wicked-crew 0.16.4 → 0.16.5

package/dist/api/needs.js

@@ -0,0 +1,618 @@
+/**
+ * The one "needs you" rule (`GET /system.attention[]`, api-types 0.140.0) and its companion,
+ * `unresolved[]`.
+ *
+ * The operator's rule: anything that is work stuck (the system slowing or preventing it, work that
+ * cannot move) is counted, prioritized by impact. So `attention[]` holds one item per ROOT CAUSE
+ * holding work up right now:
+ *
+ * - `prevents`: work cannot move until a person acts (an open gate, a stalled run, a recent
+ *   failure, a down component, a seat gap with no alternative);
+ * - `slows`: the system itself slows work (host load).
+ *
+ * One cause that holds several runs is ONE item, naming them in `blockedRunIds`. A merge needs
+ * evidence, never a similar label: the same repo failing the same check on a base that fails it
+ * too (plus the run whose stated problem IS that red base, when it waits at a gate: its gate is the
+ * item's action); the same down component a held run's denial names; the same seats leaving runs
+ * with no distinct judge. Seat problems fold into the run item they block.
+ *
+ * What is NOT stuck never counts, and is never hidden either (operator, 2026-10-27: "don't let
+ * the system go green with stale jobs"): superseded runs, failed runs older than 7 days and asks
+ * parked at their turn gate past a day move to `unresolved[]`, each with what it cost and how to
+ * resolve it. Answered asks are not stuck. Pending proposals are `toReview`.
+ *
+ * Order (DEFINITION §4): runs held, then prevents before slows, then a component before one run's own
+ * cause (a component also holds every new run), then the longest wait (the gate's arrival, never the
+ * run's launch), then the units left.
+ *
+ * Pure: every input is a reading the route already made.
+ */
+const DAY_MS = 86_400_000;
+/** A failed run launched longer ago than this is history to resolve, not a need. */
+export const FAILED_FRESH_MS = 7 * DAY_MS;
+/** An ask parked at its turn gate longer than this is unresolved work. */
+export const PARKED_AFTER_MS = DAY_MS;
+/** The live components whose `down` (or silence) holds every live run. */
+const WORK_PATH = new Set(['daemon', 'gateway', 'broker']);
+/** What `down` means in words for the rows where "down" reads oddly. */
+const DOWN_WORD = { load: 'saturated', disk: 'nearly full', state_home: 'refusing launches', skills: 'refusing launches' };
+/** A held run's denial names the component it died on. */
+const CITES = {
+    gateway: /\b(inference gateway|agw[:\s]|gateway)\b/i,
+    broker: /\bbroker\b/i,
+};
+/** A floor denial whose base fails the same check: the red-base evidence. */
+const BASE_RED = /base_red_unseparated|the run base [0-9a-f]{6,40} fails this check too|base fails (this check )?too/i;
+/** The first failing check a floor denial names (`test: exit 101`). */
+const CHECK_NAME = /(?:^|[\s(\]—-])([A-Za-z][\w.-]*): exit -?\d+/;
+/** A run whose own stated problem is that its repo's base is red (the fix the group waits on). */
+const STATES_RED_BASE = /\bbase\b[^.\n]{0,40}\bred\b|\bred base\b/i;
+/** A denial that IS the missing judge (the evaluator ran on the creator's seat, or none could judge). */
+const JUDGE_DENIAL = /distinct[_ ]evaluator|no distinct judge|could not be judged|no (seat|judge) (can|could) judge/i;
+/** A dead-seat denial: every eligible seat failed the unit. */
+const DEAD_SEAT = /dead seat|every eligible seat has (now )?failed/i;
+const short = (id) => id.slice(0, 8);
+/** "1 job", "4 jobs": a count in words, never "job(s)". */
+export const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+/** A job title as a person reads it: identifiers' underscores become spaces. */
+const readable = (t) => t.replace(/_/g, ' ');
+const isoOf = (ms) => (ms === null || !Number.isFinite(ms) ? null : new Date(ms).toISOString());
+const secsToMs = (v) => (typeof v === 'number' && Number.isFinite(v) ? v * 1000 : null);
+const msOf = (v) => {
+    if (typeof v !== 'string' || v === '')
+        return null;
+    const t = Date.parse(v);
+    return Number.isFinite(t) ? t : null;
+};
+const norm = (s) => (typeof s === 'string' ? s.trim().replace(/\s+/g, ' ').toLowerCase() : '');
+const titleOf = (v) => (typeof v.session.title === 'string' && v.session.title !== '' ? v.session.title : v.session.problem.slice(0, 60));
+const repoOf = (v) => (typeof v.session.repo_ref === 'string' && v.session.repo_ref !== '' ? v.session.repo_ref : null);
+const unitsLeftOf = (v) => (v === undefined ? 0 : v.units.filter((u) => u.status !== 'done').length);
+const isAskRun = (v) => v.session.ask_path === true || /^ask\//.test(v.session.workflow_id ?? '');
+const DELIVERED = new Set(['delivered', 'pushed']);
+/**
+ * Which run replaced this one, if any: a run naming it in `retry_of`, or a LATER run with the same
+ * repo, workflow and title that completed or delivered. A failed run with a retry is resolved by
+ * that retry (`retried`); anything else superseded is still the operator's to close.
+ */
+export function supersession(views) {
+    const out = new Map();
+    for (const v of views) {
+        const r = v.session.retry_of;
+        // A cancelled retry carries nothing: the work it was meant to redo is still the original's.
+        if (v.session.status === 'cancelled')
+            continue;
+        if (typeof r === 'string' && r !== '' && r !== v.session.id && !out.has(r))
+            out.set(r, { by: v.session.id, retried: true });
+    }
+    const done = views
+        .filter((v) => v.session.status === 'completed' || DELIVERED.has(v.session.delivery ?? ''))
+        .map((v) => ({ v, at: secsToMs(v.session.created_at) }))
+        .filter((x) => x.at !== null)
+        .sort((a, b) => a.at - b.at);
+    for (const v of views) {
+        if (out.has(v.session.id))
+            continue;
+        const at = secsToMs(v.session.created_at);
+        const title = norm(titleOf(v));
+        if (at === null || title === '')
+            continue;
+        const same = done.filter((d) => d.v.session.id !== v.session.id &&
+            d.at > at &&
+            repoOf(d.v) === repoOf(v) &&
+            d.v.session.workflow_id === v.session.workflow_id &&
+            norm(titleOf(d.v)) === title);
+        // The completed successor first (a run that delivered and then failed is a weaker link).
+        const later = same.find((d) => d.v.session.status === 'completed') ?? same[0];
+        if (later !== undefined)
+            out.set(v.session.id, { by: later.v.session.id, retried: false });
+    }
+    return out;
+}
+/** An ask's TURN gate (answered by the chat's next message): a terminal gate with every unit done.
+ *  An ask held at an escalation is a real gate (68c26704). */
+export function isAnsweredAsk(v, run) {
+    if (v.session.status !== 'awaiting_human' || !isAskRun(v))
+        return false;
+    const kind = run?.gate?.kind ?? null;
+    if (kind === 'escalation')
+        return false;
+    return v.session.ask_turn === true && v.units.length > 0 && v.units.every((u) => u.status === 'done');
+}
+function gateTarget(run, runId) {
+    return {
+        kind: 'run',
+        runId,
+        ...(run?.gate?.ord != null ? { gateOrd: run.gate.ord } : {}),
+        ...(run?.gate?.interactionId != null ? { interactionId: run.gate.interactionId } : {}),
+    };
+}
+/** The unit a held run's gate is about, and the words it was denied with. */
+function denialOf(v, run) {
+    if (v === undefined)
+        return '';
+    // A live run's cause is its CURRENT gate's denial, and only while it is held there: an earlier
+    // unit's old denial (retried, overridden) never re-labels a deliver gate or a stalled run.
+    if (run !== undefined) {
+        if (run.liveness !== 'held')
+            return '';
+        const ord = run.gate?.ord ?? null;
+        const at = ord !== null ? v.units.find((u) => u.ord === ord) : undefined;
+        if (at !== undefined)
+            return typeof at.denial_reason === 'string' ? at.denial_reason : '';
+    }
+    return v.units.map((u) => u.denial_reason ?? '').find((d) => d !== '') ?? '';
+}
+/** The seats in a run's pool that cannot take its work, in words ("pi signed out, copilot benched"). */
+function seatsOut(v, clis) {
+    const pool = v?.session.clis !== undefined && v.session.clis.length > 0 ? new Set(v.session.clis.map((k) => k.split('#', 1)[0])) : null;
+    return clis
+        .filter((c) => (pool === null || pool.has(c.cli.split('#', 1)[0])) && (c.state === 'signed_out' || c.state === 'benched'))
+        .map((c) => `${c.cli} ${c.state === 'benched' ? `benched${c.benchedUntil !== undefined ? ` until ${c.benchedUntil.slice(11, 16)} UTC` : ''}` : 'signed out'}`);
+}
+/** Why a held run is held, in a person's words (the denial's category, never its raw text). */
+function heldWords(denial, dead, noFailover) {
+    if (dead)
+        return noFailover ? 'No other helper can take over' : 'Its helper stopped unexpectedly';
+    if (JUDGE_DENIAL.test(denial))
+        return 'It needs a reviewer other than the helper that built it';
+    // Enforcement that never ran is not a refusal: the calls went unchecked (core#653).
+    if (/governance_unproven|gate-hook never ran|went unchecked/i.test(denial))
+        return 'Its tool calls ran without the required checks';
+    if (/boundary-deny|denied a tool[- ]call|tool call was refused|refused (a |the )?tool/i.test(denial))
+        return 'A tool call was refused by the job’s rules';
+    if (/input governance/i.test(denial))
+        return 'Its input was refused by the job’s rules';
+    if (/floor failed|repo checks/i.test(denial))
+        return 'Its checks failed';
+    return 'It stopped and waits for your decision';
+}
+/** What a gate that waits on you asks, in a person's words. */
+function waitingWords(kind) {
+    if (kind === 'deliver')
+        return 'Ready to deliver';
+    if (kind === 'plan_approval' || kind === 'plan')
+        return 'Waiting for you to approve its plan';
+    if (kind === 'question')
+        return 'It asks you a question';
+    if (kind === 'terminal')
+        return 'Waiting for you to accept it';
+    return 'Waiting for your decision';
+}
+function runItem(m, clis) {
+    const r = m.run;
+    const v = m.view;
+    const title = readable(v !== undefined ? titleOf(v) : `job ${short(m.runId)}`);
+    if (r === undefined) {
+        // A recent failed run: it stopped, and a person decides what happens to the work.
+        return {
+            id: `run:${m.runId}`,
+            source: 'run',
+            kind: 'prevents',
+            title,
+            reason: 'It failed',
+            remedy: 'Open the job: retry it, or archive it with a reason.',
+            target: { kind: 'run', runId: m.runId },
+            action: { kind: 'open_run', label: 'Open the job' },
+        };
+    }
+    const denial = denialOf(v, r);
+    const dead = r.liveness === 'held' && DEAD_SEAT.test(denial);
+    const out = dead ? seatsOut(v, clis) : [];
+    const signIn = out.filter((x) => x.endsWith('signed out')).map((x) => x.split(' ')[0]);
+    return {
+        id: `run:${m.runId}`,
+        source: 'run',
+        kind: 'prevents',
+        title: dead ? `A job lost its helper: ${title}` : title,
+        reason: r.liveness === 'waiting_on_you' ? waitingWords(r.gate?.kind)
+            : r.liveness === 'held' ? heldWords(denial, dead, out.length > 0)
+                : `${r.reason.charAt(0).toUpperCase()}${r.reason.slice(1)}`,
+        remedy: r.liveness === 'waiting_on_you'
+            ? 'Answer the gate.'
+            : r.liveness === 'held'
+                ? dead
+                    ? `Approve the retry${signIn.length > 0 ? `; sign in ${signIn.join(' and ')} so another helper can take over` : ''}${out.length > signIn.length ? ` (${out.filter((x) => !x.endsWith('signed out')).join(', ')})` : ''}.`
+                    : 'Open the gate and decide: retry with a note, reassign, or stop.'
+                : 'Open the job: reassign the step or stop it. The watchdog re-dispatches a silent step on its own after its threshold.',
+        target: gateTarget(r, m.runId),
+        action: r.gate !== undefined ? { kind: 'open_gate', label: 'Open the gate' } : { kind: 'open_run', label: 'Open the job' },
+    };
+}
+export function buildNeeds(input) {
+    const { now } = input;
+    const byId = new Map(input.views.map((v) => [v.session.id, v]));
+    const runById = new Map(input.runs.map((r) => [r.runId, r]));
+    const sup = supersession(input.views);
+    const unresolved = [];
+    const members = [];
+    /** Runs that are not stuck (answered asks): no later pass (judge gaps, no worker, load) brings them back. */
+    const notStuck = new Set();
+    const eligible = (runId) => !notStuck.has(runId) && !sup.has(runId) && byId.get(runId)?.session.archived_at == null;
+    const costFor = (v) => {
+        const c = input.costOf?.(v.session.id);
+        const start = secsToMs(v.session.created_at);
+        const end = secsToMs(v.session.ended_at) ?? (v.session.status === 'failed' || v.session.status === 'completed' || v.session.status === 'cancelled' ? null : now);
+        return { costUsd: c?.costUsd ?? null, tokens: c?.tokens ?? null, wallMs: start !== null && end !== null ? Math.max(0, end - start) : null };
+    };
+    const pushUnresolved = (v, why, reason, since, actions, by) => {
+        unresolved.push({
+            id: `unresolved:${v.session.id}`,
+            runId: v.session.id,
+            title: readable(titleOf(v)),
+            repo: repoOf(v),
+            workflow: v.session.workflow_id ?? null,
+            status: v.session.status,
+            why,
+            reason,
+            ...(by !== undefined ? { supersededBy: by } : {}),
+            since: isoOf(since),
+            cost: costFor(v),
+            actions,
+        });
+    };
+    for (const v of input.views) {
+        if (v.session.archived_at != null)
+            continue; // resolved on the record
+        const id = v.session.id;
+        const run = runById.get(id);
+        const s = sup.get(id);
+        const status = v.session.status;
+        const gateAt = msOf(run?.gate?.receivedAt ?? null);
+        const endedAt = secsToMs(v.session.ended_at);
+        if (status === 'failed') {
+            if (s?.retried === true)
+                continue; // retried: the retry carries the work
+            // Aged from the FAILURE (its end); a run with no end on record is aged from its launch.
+            const failedAt = endedAt ?? secsToMs(v.session.created_at);
+            if (s !== undefined) {
+                const d = byId.get(s.by);
+                pushUnresolved(v, 'superseded', `failed; superseded by ${short(s.by)}, which ${d !== undefined && DELIVERED.has(d.session.delivery ?? '') ? 'delivered' : 'completed'}`, failedAt, ['close_superseded', 'archive'], s.by);
+                continue;
+            }
+            if (failedAt !== null && now - failedAt > FAILED_FRESH_MS) {
+                pushUnresolved(v, 'failed', `failed ${plural(Math.round((now - failedAt) / DAY_MS), 'day')} ago and was never retried or archived`, failedAt, ['retry', 'archive']);
+                continue;
+            }
+            members.push({ runId: id, view: v, run: undefined, severity: 'red', waitedMs: failedAt });
+            continue;
+        }
+        if (run === undefined)
+            continue; // completed / cancelled: resolved
+        // An open run is superseded only while it is parked at a gate (resolve can close it) and its
+        // successor did not itself fail or get cancelled (then this run is still the work).
+        const successor = s !== undefined ? byId.get(s.by) : undefined;
+        const replaced = s !== undefined && status === 'awaiting_human' && successor?.session.status !== 'failed' && successor?.session.status !== 'cancelled';
+        if (s !== undefined && !replaced)
+            sup.delete(id);
+        if (s !== undefined && replaced) {
+            const d = byId.get(s.by);
+            const how = s.retried ? `retried as ${short(s.by)}` : `superseded by ${short(s.by)}`;
+            const what = d === undefined ? '' : d.session.status === 'completed' || DELIVERED.has(d.session.delivery ?? '') ? `, which ${DELIVERED.has(d.session.delivery ?? '') ? 'delivered' : 'completed'}` : `, which is ${d.session.status.replace(/_/g, ' ')}`;
+            pushUnresolved(v, 'superseded', `still open at its ${run.gate?.kind?.replace(/_/g, ' ') ?? 'last'} gate; ${how}${what}`, gateAt, ['close_superseded', 'archive'], s.by);
+            continue;
+        }
+        if (isAnsweredAsk(v, run)) {
+            notStuck.add(id);
+            if (gateAt !== null && now - gateAt > PARKED_AFTER_MS) {
+                pushUnresolved(v, 'parked', `an answered ask parked at its turn for ${Math.round((now - gateAt) / 3_600_000)} h`, gateAt, ['archive']);
+            }
+            continue;
+        }
+        if (run.liveness === 'working' || run.liveness === 'quiet')
+            continue;
+        members.push({ runId: id, view: v, run, severity: run.liveness === 'waiting_on_you' ? 'yellow' : 'red', waitedMs: gateAt });
+    }
+    const groups = new Map();
+    const join = (key, m, build) => {
+        const g = groups.get(key);
+        if (g === undefined)
+            groups.set(key, { key, members: [m], build });
+        else if (!g.members.some((x) => x.runId === m.runId))
+            g.members.push(m);
+    };
+    // Down (or silent) components first: a held run whose denial names one joins it.
+    const infraItems = [];
+    for (const row of input.infra) {
+        if (row.state === 'down')
+            infraItems.push({ row, kind: 'prevents' });
+        else if (row.state === 'degraded' && (row.key === 'load' || row.key === 'daemon' || (row.key === 'skills' && /launches wait/i.test(row.reason))))
+            infraItems.push({ row, kind: 'slows' });
+        else if (row.state === 'unknown' && WORK_PATH.has(row.key))
+            infraItems.push({ row, kind: 'slows' });
+    }
+    // A down component claims the held runs whose denial names it, and the stalled runs on its path
+    // (a stalled run behind a dead gateway is the gateway's, not a cause of its own).
+    const claimed = new Set();
+    for (const { row } of infraItems) {
+        if (row.state !== 'down')
+            continue;
+        const cites = CITES[row.key];
+        const onPath = input.infraHoldsLive(row.key);
+        for (const m of members) {
+            if (m.run === undefined)
+                continue;
+            if ((cites !== undefined && cites.test(denialOf(m.view, m.run))) || (onPath && m.run.liveness === 'stalled'))
+                claimed.add(`${row.key}\u0000${m.runId}`);
+        }
+    }
+    // Red base: same repo, same failing check, a base that fails it too.
+    const baseKey = (m) => {
+        if (m.run === undefined || m.view === undefined)
+            return null;
+        const d = denialOf(m.view, m.run);
+        if (!BASE_RED.test(d))
+            return null;
+        const repo = repoOf(m.view);
+        if (repo === null)
+            return null;
+        return `base:${repo}:${CHECK_NAME.exec(d)?.[1] ?? 'checks'}`;
+    };
+    const rest = [];
+    for (const m of members) {
+        if ([...claimed].some((c) => c.endsWith(`\u0000${m.runId}`)))
+            continue;
+        const k = baseKey(m);
+        if (k !== null) {
+            join(k, m, (ms) => baseRedItem(k, ms));
+            continue;
+        }
+        rest.push(m);
+    }
+    // The fix the red base waits on: a run in that repo whose own problem is the red base.
+    const left = [];
+    for (const m of rest) {
+        const repo = m.view !== undefined ? repoOf(m.view) : null;
+        // The fix waits at its DELIVER gate (its own work is done); one fix per red base.
+        const target = m.run !== undefined && m.run.gate?.kind === 'deliver' && repo !== null && STATES_RED_BASE.test(m.view?.session.problem ?? '')
+            ? [...groups.values()].filter((g) => g.key.startsWith(`base:${repo}:`) && !g.members.some(baseKeyless)).sort((a, b) => b.members.length - a.members.length)[0]
+            : undefined;
+        if (target !== undefined)
+            target.members.push(m);
+        else
+            left.push(m);
+    }
+    // Runs with no distinct judge and nothing else holding them: one item per set of missing seats.
+    const gapByRun = new Map(input.gaps.map((g) => [g.run.runId, g]));
+    const seatKey = (gap) => `seat:${gap.creator ?? ''}:${gap.blockedBy.map((c) => c.cli).sort().join('+')}`;
+    const seatGroup = (key, gap) => (ms) => {
+        const who = gap.blockedBy.map((c) => `${c.cli} ${c.state === 'benched' ? 'benched' : c.state.replace('_', ' ')}`);
+        return {
+            id: ms.length === 1 ? `judge:${ms[0].runId}` : key,
+            severity: 'red',
+            source: 'run',
+            kind: 'prevents',
+            title: ms.length === 1 ? 'A job has no independent reviewer' : `${ms.length} jobs have no independent reviewer`,
+            reason: `No helper in the pool can review ${gap.creator ?? 'the creator'}’s work${who.length > 0 ? ` (${who.join(', ')})` : ''}`,
+            remedy: 'Sign in another helper in the job’s pool, or reassign the step to a helper whose work another helper can review.',
+            target: gateTarget(ms[0].run, ms[0].runId),
+            action: ms[0].run?.gate !== undefined ? { kind: 'open_gate', label: 'Open the gate' } : { kind: 'open_run', label: 'Open the job' },
+        };
+    };
+    for (const m of left) {
+        const gap = gapByRun.get(m.runId);
+        // A held run whose own denial IS the missing judge joins the other runs missing the same seats;
+        // a run held by its own failure keeps its item, the seat gap named in it.
+        if (gap !== undefined && JUDGE_DENIAL.test(denialOf(m.view, m.run))) {
+            const key = seatKey(gap);
+            join(key, m, seatGroup(key, gap));
+            continue;
+        }
+        join(`run:${m.runId}`, m, (ms) => {
+            const base = runItem(ms[0], input.clis);
+            if (gap === undefined)
+                return base;
+            const who = gap.blockedBy.map((c) => `${c.cli} ${c.state === 'benched' ? 'benched' : c.state.replace('_', ' ')}`);
+            return { ...base, severity: 'red', reason: `${base.reason}; no independent reviewer for ${gap.creator ?? 'its creator'}’s work${who.length > 0 ? ` (${who.join(', ')})` : ''}` };
+        });
+    }
+    const memberIds = new Set(members.map((m) => m.runId));
+    for (const gap of input.gaps) {
+        if (memberIds.has(gap.run.runId) || !eligible(gap.run.runId))
+            continue;
+        const key = seatKey(gap);
+        join(key, { runId: gap.run.runId, view: byId.get(gap.run.runId), run: gap.run, severity: 'red', waitedMs: msOf(gap.run.gate?.receivedAt ?? null) }, seatGroup(key, gap));
+    }
+    // No seat can take any work at all: that is its own item, holding every run.
+    const anyWorker = input.clis.some((c) => c.workEligible && c.state !== 'signed_out' && c.state !== 'benched');
+    if (input.clis.length > 0 && !anyWorker) {
+        const live = input.runs.filter((r) => eligible(r.runId)).map((r) => ({ runId: r.runId, view: byId.get(r.runId), run: r, severity: 'red', waitedMs: msOf(r.gate?.receivedAt ?? null) }));
+        groups.set('cli:none', {
+            key: 'cli:none',
+            members: live,
+            build: () => ({
+                id: 'cli:none',
+                severity: 'red',
+                source: 'cli',
+                kind: 'prevents',
+                title: 'No helper can take work',
+                reason: `Every helper is signed out or benched (${seatsOut(undefined, input.clis).join(', ')})`,
+                remedy: 'Sign a CLI in, or wait for a bench to lift.',
+                target: { kind: 'cli', cli: input.clis[0].cli },
+                action: input.clis.some((c) => c.canSignIn) ? { kind: 'sign_in', label: 'Sign in' } : null,
+            }),
+        });
+    }
+    const items = [];
+    const finish = (g, body) => {
+        const ms = g.members;
+        const waits = ms.map((m) => m.waitedMs).filter((x) => x !== null);
+        items.push({
+            ...body,
+            severity: body.severity ?? (ms.some((m) => m.severity === 'red') ? 'red' : 'yellow'),
+            blocks: ms.length,
+            blockedRunIds: ms.map((m) => m.runId),
+            // A slowdown has no wait of its own: the runs it slows wait on their own causes.
+            waitedSince: body.kind === 'slows' ? null : isoOf(waits.length > 0 ? Math.min(...waits) : null),
+            unitsLeft: ms.reduce((a, m) => a + unitsLeftOf(m.view), 0),
+        });
+    };
+    for (const g of groups.values())
+        finish(g, g.build(g.members));
+    // Components: a down one holds the runs whose denial names it (and every live run when it is on
+    // their path); host load slows the held runs whose next step is real work, and every new run.
+    const heldMembers = members.filter((m) => m.run !== undefined);
+    for (const { row, kind } of infraItems) {
+        const held = [];
+        const add = (m) => {
+            if (!held.some((x) => x.runId === m.runId))
+                held.push(m);
+        };
+        if (row.key === 'load') {
+            for (const m of heldMembers)
+                if (m.run.gate?.kind === 'escalation' && m.view !== undefined && !isAskRun(m.view))
+                    add(m);
+            for (const r of input.runs)
+                if ((r.liveness === 'working' || r.liveness === 'quiet' || r.liveness === 'stalled') && eligible(r.runId))
+                    add({ runId: r.runId, view: byId.get(r.runId), run: r, severity: 'yellow', waitedMs: null });
+        }
+        else {
+            for (const m of heldMembers)
+                if (claimed.has(`${row.key}\u0000${m.runId}`))
+                    add(m);
+            if (input.infraHoldsLive(row.key)) {
+                for (const r of input.runs)
+                    if ((r.liveness === 'working' || r.liveness === 'quiet' || r.liveness === 'stalled') && eligible(r.runId))
+                        add({ runId: r.runId, view: byId.get(r.runId), run: r, severity: 'red', waitedMs: null });
+            }
+        }
+        // A slowdown that slows no work is not stuck work (a down component still prevents new runs).
+        // The one exception: a run list that could not be read, so nothing proves there is no work.
+        if (kind === 'slows' && held.length === 0 && !(row.key === 'daemon' && row.state === 'degraded'))
+            continue;
+        const down = row.state === 'down';
+        finish({ members: held }, {
+            id: `infra:${row.key}`,
+            severity: down ? 'red' : 'yellow',
+            source: 'infra',
+            kind,
+            title: `${row.label}: ${row.state === 'unknown' ? 'not answering' : down ? (DOWN_WORD[row.key] ?? 'down') : 'degraded'}`,
+            reason: `${row.reason}${held.length > 0 ? `; it ${kind === 'slows' ? 'slows the next step of' : 'holds'} ${plural(held.length, 'job')}${row.key === 'load' ? ' and every new one' : ''}` : ''}`,
+            remedy: row.remedy ?? 'Re-check.',
+            target: { kind: 'infra', key: row.key },
+            action: { kind: 'recheck', label: 'Re-check' },
+        });
+    }
+    const KIND_RANK = { prevents: 0, slows: 1 };
+    items.sort((a, b) => b.blocks - a.blocks ||
+        KIND_RANK[a.kind ?? 'prevents'] - KIND_RANK[b.kind ?? 'prevents'] ||
+        // A component also holds every NEW run: on a tie it outranks one run's own cause.
+        (a.source !== 'run' ? 0 : 1) - (b.source !== 'run' ? 0 : 1) ||
+        (msOf(a.waitedSince ?? null) ?? Infinity) - (msOf(b.waitedSince ?? null) ?? Infinity) ||
+        (b.unitsLeft ?? 0) - (a.unitsLeft ?? 0) ||
+        a.id.localeCompare(b.id));
+    const costed = unresolved.filter((u) => u.cost.costUsd !== null);
+    const tokened = unresolved.filter((u) => u.cost.tokens !== null);
+    unresolved.sort((a, b) => (b.cost.costUsd ?? -1) - (a.cost.costUsd ?? -1) ||
+        (msOf(a.since) ?? Infinity) - (msOf(b.since) ?? Infinity) ||
+        a.runId.localeCompare(b.runId));
+    return {
+        attention: items,
+        unresolved,
+        unresolvedSpend: {
+            costUsd: costed.length > 0 ? Math.round(costed.reduce((s, u) => s + (u.cost.costUsd ?? 0), 0) * 10_000) / 10_000 : null,
+            tokens: tokened.length > 0 ? tokened.reduce((t, u) => ({ input: t.input + u.cost.tokens.input, output: t.output + u.cost.tokens.output }), { input: 0, output: 0 }) : null,
+            costKnown: costed.length,
+        },
+    };
+}
+function baseRedItem(key, ms) {
+    const [, repo, check] = key.split(':');
+    const fix = ms.find((m) => STATES_RED_BASE.test(m.view?.session.problem ?? '') && baseKeyless(m));
+    const floors = ms.filter((m) => m !== fix);
+    const fixTitle = fix?.view !== undefined ? titleOf(fix.view) : '';
+    return {
+        id: key,
+        source: 'run',
+        kind: 'prevents',
+        title: `${readable(repo)}'s base is red inside the floor sandbox`,
+        // The fix is named once (the remedy), never in both lines.
+        // Delivery opens the fix's PR (merge stays a person's), and nothing retries the held jobs on its
+        // own: the sentence says all three steps.
+        reason: `${plural(floors.length, 'job')} ${floors.length === 1 ? 'fails' : 'fail'} \`${check}\` on a base that fails it too.${fix !== undefined ? ' The fix is ready: approve its delivery and merge it, then retry the held jobs.' : ''}`,
+        remedy: fix !== undefined
+            ? `Deliver “${readable(fixTitle)}”.`
+            : 'Make the base green (or use the floor override), then retry the held jobs.',
+        target: gateTarget((fix ?? ms[0]).run, (fix ?? ms[0]).runId),
+        action: { kind: 'open_gate', label: fix !== undefined ? 'Open the fix’s gate' : 'Open the gate' },
+    };
+}
+/** A run that joined a red-base group as its fix (it has no red-base denial of its own). */
+function baseKeyless(m) {
+    return !BASE_RED.test(denialOf(m.view, m.run));
+}
+/** The level: `red` when an attention item is red; `yellow` when anything needs a look OR is
+ *  unresolved; `green` only when both are empty. */
+export function needsLevel(attention, unresolved = []) {
+    if (attention.some((a) => a.severity === 'red'))
+        return 'red';
+    return attention.length > 0 || unresolved.length > 0 ? 'yellow' : 'green';
+}
+/** Fold one run's event log into what it cost (`cliUsage` frames). `null` fields when none carried it. */
+export function foldRunCost(events) {
+    let input = 0;
+    let output = 0;
+    let tokens = false;
+    let cost = 0;
+    let costed = false;
+    for (const e of events) {
+        if (e.type !== 'cliUsage')
+            continue;
+        const i = typeof e['inputTokens'] === 'number' ? e['inputTokens'] : undefined;
+        const o = typeof e['outputTokens'] === 'number' ? e['outputTokens'] : undefined;
+        if (i !== undefined || o !== undefined) {
+            tokens = true;
+            input += i ?? 0;
+            output += o ?? 0;
+        }
+        if (typeof e['costUsd'] === 'number' && Number.isFinite(e['costUsd'])) {
+            costed = true;
+            cost += e['costUsd'];
+        }
+    }
+    return { costUsd: costed ? Math.round(cost * 10_000) / 10_000 : null, tokens: tokens ? { input, output } : null };
+}
+/** Per-run cost, read once per terminal run (it cannot change) and briefly for an open one. The
+ *  snapshot never waits past its bound: a run not read yet reads unknown, and the next read has it. */
+export class RunCostCache {
+    ttlMs;
+    now;
+    done = new Map();
+    inFlight = null;
+    constructor(ttlMs = 60_000, now = Date.now) {
+        this.ttlMs = ttlMs;
+        this.now = now;
+    }
+    get(runId) {
+        return this.done.get(runId)?.cost;
+    }
+    /** Read every listed run not cached, stale, or whose `stamp` moved (a failed run resumed and ended
+     *  again has a new end: its cost is read again); resolves when all are read. */
+    fill(runs, read) {
+        if (this.inFlight !== null)
+            return this.inFlight;
+        const t = this.now();
+        const todo = runs.filter((r) => {
+            const c = this.done.get(r.id);
+            return c === undefined || c.stamp !== (r.stamp ?? '') || (!c.final && t - c.at > this.ttlMs);
+        });
+        if (todo.length === 0)
+            return Promise.resolve();
+        this.inFlight = (async () => {
+            for (const r of todo) {
+                try {
+                    const events = await read(r.id);
+                    if (events !== null)
+                        this.done.set(r.id, { at: this.now(), cost: foldRunCost(events), final: r.final, stamp: r.stamp ?? '' });
+                }
+                catch {
+                    // unreadable: stays unknown, retried next read
+                }
+            }
+        })().finally(() => {
+            this.inFlight = null;
+        });
+        return this.inFlight;
+    }
+}
+//# sourceMappingURL=needs.js.map