zigmini 0.8.0-beta.6 → 0.8.0-beta.7

package/src/reply-notifications.ts

@@ -0,0 +1,144 @@
+import type { NotificationSettings, ReplyNotification } from "./protocol.ts";
+import type { Store } from "./store.ts";
+
+export interface NativeReplySource {
+	readonly sessionPath: string;
+	readonly conv: string;
+	readonly workId?: string;
+	readonly title: string;
+}
+
+export interface NativeReplyEntry {
+	readonly id?: string;
+	readonly type?: string;
+	readonly message?: {
+		readonly role?: string;
+		readonly content?: unknown;
+		readonly stopReason?: string;
+		readonly errorMessage?: string;
+	};
+}
+
+/** entry_appended carries a persisted entry, unlike message_end's identity-free message object. */
+export function nativeReplyEntry(value: unknown): NativeReplyEntry | null {
+	if (typeof value !== "object" || value === null || !("id" in value) || typeof value.id !== "string" || !value.id ||
+		!("type" in value) || typeof value.type !== "string") return null;
+	const message = "message" in value ? value.message : undefined;
+	if (typeof message !== "object" || message === null) return { id: value.id, type: value.type };
+	return {
+		id: value.id, type: value.type,
+		message: {
+			role: "role" in message && typeof message.role === "string" ? message.role : undefined,
+			stopReason: "stopReason" in message && typeof message.stopReason === "string" ? message.stopReason : undefined,
+			errorMessage: "errorMessage" in message && typeof message.errorMessage === "string" ? message.errorMessage : undefined,
+			content: "content" in message ? message.content : undefined,
+		},
+	};
+}
+
+function replyText(entry: NativeReplyEntry): string | null {
+	const message = entry.type === "message" ? entry.message : undefined;
+	// Only native completed assistant messages qualify, including intermediate tool-use messages.
+	if (message?.role !== "assistant" || !["stop", "toolUse", "length"].includes(message.stopReason ?? "") || message.errorMessage) return null;
+	const content = message.content;
+	const text = typeof content === "string" ? content : Array.isArray(content)
+		? content.flatMap((part: unknown) => typeof part === "object" && part !== null &&
+			"type" in part && part.type === "text" && "text" in part && typeof part.text === "string" ? [part.text] : []).join("")
+		: "";
+	return text.trim() ? text : null;
+}
+
+export class ReplyNotifications<Connection extends object> {
+	private readonly devices = new Map<Connection, { deviceId: string; sent: Set<string> }>();
+
+	constructor(private readonly store: Store, private readonly send: (connection: Connection, notification: ReplyNotification) => void) {}
+
+	settings(): NotificationSettings {
+		return { mode: this.store.getSetting("notifications.mode") === "all-replies" ? "all-replies" : "inbox-only" };
+	}
+
+	revision(): string {
+		return this.store.getSetting("notifications.revision") ?? "0";
+	}
+
+	/** The read's revision is captured before RPC, so a toggle cannot admit an older in-flight read. */
+	observe(source: NativeReplySource, entries: readonly NativeReplyEntry[], revision: string): void {
+		if (revision !== this.revision()) return;
+		for (const entry of entries) {
+			if (typeof entry.id !== "string" || !entry.id) throw new Error("reply_history_entry_without_id");
+			const text = replyText(entry);
+			const notification = this.settings().mode === "all-replies" && text !== null ? {
+				id: crypto.randomUUID(), conv: source.conv, title: source.title, text,
+				...(source.workId ? { workId: source.workId } : {}),
+			} : null;
+			this.store.recordReplyNotification(source.sessionPath, entry.id, notification);
+		}
+		this.deliver();
+	}
+
+	setMode(mode: NotificationSettings["mode"]): void {
+		if (mode === this.settings().mode) return;
+		this.store.setNotificationMode(mode);
+	}
+
+	connectDevice(connection: Connection, deviceId: string): void {
+		if (this.devices.get(connection)?.deviceId === deviceId) return;
+		this.devices.set(connection, { deviceId, sent: new Set() });
+		this.deliver();
+	}
+
+	disconnectDevice(connection: Connection): void {
+		this.devices.delete(connection);
+		this.deliver();
+	}
+
+	ack(connection: Connection, id: string): boolean {
+		const device = this.devices.get(connection);
+		if (!device?.sent.has(id)) return false;
+		this.store.ackReplyNotification(id, device.deviceId);
+		return true;
+	}
+
+	/** Flushes committed occurrences, including explicitly published work replies. */
+	deliver(): void {
+		if (this.settings().mode !== "all-replies") return;
+		for (const [connection, device] of this.devices) {
+			for (const notification of this.store.pendingReplyNotifications(device.deviceId)) {
+				if ([...this.devices.values()].some((other) => other.deviceId === device.deviceId && other.sent.has(notification.id))) continue;
+				device.sent.add(notification.id);
+				this.send(connection, notification);
+			}
+		}
+	}
+}
+
+/** Native owners use this narrow seam; notification transport never observes synthetic chat publication. */
+export type NativeReplyObserver = Pick<ReplyNotifications<object>, "observe" | "revision" | "settings">;
+
+/** Writes serialize across awaited activation snapshots; rejected requests never reach the queue. */
+export class NotificationSettingsApi {
+	private writes: Promise<unknown> = Promise.resolve();
+
+	constructor(private readonly notifications: Pick<ReplyNotifications<object>, "settings" | "setMode">,
+		private readonly baseline: () => Promise<void>, private readonly publish: (settings: NotificationSettings) => void) {}
+
+	async handle(req: Request): Promise<Response> {
+		if (req.method === "GET") return Response.json(this.notifications.settings());
+		if (req.method !== "PUT") return Response.json({ error: "method_not_allowed" }, { status: 405 });
+		const body: unknown = await req.json().catch(() => null);
+		if (typeof body !== "object" || body === null || Array.isArray(body) || Object.keys(body).length !== 1 ||
+			!("mode" in body) || (body.mode !== "inbox-only" && body.mode !== "all-replies")) {
+			return Response.json({ error: "invalid_notification_settings" }, { status: 400 });
+		}
+		const mode = body.mode;
+		const write = this.writes.then(async () => {
+			if (mode === "all-replies" && this.notifications.settings().mode !== mode) await this.baseline();
+			this.notifications.setMode(mode);
+			const settings = this.notifications.settings();
+			this.publish(settings);
+			return Response.json(settings);
+		});
+		this.writes = write.catch(() => undefined);
+		return write;
+	}
+}

package/src/runtime/paths.ts

@@ -41,6 +41,7 @@ export interface RuntimePaths {
 	readonly backups: string;
 	readonly scheduleFile: string;
 	readonly voiceSettingFile: string;
+	readonly securityCheckFile: string;
 	readonly logs: string;
 	readonly secrets: string;
 	readonly omoTokenFile: string;
@@ -108,6 +109,7 @@ export function runtimePaths(env: Env = process.env, exists: (path: string) => b
 		backups: join(data, "backups"),
 		scheduleFile: value(env, "ZGW_SCHEDULE_FILE") ?? join(data, "schedule.json"),
 		voiceSettingFile: value(env, "ZGW_VOICE_SETTING_FILE") ?? join(data, "voice-setting"),
+		securityCheckFile: value(env, "ZGW_SECURITY_CHECK_FILE") ?? join(data, "security-check"),
 		logs: join(home, "logs"),
 		secrets,
 		omoTokenFile: value(env, "ZGW_OMO_TOKEN_FILE") ?? join(secrets, "omo-ws-token"),

package/src/security-check.ts

@@ -0,0 +1,241 @@
+import { entropy, isAllowed, type AllowEntry, type Rule } from "../scripts/secret-rules.ts";
+import ruleConfig from "../scripts/secret-scan.rules.json";
+import allowConfig from "../scripts/secret-scan.allow.json";
+import { readVoiceSetting, writeVoiceSetting } from "./voice-setting.ts";
+
+// Improvement 165: every user text bound for the engine passes one security check first (work 779e5b0e).
+// The rules, the allow list and the matching helpers are the repository security check's own (scripts/secret-rules.ts,
+// scripts/secret-scan.rules.json, scripts/secret-scan.allow.json; docs/security-check.md); this module only compiles them
+// once and runs them in memory. No network, disk or process call happens per message.
+
+export type SecurityRule = Rule;
+export type SecurityAllow = AllowEntry;
+/** One kind of finding and its count; the form that may reach logs. */
+export interface SecurityFinding { readonly kind: string; readonly label: string; readonly count: number }
+/** One matched value and where it is (1-based line and column of text `text`). Only the user's own screens get these. */
+export interface SecurityOccurrence {
+	readonly kind: string;
+	readonly label: string;
+	readonly value: string;
+	readonly text: number;
+	readonly line: number;
+	readonly column: number;
+}
+/** A message held back by the check until the user sends or drops it; kept in gateway memory only. */
+export interface HeldMessage {
+	readonly id: string;
+	readonly conv: string;
+	readonly source: "message" | "answer";
+	readonly createdAt: string;
+	readonly findings: readonly SecurityFinding[];
+	readonly occurrences: readonly SecurityOccurrence[];
+	/** The user's own text, so the screen can put it back into the composer when the message is dropped or lost. */
+	readonly draft?: string;
+}
+
+export const SECURITY_CHECK_PATH = "/api/settings/security-check";
+export const SECURITY_BLOCKED = "security_check_blocked";
+export const SECURITY_HELD_PATH = "/api/security-check/held";
+
+/** User-facing names of the finding kinds; rule ids without an entry fall back to "기타 보안 값". */
+const KIND_OF_RULE: Readonly<Record<string, string>> = {
+	"private-key": "private-key",
+	"ssh-public-key": "private-key",
+	"github-token": "token", "npm-token": "token", "anthropic-key": "token", "openai-key": "token", "notion-token": "token",
+	"slack-token": "token", "slack-webhook": "token", "aws-access-key": "token", "gcp-api-key": "token", "tailscale-key": "token",
+	"jwt": "token", "high-entropy-assignment": "token",
+	"credential-assignment": "credential", "authorization": "credential", "cookie-header": "credential",
+	"user-home-path": "home-path",
+	"ipv4": "internal-address", "ipv6-internal": "internal-address", "internal-host": "internal-address", "internal-url": "internal-address",
+	"email": "email", "phone-number": "phone",
+	"adb-device": "device-id", "device-serial": "device-id",
+};
+export const KIND_LABELS: Readonly<Record<string, string>> = {
+	"private-key": "비밀키",
+	"token": "토큰·API 키",
+	"credential": "비밀번호·인증·쿠키 값",
+	"home-path": "홈 폴더 경로",
+	"internal-address": "내부 IP·호스트",
+	"email": "이메일 주소",
+	"phone": "전화번호",
+	"device-id": "기기 식별값",
+	"other": "기타 보안 값",
+};
+
+interface Compiled { readonly id: string; readonly kind: string; readonly regex: RegExp; readonly group: number; readonly minEntropy?: number }
+
+/** The repository rules and allow list, as shipped in the package. */
+export function defaultChecker(): SecurityChecker {
+	return new SecurityChecker(ruleConfig.rules as Rule[], allowConfig.allow as AllowEntry[]);
+}
+
+/** Compiles every rule once; scan() reuses the compiled expressions for every message. */
+export class SecurityChecker {
+	private readonly rules: readonly Compiled[];
+
+	constructor(rules: readonly SecurityRule[], private readonly allow: readonly SecurityAllow[] = []) {
+		this.rules = rules.map((rule) => ({
+			id: rule.id,
+			kind: KIND_OF_RULE[rule.id] ?? "other",
+			regex: new RegExp(rule.pattern, `${(rule.flags ?? "").replace(/[gy]/g, "")}g`),
+			group: rule.group ?? 0,
+			...(rule.minEntropy === undefined ? {} : { minEntropy: rule.minEntropy }),
+		}));
+	}
+
+	/** Counts per kind over all texts, in KIND_LABELS order; empty when nothing matched. */
+	scan(texts: readonly string[]): SecurityFinding[] {
+		return countFindings(this.occurrences(texts));
+	}
+
+	/** Every matched value with its place, in text order then rule order. */
+	occurrences(texts: readonly string[]): SecurityOccurrence[] {
+		const found: SecurityOccurrence[] = [];
+		for (const [index, text] of texts.entries()) {
+			if (!text) continue;
+			for (const rule of this.rules) {
+				const regex = rule.regex;
+				regex.lastIndex = 0;
+				let match: RegExpExecArray | null;
+				while ((match = regex.exec(text)) !== null) {
+					if (match[0].length === 0) regex.lastIndex += 1;
+					const value = match[rule.group];
+					if (!value) continue;
+					if (rule.minEntropy !== undefined && entropy(value) < rule.minEntropy) continue;
+					if (isAllowed(rule.id, value, this.allow)) continue;
+					const at = match.index + (rule.group === 0 ? 0 : match[0].indexOf(value));
+					const before = text.slice(0, at);
+					const line = before.split("\n").length;
+					found.push({ kind: rule.kind, label: KIND_LABELS[rule.kind]!, value, text: index, line, column: at - before.lastIndexOf("\n") });
+				}
+			}
+		}
+		return found;
+	}
+}
+
+export function countFindings(occurrences: readonly SecurityOccurrence[]): SecurityFinding[] {
+	const counts = new Map<string, number>();
+	for (const occurrence of occurrences) counts.set(occurrence.kind, (counts.get(occurrence.kind) ?? 0) + 1);
+	return Object.keys(KIND_LABELS).filter((kind) => counts.has(kind))
+		.map((kind) => ({ kind, label: KIND_LABELS[kind]!, count: counts.get(kind)! }));
+}
+
+/** "토큰·API 키 2건, 홈 폴더 경로 1건" */
+export function findingSummary(findings: readonly SecurityFinding[]): string {
+	return findings.map((finding) => `${finding.label} ${finding.count}건`).join(", ");
+}
+
+export function blockedMessage(findings: readonly SecurityFinding[]): string {
+	return `보안검사에 걸려 엔진에 보내지 않고 보류했습니다: ${findingSummary(findings)}.`;
+}
+
+/** Thrown for a held decision answer; `held` (with the values) goes only to the user's screen that sent it. */
+export class SecurityCheckError extends Error {
+	readonly code = SECURITY_BLOCKED;
+	constructor(readonly held: HeldMessage) {
+		super(blockedMessage(held.findings));
+	}
+}
+
+/**
+ * The on/off setting (default on) and the checker. The setting file uses the voice setting format ("off" means off,
+ * anything else or a missing file means on); it is read once at start and kept in memory, so a check reads no disk.
+ */
+export class MessageGuard {
+	private on: boolean;
+	private readonly held = new Map<string, { info: HeldMessage; send: () => Promise<void> }>();
+
+	/** `onHold` sends each new held entry (with its values) straight to the user's screens; never to omo or the store. */
+	constructor(private readonly checker: SecurityChecker, readonly file: string | null, private readonly onHold: (held: HeldMessage) => void = () => {}) {
+		this.on = file === null ? true : readVoiceSetting(file);
+	}
+
+	enabled(): boolean {
+		return this.on;
+	}
+
+	set(enabled: boolean): boolean {
+		if (this.file !== null) writeVoiceSetting(this.file, enabled);
+		this.on = enabled;
+		return enabled;
+	}
+
+	/** Matched values of the texts, or null when the check is off or nothing matched. */
+	check(texts: readonly string[]): SecurityOccurrence[] | null {
+		if (!this.on) return null;
+		const found = this.checker.occurrences(texts);
+		return found.length > 0 ? found : null;
+	}
+
+	/** Keeps `send` until the user decides; nothing is written to disk. */
+	hold(conv: string, source: HeldMessage["source"], occurrences: readonly SecurityOccurrence[], send: () => Promise<void>, draft?: string): HeldMessage {
+		const info: HeldMessage = {
+			id: crypto.randomUUID(), conv, source, createdAt: new Date().toISOString(),
+			findings: countFindings(occurrences), occurrences, ...(draft === undefined ? {} : { draft }),
+		};
+		this.held.set(info.id, { info, send });
+		this.onHold(info);
+		return info;
+	}
+
+	/** Held when check() finds anything: throws SecurityCheckError with the held entry. */
+	holdOrPass(conv: string, source: HeldMessage["source"], texts: readonly string[], send: () => Promise<void>): void {
+		const found = this.check(texts);
+		if (found) throw new SecurityCheckError(this.hold(conv, source, found, send));
+	}
+
+	list(): HeldMessage[] {
+		return [...this.held.values()].map((entry) => entry.info);
+	}
+
+	/** Removes the entry; "sent" runs its send. null when the id is unknown (already decided, or lost by a restart). */
+	async decide(id: string, send: boolean): Promise<"sent" | "dropped" | null> {
+		const entry = this.held.get(id);
+		if (!entry) return null;
+		this.held.delete(id);
+		if (!send) return "dropped";
+		await entry.send();
+		return "sent";
+	}
+}
+
+/** GET (both ports) and PUT (trusted web port) of SECURITY_CHECK_PATH. */
+export async function handleSecurityCheckSetting(
+	req: Request,
+	trusted: boolean,
+	guard: Pick<MessageGuard, "enabled" | "set">,
+	publish: (enabled: boolean) => void,
+): Promise<Response | null> {
+	if (req.method === "GET") return Response.json({ enabled: guard.enabled() });
+	if (req.method !== "PUT") return null;
+	if (!trusted) return Response.json({ error: "forbidden" }, { status: 403 });
+	const body = (await req.json().catch(() => null)) as { enabled?: unknown } | null;
+	if (typeof body?.enabled !== "boolean") return Response.json({ error: "enabled_required" }, { status: 400 });
+	const enabled = guard.set(body.enabled);
+	publish(enabled);
+	return Response.json({ enabled });
+}
+
+/** GET SECURITY_HELD_PATH lists held messages; POST SECURITY_HELD_PATH/<id> {send} sends or drops one. */
+export async function handleHeld(
+	req: Request,
+	url: URL,
+	guard: Pick<MessageGuard, "list" | "decide">,
+	resolved: (id: string, outcome: "sent" | "dropped") => void,
+): Promise<Response | null> {
+	if (url.pathname === SECURITY_HELD_PATH) return req.method === "GET" ? Response.json({ held: guard.list() }) : null;
+	if (!url.pathname.startsWith(`${SECURITY_HELD_PATH}/`) || req.method !== "POST") return null;
+	const id = decodeURIComponent(url.pathname.slice(SECURITY_HELD_PATH.length + 1));
+	const body = (await req.json().catch(() => null)) as { send?: unknown } | null;
+	if (typeof body?.send !== "boolean") return Response.json({ error: "send_required" }, { status: 400 });
+	let outcome: "sent" | "dropped" | null;
+	try {
+		outcome = await guard.decide(id, body.send);
+	} catch (error) {
+		return Response.json({ error: "send_failed", message: error instanceof Error ? error.message : String(error) }, { status: 502 });
+	}
+	if (outcome === null) return Response.json({ error: "held_not_found" }, { status: 404 });
+	resolved(id, outcome);
+	return Response.json({ id, outcome });
+}

package/src/store.ts

@@ -3,7 +3,8 @@ import { OMO_CHECK_BASELINE, omoCheckActionable, omoCheckDaytime } from "./omo-c
 import { mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
-import type { ConversationInfo, DecisionAnswerRequest } from "./protocol.ts";
+import type { ConversationInfo, DecisionAnswerRequest, NotificationMode, ReplyNotification } from "./protocol.ts";
+import type { NativeTurnStats } from "./turn-stats.ts";
 
 export interface StoredEvent {
 	seq: number;
@@ -517,6 +518,19 @@ export class Store {
 				acked_at INTEGER
 			);
 			CREATE INDEX IF NOT EXISTS reminders_fire ON reminders(fired_at, fire_at);
+			CREATE TABLE IF NOT EXISTS reply_notifications (
+				session_path TEXT NOT NULL,
+				entry_id TEXT NOT NULL,
+				id TEXT NOT NULL UNIQUE,
+				data TEXT,
+				cancelled INTEGER NOT NULL DEFAULT 0,
+				PRIMARY KEY (session_path, entry_id)
+			);
+			CREATE TABLE IF NOT EXISTS reply_notification_acks (
+				id TEXT NOT NULL,
+				device_id TEXT NOT NULL,
+				PRIMARY KEY (id, device_id)
+			);
 			CREATE TABLE IF NOT EXISTS omo_ledger (
 				conv TEXT PRIMARY KEY,
 				session_path TEXT NOT NULL,
@@ -977,6 +991,30 @@ export class Store {
 		return { seq: Number(result.lastInsertRowid), conv, type, data, ts };
 	}
 
+	/** Bind to one persisted native answer; replay never creates another statistics row. */
+	appendTurnStats(conv: string, durableSessionId: string, measured: NativeTurnStats): StoredEvent | null {
+		return this.db.transaction(() => {
+			const existing = this.db.query<{ seq: number }, [string, string]>(
+				"SELECT seq FROM events WHERE conv = ? AND type = 'message.stats' AND json_extract(data, '$.turnId') = ? LIMIT 1",
+			).get(conv, measured.turnId);
+			if (existing) return null;
+			const answer = this.db.query<{ seq: number; itemId: string }, [string, string, string, number, number]>(
+				`SELECT seq, json_extract(data, '$.itemId') AS itemId FROM events
+				WHERE conv = ? AND type = 'message.final'
+				AND json_extract(data, '$.engineTurn.sessionId') = ?
+				AND json_extract(data, '$.engineTurn.id') = ?
+				AND json_extract(data, '$.engineTurn.messageTimestamp') = ?
+				AND json_extract(data, '$.engineTurn.messageIndex') = ?
+				AND json_type(data, '$.itemId') = 'text'
+				ORDER BY seq DESC LIMIT 1`,
+			).get(conv, durableSessionId, measured.turnId, measured.finalMessageTimestamp, measured.finalMessageIndex);
+			if (!answer) return null;
+			return this.appendEvent(conv, "message.stats", {
+				itemId: answer.itemId, messageSeq: answer.seq, turnId: measured.turnId, stats: measured.stats,
+			});
+		}).immediate();
+	}
+
 	/** Acceptance and definitely-unsent intent precede every session-admission await. */
 	acceptMainUser(conv: string, data: unknown): StoredEvent {
 		return this.db.transaction(() => {
@@ -1043,6 +1081,31 @@ export class Store {
 		this.db.query("INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(key, value);
 	}
 
+	/** A source occurrence is recorded even while disabled, making the eligibility boundary durable. */
+	recordReplyNotification(sessionPath: string, entryId: string, notification: ReplyNotification | null): void {
+		this.db.query("INSERT OR IGNORE INTO reply_notifications (session_path, entry_id, id, data) VALUES (?, ?, ?, ?)")
+			.run(sessionPath, entryId, notification?.id ?? crypto.randomUUID(), notification ? JSON.stringify(notification) : null);
+	}
+
+	pendingReplyNotifications(deviceId: string): ReplyNotification[] {
+		return this.db.query<{ data: string }, [string]>(`SELECT data FROM reply_notifications AS n
+			WHERE data IS NOT NULL AND cancelled = 0 AND NOT EXISTS
+			(SELECT 1 FROM reply_notification_acks AS a WHERE a.id = n.id AND a.device_id = ?) ORDER BY n.rowid`)
+			.all(deviceId).map((row) => JSON.parse(row.data) as ReplyNotification);
+	}
+
+	ackReplyNotification(id: string, deviceId: string): void {
+		this.db.query("INSERT OR IGNORE INTO reply_notification_acks (id, device_id) VALUES (?, ?)").run(id, deviceId);
+	}
+
+	setNotificationMode(mode: NotificationMode): void {
+		this.db.transaction(() => {
+			if (mode === "inbox-only") this.db.query("UPDATE reply_notifications SET cancelled = 1 WHERE data IS NOT NULL").run();
+			this.setSetting("notifications.mode", mode);
+			this.setSetting("notifications.revision", String(Number(this.getSetting("notifications.revision") ?? 0) + 1));
+		}).immediate();
+	}
+
 	getMemo(): Memo {
 		const row = this.db
 			.query<{ text: string; width: number | null; height: number | null; images: string; updated_at: string }, []>(
@@ -1476,6 +1539,13 @@ export class Store {
 			}
 			if (unreported.length !== updates.length) throw new WorkStoreError("publish_conflict", unreported.map((u) => u.id));
 			const event = this.appendEvent(ownerConv, "message.final", { text, work_update_ids: updates.map((update) => update.id) });
+			// Publishing is a distinct complete chat reply, not a replay of the worker's native message.
+			// Admit it in this transaction so a restart between commit and fan-out cannot lose it.
+			this.recordReplyNotification("gateway:work-publication", String(event.seq),
+				this.getSetting("notifications.mode") === "all-replies" && text.trim() ? {
+					id: crypto.randomUUID(), conv: ownerConv,
+					title: this.getConversation(ownerConv)?.title ?? "Reply", text,
+				} : null);
 			for (const update of updates) this.db.query("UPDATE work_updates SET reported_event_seq = ? WHERE id = ?").run(event.seq, update.id);
 			return [event];
 		}).immediate();

package/src/turn-stats.ts

@@ -0,0 +1,49 @@
+import type { TurnStats } from "./protocol.ts";
+
+export interface NativeTurnStats {
+	readonly version: 1;
+	readonly turnId: string;
+	readonly finalMessageTimestamp: number;
+	readonly finalMessageIndex: number;
+	readonly stats: TurnStats;
+}
+
+function record(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+export function turnId(value: unknown): string | null {
+	return typeof value === "string" && /^[a-zA-Z0-9_-]{1,128}$/.test(value) ? value : null;
+}
+
+export function messageTimestamp(value: unknown): value is number {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+
+/** Parse the engine boundary once. Unknown fields never reach stored/client data. */
+export function nativeTurnStats(value: unknown): NativeTurnStats | null {
+	if (!record(value) || value.version !== 1) return null;
+	const id = turnId(value.turnId);
+	if (!id || !messageTimestamp(value.finalMessageTimestamp) || !record(value.stats)) return null;
+	if (typeof value.finalMessageIndex !== "number" || !Number.isSafeInteger(value.finalMessageIndex) || value.finalMessageIndex <= 0) return null;
+	const { tokensPerSecond, modelDurationMs, cacheHitPercent } = value.stats;
+	if (tokensPerSecond !== undefined &&
+		(typeof tokensPerSecond !== "number" || !Number.isFinite(tokensPerSecond) || tokensPerSecond <= 0)) return null;
+	if (modelDurationMs !== undefined &&
+		(typeof modelDurationMs !== "number" || !Number.isFinite(modelDurationMs) || modelDurationMs <= 0)) return null;
+	if (cacheHitPercent !== undefined &&
+		(typeof cacheHitPercent !== "number" || !Number.isFinite(cacheHitPercent) || cacheHitPercent < 0 || cacheHitPercent > 100)) return null;
+	if (tokensPerSecond === undefined && modelDurationMs === undefined && cacheHitPercent === undefined) return null;
+	return {
+		version: 1, turnId: id, finalMessageTimestamp: value.finalMessageTimestamp, finalMessageIndex: value.finalMessageIndex,
+		stats: {
+			...(tokensPerSecond === undefined ? {} : { tokensPerSecond }),
+			...(modelDurationMs === undefined ? {} : { modelDurationMs }),
+			...(cacheHitPercent === undefined ? {} : { cacheHitPercent }),
+		},
+	};
+}
+
+export function nativeTurnStarted(value: unknown): string | null {
+	return record(value) && value.version === 1 ? turnId(value.turnId) : null;
+}

package/src/work-watch.ts

@@ -1,4 +1,4 @@
-import type { OmoEvent } from "./omo/client.ts";
+import { blockingCompaction, COMPACTION_FAILURE_KINDS, compactionOutcome, type OmoEvent } from "./omo/client.ts";
 import type { Store, WorkCommand, WorkItem, WorkUpdate } from "./store.ts";
 
 /**
@@ -68,7 +68,7 @@ export interface Verdict {
 	readonly evidence?: Readonly<Record<string, unknown>>;
 }
 
-/** Live signals of one work session, kept in memory only and reset whenever the OMO connection changes. */
+/** Live runtime signals reset on connection changes; safe compaction outcomes reload from work observations. */
 export interface Live {
 	observedSince: number;
 	lastActivityAt: number;
@@ -81,11 +81,12 @@ export interface Live {
 	readonly openTools: Map<string, { name: string; at: number }>;
 	/** Running sub-tasks from senpi-task's `omo.task.updated`; null while unknown. */
 	children: { active: number; at: number } | null;
+	readonly compactionTerminals: Set<string>;
 	lastError: { kind: "model_error" | "compaction_failed" | "retry_exhausted"; message: string; at: number } | null;
 }
 
 export function newLive(now: number): Live {
-	return { observedSince: now, lastActivityAt: now, streaming: null, runStartedAt: null, runObserved: false, stoppedAt: null, openTools: new Map(), children: null, lastError: null };
+	return { observedSince: now, lastActivityAt: now, streaming: null, runStartedAt: null, runObserved: false, stoppedAt: null, openTools: new Map(), children: null, compactionTerminals: new Set(), lastError: null };
 }
 
 export interface JudgeInput {
@@ -270,6 +271,15 @@ export class WorkWatcher {
 		let live = this.lives.get(workId);
 		if (!live) {
 			live = newLive(this.clock());
+			for (const update of this.store.listWorkUpdates(workId)) {
+				const details = update.details;
+				if (update.kind !== "observation" || !record(details) || details.source !== "compaction-watcher" ||
+					typeof details.at !== "number" || !Number.isFinite(new Date(details.at).getTime())) continue;
+				if (typeof details.requestId === "string") live.compactionTerminals.add(details.requestId);
+				const failureKind = COMPACTION_FAILURE_KINDS.find((kind) => kind === details.failureKind);
+				if (failureKind) live.lastError = { kind: "compaction_failed", message: failureKind, at: details.at };
+				else if (details.failureKind === null) live.lastError = null;
+			}
 			this.lives.set(workId, live);
 		}
 		return live;
@@ -306,8 +316,22 @@ export class WorkWatcher {
 		const now = this.clock();
 		const live = this.live(workId);
 		live.lastActivityAt = now;
+		const previousError = live.lastError;
+		const changed = this.apply(live, event, now);
+		if (previousError !== live.lastError &&
+			(previousError?.kind === "compaction_failed" || live.lastError?.kind === "compaction_failed")) {
+			this.store.recordWorkUpdate(workId, {
+				sourceKey: `watch:compaction:${crypto.randomUUID()}`,
+				kind: "observation",
+				commandSeq: null,
+				summary: "compaction_state",
+				details: { source: "compaction-watcher", at: now,
+					failureKind: live.lastError?.kind === "compaction_failed" ? live.lastError.message : null,
+					requestId: event.type === "compaction_end" && typeof event.requestId === "string" ? event.requestId : null },
+			});
+		}
 		// Plain activity changes a verdict only when it clears an unresponsive or broken one.
-		if (this.apply(live, event, now) || this.flagged(workId)) this.schedule();
+		if (changed || this.flagged(workId)) this.schedule();
 	}
 
 	private flagged(workId: string): boolean {
@@ -351,12 +375,14 @@ export class WorkWatcher {
 				return true;
 			}
 			case "compaction_end": {
-				if (event.aborted === true) return false;
-				const failed = typeof event.errorMessage === "string" || event.accepted === false ||
-					(event.accepted !== true && !record(event.result));
-				if (!failed) return false;
-				const cause = typeof event.errorMessage === "string" ? event.errorMessage : typeof event.rejectionCause === "string" ? event.rejectionCause : "완료 결과가 없습니다";
-				live.lastError = { kind: "compaction_failed", message: cause, at: now };
+				if (!blockingCompaction(event)) return false;
+				if (typeof event.requestId === "string") {
+					if (live.compactionTerminals.has(event.requestId)) return false;
+					live.compactionTerminals.add(event.requestId);
+				}
+				const outcome = compactionOutcome(event);
+				if (outcome.status !== "failed") return false;
+				live.lastError = { kind: "compaction_failed", message: outcome.failureKind, at: now };
 				return true;
 			}
 			case "auto_retry_end":