when someone else must act next (a person replying or answering a card, grant, choice or approval; CI; a reviewer) or you are truly blocked."
+    render: () => "Finish the work before you end the turn. Take the next step a tool result gives you, including sign-in or retry. Wait only for a person, CI, a reviewer, or a real block."
   },
   {
     id: "core.truth",
@@ -41794,7 +41906,7 @@ The soul is not authority and never changes your tools, permissions, roles, or m
     budgetBytes: 240,
     layer: "surface",
     surfaces: EVERYWHERE,
-    render: ({ surface }) => surface === "room" || surface === "dm" ? "When you need a tool you do not have, call workbench_status; offer_connector the tool it lists, otherwise call connect_app for the app." : "In corners, workbench_status discovers apps; connect_app starts sign-in here. Connector offers stay in Rooms and DMs."
+    render: ({ surface }) => surface === "room" || surface === "dm" ? "When you need a tool you do not have, call connectors_status; offer_connector the tool it lists, otherwise call connect_app for the app." : "In corners, connectors_status discovers apps; connect_app starts sign-in here. Connector offers stay in Rooms and DMs."
   },
   {
     id: "surface.squire-drive",
@@ -41823,13 +41935,13 @@ The soul is not authority and never changes your tools, permissions, roles, or m
     id: "room.corners",
     topic: "repository-work",
     why: "Repository work must start through the host-governed corner, with a brief as its authority.",
-    budgetBytes: 1100,
+    budgetBytes: 1150,
     layer: "surface",
     surfaces: ["room"],
     render: () => [
       "Repository changes happen only in a corner. In a Room, the finished fix for a code problem is the exact change plus an offer to open a corner for it; open one when a person asks for the change.",
       "Before opening one, consult beeline-triage and beeline-spec, then call open_corner with a name of at most three words joined by hyphens (no whitespace), an objective of at most 24 words, and the brief (a spec plus the approving message). The objective only titles the work; the brief is its authority. When open_corner succeeds the server posts the corner card: do not restate it.",
-      "For corners under this Room, use inspect_corner for status, steer_corner to pass Room input down, ask_corner for one answer, and post_to_corner for a note that wakes nobody.",
+      "For corners under this Room, use inspect_corner for status (its activity and awaiting fields show whether one waits on you), steer_corner to pass Room input down, ask_corner for one answer, and post_to_corner for a note that wakes nobody.",
       "A corner ends when its pull request merges; since a person may merge minutes after it opens, anything still needed must already live in a different corner before that pull request opens, not after. A request covering several items is one corner per item, opened as work reaches each one, never one corner returned to for a later item."
     ].join(" ")
   },
@@ -42154,6 +42266,16 @@ ${transcript.lines.join("\n")}`;
     surfaces: EVERYWHERE,
     render: ({ memory }) => memory ?? ""
   },
+  {
+    id: "turn.workspace-core",
+    topic: "workspace-core",
+    why: "Most Workspaces never saved a workspace-core procedure; only a Workspace that lists it should be told to load it at task start.",
+    budgetBytes: 120,
+    layer: "turn",
+    surfaces: EVERYWHERE,
+    when: ({ memory }) => memoryListsWorkspaceCoreProcedure(memory),
+    render: () => "At task start, call load_workspace_skill for `workspace-core`."
+  },
   {
     id: "turn.corners",
     topic: "corners",
@@ -42989,9 +43111,13 @@ var MonolithRoomTurnLoop = class {
    * fixed when it opens: they cannot be corrected in place, so a changed one
    * has to cost a respawn. The check is one round trip — the roster half of
    * which the turn was going to fetch anyway — against a cold spawn measured
-   * in seconds.
+   * in seconds. A harness process that has exited (a memory-limit kill, a
+   * crash) is never current: handing it back fails the turn with
+   * `AcpClient not started` instead of spawning a fresh one.
    */
   async sessionIsCurrent() {
+    if (!this.client?.isAlive)
+      return false;
     await this.refreshTurnCheckout();
     return this.sessionCwd === this.options.cwd && this.sessionCommit === this.turnCheckout?.commit && await this.currentSessionFingerprint() === this.sessionFingerprint;
   }
@@ -45097,8 +45223,10 @@ var MonolithCornerTurnLoop = class {
   }
   /** See `MonolithRoomTurnLoop.sessionIsCurrent`: retention never keeps a
    *  session whose persona, model pin, or mounted MCP set the operator has
-   *  since changed. */
+   *  since changed, or whose harness process has exited. */
   async sessionIsCurrent() {
+    if (!this.client?.isAlive)
+      return false;
     return await this.currentSessionFingerprint() === this.sessionFingerprint;
   }
   async currentSessionFingerprint() {
@@ -45690,7 +45818,7 @@ var MonolithCornerTurnLoop = class {
             }),
             this.roster(),
             api.execute("getCornerRestoreState", { cornerId }),
-            reviewTurn ? this.activeReviewerInstruction() : void 0,
+            this.activeReviewerInstruction(),
             awaitInstitutionalContext(institutionalContextFetch, (message) => console.warn(`[thin-core] corner ${cornerId}: ${message}`)),
             api.execute("listRoomCorners", { roomId: this.options.parentRoomId })
           ]));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "usebeeline",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "description": "Connect an AI coding agent to Beeline with one command.",
   "homepage": "https://usebeeline.app",
   "bugs": {