wicked-crew 0.6.0 → 0.7.0

package/dist/api/audit.d.ts

@@ -21,6 +21,8 @@ export interface AuditReadFilter {
     /** Max entries returned (newest first). Default 200, capped at 1000. */
     limit?: number;
 }
+/** `readAll`'s filter: no limit — the whole point is that nothing gets trimmed. */
+export type AuditScanFilter = Omit<AuditReadFilter, 'limit'>;
 export declare class AuditLog {
     readonly path: string;
     private readonly warn;
@@ -53,5 +55,16 @@ export declare class AuditLog {
      * still answers.
      */
     read(filter?: AuditReadFilter): Promise<AuditEntry[]>;
+    /**
+     * Read the trail EXHAUSTIVELY, newest first — no read cap. The hydrate path
+     * for the boot-time indexes (`RetryIndex`, `GuidanceIndex`): durable facts
+     * like retry lineage must not vanish because 1000+ newer launches landed on
+     * top of them (BRIEF-UX-002 C5). Same cost class as `read` — that already
+     * parses the whole file and only trims the returned slice — so this is a
+     * one-time full-file scan at boot, measured at ~19ms on a 19k-line live trail.
+     */
+    readAll(filter?: AuditScanFilter): Promise<AuditEntry[]>;
+    /** The shared full-file parse: every matching entry, newest first, uncapped. */
+    private scan;
 }
 //# sourceMappingURL=audit.d.ts.map

package/dist/api/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/api/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE1D,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,QAAQ;IAMjB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IANvB,OAAO,CAAC,KAAK,CAAoC;IACjD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAS;gBAGd,IAAI,GAAE,MAA2B,EACzB,IAAI,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAA6B;IAGvE;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,IAAI,QAAQ;IAMvB;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI;IAyBzG,wCAAwC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB;;;;OAIG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;CA2B5D"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/api/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE1D,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;AAE7D,qBAAa,QAAQ;IAMjB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IANvB,OAAO,CAAC,KAAK,CAAoC;IACjD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAS;gBAGd,IAAI,GAAE,MAA2B,EACzB,IAAI,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAA6B;IAGvE;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,IAAI,QAAQ;IAMvB;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI;IAyBzG,wCAAwC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB;;;;OAIG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAM3D;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAIxD,gFAAgF;YAClE,IAAI;CA0BnB"}

package/dist/api/audit.js

@@ -77,6 +77,23 @@ export class AuditLog {
      * still answers.
      */
     async read(filter) {
+        const entries = await this.scan(filter);
+        const limit = Math.min(Math.max(filter?.limit ?? 200, 1), 1000);
+        return entries.slice(0, limit);
+    }
+    /**
+     * Read the trail EXHAUSTIVELY, newest first — no read cap. The hydrate path
+     * for the boot-time indexes (`RetryIndex`, `GuidanceIndex`): durable facts
+     * like retry lineage must not vanish because 1000+ newer launches landed on
+     * top of them (BRIEF-UX-002 C5). Same cost class as `read` — that already
+     * parses the whole file and only trims the returned slice — so this is a
+     * one-time full-file scan at boot, measured at ~19ms on a 19k-line live trail.
+     */
+    readAll(filter) {
+        return this.scan(filter);
+    }
+    /** The shared full-file parse: every matching entry, newest first, uncapped. */
+    async scan(filter) {
         if (this.disabled)
             return [];
         await this.flush();
@@ -108,8 +125,7 @@ export class AuditLog {
             }
         }
         entries.reverse(); // file order is append order; the API answers newest first
-        const limit = Math.min(Math.max(filter?.limit ?? 200, 1), 1000);
-        return entries.slice(0, limit);
+        return entries;
     }
 }
 //# sourceMappingURL=audit.js.map

package/dist/api/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/api/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,OAAO,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;AACtF,CAAC;AASD,MAAM,OAAO,QAAQ;IAMR;IACQ;IANX,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACzC,QAAQ,GAAG,KAAK,CAAC;IACjB,QAAQ,GAAG,KAAK,CAAC;IAEzB,YACW,OAAe,gBAAgB,EAAE,EACzB,OAA8B,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAD5D,SAAI,GAAJ,IAAI,CAA6B;QACzB,SAAI,GAAJ,IAAI,CAAgD;IACpE,CAAC;IAEJ;;;;;;OAMG;IACH,MAAM,CAAC,IAAI;QACT,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAc,EAAE,KAAY,EAAE,MAA6D;QAChG,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,MAAM,KAAK,GAAe;YACxB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM;YACN,KAAK;YACL,GAAG,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACpC,IAAI,CAAC,IAAI,CACP,4BAA4B,MAAM,OAAO,KAAK,CAAC,EAAE,OAAO,IAAI,CAAC,IAAI,KAC/D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,sDAAsD,CACvD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,KAAK;QACH,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,MAAwB;QACjC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC,CAAC,uBAAuB;YACxF,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,SAAS;YACjC,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;gBACzC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;oBAAE,SAAS;gBACvE,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;oBAAE,SAAS;gBACtE,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;oBAAE,SAAS;gBACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,kDAAkD;YACpD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,2DAA2D;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAChE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/api/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,OAAO,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;AACtF,CAAC;AAYD,MAAM,OAAO,QAAQ;IAMR;IACQ;IANX,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACzC,QAAQ,GAAG,KAAK,CAAC;IACjB,QAAQ,GAAG,KAAK,CAAC;IAEzB,YACW,OAAe,gBAAgB,EAAE,EACzB,OAA8B,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAD5D,SAAI,GAAJ,IAAI,CAA6B;QACzB,SAAI,GAAJ,IAAI,CAAgD;IACpE,CAAC;IAEJ;;;;;;OAMG;IACH,MAAM,CAAC,IAAI;QACT,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAc,EAAE,KAAY,EAAE,MAA6D;QAChG,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,MAAM,KAAK,GAAe;YACxB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM;YACN,KAAK;YACL,GAAG,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACpC,IAAI,CAAC,IAAI,CACP,4BAA4B,MAAM,OAAO,KAAK,CAAC,EAAE,OAAO,IAAI,CAAC,IAAI,KAC/D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,sDAAsD,CACvD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,KAAK;QACH,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,MAAwB;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAChE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,MAAwB;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,IAAI,CAAC,MAAwB;QACzC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC,CAAC,uBAAuB;YACxF,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,SAAS;YACjC,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;gBACzC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;oBAAE,SAAS;gBACvE,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;oBAAE,SAAS;gBACtE,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;oBAAE,SAAS;gBACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,kDAAkD;YACpD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,2DAA2D;QAC9E,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/api/guidance-index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The run→operator-guidance index (DES-UX-002 §7.2, CREW-UX-7).
+ *
+ * NAMING NOTE: DES-UX-002 §7.2 labels this slice CREW-UX-4, but that id was already spent on an
+ * unrelated merged slice (crew#308) — this implementation is CREW-UX-7; the doc's §7.2 spec is
+ * what it implements.
+ *
+ * A durable pre-gate annotation: ONE operator guidance note per run, upserted via
+ * `PUT /runs/:id/guidance` and echoed as `AgentSession.guidance` on the run DTOs. The engine's
+ * run record carries no such field (wicked-core-ts 0.6.x), so — exactly like retry lineage
+ * (CREW-UX-3) and the actor trail (task #88) — the durable record is the audit trail: every
+ * write lands as a `guidance.set` entry whose `detail.text` is the full note (empty string =
+ * cleared), and this map is the read-side latency layer that lets the run DTOs echo it without
+ * a trail scan per request.
+ *
+ * Mirrors `RetryIndex`'s posture: hydrated once at server start (best-effort — a missing or
+ * unreadable trail leaves guidance blank, the pre-CREW-UX-7 behavior, not an error) and updated
+ * at the same post-commit point that writes the audit entry, so the map can only lag by a
+ * failed hydrate, never diverge silently.
+ */
+import type { AuditLog } from './audit.js';
+export declare class GuidanceIndex {
+    private readonly runToGuidance;
+    /**
+     * Load guidance from EVERY `guidance.set` entry in the trail — exhaustively, not capped
+     * (BRIEF-UX-002 C5, same defect as `RetryIndex.hydrate`: a durable note must not vanish
+     * because 1000+ newer writes landed on top of it). The trail answers newest first, so the
+     * FIRST entry seen per run is the current note — later (older) entries for the same run
+     * are superseded writes and are skipped, which is also what keeps a cleared note (newest
+     * entry has `text: ''`) from being resurrected by an older non-empty one. Still best-effort,
+     * like `RetryIndex.hydrate`; cost is one full-file scan at boot.
+     */
+    hydrate(audit: AuditLog, log?: (msg: string) => void): Promise<void>;
+    /** Upsert the note; the empty string CLEARS it (the DTO field goes back to absent). */
+    set(runId: string, text: string): void;
+    /** The note for this run, or `undefined` (the DTO spells that as an ABSENT field). */
+    guidanceFor(runId: string): string | undefined;
+}
+//# sourceMappingURL=guidance-index.d.ts.map

package/dist/api/guidance-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guidance-index.d.ts","sourceRoot":"","sources":["../../src/api/guidance-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAE3D;;;;;;;;OAQG;IACG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB1E,uFAAuF;IACvF,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAKtC,sFAAsF;IACtF,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAG/C"}

package/dist/api/guidance-index.js

@@ -0,0 +1,67 @@
+/**
+ * The run→operator-guidance index (DES-UX-002 §7.2, CREW-UX-7).
+ *
+ * NAMING NOTE: DES-UX-002 §7.2 labels this slice CREW-UX-4, but that id was already spent on an
+ * unrelated merged slice (crew#308) — this implementation is CREW-UX-7; the doc's §7.2 spec is
+ * what it implements.
+ *
+ * A durable pre-gate annotation: ONE operator guidance note per run, upserted via
+ * `PUT /runs/:id/guidance` and echoed as `AgentSession.guidance` on the run DTOs. The engine's
+ * run record carries no such field (wicked-core-ts 0.6.x), so — exactly like retry lineage
+ * (CREW-UX-3) and the actor trail (task #88) — the durable record is the audit trail: every
+ * write lands as a `guidance.set` entry whose `detail.text` is the full note (empty string =
+ * cleared), and this map is the read-side latency layer that lets the run DTOs echo it without
+ * a trail scan per request.
+ *
+ * Mirrors `RetryIndex`'s posture: hydrated once at server start (best-effort — a missing or
+ * unreadable trail leaves guidance blank, the pre-CREW-UX-7 behavior, not an error) and updated
+ * at the same post-commit point that writes the audit entry, so the map can only lag by a
+ * failed hydrate, never diverge silently.
+ */
+export class GuidanceIndex {
+    runToGuidance = new Map();
+    /**
+     * Load guidance from EVERY `guidance.set` entry in the trail — exhaustively, not capped
+     * (BRIEF-UX-002 C5, same defect as `RetryIndex.hydrate`: a durable note must not vanish
+     * because 1000+ newer writes landed on top of it). The trail answers newest first, so the
+     * FIRST entry seen per run is the current note — later (older) entries for the same run
+     * are superseded writes and are skipped, which is also what keeps a cleared note (newest
+     * entry has `text: ''`) from being resurrected by an older non-empty one. Still best-effort,
+     * like `RetryIndex.hydrate`; cost is one full-file scan at boot.
+     */
+    async hydrate(audit, log) {
+        try {
+            const superseded = new Set();
+            for (const entry of await audit.readAll({ action: 'guidance.set' })) {
+                if (typeof entry.runId !== 'string')
+                    continue;
+                if (superseded.has(entry.runId))
+                    continue;
+                // The NEWEST entry for a run decides — even when its text is malformed. Marking the
+                // run seen BEFORE the text check keeps a corrupt newest write from resurrecting an
+                // older superseded note (Copilot, #312): unknowable current note = no note.
+                superseded.add(entry.runId);
+                const text = entry.detail?.['text'];
+                if (typeof text !== 'string')
+                    continue;
+                if (text !== '')
+                    this.runToGuidance.set(entry.runId, text);
+            }
+        }
+        catch (err) {
+            log?.(`[runs] guidance-index hydrate failed (prior runs read as no-guidance until restart): ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    /** Upsert the note; the empty string CLEARS it (the DTO field goes back to absent). */
+    set(runId, text) {
+        if (text === '')
+            this.runToGuidance.delete(runId);
+        else
+            this.runToGuidance.set(runId, text);
+    }
+    /** The note for this run, or `undefined` (the DTO spells that as an ABSENT field). */
+    guidanceFor(runId) {
+        return this.runToGuidance.get(runId);
+    }
+}
+//# sourceMappingURL=guidance-index.js.map

package/dist/api/guidance-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guidance-index.js","sourceRoot":"","sources":["../../src/api/guidance-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,MAAM,OAAO,aAAa;IACP,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3D;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,KAAe,EAAE,GAA2B;QACxD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;gBACpE,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;oBAAE,SAAS;gBAC9C,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAC1C,oFAAoF;gBACpF,mFAAmF;gBACnF,4EAA4E;gBAC5E,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBACvC,IAAI,IAAI,KAAK,EAAE;oBAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,EAAE,CACH,wFACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,GAAG,CAAC,KAAa,EAAE,IAAY;QAC7B,IAAI,IAAI,KAAK,EAAE;YAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;;YAC7C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,sFAAsF;IACtF,WAAW,CAAC,KAAa;QACvB,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/api/open-path.d.ts

@@ -4,6 +4,22 @@
  * whose name merely starts with dots (`/a/..hidden`) is not wrongly excluded.
  */
 export declare function isInsideRoot(root: string, target: string): boolean;
+/** The session fields the root set is derived from — structural on purpose, so this stays a leaf
+ *  module (routes.ts hands it the wire-shape `SessionView.session`; tests hand it a literal). */
+export interface RootSourceSession {
+    workdir?: string | null;
+    extra_write_roots?: string[] | null;
+}
+/**
+ * The ONE root set a caller-supplied path is contained against (DES-FEEDBACK-002 CREW-1):
+ * the run's workdir + its `extra_write_roots` (when a run is in play) + every registered repo
+ * root. Extracted from the `POST /open` handler so `/open`, `GET /runs/:id/files`, and
+ * `GET /runs/:id/diff` cannot drift — three copies of a containment root set is how one of
+ * them quietly widens.
+ */
+export declare function allowedRootsFor(session: RootSourceSession | undefined, repos: ReadonlyArray<{
+    root_path: string;
+}>): string[];
 /** The platform's opener invocation. Exported for tests; args are always a real argv array. */
 export declare function platformOpenCommand(target: string): {
     cmd: string;

package/dist/api/open-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"open-path.d.ts","sourceRoot":"","sources":["../../src/api/open-path.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CA2BlE;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAWnF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUnE"}
+{"version":3,"file":"open-path.d.ts","sourceRoot":"","sources":["../../src/api/open-path.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CA2BlE;AAED;iGACiG;AACjG,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,iBAAiB,GAAG,SAAS,EACtC,KAAK,EAAE,aAAa,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,GAC1C,MAAM,EAAE,CAWV;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAWnF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUnE"}

package/dist/api/open-path.js

@@ -47,6 +47,28 @@ export function isInsideRoot(root, target) {
         return false; // different drive/tree entirely (win32)
     return rel.split(sep)[0] !== '..';
 }
+/**
+ * The ONE root set a caller-supplied path is contained against (DES-FEEDBACK-002 CREW-1):
+ * the run's workdir + its `extra_write_roots` (when a run is in play) + every registered repo
+ * root. Extracted from the `POST /open` handler so `/open`, `GET /runs/:id/files`, and
+ * `GET /runs/:id/diff` cannot drift — three copies of a containment root set is how one of
+ * them quietly widens.
+ */
+export function allowedRootsFor(session, repos) {
+    const roots = [];
+    if (session !== undefined) {
+        const workdir = session.workdir;
+        if (typeof workdir === 'string' && workdir.length > 0)
+            roots.push(workdir);
+        for (const r of session.extra_write_roots ?? []) {
+            if (typeof r === 'string' && r.length > 0)
+                roots.push(r);
+        }
+    }
+    for (const repo of repos)
+        roots.push(repo.root_path);
+    return roots;
+}
 /** The platform's opener invocation. Exported for tests; args are always a real argv array. */
 export function platformOpenCommand(target) {
     switch (process.platform) {

package/dist/api/open-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"open-path.js","sourceRoot":"","sources":["../../src/api/open-path.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,EAAE;AACF,kGAAkG;AAClG,+FAA+F;AAC/F,kGAAkG;AAClG,gGAAgG;AAChG,6CAA6C;AAE7C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAExF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc;IACvD,4EAA4E;IAC5E,qFAAqF;IACrF,sFAAsF;IACtF,uFAAuF;IACvF,qFAAqF;IACrF,wFAAwF;IACxF,2FAA2F;IAC3F,MAAM,IAAI,GAAG,CAAC,CAAS,EAAiB,EAAE;QACxC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAClE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,GAAG,CAAC;YAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;IAC/C,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,wCAAwC;IAC3E,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;AACpC,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,KAAK,OAAO;YACV,yFAAyF;YACzF,sFAAsF;YACtF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3D;YACE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACzD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,cAAc,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"open-path.js","sourceRoot":"","sources":["../../src/api/open-path.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,EAAE;AACF,kGAAkG;AAClG,+FAA+F;AAC/F,kGAAkG;AAClG,gGAAgG;AAChG,6CAA6C;AAE7C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAExF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc;IACvD,4EAA4E;IAC5E,qFAAqF;IACrF,sFAAsF;IACtF,uFAAuF;IACvF,qFAAqF;IACrF,wFAAwF;IACxF,2FAA2F;IAC3F,MAAM,IAAI,GAAG,CAAC,CAAS,EAAiB,EAAE;QACxC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAClE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,GAAG,CAAC;YAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;IAC/C,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,wCAAwC;IAC3E,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;AACpC,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAsC,EACtC,KAA2C;IAE3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;YAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,KAAK,OAAO;YACV,yFAAyF;YACzF,sFAAsF;YACtF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3D;YACE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACzD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,cAAc,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/retry-index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The run→retry-lineage index (DES-UX-001 §8.3, CREW-UX-3).
+ *
+ * The engine's `LaunchOptions` carries no lineage field (checked, wicked-core-ts 0.6.x), so —
+ * exactly like the actor trail (task #88) — WHICH run a launch retries is knowledge only the
+ * daemon's HTTP layer ever holds. The durable record is the `run.launched` audit entry whose
+ * `detail.retryOf` the launch route writes; this map is the read-side latency layer that lets
+ * `GET /runs` / `GET /runs/:id` echo `AgentSession.retry_of` without a trail scan per request.
+ *
+ * Mirrors `MembershipIndex`'s posture: hydrated once at server start (from the audit trail,
+ * best-effort — a missing/unreadable trail leaves lineage blank for PRIOR runs, which is the
+ * pre-CREW-UX-3 behavior, not an error) and updated at the same post-commit point that writes
+ * the audit entry, so the map can only lag by a failed hydrate, never diverge silently.
+ */
+import type { AuditLog } from './audit.js';
+export declare class RetryIndex {
+    private readonly runToRetryOf;
+    /**
+     * Load lineage from EVERY `run.launched` entry in the trail — exhaustively, not capped
+     * (BRIEF-UX-002 C5: a lineage fact 2,678 launches deep must survive a restart; the newest-1000
+     * cap silently dropped it and the chronicle rendered the chain as peer episodes). Still
+     * best-effort: a missing/unreadable trail leaves lineage blank, the pre-CREW-UX-3 answer.
+     * Cost: one full-file scan at boot — `read` already parses the whole file anyway.
+     */
+    hydrate(audit: AuditLog, log?: (msg: string) => void): Promise<void>;
+    set(runId: string, retryOf: string): void;
+    /** The run id this run retries, or `undefined` (the DTO spells that as an ABSENT field). */
+    retryOfFor(runId: string): string | undefined;
+}
+//# sourceMappingURL=retry-index.d.ts.map

package/dist/api/retry-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry-index.d.ts","sourceRoot":"","sources":["../../src/api/retry-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAE1D;;;;;;OAMG;IACG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB1E,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAIzC,4FAA4F;IAC5F,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAG9C"}

package/dist/api/retry-index.js

@@ -0,0 +1,45 @@
+/**
+ * The run→retry-lineage index (DES-UX-001 §8.3, CREW-UX-3).
+ *
+ * The engine's `LaunchOptions` carries no lineage field (checked, wicked-core-ts 0.6.x), so —
+ * exactly like the actor trail (task #88) — WHICH run a launch retries is knowledge only the
+ * daemon's HTTP layer ever holds. The durable record is the `run.launched` audit entry whose
+ * `detail.retryOf` the launch route writes; this map is the read-side latency layer that lets
+ * `GET /runs` / `GET /runs/:id` echo `AgentSession.retry_of` without a trail scan per request.
+ *
+ * Mirrors `MembershipIndex`'s posture: hydrated once at server start (from the audit trail,
+ * best-effort — a missing/unreadable trail leaves lineage blank for PRIOR runs, which is the
+ * pre-CREW-UX-3 behavior, not an error) and updated at the same post-commit point that writes
+ * the audit entry, so the map can only lag by a failed hydrate, never diverge silently.
+ */
+export class RetryIndex {
+    runToRetryOf = new Map();
+    /**
+     * Load lineage from EVERY `run.launched` entry in the trail — exhaustively, not capped
+     * (BRIEF-UX-002 C5: a lineage fact 2,678 launches deep must survive a restart; the newest-1000
+     * cap silently dropped it and the chronicle rendered the chain as peer episodes). Still
+     * best-effort: a missing/unreadable trail leaves lineage blank, the pre-CREW-UX-3 answer.
+     * Cost: one full-file scan at boot — `read` already parses the whole file anyway.
+     */
+    async hydrate(audit, log) {
+        try {
+            for (const entry of await audit.readAll({ action: 'run.launched' })) {
+                const retryOf = entry.detail?.['retryOf'];
+                if (typeof entry.runId === 'string' && typeof retryOf === 'string') {
+                    this.runToRetryOf.set(entry.runId, retryOf);
+                }
+            }
+        }
+        catch (err) {
+            log?.(`[runs] retry-index hydrate failed (prior runs read as not-a-retry until restart): ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    set(runId, retryOf) {
+        this.runToRetryOf.set(runId, retryOf);
+    }
+    /** The run id this run retries, or `undefined` (the DTO spells that as an ABSENT field). */
+    retryOfFor(runId) {
+        return this.runToRetryOf.get(runId);
+    }
+}
+//# sourceMappingURL=retry-index.js.map

package/dist/api/retry-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry-index.js","sourceRoot":"","sources":["../../src/api/retry-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,MAAM,OAAO,UAAU;IACJ,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1D;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,KAAe,EAAE,GAA2B;QACxD,IAAI,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;gBACpE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1C,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACnE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,EAAE,CACH,qFACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,GAAG,CAAC,KAAa,EAAE,OAAe;QAChC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED,4FAA4F;IAC5F,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;CACF"}

package/dist/api/routes.d.ts

@@ -8,6 +8,8 @@ import { SeatHealthTracker } from './seat-health.js';
 import { type ProjectRoutesDeps } from '../projects/routes.js';
 import { InteractiveBridgePool } from '../interactive/bridge-pool.js';
 import { AuditLog } from './audit.js';
+import { RetryIndex } from './retry-index.js';
+import { GuidanceIndex } from './guidance-index.js';
 import { type AuthMode } from './auth.js';
 export { API_PREFIX } from './api-prefix.js';
 /**
@@ -23,7 +25,7 @@ export { API_PREFIX } from './api-prefix.js';
  * schema does not accept — so `.strict()` is what turns that trip into a 400 instead of an
  * unworkflowed run reported as `201`.
  */
-export declare const LaunchSchema: z.ZodObject<{
+export declare const LaunchSchema: z.ZodEffects<z.ZodObject<{
     problem: z.ZodString;
     sessionId: z.ZodOptional<z.ZodString>;
     clisJson: z.ZodOptional<z.ZodString>;
@@ -34,8 +36,18 @@ export declare const LaunchSchema: z.ZodObject<{
     /** DES-PROJECT-001 §2.2 — file the run into a project; membership attaches atomically with
      *  the launch record. Unknown/archived ⇒ the launch fails (never a silent unfiled run). */
     projectId: z.ZodOptional<z.ZodString>;
+    /** crew#293 — `"pr"` appends the hardened deliver Tool phase (push run branch + `gh pr create`)
+     *  to a PER-RUN copy of the selected workflow. Requires `workflow` (enforced by the refine
+     *  below, so the 400 happens at parse time, not after the adapter is consulted). */
+    deliver: z.ZodOptional<z.ZodLiteral<"pr">>;
+    /** DES-UX-001 §8.3 (CREW-UX-3) — the run this launch retries. Must name an EXISTING run id
+     *  (the route checks the store and 400s with a named error otherwise); persisted via the
+     *  `run.launched` audit entry + retry index and echoed as `AgentSession.retry_of`. */
+    retryOf: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     problem: string;
+    retryOf?: string | undefined;
+    deliver?: "pr" | undefined;
     projectId?: string | undefined;
     sessionId?: string | undefined;
     clisJson?: string | undefined;
@@ -45,6 +57,30 @@ export declare const LaunchSchema: z.ZodObject<{
     workflow?: string | undefined;
 }, {
     problem: string;
+    retryOf?: string | undefined;
+    deliver?: "pr" | undefined;
+    projectId?: string | undefined;
+    sessionId?: string | undefined;
+    clisJson?: string | undefined;
+    entityMode?: "shared" | "isolated" | undefined;
+    humanConfirm?: string | undefined;
+    repoRef?: string | undefined;
+    workflow?: string | undefined;
+}>, {
+    problem: string;
+    retryOf?: string | undefined;
+    deliver?: "pr" | undefined;
+    projectId?: string | undefined;
+    sessionId?: string | undefined;
+    clisJson?: string | undefined;
+    entityMode?: "shared" | "isolated" | undefined;
+    humanConfirm?: string | undefined;
+    repoRef?: string | undefined;
+    workflow?: string | undefined;
+}, {
+    problem: string;
+    retryOf?: string | undefined;
+    deliver?: "pr" | undefined;
     projectId?: string | undefined;
     sessionId?: string | undefined;
     clisJson?: string | undefined;
@@ -63,6 +99,16 @@ export declare const GateSchema: z.ZodObject<{
     approve: boolean;
     amend?: string | undefined;
 }>;
+/** `PUT /runs/:id/guidance` (DES-UX-002 §7.2, CREW-UX-7) — the durable pre-gate note body.
+ *  The empty string is a legal body: it CLEARS the note. The byte cap is checked in the route
+ *  (not zod's char-counting `max`) so the 400 names the actual limit. */
+export declare const GuidanceSchema: z.ZodObject<{
+    text: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    text: string;
+}, {
+    text: string;
+}>;
 export declare const OpenTerminalSchema: z.ZodObject<{
     cwd: z.ZodString;
     cmd: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -105,6 +151,12 @@ export interface SecurityDeps {
  */
 export interface RuntimeDeps {
     seatHealth?: SeatHealthTracker;
+    /** Run→retry-lineage index (CREW-UX-3) — `createServer` hydrates one from the audit trail so
+     *  a restarted daemon still echoes `retry_of`; a directly-driven route set gets a fresh one. */
+    retryIndex?: RetryIndex;
+    /** Run→operator-guidance index (CREW-UX-7) — `createServer` hydrates one from the audit trail
+     *  so a restarted daemon still echoes `guidance`; a directly-driven route set gets a fresh one. */
+    guidanceIndex?: GuidanceIndex;
     openWithOs?: (target: string) => Promise<void>;
     /** Seat sign-in presence probe (seat sign-in) — injectable so route tests never read the
      *  developer's real dotfiles. Defaults to the file/env heuristic in seat-signin.ts. */

package/dist/api/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/api/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAwB,WAAW,EAAkD,MAAM,oBAAoB,CAAC;AAEvH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAMnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAItE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAyF7C;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,YAAY;;;;;;;;IAQvB;+FAC2F;;;;;;;;;;;;;;;;;;;;EAElF,CAAC;AAEZ,eAAO,MAAM,UAAU;;;;;;;;;EAGZ,CAAC;AAQZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAQpB,CAAC;AAOZ,4FAA4F;AAC5F,eAAO,MAAM,cAAc;;;;;;;;;EAGhB,CAAC;AAEZ,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;2FACuF;IACvF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC1E;;0DAEsD;IACtD,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;CAC5C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB,EAIlC,YAAY,GAAE,WAA+B,EAG7C,QAAQ,GAAE,iBAAqF,EAK/F,QAAQ,GAAE,YAA0D,EAGpE,OAAO,GAAE,WAAgB,GACxB,IAAI,CA86CN"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/api/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAwB,WAAW,EAAkD,MAAM,oBAAoB,CAAC;AAEvH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAMnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAWrD,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEtF,OAAO,EAAe,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAInF,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAyF7C;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,YAAY;;;;;;;;IAQvB;+FAC2F;;IAE3F;;wFAEoF;;IAEpF;;0FAEsF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKtF,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;EAGZ,CAAC;AAEZ;;yEAEyE;AACzE,eAAO,MAAM,cAAc;;;;;;EAEhB,CAAC;AAUZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAQpB,CAAC;AAOZ,4FAA4F;AAC5F,eAAO,MAAM,cAAc;;;;;;;;;EAGhB,CAAC;AAwBZ,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;oGACgG;IAChG,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;uGACmG;IACnG,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;2FACuF;IACvF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC1E;;0DAEsD;IACtD,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;CAC5C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB,EAIlC,YAAY,GAAE,WAA+B,EAG7C,QAAQ,GAAE,iBAAqF,EAK/F,QAAQ,GAAE,YAA0D,EAGpE,OAAO,GAAE,WAAgB,GACxB,IAAI,CAqtDN"}