zigmini 0.8.0-beta.5 → 0.8.0-beta.7

package/src/hub.ts

@@ -1,7 +1,7 @@
 import { scopedActionId, type DialogAnswer, type DialogGate, type DialogMethod, type DialogRequest, type DialogResolution } from "./approvals.ts";
 import type { DecisionService } from "./decisions.ts";
 import type { SttProvider } from "./adapters/voice/stt.ts";
-import { OmoCommandError, type OmoEvent, type OmoStatus } from "./omo/client.ts";
+import { blockingCompaction, compactionOutcome, OmoCommandError, type CompactionFailureKind, type OmoEvent, type OmoStatus } from "./omo/client.ts";
 import type { OmoRpc } from "./omo/generations.ts";
 import { type ActionAnswerData, type ConversationActivity, type ConversationInfo, type Envelope, type MessageReference, PROTOCOL_VERSION, type Source, type Trust } from "./protocol.ts";
 import { readFileSync, statSync } from "node:fs";
@@ -13,6 +13,9 @@ import { isVersionCommand, VERSION_COMMAND } from "./version.ts";
 import { isUsageCommand, USAGE_COMMAND } from "./usage.ts";
 import { MessageReferenceError, referencedInput, resolveMessageReferences } from "./message-references.ts";
 import { readProfile } from "./profile.ts";
+import type { MessageGuard } from "./security-check.ts";
+import { nativeReplyEntry, type NativeReplyObserver } from "./reply-notifications.ts";
+import { messageTimestamp, nativeTurnStarted, nativeTurnStats } from "./turn-stats.ts";
 
 export type Broadcast = (envelope: Envelope) => void;
 
@@ -35,6 +38,7 @@ const HISTORY_MAX_PAGE = 500;
 const HISTORY_MAX_RESUME = 1000;
 
 export interface HubOptions {
+	replies?: NativeReplyObserver;
 	cwd: string;
 	sessionDir: string;
 	permissionPreset: string;
@@ -59,12 +63,30 @@ export interface HubOptions {
 	versionReport?: () => Promise<string>;
 	/** Answers `/usage` (model account usage) as a notice; the command never reaches omo. */
 	usageReport?: () => Promise<string>;
+	/** Improvement 165: the security check of user text; a finding keeps the text from omo and the store. */
+	guard?: Pick<MessageGuard, "check" | "hold">;
 }
 
 /** Anthropic rejects images over 5 MB; bigger attachments reach the agent as a file path only. */
 const PROMPT_IMAGE_MAX_BYTES = 5 * 1024 * 1024;
 const MAX_ATTACHMENTS = 4;
 
+const COMPACTION_RECOVERY = {
+	invalid_model: { action: "settings", message: "요약 모델 설정을 확인하거나 compaction.model을 auto로 바꾼 뒤 다시 진행해 주세요." },
+	auth_missing: { action: "login", message: "요약에 사용하는 제공자에 로그인한 뒤 다시 진행해 주세요." },
+	auth_expired: { action: "login", message: "요약에 사용하는 제공자에 다시 로그인한 뒤 다시 진행해 주세요." },
+	quota: { action: "quota", message: "제공자의 사용 한도가 복구된 뒤 다시 진행해 주세요." },
+	org_denied: { action: "account", message: "해당 제공자의 계정과 조직 권한을 확인한 뒤 다시 진행해 주세요." },
+	model_unavailable: { action: "settings", message: "요약 모델의 사용 가능 여부와 설정을 확인한 뒤 다시 진행해 주세요." },
+	refused: { action: "retry", message: "제공자가 요약을 거절했습니다. 원인을 해결한 뒤 다시 진행해 주세요." },
+	timeout: { action: "retry", message: "요약 요청 시간이 초과됐습니다. 원인을 해결한 뒤 다시 진행해 주세요." },
+	incomplete: { action: "retry", message: "요약 응답이 완전하지 않습니다. 원인을 해결한 뒤 다시 진행해 주세요." },
+	empty: { action: "retry", message: "요약 응답이 비어 있습니다. 원인을 해결한 뒤 다시 진행해 주세요." },
+	context_budget: { action: "retry", message: "요약 결과가 대화 모델의 입력 한도에 맞지 않습니다. 원인을 해결한 뒤 다시 진행해 주세요." },
+	stale: { action: "retry", message: "요약 중 대화가 바뀌었습니다. 최신 대화에서 다시 진행해 주세요." },
+	provider: { action: "retry", message: "원인을 해결한 뒤 다시 진행해 주세요." },
+} as const satisfies Record<CompactionFailureKind, { readonly action: string; readonly message: string }>;
+
 export type RotationReason = "manual" | "age" | ForcedRotationReason;
 /** Bug 72 proposal 4: limits that rotate a session even with works, updates, decisions or questions open. */
 export type ForcedRotationReason = "size" | "compactions";
@@ -176,6 +198,9 @@ interface ConvRuntime {
 	finishRotation: (() => void) | null;
 	itemId: string | null;
 	itemText: string;
+	/** Set only by the engine's structured start event; never inferred from arrival timing. */
+	statsTurnId: string | null;
+	statsMessageIndex: number;
 }
 
 interface ContentPart {
@@ -192,7 +217,7 @@ interface SessionEntry {
 	customType?: string;
 	data?: unknown;
 	details?: { notification_id?: string };
-	message?: { role?: string; content?: ContentPart[] | string; stopReason?: string; clientInputId?: string };
+	message?: { role?: string; content?: ContentPart[] | string; stopReason?: string; errorMessage?: string; clientInputId?: string };
 }
 
 interface EntriesResult {
@@ -342,6 +367,20 @@ export class Hub {
 		this.omo = omo;
 	}
 
+	/** Explicit mode activation snapshots every existing main source before admitting new occurrences. */
+	async notificationBaseline(): Promise<void> {
+		for (const conv of this.store.listConversations()) {
+			if (!conv.threadId) continue;
+			const { sessionId } = await this.ensureSession(conv);
+			const generation = this.generation;
+			const revision = this.options.replies?.revision();
+			const result = await this.requireOmo().command<EntriesResult>("get_entries", { sessionId });
+			if (generation !== this.generation || this.omoStatus !== "ready" || this.rt(conv.id).sessionId !== sessionId ||
+				this.store.getConversation(conv.id)?.threadId !== conv.threadId) throw new Error("reply_baseline_discarded");
+			if (revision !== undefined) this.options.replies?.observe({ sessionPath: conv.threadId, conv: conv.id, title: conv.title }, result.entries, revision);
+		}
+	}
+
 	attachDecisions(decisions: DecisionService): void {
 		this.decisions = decisions;
 	}
@@ -706,6 +745,8 @@ export class Hub {
 			this.uiSessionScopes.clear();
 			for (const [conv, rt] of this.runtime) {
 				rt.sessionId = null;
+				rt.statsTurnId = null;
+				rt.statsMessageIndex = 0;
 				rt.opening = null;
 				rt.running = false;
 				rt.waking = null;
@@ -757,6 +798,10 @@ export class Hub {
 				} else if (this.hasUnfinishedTurn(conv.id)) await this.recoverConversation(current);
 				else if (this.openQuestionCards(conv.id, this.conversationScope(conv.id)).size > 0) await this.ensureSession(current);
 				else if (this.store.unreportedWorkUpdates(conv.id).length > 0 || this.workSummary(conv.id).length > 0) await this.ensureSession(current);
+				if (this.options.replies?.settings().mode === "all-replies" && current.threadId) {
+					await this.ensureSession(this.store.getConversation(conv.id) ?? current);
+					await this.syncLedger(conv.id);
+				}
 				// Opening main comes first. A notification ACK or worker reconciliation cannot hold readiness.
 				void this.notifyWorkUpdates(conv.id);
 			} catch (error) {
@@ -770,7 +815,7 @@ export class Hub {
 	}
 
 	/** `images` are names of files already uploaded to the media folder; unknown names are dropped. */
-	async sendText(convId: string, text: string, src: Source, trust: Trust, images: string[] = [], referenceIds?: unknown): Promise<void> {
+	async sendText(convId: string, text: string, src: Source, trust: Trust, images: string[] = [], referenceIds?: unknown, checked = false): Promise<void> {
 		if (this.maintenanceId) throw new MaintenanceError("maintenance_held");
 		const conv = this.store.getConversation(convId);
 		if (!conv) throw new Error(`unknown_conversation:${convId}`);
@@ -792,6 +837,13 @@ export class Hub {
 			throw new MessageReferenceError("message_reference_images_unavailable");
 		}
 		if (!body && attached.length === 0 && references.length === 0) return;
+		// Improvement 165: a finding holds the message in gateway memory. The guard sends the card with the values to the
+		// user's screens only (never stored, never in a prompt); the user's "send" runs this call again with checked.
+		const found = checked ? null : this.options.guard?.check([prompt.text]);
+		if (found) {
+			this.options.guard!.hold(convId, "message", found, () => this.sendText(convId, text, src, trust, images, referenceIds, true), body);
+			return;
+		}
 		const input = this.store.acceptMainUser(convId, {
 			text: body, src, trust, ...(attached.length ? { images: attached } : {}),
 			...(references.length ? { references } : {}),
@@ -1233,6 +1285,8 @@ export class Hub {
 		rt.sessionId = null;
 		rt.itemId = null;
 		rt.itemText = "";
+		rt.statsTurnId = null;
+		rt.statsMessageIndex = 0;
 		rt.notified.clear();
 		const to = `${this.options.sessionDir.replace(/\/$/, "")}/zgw-${convId}-${fileStamp(this.now())}-${crypto.randomUUID().slice(0, 8)}.jsonl`;
 		this.store.rotateThread(convId, to, new Date(this.now()).toISOString(), retirement.handoff);
@@ -1690,6 +1744,28 @@ export class Hub {
 		}
 		const rt = this.rt(conv);
 		switch (event.type) {
+			case "extension_event": {
+				if (event.name === "zgw.turn_started") {
+					rt.statsTurnId = nativeTurnStarted(event.data);
+					rt.statsMessageIndex = 0;
+				} else if (event.name === "zgw.turn_stats" && rt.durableId) {
+					const measured = nativeTurnStats(event.data);
+					if (!measured) return;
+					const stored = this.store.appendTurnStats(conv, rt.durableId, measured);
+					if (stored) this.publishStored(stored);
+				}
+				return;
+			}
+			case "entry_appended": {
+				// Native emits message_end before persistence; this later event closes that gap.
+				const entry = nativeReplyEntry(event.entry);
+				if (entry && this.options.replies) {
+					this.options.replies.observe({ sessionPath: owner.sessionPath, conv, title: this.store.getConversation(conv)?.title ?? "Reply" },
+						[entry], this.options.replies.revision());
+					return;
+				}
+				return this.options.replies ? this.syncLedger(conv) : undefined;
+			}
 			case "agent_start":
 				rt.run++;
 				rt.running = true;
@@ -1717,7 +1793,7 @@ export class Hub {
 			}
 			case "message_end": {
 				const message = event.message as {
-					role?: string; content?: ContentPart[] | string; stopReason?: string; errorMessage?: string; clientInputId?: string;
+					role?: string; content?: ContentPart[] | string; stopReason?: string; errorMessage?: string; clientInputId?: string; timestamp?: unknown;
 					customType?: string; details?: { notification_id?: string };
 				} | undefined;
 				if (message?.role === "user") {
@@ -1739,12 +1815,18 @@ export class Hub {
 					return;
 				}
 				if (message?.role !== "assistant") return;
+				rt.statsMessageIndex++;
 				const itemId = rt.itemId ?? this.nextId("m");
 				const content = typeof message.content === "string" ? [{ type: "text", text: message.content }] : message.content ?? [];
 				const thinking = content.filter((c) => c.type === "thinking").map((c) => c.thinking ?? "").join("\n\n").trim();
 				if (thinking) this.emit(conv, "thinking.final", { itemId, text: thinking });
 				const text = content.filter((c) => c.type === "text").map((c) => c.text ?? "").join("");
-				if (text || rt.itemText) this.emit(conv, "message.final", { itemId, text: text || rt.itemText });
+				if (text || rt.itemText) this.emit(conv, "message.final", {
+					itemId, text: text || rt.itemText,
+					...(rt.statsTurnId && rt.durableId && messageTimestamp(message.timestamp) &&
+						message.stopReason !== "aborted" && message.stopReason !== "error" && !message.errorMessage
+						? { engineTurn: { id: rt.statsTurnId, sessionId: rt.durableId, messageTimestamp: message.timestamp, messageIndex: rt.statsMessageIndex } } : {}),
+				});
 				if (message.stopReason === "aborted") {
 					this.emit(conv, "notice", { message: "작업을 중단했습니다.", level: "info" });
 				} else if (message.stopReason === "error" || message.errorMessage) {
@@ -1752,7 +1834,7 @@ export class Hub {
 				}
 				rt.itemId = null;
 				rt.itemText = "";
-				return;
+				return this.options.replies ? this.syncLedger(conv) : undefined;
 			}
 			case "tool_execution_start":
 				this.emit(conv, "progress.update", {
@@ -1776,36 +1858,43 @@ export class Hub {
 				});
 				return;
 			}
-			case "compaction_start":
-				this.emit(conv, "session.compaction", { status: "running", reason: event.reason, requestId: event.requestId });
+			case "compaction_start": {
+				if (!blockingCompaction(event) || this.compactionSeen(conv, event, false)) return;
+				const requestId = typeof event.requestId === "string" ? event.requestId : undefined;
+				this.emit(conv, "session.compaction", { status: "running", requestId });
+				this.emit(conv, "notice", { kind: "compaction-started", level: "info", requestId,
+					message: "대화 내용을 요약하고 있습니다. 완료될 때까지 기다려 주세요." });
 				return;
+			}
 			case "compaction_end": {
-				const failed = typeof event.errorMessage === "string" || event.accepted === false ||
-					(event.accepted !== true && (typeof event.result !== "object" || event.result === null));
+				if (!blockingCompaction(event) || this.compactionSeen(conv, event, true)) return;
+				const requestId = typeof event.requestId === "string" ? event.requestId : undefined;
+				const outcome = compactionOutcome(event);
 				this.emit(conv, "session.compaction", {
-					status: event.aborted === true ? "cancelled" : failed ? "failed" : "completed",
-					reason: event.reason,
-					requestId: event.requestId,
-					accepted: event.accepted,
-					error: event.errorMessage,
-					rejectionCause: event.rejectionCause,
+					...outcome, requestId, accepted: outcome.status === "completed",
 				});
-				if (event.aborted === true) {
-					this.emit(conv, "notice", {
-						kind: "compaction-cancelled",
-						level: "warning",
-						message: "컨텍스트 압축이 취소됐습니다. 같은 세션을 유지하며 이전 입력을 자동으로 다시 보내지 않습니다.",
-					});
-				} else if (failed) {
-					this.emit(conv, "error", {
-						kind: "compaction-failed",
-						message: `컨텍스트 압축 실패: ${event.errorMessage ?? event.rejectionCause ?? "완료 결과가 없습니다"}. 같은 세션을 유지합니다. 원인을 해결한 뒤 계속할 지시를 보내 주세요. 이전 입력은 자동 재전송하지 않습니다.`,
-					});
+				switch (outcome.status) {
+					case "cancelled":
+						this.emit(conv, "notice", { kind: "compaction-cancelled", level: "warning", requestId,
+							message: "대화 요약을 취소했습니다. 이전 내용과 같은 세션을 유지합니다. 이전 입력은 자동으로 다시 보내지 않습니다." });
+						break;
+					case "failed": {
+						const recovery = COMPACTION_RECOVERY[outcome.failureKind];
+						this.emit(conv, "error", { kind: "compaction-failed", requestId, failureKind: outcome.failureKind,
+							action: recovery.action, message: `대화 요약에 실패했습니다. 이전 내용은 유지했습니다. ${recovery.message}` });
+						break;
+					}
+					case "completed":
+						this.emit(conv, "notice", { kind: "compaction-completed", level: "info", requestId,
+							message: "대화 요약을 완료했습니다. 같은 세션에서 계속합니다." });
+						break;
 				}
 				return;
 			}
 			case "agent_settled": {
 				rt.running = false;
+				rt.statsTurnId = null;
+				rt.statsMessageIndex = 0;
 				this.publishActivity(conv);
 				this.unwatchConversation(conv);
 				this.dialogs.cancelScope(owner.scope, "작업이 끝났습니다.");
@@ -1828,6 +1917,8 @@ export class Hub {
 				this.releaseScopedUiOwner(owner);
 				rt.sessionId = null;
 				rt.durableId = null;
+				rt.statsTurnId = null;
+				rt.statsMessageIndex = 0;
 				rt.running = false;
 				this.publishActivity(conv);
 				rt.run++;
@@ -2230,6 +2321,7 @@ export class Hub {
 	}
 
 	private async readLedger(conv: string): Promise<void> {
+		const replyRevision = this.options.replies?.revision();
 		const rt = this.rt(conv);
 		const generation = this.generation;
 		const sessionId = rt.sessionId;
@@ -2246,7 +2338,10 @@ export class Hub {
 				const result = await this.requireOmo().command<EntriesResult>("get_entries", { sessionId, since });
 				logLedgerRead(conv, "since", result);
 				if (!current()) throw new LedgerReadDiscarded();
-				this.store.appendLedger(conv, { sessionPath, durableId, lastEntryId: since }, ledgerEntries(result.entries), result.leafId);
+				const entries = ledgerEntries(result.entries);
+				// Persist notification identity before advancing the native history cursor.
+				if (replyRevision !== undefined) this.options.replies?.observe({ sessionPath, conv, title: this.store.getConversation(conv)?.title ?? "Reply" }, result.entries, replyRevision);
+				this.store.appendLedger(conv, { sessionPath, durableId, lastEntryId: since }, entries, result.leafId);
 				return;
 			} catch (error) {
 				if (!(error instanceof OmoCommandError) || !error.code.startsWith("Entry not found")) throw error;
@@ -2256,10 +2351,13 @@ export class Hub {
 		// A full read is the one unbounded response the ledger asks for: one at a time across conversations.
 		const rebuild = this.ledgerRebuilds.then(async () => {
 			if (!current()) throw new LedgerReadDiscarded();
+			const rebuildReplyRevision = this.options.replies?.revision();
 			const result = await this.requireOmo().command<EntriesResult>("get_entries", { sessionId });
 			logLedgerRead(conv, "full", result);
 			if (!current()) throw new LedgerReadDiscarded();
-			this.store.rebuildLedger(conv, sessionPath, durableId, ledgerEntries(result.entries), result.leafId);
+			const entries = ledgerEntries(result.entries);
+			if (rebuildReplyRevision !== undefined) this.options.replies?.observe({ sessionPath, conv, title: this.store.getConversation(conv)?.title ?? "Reply" }, result.entries, rebuildReplyRevision);
+			this.store.rebuildLedger(conv, sessionPath, durableId, entries, result.leafId);
 		});
 		this.ledgerRebuilds = rebuild.catch(() => undefined);
 		await rebuild;
@@ -2361,6 +2459,7 @@ export class Hub {
 			permissionPreset: this.options.permissionPreset,
 			retain_on_disconnect: true,
 			kind: "interactive",
+			promptSurface: "app",
 			context: { zgw_conv: conv.id, zgw_role: "main" },
 		});
 		return { sessionPath, opened };
@@ -2453,7 +2552,7 @@ export class Hub {
 			rt = {
 				sessionId: null, opening: null, running: false, run: 0, rotating: false, admitting: 0, clientInputIdentity: false, atomicQueuedResume: false, durableId: null,
 				waking: null, wake: null, notified: new Set(),
-				itemId: null, itemText: "",
+				itemId: null, itemText: "", statsTurnId: null, statsMessageIndex: 0,
 				rotationDone: null, finishRotation: null,
 			};
 			this.runtime.set(conv, rt);
@@ -2470,6 +2569,17 @@ export class Hub {
 		this.emit("main", "notice", { kind: "update", level: "info", message });
 	}
 
+	/** Persisted lifecycle records also deduplicate a terminal replay after a gateway restart. */
+	private compactionSeen(conv: string, event: OmoEvent, terminal: boolean): boolean {
+		if (typeof event.requestId !== "string") return false;
+		return this.store.eventsAfter(conv, this.store.lastSeq(conv, "session.rotated")).some((stored) => {
+			if (stored.type !== "session.compaction") return false;
+			const data = stored.data;
+			return typeof data === "object" && data !== null && "requestId" in data && data.requestId === event.requestId &&
+				(!terminal || ("status" in data && data.status !== "running"));
+		});
+	}
+
 	private emit(conv: string, type: string, data: unknown, persist = true): StoredEvent | null {
 		const stored = persist && conv !== "*" ? this.store.appendEvent(conv, type, data) : null;
 		if (stored) this.publishStored(stored);

package/src/main.ts

@@ -4,6 +4,7 @@ import { join, normalize } from "node:path";
 import type { Server, ServerWebSocket, WebSocketHandler } from "bun";
 import { createSttProvider } from "./adapters/voice/stt.ts";
 import { createTtsProvider, speakableText, splitForTts } from "./adapters/voice/tts.ts";
+import { handleHeld, handleSecurityCheckSetting, MessageGuard, SECURITY_CHECK_PATH, SECURITY_HELD_PATH, SecurityCheckError, defaultChecker } from "./security-check.ts";
 import { handleVoiceInstall, handleVoiceSetting, routeVoiceApi, VOICE_INSTALL_PATH, VOICE_SETTING_PATH, voiceGate, voiceUpdated } from "./voice-api.ts";
 import { readVoiceSetting, VoiceSetting } from "./voice-setting.ts";
 import { applyVoiceAgents } from "./voice/agents.ts";
@@ -44,8 +45,9 @@ import { activeRecord, readRegistry, slotUrl } from "./runtime/slots.ts";
 import { NATIVE_LIFECYCLE_PREFIX } from "./omo/lifecycle.ts";
 import { RECOVERY_RECEIPT_PREFIX } from "./omo/recovery-receipt.ts";
 import { fileScheduleSource, notionRoutineSource, ReminderLoop } from "./schedule/reminders.ts";
-import { type ClientMessage, type Envelope, PROTOCOL_VERSION, type Source } from "./protocol.ts";
+import { type ClientMessage, type Envelope, PROTOCOL_VERSION, ROTATION_HELD_MESSAGE, type Source } from "./protocol.ts";
 import { QuestionNotifications } from "./question-notifications.ts";
+import { NotificationSettingsApi, ReplyNotifications } from "./reply-notifications.ts";
 import { DecisionStoreError, Store } from "./store.ts";
 import { TranscriptLog } from "./transcript.ts";
 import { WorkRouter } from "./work.ts";
@@ -145,11 +147,18 @@ const updateApi: UpdateApiDeps = {
 };
 
 let publish: (envelope: Envelope) => void = () => {};
+const replyNotifications = new ReplyNotifications<ServerWebSocket<Conn>>(store, (ws, notification) => {
+	if (ws.data.deviceId && store.getDevice(ws.data.deviceId)?.status === "approved") ws.send(envelope("reply.notification", notification, notification.conv));
+});
+const messageGuard = new MessageGuard(defaultChecker(), runtimePaths().securityCheckFile, (held) => publish({
+	v: PROTOCOL_VERSION, id: crypto.randomUUID(), ts: new Date().toISOString(), conv: held.conv, type: "security-check.held", data: held,
+}));
 const hub = new Hub(
 	store,
 	dialogs,
 	stt,
 	{
+		replies: replyNotifications,
 		cwd: config.omoCwd,
 		sessionDir: config.omoSessionDir,
 		permissionPreset: config.omoPermissionPreset,
@@ -164,6 +173,7 @@ const hub = new Hub(
 			build: process.env.ZGW_BUILD_SHA,
 		}),
 		usageReport: createUsageReport({ dir: agentDir(), inContainer: existsSync("/.dockerenv") }),
+		guard: messageGuard,
 	},
 	(e) => publish(e),
 );
@@ -205,7 +215,7 @@ const omo = new GenerationRouter(startup.endpoints, startup.active, {
 	onEvent: (e) => {
 		if (work.onEvent(e)) return;
 		summarizer.onEvent(e, hub.ownsSession(e.sessionId));
-		hub.onEvent(e);
+		void Promise.resolve(hub.onEvent(e)).catch((error) => console.error("native event:", error));
 	},
 	onStatus: (s, d) => {
 		const generation = ++connectionGeneration;
@@ -249,10 +259,12 @@ function releaseRecovery(): void {
 	})().finally(() => { releaseRunning = null; });
 }
 const work = new WorkRouter(store, omo, {
+	replies: replyNotifications,
 	sessionDir: config.omoSessionDir,
 	permissionPreset: config.omoPermissionPreset,
 	onPublished(event) {
 		hub.publishStored(event);
+		replyNotifications.deliver();
 		// A published work report raises that work's `reported` in the work status.
 		workStatus.schedule();
 	},
@@ -285,6 +297,12 @@ const work = new WorkRouter(store, omo, {
 		else hub.handleScopedUiRequest(owner, event);
 	},
 });
+const notificationSettingsApi = new NotificationSettingsApi(replyNotifications, async () => {
+	await hub.notificationBaseline();
+	await work.notificationBaseline();
+}, (data) => publish({
+	v: PROTOCOL_VERSION, id: crypto.randomUUID(), ts: new Date().toISOString(), conv: "*", type: "notifications.updated", data,
+}));
 hub.attachOmo(omo);
 const omoCheck = new OmoCheckScheduler(store, {
 	cwd: process.env.ZGW_OMO_CHECK_CWD ?? "",
@@ -302,7 +320,7 @@ const decisions = new DecisionService(store, {
 }, (data) => publish({
 	v: PROTOCOL_VERSION, id: crypto.randomUUID(), ts: new Date().toISOString(),
 	conv: data.decision.ownerConv, type: "decision.updated", data,
-}), { onHistory: (event) => hub.publishStored(event) });
+}), { onHistory: (event) => hub.publishStored(event), guard: messageGuard });
 hub.attachDecisions(decisions);
 const summarizer = new SpeechSummarizer(omo, {
 	sessionDir: config.omoSessionDir,
@@ -373,6 +391,7 @@ async function handleClient(ws: ServerWebSocket<Conn>, raw: string): Promise<voi
 		ws.data.notifyOnly &&
 		msg.type !== "hello" &&
 		msg.type !== "reminder.ack" &&
+		msg.type !== "reply.notification.ack" &&
 		msg.type !== "question.notification.ack"
 	) return;
 	if (
@@ -403,6 +422,7 @@ async function handleClient(ws: ServerWebSocket<Conn>, raw: string): Promise<voi
 			if (state.omo === "ready") questionNotifications.sync(snapshot.approvals);
 			if (ws.data.notifyOnly) {
 				if (ws.data.deviceId) questionNotifications.connectDevice(ws, ws.data.deviceId);
+				if (ws.data.deviceId) replyNotifications.connectDevice(ws, ws.data.deviceId);
 				for (const r of reminders.pending(Date.now())) ws.send(envelope("reminder", r));
 				return;
 			}
@@ -423,6 +443,10 @@ async function handleClient(ws: ServerWebSocket<Conn>, raw: string): Promise<voi
 		case "reminder.ack":
 			if (typeof msg.data?.id === "string") reminders.ack(msg.data.id, Date.now());
 			return;
+		case "reply.notification.ack":
+			if (ws.data.notifyOnly && ws.data.deviceId && typeof msg.data?.id === "string" &&
+				store.getDevice(ws.data.deviceId)?.status === "approved") replyNotifications.ack(ws, msg.data.id);
+			return;
 		case "question.notification.ack": {
 			const id = ws.data.deviceId;
 			if (
@@ -461,6 +485,9 @@ async function handleClient(ws: ServerWebSocket<Conn>, raw: string): Promise<voi
 					ws.send(envelope("error", { message: "approval_not_pending", actionId: msg.data.actionId }, msg.conv));
 				}
 			} catch (error) {
+				if (error instanceof SecurityCheckError) {
+					return;
+				}
 				if (!(error instanceof DecisionStoreError)) throw error;
 				ws.send(envelope("error", {
 					message: error.code, actionId: msg.data.actionId,
@@ -475,7 +502,7 @@ async function handleClient(ws: ServerWebSocket<Conn>, raw: string): Promise<voi
 			return;
 		case "conversation.rotate":
 			await hub.rotateSession(msg.conv, "manual").catch((e) => {
-				const message = e instanceof Error && e.message === "turn_running" ? "진행 중이거나 확인되지 않은 작업이 있어 같은 세션을 유지합니다." : String(e);
+				const message = e instanceof Error && e.message === "turn_running" ? ROTATION_HELD_MESSAGE : String(e);
 				ws.send(envelope("error", { message }, msg.conv));
 			});
 			return;
@@ -610,6 +637,7 @@ async function handle(req: Request, srv: Server<Conn>, trusted: boolean): Promis
 		return srv.upgrade(req, { data: { trusted, deviceId, notifyOnly, webClient: false } }) ? undefined : new Response("upgrade failed", { status: 400 });
 	}
 	// Voice off answers 503 before native admission and before any body is read.
+	if (url.pathname === "/api/settings/notifications") return notificationSettingsApi.handle(req);
 	const voiceDisabled = voiceGate(req, url, voiceSetting);
 	if (voiceDisabled) return voiceDisabled;
 	if (url.pathname === VOICE_INSTALL_PATH) {
@@ -623,6 +651,18 @@ async function handle(req: Request, srv: Server<Conn>, trusted: boolean): Promis
 		});
 		if (response) return response;
 	}
+	if (url.pathname === SECURITY_HELD_PATH || url.pathname.startsWith(`${SECURITY_HELD_PATH}/`)) {
+		const response = await handleHeld(req, url, messageGuard, (id, outcome) => publish({
+			v: PROTOCOL_VERSION, id: crypto.randomUUID(), ts: new Date().toISOString(), conv: "*", type: "security-check.resolved", data: { id, outcome },
+		}));
+		if (response) return response;
+	}
+	if (url.pathname === SECURITY_CHECK_PATH) {
+		const response = await handleSecurityCheckSetting(req, trusted, messageGuard, (enabled) => publish({
+			v: PROTOCOL_VERSION, id: crypto.randomUUID(), ts: new Date().toISOString(), conv: "*", type: "security-check.updated", data: { enabled },
+		}));
+		if (response) return response;
+	}
 	if (url.pathname === PROFILE_ICON_PATH) {
 		const response = await handleProfileIcon(req, url, trusted, { icon: profileIcon, profile: () => readProfile(store), publish: (e) => publish(e) });
 		if (response) return response;
@@ -827,6 +867,7 @@ const websocket: WebSocketHandler<Conn> = {
 	close(ws) {
 		if (ws.data.deviceId) deviceSockets.get(ws.data.deviceId)?.delete(ws);
 		questionNotifications.disconnectDevice(ws);
+		replyNotifications.disconnectDevice(ws);
 		questionNotifications.disconnectWeb(ws);
 	},
 };

package/src/omo/client.ts

@@ -10,6 +10,34 @@ export interface OmoEvent {
 	[key: string]: unknown;
 }
 
+/** Public S3 terminal categories. Native diagnostics never cross the UI boundary. */
+export const COMPACTION_FAILURE_KINDS = [
+	"invalid_model", "auth_missing", "auth_expired", "quota", "org_denied", "model_unavailable",
+	"refused", "timeout", "incomplete", "empty", "context_budget", "stale", "provider",
+] as const;
+export type CompactionFailureKind = typeof COMPACTION_FAILURE_KINDS[number];
+export type CompactionOutcome =
+	| { readonly status: "failed"; readonly failureKind: CompactionFailureKind }
+	| { readonly status: "cancelled" | "completed" };
+
+export function blockingCompaction(event: OmoEvent): boolean {
+	return event.blocking !== false && event.reason !== "speculative" && event.reason !== "idle";
+}
+
+/** Old engines have no structured failure; do not classify their raw error strings. */
+export function compactionOutcome(event: OmoEvent): CompactionOutcome {
+	const failure = event.failure;
+	const structured = typeof failure === "object" && failure !== null;
+	if (event.aborted === true && !structured && event.rejectionCause !== "cancelled-by-extension") return { status: "cancelled" };
+	const result = typeof event.result === "object" && event.result !== null && !Array.isArray(event.result);
+	const failed = structured || typeof event.errorMessage === "string" || event.accepted === false ||
+		(event.accepted !== true && !result);
+	if (!failed) return { status: "completed" };
+	const kind = structured && "kind" in failure ? failure.kind : undefined;
+	for (const known of COMPACTION_FAILURE_KINDS) if (kind === known) return { status: "failed", failureKind: known };
+	return { status: "failed", failureKind: "provider" };
+}
+
 export interface OmoResponse {
 	type: "response";
 	id: string;

package/src/protocol.ts

@@ -1,5 +1,8 @@
 export const PROTOCOL_VERSION = 1;
 
+/** The `error` message a refused `conversation.rotate` gets when a turn or an open wait holds the session (hub `turn_running`). */
+export const ROTATION_HELD_MESSAGE = "진행 중이거나 확인되지 않은 작업이 있어 같은 세션을 유지합니다.";
+
 export type Channel = "web" | "app" | "home" | "hud" | "discord";
 export type Trust = "owner" | "owner-voice" | "unknown";
 
@@ -16,6 +19,22 @@ export interface MessageReference {
 	readonly images?: readonly string[];
 }
 
+/** Measured across one native response turn, including its model calls around tools. */
+export interface TurnStats {
+	readonly tokensPerSecond?: number;
+	/** Sum of assistant/model processing intervals, not tool or total wall time. */
+	readonly modelDurationMs?: number;
+	/** Missing cache usage is unknown, not zero. */
+	readonly cacheHitPercent?: number;
+}
+
+export interface MessageStatsData {
+	readonly itemId: string;
+	readonly messageSeq: number;
+	readonly turnId: string;
+	readonly stats: TurnStats;
+}
+
 export interface Envelope<T extends string = string, D = unknown> {
 	v: typeof PROTOCOL_VERSION;
 	id: string;
@@ -115,6 +134,18 @@ export interface DecisionUpdatedData {
 	readonly counters: DecisionCountersInfo;
 }
 
+export type NotificationMode = "inbox-only" | "all-replies";
+export interface NotificationSettings {
+	readonly mode: NotificationMode;
+}
+export interface ReplyNotification {
+	readonly id: string;
+	readonly conv: string;
+	readonly title: string;
+	readonly text: string;
+	readonly workId?: string;
+}
+
 export type ClientMessage =
 	| { type: "hello"; data: { client: string; version: string } }
 	| { type: "client.presence"; data: { visible: boolean } }
@@ -125,4 +156,5 @@ export type ClientMessage =
 	| { type: "input.interrupt"; conv: string; data: Record<string, never> }
 	| { type: "conversation.rotate"; conv: string }
 	| { type: "reminder.ack"; data: { id: string } }
-	| { type: "question.notification.ack"; data: { id: string } };
+	| { type: "question.notification.ack"; data: { id: string } }
+	| { type: "reply.notification.ack"; data: { id: string } };