wicked-crew 0.15.8 → 0.16.0

package/dist/api/routes.js

@@ -5,7 +5,7 @@ import { z } from 'zod';
 import { listRequirements, getRequirement, patchRequirement } from './requirements.js';
 import { randomUUID } from 'node:crypto';
 import { homedir } from 'node:os';
-import { readFileSync, existsSync } from 'node:fs';
+import { readFileSync, existsSync, mkdirSync } from 'node:fs';
 import { promises as fsp } from 'node:fs';
 import { isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -13,6 +13,11 @@ import { videoPalette } from '../appearance/video-palette.js';
 import { CampaignsUnsupportedError, ChatUnsupportedError, CoreAdapter, ElicitationUnsupportedError, GovernanceReplayUnsupportedError, PlanLaunchUnsupportedError, SteeringUnsupportedError, addonSupportsQeOverride, addonSupportsReducedAssurance, humanGatePhaseIds, settingsFilePath } from '../core/adapter.js';
 import { codeGraphDb, codeGraphErrorStatus, requirementsGraph } from '../core/repoPaths.js';
 import { resolveCursorUnit } from '../core/cursor.js';
+/** Create `dir` (private) when missing and answer it — a read root must exist when a run launches. */
+function ensureDir(dir) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    return dir;
+}
 import { detectRefusal, isOpenGate, offeredChoices, replayOpenGate } from './gate-cache.js';
 import { acceptanceRequirementOf, buildAcceptanceView } from '../qe/acceptance.js';
 import { runIdentityOf, wireIdentity } from '../core/run-identity.js';
@@ -28,7 +33,7 @@ import { chatSeatAdmission } from './seat-standing.js';
 import { seatGovernanceDiagnostics, seatGovernanceWarnings, } from './seat-governance.js';
 import { seatWorkDefaultNow } from './seat-work-default.js';
 import { ROSTER_REFRESH_WAIT_MS, rosterWithStandingFactory } from './roster-standing.js';
-import { SeatContainerStatus, isContainerLoginCli, isContainerSeatFloor, loginDetail, runSeatLogin, seatLoginDepsFor, } from './seat-container-login.js';
+import { SeatContainerStatus, gatewayDirOf, isContainerLoginCli, isContainerSeatFloor, isHostSeatFloor, loginDetail, runSeatLogin, seatLoginDepsFor, } from './seat-container-login.js';
 import { ChatTurnIndex } from './chat-turns.js';
 import { ChatScopeIndex, chatScopeDeps, chatScopeStatement, prepareChatScratch, removeChatScratch, namedKindRefusal, resolveChatScope, } from './chat-scope.js';
 import { ASK_TURN_BUDGET_SECS, AskPathIndex, answerStep, isAskTurn } from './ask-paths.js';
@@ -69,6 +74,7 @@ import { aggregateReceipt, postHocDeliveryAssurance, qeAcceptanceFromView, qeAcc
 import { ProjectSettingsStore } from '../projects/settings.js';
 import { isHumanOperator } from './watch-routes.js';
 import { boundOrigin, InteractiveBridgePool } from '../interactive/bridge-pool.js';
+import { defaultInteractiveRoot } from '../interactive/bridge-root.js';
 import { composeDeliverText, configuredPublicOrigin, extractFollowUps, factsFromRun, reportsFromOutputs, FOLLOW_UPS_MAX, framedDeliverText, runUrlFor, } from '../core/deliver-text.js';
 import { deliverIdentityFor, deliverRepoFor, deliverTargetView, isGitHubLogin, pushIdentityOf, readDeliverOriginUrl, resolvePullRequest as resolvePullRequestViaGh, unverifiedTreesFrom, } from '../core/deliver.js';
 import { credentialsMissingIn, deliverCredentialsProbe, missingCredentials } from '../core/deliver-credentials.js';
@@ -76,7 +82,7 @@ import { codebaseArchiveUrl } from './codebase-archive.js';
 import { registerInteractiveProxy } from '../interactive/proxy-routes.js';
 import { registerInteractiveDocDelete } from '../interactive/doc-delete-routes.js';
 import { registerInteractiveDocChecks } from '../interactive/doc-checks-routes.js';
-import { crewStateHome } from '../projects/state-home.js';
+import { crewStateHome, stateHomeOfDb } from '../projects/state-home.js';
 import { registerInteractiveDocList } from '../interactive/doc-list-routes.js';
 import { REVIEWS_DIRNAME } from '../interactive/review-ledger.js';
 import { MembershipIndex } from '../projects/membership-index.js';
@@ -85,6 +91,9 @@ import { resolveLinkedIssues } from '../core/linked-issues.js';
 import { AuditLog } from './audit.js';
 import { AcpFoldCache, EngineVersionCache, eventsDirOf, installedPackageVersion, hostSandboxLauncher, seatRosterFile, listStoreFiles, readStudioBundleVersion, } from './diagnostics.js';
 import { GovernanceDiagnostics } from './governance-health.js';
+import { ATTACHMENT_LIMITS, ATTACHMENT_MAX_MESSAGE_BYTES, AttachmentError, ChatAttachmentStore, attachmentWire, attachmentsBlock, boundaryOf, parseMultipart, stageForSeat } from './chat-attachments.js';
+import { CHAT_HISTORY_MAX_LIMIT, ChatHistoryStore, decodeCursor } from './chat-history.js';
+import { PROBE_TIMEOUT_MS, SYSTEM_BUDGET_MS, SYSTEM_STATS_DAYS, WeekFoldCache, assembleSnapshot, buildAttention, buildClis, buildGovernance, diskRow, estateReadonlyCall, infraRow, judgeGaps, livenessThresholds, loadRow, probeBroker, probeBus, probeEstate, probeGateway, probeInteractive, probeVault, readBridgeLockAsync, readWeek, resolveContainerRuntime, runLiveness, settleWithin, skillsRow, sortRuns, stateHomeRow, unfinished, } from './system-snapshot.js';
 import { governanceStoreFix, legacyHomeOutboxPath } from '../core/governance-store.js';
 import { UsageError, replayOutboxInto } from '../cli/governance.js';
 import { foldDeadletters } from './governance-health.js';
@@ -697,6 +706,8 @@ export const ChatOpenSchema = z.object({
     scopeKind: z.enum(['system', 'everything', 'project', 'repo', 'repos', 'none']).optional(),
     /** (ASK-C1) The seat the operator chose as the primary agent; omitted ⇒ the engine picks at random. */
     primary: z.string().min(1).optional(),
+    /** (api-types 0.137.0, DES-SYSTEM-CHAT) The page the chat was started on, for the history list. */
+    startedOn: z.object({ route: z.string().min(1).max(512), label: z.string().min(1).max(200) }).strict().optional(),
 }).strict();
 /**
  * The `singleSeat` disclosure (crew#641, hole closed in crew#650) — built in ONE place so the 201
@@ -802,6 +813,8 @@ runtime = {}) {
     const chatTurns = runtime.chatTurns ?? new ChatTurnIndex();
     const askPaths = runtime.askPaths ?? new AskPathIndex();
     const chatTranscripts = runtime.chatTranscripts;
+    const chatAttachments = runtime.chatAttachments ?? new ChatAttachmentStore();
+    const chatHistory = runtime.chatHistory ?? (chatTranscripts !== undefined ? new ChatHistoryStore(chatTranscripts, chatAttachments) : null);
     const deliveryIndex = runtime.deliveryIndex ?? new DeliveryIndex();
     // Wave 6: the doc↔run binding and the registered test sets — `createServer` injects the real
     // ones; a directly-driven route set gets an empty index (every run `document_id: null`, no sets).
@@ -1176,6 +1189,27 @@ runtime = {}) {
     // The daemon's QE acceptance setting as read now ('required' when the settings cannot be read:
     // fail closed, never off by accident).
     const qeAcceptanceNow = async () => qeAcceptanceMode(await Promise.resolve().then(() => adapter.getSettings()).catch(() => null));
+    // The `/health.warnings` list, shared with `GET /system`'s daemon row (DES-SYSTEM-VIEW).
+    const healthWarningsOf = (stateHome, baseSkill) => [
+        ...(stateHome === null ? [] : stateHome.findings.map((f) => ({ kind: f.kind, severity: f.severity, message: f.message }))),
+        ...(baseSkill?.finding ? [{ kind: baseSkill.finding.kind, severity: baseSkill.finding.severity, message: baseSkill.finding.message }] : []),
+        // crew#753: a garden older than the minimum is a blocking finding on the first screen too.
+        ...[gardenBlocker()].filter((f) => f !== null),
+        // DES-TEAMING-002 T0: the daemon's bus did not open at boot, so the engine was handed none
+        // and runs un-teamed. A daemon-level notice (status stays ok: it serves); the per-run
+        // `transport:"none"` record lands with P1.
+        ...(adapter.busUnavailable != null ? [busUnavailableWarning(adapter.busUnavailable)] : []),
+        // wicked-core#631: the engine has the bus but not the calls crew reaches it through.
+        ...(adapter.busSeamsOff != null ? [busSeamsOffWarning(adapter.busSeamsOff)] : []),
+        // crew#742: a seat that runs ungoverned, or floor seats on a host that cannot arm their
+        // boundary, are named before any run starts.
+        ...seatGovernanceWarnings(seatGovernanceNow(), hostSandboxLauncher()),
+        // crew 0.15.2 (#916): a custom seat written council-off with no work flag is now work-eligible
+        // by the engine default; each is named once, so the operator can keep it off work.
+        ...seatWorkDefaultNow(),
+        // crew#1068: the engine has no wicked-vault CLI to record held boundary findings with.
+        ...[adapter.vaultBin != null ? vaultBinWarning(adapter.vaultBin) : null].filter((w) => w !== null),
+    ];
     app.get(`${V}/health`, { config: { manifest: { statusCodes: [200] } } }, async () => {
         const ping = await enginePing();
         // F-E2E-030: what this deployment can keep. A composer reads `capabilities.deliverGate`
@@ -1207,6 +1241,11 @@ runtime = {}) {
             qeAcceptance: await qeAcceptanceNow(),
             // api-types 0.128.0: `LaunchRunBody.primary` (the lead agent) is accepted.
             launchPrimary: true,
+            // api-types 0.136.0 (DES-SYSTEM-VIEW): `GET /system`, the Nerve Center snapshot, is served.
+            system: true,
+            // api-types 0.137.0 (DES-SYSTEM-CHAT): the chat history (list, reopen, close) and attachments.
+            chatList: chatHistory !== null,
+            chatAttachments: true,
         };
         // wicked-core#411 / crew#497: the state-home blocker rides the health probe as a WARNING. The
         // daemon still SERVES (status stays ok — studio must load and show the blocker) but refuses to
@@ -1223,26 +1262,7 @@ runtime = {}) {
         // `baseSkill.finding` and `/diagnostics.skills.findings[]` (one surface, no new field;
         // `HealthWarning.kind` is open); status stays ok because the daemon serves and studio must load
         // and show it — exactly the state-home blocker's precedent above.
-        const warnings = [
-            ...(stateHome === null ? [] : stateHome.findings.map((f) => ({ kind: f.kind, severity: f.severity, message: f.message }))),
-            ...(baseSkill?.finding ? [{ kind: baseSkill.finding.kind, severity: baseSkill.finding.severity, message: baseSkill.finding.message }] : []),
-            // crew#753: a garden older than the minimum is a blocking finding on the first screen too.
-            ...[gardenBlocker()].filter((f) => f !== null),
-            // DES-TEAMING-002 T0: the daemon's bus did not open at boot, so the engine was handed none
-            // and runs un-teamed. A daemon-level notice (status stays ok: it serves); the per-run
-            // `transport:"none"` record lands with P1.
-            ...(adapter.busUnavailable != null ? [busUnavailableWarning(adapter.busUnavailable)] : []),
-            // wicked-core#631: the engine has the bus but not the calls crew reaches it through.
-            ...(adapter.busSeamsOff != null ? [busSeamsOffWarning(adapter.busSeamsOff)] : []),
-            // crew#742: a seat that runs ungoverned, or floor seats on a host that cannot arm their
-            // boundary, are named before any run starts.
-            ...seatGovernanceWarnings(seatGovernanceNow(), hostSandboxLauncher()),
-            // crew 0.15.2 (#916): a custom seat written council-off with no work flag is now work-eligible
-            // by the engine default; each is named once, so the operator can keep it off work.
-            ...seatWorkDefaultNow(),
-            // crew#1068: the engine has no wicked-vault CLI to record held boundary findings with.
-            ...[adapter.vaultBin != null ? vaultBinWarning(adapter.vaultBin) : null].filter((w) => w !== null),
-        ];
+        const warnings = healthWarningsOf(stateHome, baseSkill);
         return {
             status: 'ok',
             version: PKG_VERSION,
@@ -1265,7 +1285,9 @@ runtime = {}) {
     // binding when the addon has one, and the dead-letter outbox folded on change. Built at boot so
     // the record baseline is the boot baseline.
     const governanceDiagnostics = new GovernanceDiagnostics(adapter.governanceStore ?? null, CoreAdapter.eventStoreCounter(), runtime.governanceLegacyOutboxPath === undefined ? legacyHomeOutboxPath() : runtime.governanceLegacyOutboxPath);
-    app.get(`${V}/diagnostics`, { config: { manifest: { responseType: 'DiagnosticsResponse', statusCodes: [200] } } }, async () => {
+    // The diagnostics body, shared by `GET /diagnostics` (the raw dump) and `GET /system` (the
+    // Nerve Center snapshot, which carries every block of it on its rows — DES-SYSTEM-VIEW).
+    const diagnosticsNow = async () => {
         // `dbPath` is a readonly field of the real adapter; a stub-driven route set may lack it,
         // and diagnostics over an unknown store honestly reports no stores and no ACP record.
         const dbPath = typeof adapter.dbPath === 'string' && adapter.dbPath !== '' ? adapter.dbPath : null;
@@ -1323,7 +1345,8 @@ runtime = {}) {
             // `null` on a route set driven without the real adapter.
             vault: adapter.vaultBin != null ? vaultDiagnostics(adapter.vaultBin) : null,
         };
-    });
+    };
+    app.get(`${V}/diagnostics`, { config: { manifest: { responseType: 'DiagnosticsResponse', statusCodes: [200] } } }, async () => diagnosticsNow());
     // Who am I talking to the daemon as? (task #88). In local mode this is
     // always the implicit full-trust local actor; in required mode it names the
     // token's actor — the cheap probe a skin uses to decide what to render.
@@ -3070,6 +3093,17 @@ runtime = {}) {
                 // DC-S7: only a chat that actually OPENED is preface-eligible — recorded here, after the scope
                 // is published, so a refused open leaves no per-chat state behind (codex r1).
                 considerations.noteChatOpen(chatId, inForceAtOpen);
+                // DES-SYSTEM-CHAT: the history entry (kept after the chat ends; only DELETE removes it).
+                try {
+                    chatHistory?.opened(chatId, {
+                        startedOn: b.startedOn,
+                        cli: b.primary ?? clis[0] ?? null,
+                        actorId: security.authMode === 'required' ? actorOf(req).id : null,
+                    });
+                }
+                catch (err) {
+                    req.log.warn({ chatId }, `chat history entry not written: ${message(err)}`);
+                }
                 // The thread learns of every refused seat the way it learns of everything else — a frame
                 // on /ws — AFTER the scope is published, so a reader never sees a refusal for a chat it
                 // cannot yet look up.
@@ -3127,6 +3161,8 @@ runtime = {}) {
     const ChatMessageSchema = z.object({
         text: z.string().min(1).max(65536),
         targets: z.array(z.string().min(1)).min(1).max(8).optional(),
+        /** (api-types 0.137.0) Attachment ids from `POST /chats/:id/attachments`. */
+        attachments: z.array(z.string().min(1).max(64)).optional(),
     }).strict();
     // F-RECON-017: a message sent while a targeted seat is still answering the previous one is
     // REFUSED, not queued. The engine queues silently (the worker gets the text the instant the
@@ -3156,6 +3192,21 @@ runtime = {}) {
             return reply.code(409).send({ error: `chat '${id}' has no eligible seat — sign a seat in and re-seat it (POST /chats/:id/seats)` });
         }
         const text = parsed.data.text;
+        // DES-SYSTEM-CHAT: the attachments this message carries — every id this chat's, within the caps,
+        // refused before anything is reserved or sent.
+        let attached = [];
+        if (parsed.data.attachments !== undefined && parsed.data.attachments.length > 0) {
+            try {
+                attached = chatAttachments.resolve(id, parsed.data.attachments);
+            }
+            catch (err) {
+                if (err instanceof AttachmentError)
+                    return reply.code(err.status).send(err.body());
+                throw err;
+            }
+        }
+        // What the seats receive: the operator's words, then the attachments block (paths + text).
+        let seatText = text;
         let scope = chatScopes.get(id);
         const storedScope = scope;
         let engine = chatScopes.engineOf(id);
@@ -3195,7 +3246,7 @@ runtime = {}) {
                 after();
                 if (preface !== null)
                     chatTranscripts?.appendSystem(id, turnId, preface);
-                chatTranscripts?.appendUser(id, turnId, text, voice);
+                chatTranscripts?.appendUser(id, turnId, text, voice, attached.map(attachmentWire));
                 // The recorder's audience is the turn's AS THE TURN INDEX HOLDS IT NOW: the eligible roster
                 // for a random pick, or the PA the relay narrowed it to during the engine awaits above
                 // (`path.started` / `path.repicked` may land before this record exists — ASK-C2, codex on
@@ -3213,7 +3264,7 @@ runtime = {}) {
         };
         // DC-S7: the rules the chat's seats were told about ride the step's instructions, as the
         // preface rode a pool send; told only once the send is accepted (`commit`).
-        const withPreface = (preface) => (preface !== null ? `${preface}\n\n${text}` : text);
+        const withPreface = (preface) => (preface !== null ? `${preface}\n\n${seatText}` : seatText);
         try {
             const rules = (await considerations.inForceFor(scope?.projectId ?? null)).rules;
             // crew#1020: a project/everything chat must see repos attached since open. Admission was
@@ -3297,6 +3348,22 @@ runtime = {}) {
                     chatTranscripts?.registerRoots(id, scope.repos.map((r) => ({ absRoot: resolve(r.rootPath), name: r.name })));
                 }
             }
+            // DES-SYSTEM-CHAT: stage the attachments read-only in the chat's scratch root (a read root of
+            // its run since launch) and list them in the turn's instructions.
+            const attachRoot = scope !== undefined ? join(scope.cwd, 'attachments') : null;
+            if (attached.length > 0) {
+                if (attachRoot === null) {
+                    askPaths.release(id, lease);
+                    return reply.code(409).send({ error: `chat '${id}' has no scratch root to hand its attachments to the seat; nothing was sent` });
+                }
+                try {
+                    seatText = `${text}\n${attachmentsBlock(stageForSeat(attached, attachRoot))}`;
+                }
+                catch (err) {
+                    askPaths.release(id, lease);
+                    return reply.code(500).send({ error: `could not stage the attachments for the seat: ${message(err)}` });
+                }
+            }
             voice = path.pa !== null ? [path.pa] : [];
             // A random pick reserves every eligible seat until the relay names the PA.
             audience = voice.length > 0 ? voice : path.eligible;
@@ -3324,10 +3391,15 @@ runtime = {}) {
                     ...(scope?.kind === 'project' && codeGraphDb !== null ? { projectGraph: { dbPath: codeGraphDb } } : {}),
                     // crew#1034: the scope's repositories are the run's read roots, graph or no graph — the
                     // statement tells the seats to read them at their paths, so the boundary must let them.
-                    ...(readRoots.length > 0 ? { extraReadRoots: readRoots } : {}),
+                    // DES-SYSTEM-CHAT: plus the chat's attachments directory, from launch (a run cannot gain a
+                    // read root later), so a file attached on any later turn is readable too.
+                    ...(readRoots.length > 0 || attachRoot !== null
+                        ? { extraReadRoots: [...readRoots, ...(attachRoot !== null ? [ensureDir(attachRoot)] : [])] }
+                        : {}),
                 };
                 const runId = await adapter.launchRun(input);
-                if (!askPaths.started(id, generation, runId, stepId, input.projectGraph?.dbPath ?? null, input.extraReadRoots ?? [])) {
+                // The scope's roots (not the attachments directory) are what a later turn compares against.
+                if (!askPaths.started(id, generation, runId, stepId, input.projectGraph?.dbPath ?? null, readRoots)) {
                     // The chat was closed (End) while the launch was in flight: the run must not outlive it.
                     await adapter.cancelRun(runId).catch(() => undefined);
                     if (turn !== null)
@@ -3488,7 +3560,32 @@ runtime = {}) {
     // lived in the tab that abandoned it, and an operator could not reclaim one without restarting
     // the daemon. Registered BEFORE `/chats/:id` is irrelevant to fastify (it routes on the literal
     // segment first), but the order reads the way the routes nest.
-    app.get(`${V}/chats`, { config: { manifest: { responseType: 'ChatListResponse', statusCodes: [200, 400, 501] } } }, async (_req, reply) => {
+    app.get(`${V}/chats`, { config: { manifest: { responseType: 'ChatListResponse', statusCodes: [200, 400, 501] } } }, async (req, reply) => {
+        // DES-SYSTEM-CHAT (api-types 0.137.0): the paged history rides beside the live rows.
+        const q = req.query;
+        const one = (v) => (Array.isArray(v) ? v[0] : v);
+        const limitRaw = one(q.limit);
+        const limit = limitRaw === undefined ? undefined : Number(limitRaw);
+        if (limit !== undefined && (!Number.isInteger(limit) || limit < 1 || limit > CHAT_HISTORY_MAX_LIMIT)) {
+            return reply.code(400).send({ error: `\`limit\` must be a whole number from 1 to ${CHAT_HISTORY_MAX_LIMIT}` });
+        }
+        const cursor = one(q.cursor);
+        if (cursor !== undefined && decodeCursor(cursor) === null)
+            return reply.code(400).send({ error: '`cursor` is not a cursor this daemon issued' });
+        const status = one(q.status) ?? 'all';
+        if (status !== 'all' && status !== 'open' && status !== 'closed') {
+            return reply.code(400).send({ error: '`status` must be open, closed or all' });
+        }
+        const history = chatHistory === null
+            ? {}
+            : chatHistory.list({
+                ...(limit !== undefined ? { limit } : {}),
+                cursor: cursor ?? null,
+                status,
+                actorId: security.authMode === 'required' ? actorOf(req).id : null,
+                liveCli: (cid) => askPaths.get(cid)?.pa ?? null,
+                isLive: (cid) => askPaths.get(cid) !== undefined || chatScopes.get(cid) !== undefined,
+            });
         try {
             const pool = await adapter.chatList().catch((err) => {
                 if (err instanceof ChatUnsupportedError)
@@ -3507,7 +3604,11 @@ runtime = {}) {
                 };
             });
             const seen = new Set(paths.map((p) => p.chatId));
-            return { chats: [...paths, ...pool.filter((c) => !seen.has(c.chatId))] };
+            // Under `auth: required` a live chat another actor opened is not listed (its history entry
+            // names its opener); local mode lists every live chat, as before.
+            const viewer = security.authMode === 'required' ? actorOf(req).id : null;
+            const mine = (cid) => viewer === null || chatHistory === null || chatHistory.entry(cid) === null || chatHistory.visibleTo(cid, viewer);
+            return { chats: [...paths, ...pool.filter((c) => !seen.has(c.chatId))].filter((c) => mine(c.chatId)), ...history };
         }
         catch (err) {
             // A build that cannot do chat is a capability gap, not a bad request: 501 tells an operator to
@@ -3562,8 +3663,15 @@ runtime = {}) {
             return reply.code(400).send({ error: message(err) });
         }
     });
-    app.delete(`${V}/chats/:id`, async (req, reply) => {
-        const { id } = req.params;
+    // Ending a chat — shared by DELETE (end + delete its history) and POST /close (end, keep it).
+    const endChat = async (id, 
+    /** Runs right after the close fold, with NO await before it: the id cannot have been reopened
+     *  yet, so a history operation here can never land on a replacement chat (xreview r1 on #1140). */
+    afterFold) => {
+        // DES-SYSTEM-CHAT: the answering CLI the history names is the path's PA, while it is known.
+        const pa = askPaths.get(id)?.pa;
+        if (pa !== undefined && pa !== null)
+            chatHistory?.setCli(id, pa);
         // The scratch root goes with the chat at once, whether or not the engine still knew it
         // (crew#502). ASK-C1: the daemon owns the close, so the id is HELD — no grace timer — until
         // this close settles below; a reopen meanwhile is refused and a second DELETE joins this one
@@ -3597,17 +3705,122 @@ runtime = {}) {
                 chatScopes.closeHeld(id, ticket);
                 runtime.broadcast?.(frame);
             }
-            if (path?.runId !== undefined)
-                await adapter.cancelRun(path.runId).catch(() => undefined);
+            afterFold?.();
+            if (path?.runId !== undefined) {
+                const runId = path.runId;
+                const cancelled = await adapter.cancelRun(runId).then(() => null, (err) => message(err));
+                if (cancelled !== null)
+                    return { ok: true, cancelError: { runId, error: cancelled } };
+            }
             return { ok: true };
         }
         catch (err) {
-            return reply.code(400).send({ error: message(err) });
+            return { ok: false, error: message(err) };
         }
         finally {
             // Never left held: a fold that threw frees the id here (its own close settles it otherwise).
             chatScopes.closeHeld(id, ticket);
         }
+    };
+    app.delete(`${V}/chats/:id`, async (req, reply) => {
+        const { id } = req.params;
+        // DES-SYSTEM-CHAT: DELETE also deletes the chat's history and attachments (POST /close keeps them)
+        // — under `auth: required` only its opener's (another actor's chat is not this caller's to end).
+        const viewer = security.authMode === 'required' ? actorOf(req).id : null;
+        if (chatHistory !== null && chatHistory.entry(id) !== null && !chatHistory.visibleTo(id, viewer)) {
+            return reply.code(404).send({ error: `no chat ${id} on this daemon` });
+        }
+        const removeHistory = () => {
+            chatHistory?.remove(id);
+            chatAttachments.removeChat(id);
+        };
+        const ended = await endChat(id, removeHistory);
+        if (!ended.ok)
+            return reply.code(400).send({ error: ended.error });
+        // A chat the daemon no longer held (no fold ran): its kept history goes too.
+        if (chatHistory?.entry(id) !== null && chatScopes.get(id) === undefined && askPaths.get(id) === undefined)
+            removeHistory();
+        return { ok: true };
+    });
+    // DES-SYSTEM-CHAT (api-types 0.137.0): end the chat and KEEP its history and attachments.
+    app.post(`${V}/chats/:id/close`, { config: { manifest: { responseType: 'ChatCloseResponse', statusCodes: [200, 400, 404, 501, 502] } } }, async (req, reply) => {
+        const { id } = req.params;
+        if (chatHistory === null)
+            return reply.code(501).send({ error: 'this daemon keeps no chat history' });
+        const viewer = security.authMode === 'required' ? actorOf(req).id : null;
+        const known = chatHistory.entry(id) !== null;
+        if ((!known && askPaths.get(id) === undefined) || (known && !chatHistory.visibleTo(id, viewer))) {
+            return reply.code(404).send({ error: `no chat ${id} on this daemon` });
+        }
+        // The close fold archives it; closing here too (before the id is free) covers a route set
+        // without the fold, and is a no-op after it.
+        const ended = await endChat(id, () => chatHistory.closed(id));
+        if (!ended.ok)
+            return reply.code(400).send({ error: ended.error });
+        const chat = chatHistory.entry(id);
+        if (chat === null)
+            return reply.code(404).send({ error: `chat ${id} has no history on this daemon` });
+        if (ended.cancelError !== undefined) {
+            // The chat is ended and its history kept, but its run was NOT cancelled: said, never "ok".
+            return reply.code(502).send({
+                error: `chat ${id} is closed and its history kept, but its run ${ended.cancelError.runId} could not be cancelled (${ended.cancelError.error}) — cancel it from the run`,
+                runId: ended.cancelError.runId,
+                chat,
+            });
+        }
+        return { ok: true, chat };
+    });
+    // DES-SYSTEM-CHAT (api-types 0.137.0): reopen a chat — its records, live or kept.
+    app.get(`${V}/chats/:id/messages`, { config: { manifest: { responseType: 'ChatMessagesResponse', statusCodes: [200, 404, 501] } } }, async (req, reply) => {
+        const { id } = req.params;
+        if (chatHistory === null)
+            return reply.code(501).send({ error: 'this daemon keeps no chat history' });
+        const viewer = security.authMode === 'required' ? actorOf(req).id : null;
+        const chat = chatHistory.visibleTo(id, viewer)
+            ? chatHistory.entry(id, askPaths.get(id)?.pa ?? null, (cid) => askPaths.get(cid) !== undefined || chatScopes.get(cid) !== undefined)
+            : null;
+        const messages = chat === null ? null : chatHistory.messages(id);
+        if (chat === null || messages === null)
+            return reply.code(404).send({ error: `no chat ${id} in this daemon's history` });
+        return { chat, messages, attachments: chatAttachments.list(id) };
+    });
+    // DES-SYSTEM-CHAT (api-types 0.137.0): upload files to a chat (multipart/form-data). The body is
+    // buffered by a parser scoped to this route alone, capped a little over the per-message total;
+    // the per-file and per-message caps, and the types (decided from the bytes), are checked before
+    // anything is stored.
+    void app.register(async (scope) => {
+        scope.addContentTypeParser('multipart/form-data', { parseAs: 'buffer', bodyLimit: ATTACHMENT_MAX_MESSAGE_BYTES + 1024 * 1024 }, (_req, body, done) => done(null, body));
+        scope.setErrorHandler((err, _req, reply) => {
+            if (err.code === 'FST_ERR_CTP_BODY_TOO_LARGE') {
+                return reply.code(413).send(new AttachmentError(413, 'attachments_too_large', `the upload is over the ${Math.round(ATTACHMENT_MAX_MESSAGE_BYTES / 1048576)} MiB limit per message`).body());
+            }
+            if (err.code === 'FST_ERR_CTP_INVALID_MEDIA_TYPE') {
+                return reply.code(400).send(new AttachmentError(400, 'attachment_malformed', 'upload files as multipart/form-data').body());
+            }
+            return reply.send(err);
+        });
+        scope.post(`${V}/chats/:id/attachments`, { config: { manifest: { requestType: 'multipart/form-data', responseType: 'ChatAttachmentUploadResponse', statusCodes: [201, 400, 404, 413, 415] } } }, async (req, reply) => {
+            const { id } = req.params;
+            // Only a chat open on this daemon takes files (a message can only be sent on one), and
+            // under `auth: required` only its opener's.
+            const viewer = security.authMode === 'required' ? actorOf(req).id : null;
+            if (askPaths.get(id) === undefined || (chatHistory !== null && chatHistory.entry(id) !== null && !chatHistory.visibleTo(id, viewer))) {
+                return reply.code(404).send({ error: `no open chat ${id} on this daemon` });
+            }
+            const boundary = boundaryOf(req.headers['content-type']);
+            if (boundary === null || !Buffer.isBuffer(req.body)) {
+                return reply.code(400).send(new AttachmentError(400, 'attachment_malformed', 'upload files as multipart/form-data with a boundary').body());
+            }
+            try {
+                const attachments = chatAttachments.add(id, parseMultipart(req.body, boundary));
+                return reply.code(201).send({ attachments, limits: ATTACHMENT_LIMITS });
+            }
+            catch (err) {
+                if (err instanceof AttachmentError)
+                    return reply.code(err.status).send(err.body());
+                throw err;
+            }
+        });
     });
     // A unit's captured transcript. `unitKey` accepts the fully-qualified id (`run-1:survey`),
     // the id suffix (`survey`, `u3`), or the ordinal (`u3`, `3`) — see `resolveUnit`.
@@ -6918,6 +7131,235 @@ runtime = {}) {
             // F-043: the bridge emits where this daemon's interactive seams read — one bus per daemon.
             busDataDir: runtime.interactiveBridgeBusDataDir ?? null,
         });
+    // ── GET /system — the Nerve Center snapshot (DES-SYSTEM-VIEW, api-types 0.136.0) ──
+    // One derived, READ-ONLY answer: the CLIs with their 7-day record, every unfinished run with a
+    // COMPUTED liveness, the infrastructure as real bounded probes, the governance instruments and
+    // `attention[]`. Every probe runs per request (no cached "ok"); only the 7-day fold over the run
+    // store is kept for SYSTEM_STATS_TTL_MS, with its `asOf`. The whole answer is held to
+    // SYSTEM_BUDGET_MS: a part that does not settle in time reads `unknown` (or `null`) with why.
+    const weekFoldCache = new WeekFoldCache();
+    /** One stat of a run's durable event log: read before the 7-day fold, so the fold can never eat
+     *  the time a liveness verdict needs. */
+    const EVIDENCE_TIMEOUT_MS = 1_000;
+    const systemExec = runtime.systemExec ?? ((file, args, opts) => execCapped(file, args, { timeout: opts.timeout }));
+    app.get(`${V}/system`, { config: { manifest: { responseType: 'SystemSnapshot', statusCodes: [200] } } }, async () => {
+        const startedAt = Date.now();
+        const deadline = startedAt + SYSTEM_BUDGET_MS - 500;
+        const left = () => Math.max(0, deadline - Date.now());
+        const dbPath = typeof adapter.dbPath === 'string' && adapter.dbPath !== '' && adapter.dbPath !== ':memory:' ? adapter.dbPath : null;
+        const stateHome = dbPath !== null ? stateHomeOfDb(dbPath) : null;
+        const containerFloor = isContainerSeatFloor();
+        const roster = (() => {
+            try {
+                return markOptIn(rosterWithStanding());
+            }
+            catch {
+                return [];
+            }
+        })();
+        // Reads the folds and the run list depend on, each bounded.
+        const viewsP = settleWithin(async () => {
+            const detail = await adapter.sessionsDetail();
+            await backfillEndedAt(detail);
+            return detail.map(decorateRun);
+        }, PROBE_TIMEOUT_MS);
+        const settingsP = settleWithin(() => Promise.resolve(adapter.getSettings()), PROBE_TIMEOUT_MS);
+        const gatesP = settleWithin(async () => (typeof adapter.interactionRequests === 'function' ? await adapter.interactionRequests(undefined, 'open') : null), PROBE_TIMEOUT_MS);
+        const diagP = settleWithin(() => diagnosticsNow(), PROBE_TIMEOUT_MS);
+        const pingP = settleWithin(() => enginePing(), PROBE_TIMEOUT_MS);
+        const rulesP = settleWithin(async () => {
+            if (typeof adapter.listConformanceRules !== 'function')
+                return null;
+            const rules = await adapter.listConformanceRules();
+            return rules.filter((r) => r.retired !== true).length;
+        }, PROBE_TIMEOUT_MS);
+        const gatesByYouP = settleWithin(async () => {
+            const since = Date.now() - SYSTEM_STATS_DAYS * 86_400_000;
+            const entries = await audit.readAll({ action: 'gate.decided', since });
+            return entries.filter((e) => e.actor?.kind === 'human').length;
+        }, PROBE_TIMEOUT_MS);
+        // The infra probes, all at once.
+        const gatewayDir = stateHome !== null ? gatewayDirOf(join(stateHome, 'gateway')) : null;
+        const interactiveRoots = [...new Set([defaultInteractiveRoot(stateHome ?? undefined), ...interactiveBridges.keys()])];
+        const watch = runtime.watchRegistry?.() ?? null;
+        const watchHealth = watch !== null ? (() => { try {
+            return watch.health();
+        }
+        catch {
+            return null;
+        } })() : null;
+        const infraP = Promise.all([
+            probeGateway({ containerFloor, gatewayDir, runtime: containerFloor ? resolveContainerRuntime() : null, exec: systemExec }),
+            probeBroker({
+                containerFloor,
+                clis: roster.map((r) => r.key).filter((k) => isContainerLoginCli(k)),
+                status: (cli) => containerStatus.refreshFresh(cli),
+            }),
+            probeInteractive({
+                roots: interactiveRoots,
+                readLock: (root) => readBridgeLockAsync(root),
+                health: async (url, timeoutMs) => (await fetch(url, { signal: AbortSignal.timeout(timeoutMs) })).status,
+            }),
+            probeEstate({ memoryStore: memoryStoreInfo(), call: estateReadonlyCall(memoryStoreInfo().path) }),
+            probeBus({
+                unavailable: adapter.busUnavailable ?? null,
+                seamsOff: adapter.busSeamsOff ?? null,
+                dbPath: typeof adapter.busDbPath === 'string' && adapter.busDbPath !== '' ? adapter.busDbPath : null,
+                watchBus: watchHealth?.sources.bus ?? null,
+                tailLagMs: watchHealth?.tail_lag_ms ?? null,
+            }),
+            probeVault({ vault: adapter.vaultBin != null ? vaultDiagnostics(adapter.vaultBin) : null, exec: systemExec }),
+            diskRow(stateHome),
+        ]);
+        const [views, settings, openGates, diag, ping, rules, gatesByYou, infraProbed] = await Promise.all([
+            viewsP, settingsP, gatesP, diagP, pingP, rulesP, gatesByYouP, infraP,
+        ]);
+        // The broker probe refreshed each container seat's sign-in reading: the CLI cards read the
+        // roster AFTER it, so one snapshot never says "broker: signed in" beside "claude: signed out".
+        const rosterNow = (() => {
+            try {
+                return markOptIn(rosterWithStanding());
+            }
+            catch {
+                return roster;
+            }
+        })();
+        const allViews = views.kind === 'ok' ? views.value : [];
+        // runs[] with computed liveness.
+        const { quietAfterMs, stallAfterMs } = livenessThresholds(settings.kind === 'ok' ? settings.value?.workerStallMinutes : undefined);
+        const openByRun = new Map();
+        if (openGates.kind === 'ok' && openGates.value !== null) {
+            const at = (r) => new Date(r.created_at).getTime() || 0;
+            for (const r of [...openGates.value].sort((a, b) => at(a) - at(b))) {
+                openByRun.set(r.session_id, { interactionId: r.id, ord: r.ord, kind: r.gate_kind ?? (r.kind === 'elicitation' ? 'question' : null), prompt: r.prompt.slice(0, 280) });
+            }
+        }
+        const now = Date.now();
+        const live = unfinished(allViews);
+        const evidenceOf = async (id) => {
+            let best = null;
+            const relay = runtime.runEvidence?.(id);
+            if (relay !== undefined)
+                best = { at: relay.at, source: relay.source };
+            if (dbPath !== null) {
+                const st = await settleWithin(() => fsp.stat(join(eventsDirOf(dbPath), `${id}.ndjson`)), EVIDENCE_TIMEOUT_MS);
+                if (st.kind === 'ok' && (best === null || st.value.mtimeMs > best.at))
+                    best = { at: Math.floor(st.value.mtimeMs), source: 'event_log' };
+            }
+            return best;
+        };
+        const runPairs = await Promise.all(live.map(async (view) => {
+            const cached = gateCache.get(view.session.id);
+            const gate = openByRun.get(view.session.id) ??
+                (view.session.status === 'awaiting_human' && cached !== undefined
+                    ? { interactionId: null, ord: cached.ord, kind: cached.gateKind ?? null, prompt: cached.prompt.slice(0, 280) }
+                    : null);
+            const run = runLiveness({ view, now, evidence: await evidenceOf(view.session.id), gate: view.session.status === 'awaiting_human' ? gate : null, quietAfterMs, stallAfterMs });
+            return { view, run };
+        }));
+        // The 7-day fold: cached briefly, never waited on past the budget.
+        const readEvents = async (id) => {
+            const engine = await adapter.runEvents(id);
+            if (engine === null)
+                return null;
+            const daemon = runtime.stallFrames?.(id) ?? [];
+            return daemon.length === 0 ? engine : [...engine, ...daemon];
+        };
+        const week = views.kind === 'ok' && typeof adapter.runEvents === 'function'
+            ? await settleWithin(() => weekFoldCache.get(() => readWeek(allViews, readEvents, { days: SYSTEM_STATS_DAYS, now: Date.now() })), left())
+            : null;
+        const weekFold = week?.kind === 'ok' ? week.value : null;
+        const weekNote = views.kind !== 'ok'
+            ? `the engine did not list its runs within ${PROBE_TIMEOUT_MS / 1000} s`
+            : week === null
+                ? 'the run store has no event-log read binding on this engine'
+                : week.kind === 'timeout'
+                    ? 'the 7-day fold did not finish inside this snapshot’s bound; it keeps going and the next read has it'
+                    : week.kind === 'error'
+                        ? `the 7-day fold failed: ${week.error}`
+                        : weekFold === null
+                            ? 'the run store has no event-log read binding on this engine'
+                            : undefined;
+        // Diagnostics blocks, for the rows that carry them.
+        const d = diag.kind === 'ok' ? diag.value : null;
+        const seatGov = d?.seatGovernance.seats ?? [];
+        const clis = buildClis({
+            roster: rosterNow,
+            acp: (d?.acp.byCli ?? {}),
+            seatGovernance: seatGov,
+            containerFloor,
+            hostBoundary: d?.seatGovernance.hostBoundary ?? hostSandboxLauncher(),
+            week: weekFold,
+            ...(weekNote !== undefined ? { weekNote } : {}),
+        });
+        const runs = sortRuns(runPairs.map((p) => p.run));
+        const gaps = judgeGaps(runPairs, clis);
+        // infra[]: the daemon row first (it answers this request; the engine's ping says if it is free).
+        const daemonStarted = Date.now() - Math.max(views.ms, ping.ms);
+        const pingWord = ping.kind === 'ok' ? ping.value : ping.kind === 'timeout' ? 'no answer' : `error: ${ping.error}`;
+        const daemonDetails = {
+            version: PKG_VERSION,
+            ping: pingWord,
+            warnings: healthWarningsOf(runtime.stateHome !== undefined ? (d?.stateHome ?? null) : null, runtime.skills?.baseSkill() ?? null),
+            ...(d !== null ? { components: d.components, daemon: d.daemon, recentErrors: d.recentErrors } : {}),
+        };
+        const daemonRow = views.kind !== 'ok'
+            ? infraRow('daemon', 'degraded', `serving, but the engine did not list its runs (${views.kind === 'timeout' ? `no answer within ${PROBE_TIMEOUT_MS / 1000} s` : views.error}): runs[] and the CLI stats are incomplete`, 'Re-check; if the engine stays busy, a large launch may be planning.', daemonStarted, daemonDetails, PROBE_TIMEOUT_MS)
+            : ping.kind === 'ok' && ping.value === ENGINE_BUSY_PING
+                ? infraRow('daemon', 'degraded', 'serving; the engine is busy (its ping did not answer within 1 s)', 'Re-check in a minute; a large launch may be planning.', daemonStarted, daemonDetails)
+                : ping.kind !== 'ok'
+                    ? infraRow('daemon', 'unknown', `serving; the engine ping gave ${pingWord}`, 'Re-check.', daemonStarted, daemonDetails, PROBE_TIMEOUT_MS)
+                    : infraRow('daemon', 'ok', `serving crew ${PKG_VERSION}; engine ping ${ping.value}`, null, daemonStarted, daemonDetails);
+        const storesRow = d === null
+            ? infraRow('stores', 'unknown', `diagnostics did not answer within ${PROBE_TIMEOUT_MS / 1000} s`, 'Re-check.', startedAt, {}, PROBE_TIMEOUT_MS)
+            : dbPath === null
+                ? infraRow('stores', 'unknown', 'this route set has no core store', null, startedAt, { stores: d.stores })
+                : infraRow('stores', 'ok', `${d.stores.length} store file(s), ${Math.round(d.stores.reduce((a, s) => a + s.bytes, 0) / 2 ** 20)} MiB`, null, startedAt, { stores: d.stores });
+        const floorWord = containerFloor ? 'container' : isHostSeatFloor() ? 'host' : 'unset';
+        const roleFindings = d?.seatGovernance.roleFindings ?? [];
+        const seatFloorRow = d === null
+            ? infraRow('seat_floor', 'unknown', `diagnostics did not answer (${diag.kind === 'timeout' ? `no answer within ${PROBE_TIMEOUT_MS / 1000} s` : diag.kind === 'error' ? diag.error : ''})`, 'Re-check.', startedAt, { floor: floorWord }, PROBE_TIMEOUT_MS)
+            : infraRow('seat_floor', floorWord === 'host' && (d?.seatGovernance.hostBoundary ?? null) === null ? 'degraded' : roleFindings.length > 0 ? 'degraded' : 'ok', floorWord === 'container'
+                ? 'container floor: governed seats run in hardened containers'
+                : floorWord === 'host'
+                    ? (d?.seatGovernance.hostBoundary ?? null) === null
+                        ? 'interim host floor, and no OS launcher (sandbox-exec / bwrap) on PATH: floor seats run advisory'
+                        : `interim host floor, bounded by ${d?.seatGovernance.hostBoundary}`
+                    : 'no seat floor chosen', roleFindings.length > 0 ? (roleFindings[0]?.message ?? 'see the role findings') : 'Install the OS launcher, or run the container floor.', startedAt, { floor: floorWord, rosterFile: d?.seatGovernance.rosterFile ?? null, hostBoundary: d?.seatGovernance.hostBoundary ?? null, roleFindings });
+        const infra = [
+            daemonRow,
+            ...infraProbed.slice(0, 6),
+            d !== null ? skillsRow(d.skills) : infraRow('skills', 'unknown', 'diagnostics did not answer in time', 'Re-check.', startedAt),
+            stateHomeRow(d === null ? null : (d.stateHome ?? null)),
+            storesRow,
+            seatFloorRow,
+            infraProbed[6],
+            loadRow(),
+        ];
+        const governance = buildGovernance({
+            governance: (d?.governance ?? null),
+            ...(d === null ? { governanceNote: `diagnostics did not answer (${diag.kind === 'timeout' ? `no answer within ${PROBE_TIMEOUT_MS / 1000} s` : diag.kind === 'error' ? diag.error : ''})` } : {}),
+            skillsFindings: (d?.skills.findings ?? []),
+            decisions: d?.decisions ?? null,
+            clis,
+            judgeGapCount: gaps.length,
+            week: weekFold,
+            ...(weekNote !== undefined ? { weekNote } : {}),
+            gatesByYou: gatesByYou.kind === 'ok' ? gatesByYou.value : null,
+            steeringRules: rules.kind === 'ok' ? rules.value : null,
+            ...(rules.kind === 'ok' && rules.value === null ? { steeringNote: 'this engine cannot list steering rules' } : rules.kind === 'timeout' ? { steeringNote: `the rule store did not answer within ${PROBE_TIMEOUT_MS / 1000} s` } : rules.kind === 'error' ? { steeringNote: `the rule store could not be read: ${rules.error}` } : {}),
+        });
+        const working = runs.filter((r) => r.liveness !== 'waiting_on_you' && r.liveness !== 'held').length;
+        const attention = buildAttention({
+            infra,
+            clis,
+            runs,
+            governance,
+            gaps,
+            blockedByInfra: (key) => key === 'gateway' || key === 'broker' ? (containerFloor ? working : 0) : key === 'skills' || key === 'state_home' || key === 'disk' || key === 'load' ? working : 0,
+        });
+        return assembleSnapshot({ startedAt, clis, runs, infra, governance, attention });
+    });
     registerInteractiveProxy(app, adapter, {
         settings: projectSettings,
         pool: interactiveBridges,