zigmini 0.8.0-beta.6 → 0.9.0-beta.1

package/src/store.ts

@@ -1,9 +1,11 @@
 import { Database } from "bun:sqlite";
 import { OMO_CHECK_BASELINE, omoCheckActionable, omoCheckDaytime } from "./omo-check-policy.ts";
-import { mkdirSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
-import type { ConversationInfo, DecisionAnswerRequest } from "./protocol.ts";
+import type { ConversationInfo, DecisionAnswerRequest, NotificationMode, ReplyNotification } from "./protocol.ts";
+import type { NativeTurnStats } from "./turn-stats.ts";
+import { SecurityRuntimeError, securityDecision, type AllowedValue, type HeldState, type SecurityApprover, type SecurityHoldRecord, type SecurityIntent, type SecurityReceipt } from "./security-allow.ts";
 
 export interface StoredEvent {
 	seq: number;
@@ -357,7 +359,7 @@ export interface DecisionDismissal {
 }
 
 export class DecisionStoreError extends Error {
-	constructor(readonly code: "decision_not_found" | "decision_conflict" | "submission_conflict" | "source_conflict" | "invalid_decision" | "invalid_decision_answer" | "invalid_decision_cursor" | "invalid_decision_transition", readonly decision: Decision | null = null) {
+	constructor(readonly code: "security_endpoint_required" | "decision_not_found" | "decision_conflict" | "submission_conflict" | "source_conflict" | "invalid_decision" | "invalid_decision_answer" | "invalid_decision_cursor" | "invalid_decision_transition", readonly decision: Decision | null = null) {
 		super(code);
 	}
 }
@@ -460,9 +462,11 @@ function completeDecisionAnswer(method: DecisionMethod, payload: unknown, respon
 
 export class Store {
 	private readonly db: Database;
+	private readonly securityReceiptListeners = new Set<() => void>();
 
 	constructor(dataDir: string) {
-		mkdirSync(dataDir, { recursive: true });
+		mkdirSync(dataDir, { recursive: true, mode: 0o700 });
+		chmodSync(dataDir, 0o700);
 		this.db = new Database(join(dataDir, "gateway.sqlite"), { create: true });
 		this.db.exec("PRAGMA journal_mode = WAL;");
 		// Linux builds of bun:sqlite default to synchronous=FULL, which fsyncs every appended event (~80x slower,
@@ -517,6 +521,19 @@ export class Store {
 				acked_at INTEGER
 			);
 			CREATE INDEX IF NOT EXISTS reminders_fire ON reminders(fired_at, fire_at);
+			CREATE TABLE IF NOT EXISTS reply_notifications (
+				session_path TEXT NOT NULL,
+				entry_id TEXT NOT NULL,
+				id TEXT NOT NULL UNIQUE,
+				data TEXT,
+				cancelled INTEGER NOT NULL DEFAULT 0,
+				PRIMARY KEY (session_path, entry_id)
+			);
+			CREATE TABLE IF NOT EXISTS reply_notification_acks (
+				id TEXT NOT NULL,
+				device_id TEXT NOT NULL,
+				PRIMARY KEY (id, device_id)
+			);
 			CREATE TABLE IF NOT EXISTS omo_ledger (
 				conv TEXT PRIMARY KEY,
 				session_path TEXT NOT NULL,
@@ -624,6 +641,158 @@ export class Store {
 			this.db.close();
 			throw error;
 		}
+		this.db.exec(`
+			CREATE TABLE IF NOT EXISTS security_allowed_values (
+				id TEXT PRIMARY KEY, value TEXT COLLATE BINARY NOT NULL UNIQUE, data TEXT NOT NULL
+			);
+			CREATE TABLE IF NOT EXISTS security_allow_revision (
+				id INTEGER PRIMARY KEY CHECK(id = 1), revision INTEGER NOT NULL
+			);
+			INSERT OR IGNORE INTO security_allow_revision VALUES (1, 0);
+			CREATE TABLE IF NOT EXISTS security_holds (
+				id TEXT PRIMARY KEY, source_key TEXT UNIQUE, intent_submission TEXT UNIQUE, data TEXT NOT NULL
+			);
+		`);
+		for (const suffix of ["", "-wal", "-shm"]) {
+			const path = join(dataDir, `gateway.sqlite${suffix}`);
+			if (existsSync(path)) chmodSync(path, 0o600);
+		}
+	}
+
+	securityAllowedValues(): { revision: number; values: AllowedValue[] } {
+		return this.db.transaction(() => ({
+			revision: this.db.query<{ revision: number }, []>("SELECT revision FROM security_allow_revision WHERE id = 1").get()!.revision,
+			values: this.db.query<{ data: string }, []>("SELECT data FROM security_allowed_values ORDER BY json_extract(data, '$.approvedAt'), id").all()
+				.map((row): AllowedValue => JSON.parse(row.data)),
+		})).immediate();
+	}
+
+	securityHolds(): SecurityHoldRecord[] {
+		return this.db.query<{ data: string }, []>("SELECT data FROM security_holds ORDER BY rowid").all().map((row) => JSON.parse(row.data));
+	}
+
+	securityHold(id: string): SecurityHoldRecord | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM security_holds WHERE id = ?").get(id);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	securityHoldByKey(key: string): SecurityHoldRecord | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM security_holds WHERE source_key = ?").get(key);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	createSecurityHold(record: SecurityHoldRecord): void {
+		this.db.transaction(() => {
+			const s = record.state;
+			this.db.query("INSERT INTO security_holds (id, source_key, data) VALUES (?, ?, ?)").run(s.id, record.key, JSON.stringify(record));
+			this.insertDecision({
+				id: s.id, revision: s.revision, ownerConv: s.conv, scope: `security:${s.conv}`, workId: null,
+				sourceSessionPath: null, sourceRequestId: s.id, sourceCommandSeq: null, legacyActionId: null,
+				method: "confirm", permission: false, required: false, payload: { kind: "security-check", heldId: s.id },
+				bindingState: "closed", deadlineAt: null, status: "pending",
+				submissionId: null, submissionRevision: null, submissionMode: null, answer: null, commandId: null,
+				answerRoute: null, supersededBy: null, reason: null, createdAt: s.createdAt, updatedAt: s.createdAt,
+			});
+		}).immediate();
+	}
+
+	private writeSecurityHold(record: SecurityHoldRecord): SecurityHoldRecord {
+		const s = record.state;
+		this.db.query("UPDATE security_holds SET data = ?, intent_submission = ? WHERE id = ?")
+			.run(JSON.stringify(record), record.intent?.submissionId ?? null, s.id);
+		const statuses = { pending: "pending", processing: "submitted", sent: "delivered", cancelled: "closed", failed: "needs_review", unconfirmed: "needs_review" } as const;
+		this.db.query("UPDATE decisions SET revision = ?, status = ?, reason = ?, updated_at = ? WHERE id = ?")
+			.run(s.revision, statuses[s.status], s.errorCode, new Date().toISOString(), s.id);
+		return record;
+	}
+
+	claimSecurityHold(id: string, intent: SecurityIntent): { record: SecurityHoldRecord; fresh: boolean } {
+		return this.db.transaction(() => {
+			const record = this.securityHold(id);
+			if (!record) throw new SecurityRuntimeError("held_conflict");
+			if (record.intent !== null) {
+				if (!isDeepStrictEqual(record.intent, intent)) throw new SecurityRuntimeError("held_conflict", record.state);
+				return { record, fresh: false };
+			}
+			const reused = intent.submissionId === null ? null : this.db.query<{ id: string }, [string]>("SELECT id FROM security_holds WHERE intent_submission = ?").get(intent.submissionId);
+			if (reused || record.state.status !== "pending" ||
+				(intent.expectedRevision !== null && record.state.revision !== intent.expectedRevision)) throw new SecurityRuntimeError("held_conflict", record.state);
+			const claimed = this.writeSecurityHold({ ...record, intent, state: {
+				...record.state, revision: record.state.revision + 1,
+				status: intent.send ? "processing" : "cancelled",
+			} });
+			return { record: claimed, fresh: true };
+		}).immediate();
+	}
+
+	reserveSecurityDispatch(id: string, occurrences: readonly { canonicalValue?: string; value: string; kind: string; label: string }[], approver: SecurityApprover): SecurityHoldRecord {
+		return this.db.transaction(() => {
+			const record = this.securityHold(id);
+			if (!record || record.state.status !== "processing" || record.dispatchReserved) throw new SecurityRuntimeError("held_conflict", record?.state);
+			const remember = record.intent?.remember === true;
+			let revision = this.securityAllowedValues().revision;
+			if (remember) {
+				let added = 0;
+				for (const occurrence of occurrences) {
+					const value = occurrence.canonicalValue ?? occurrence.value;
+					const entry: AllowedValue = { id: crypto.randomUUID(), value, kind: occurrence.kind, label: occurrence.label,
+						approvedAt: new Date().toISOString(), approvedBy: approver, heldId: id };
+					added += this.db.query("INSERT OR IGNORE INTO security_allowed_values VALUES (?, ?, ?)").run(entry.id, value, JSON.stringify(entry)).changes;
+				}
+				if (added > 0) {
+					this.db.query("UPDATE security_allow_revision SET revision = revision + 1 WHERE id = 1").run();
+					revision++;
+				}
+			}
+			return this.writeSecurityHold({ ...record, dispatchReserved: true, state: {
+				...record.state, revision: record.state.revision + 1, remembered: remember, allowlistRevision: revision,
+			} });
+		}).immediate();
+	}
+
+	updateSecurityHold(id: string, change: Partial<Pick<HeldState, "status" | "errorCode">>, receipt?: SecurityReceipt, intent?: SecurityIntent): SecurityHoldRecord {
+		return this.db.transaction(() => {
+			const record = this.securityHold(id);
+			if (!record) throw new SecurityRuntimeError("held_conflict");
+			return this.writeSecurityHold({ ...record, intent: record.intent ?? intent ?? null, ...(receipt ? { receipt } : {}),
+				state: { ...record.state, ...change, revision: record.state.revision + 1 } });
+		}).immediate();
+	}
+
+	deleteSecurityAllowedValues(expectedRevision: number, id?: string): { revision: number; removed: number } {
+		return this.db.transaction(() => {
+			let revision = this.securityAllowedValues().revision;
+			if (revision !== expectedRevision) throw new SecurityRuntimeError("allowlist_conflict", undefined, revision);
+			const removed = id === undefined ? this.db.query("DELETE FROM security_allowed_values").run().changes
+				: this.db.query("DELETE FROM security_allowed_values WHERE id = ?").run(id).changes;
+			if (removed > 0) {
+				this.db.query("UPDATE security_allow_revision SET revision = revision + 1 WHERE id = 1").run();
+				revision++;
+			}
+			return { revision, removed };
+		}).immediate();
+	}
+
+	securityReceipt(ref: SecurityReceipt): "sent" | "unconfirmed" | null {
+		if (ref.kind === "answer") {
+			const decision = this.getDecision(ref.decisionId);
+			if (decision?.submissionId !== ref.submissionId) return null;
+			return decision?.status === "delivered" ? "sent" : decision?.reason === "receipt_unknown" ? "unconfirmed" : null;
+		}
+		const after = this.eventsAfter(ref.conv, ref.messageSeq);
+		const inputs = after.filter((event) => event.type === "main.input" && object(event.data) && object(event.data.input_ref) &&
+			event.data.input_ref.message_seq === ref.messageSeq);
+		return inputs.some((input) => after.some((event) => event.type === "main.input.ack" && object(event.data) &&
+			event.data.input_seq === input.seq)) ? "sent" : null;
+	}
+
+	onSecurityReceipt(listener: () => void): () => void {
+		this.securityReceiptListeners.add(listener);
+		return () => this.securityReceiptListeners.delete(listener);
+	}
+
+	notifySecurityReceipts(): void {
+		for (const listener of this.securityReceiptListeners) listener();
 	}
 
 	/**
@@ -925,6 +1094,7 @@ export class Store {
 					.run(input.conv, data.session_path, data.handoff);
 			}
 		}).immediate();
+		this.notifySecurityReceipts();
 	}
 
 	eventsAfter(conv: string, seq: number, limit = -1): StoredEvent[] {
@@ -977,11 +1147,36 @@ export class Store {
 		return { seq: Number(result.lastInsertRowid), conv, type, data, ts };
 	}
 
-	/** Acceptance and definitely-unsent intent precede every session-admission await. */
-	acceptMainUser(conv: string, data: unknown): StoredEvent {
+	/** Bind to one persisted native answer; replay never creates another statistics row. */
+	appendTurnStats(conv: string, durableSessionId: string, measured: NativeTurnStats): StoredEvent | null {
+		return this.db.transaction(() => {
+			const existing = this.db.query<{ seq: number }, [string, string]>(
+				"SELECT seq FROM events WHERE conv = ? AND type = 'message.stats' AND json_extract(data, '$.turnId') = ? LIMIT 1",
+			).get(conv, measured.turnId);
+			if (existing) return null;
+			const answer = this.db.query<{ seq: number; itemId: string }, [string, string, string, number, number]>(
+				`SELECT seq, json_extract(data, '$.itemId') AS itemId FROM events
+				WHERE conv = ? AND type = 'message.final'
+				AND json_extract(data, '$.engineTurn.sessionId') = ?
+				AND json_extract(data, '$.engineTurn.id') = ?
+				AND json_extract(data, '$.engineTurn.messageTimestamp') = ?
+				AND json_extract(data, '$.engineTurn.messageIndex') = ?
+				AND json_type(data, '$.itemId') = 'text'
+				ORDER BY seq DESC LIMIT 1`,
+			).get(conv, durableSessionId, measured.turnId, measured.finalMessageTimestamp, measured.finalMessageIndex);
+			if (!answer) return null;
+			return this.appendEvent(conv, "message.stats", {
+				itemId: answer.itemId, messageSeq: answer.seq, turnId: measured.turnId, stats: measured.stats,
+			});
+		}).immediate();
+	}
+
+	/** Acceptance, unsent intent and the optional receipt link commit together before session admission. */
+	acceptMainUser(conv: string, data: unknown, receipt?: (ref: SecurityReceipt) => void): StoredEvent {
 		return this.db.transaction(() => {
 			const message = this.appendEvent(conv, "message.user", data);
 			this.appendEvent(conv, "main.user.pending", { message_seq: message.seq });
+			receipt?.({ kind: "message", conv, messageSeq: message.seq });
 			return message;
 		}).immediate();
 	}
@@ -1043,6 +1238,31 @@ export class Store {
 		this.db.query("INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(key, value);
 	}
 
+	/** A source occurrence is recorded even while disabled, making the eligibility boundary durable. */
+	recordReplyNotification(sessionPath: string, entryId: string, notification: ReplyNotification | null): void {
+		this.db.query("INSERT OR IGNORE INTO reply_notifications (session_path, entry_id, id, data) VALUES (?, ?, ?, ?)")
+			.run(sessionPath, entryId, notification?.id ?? crypto.randomUUID(), notification ? JSON.stringify(notification) : null);
+	}
+
+	pendingReplyNotifications(deviceId: string): ReplyNotification[] {
+		return this.db.query<{ data: string }, [string]>(`SELECT data FROM reply_notifications AS n
+			WHERE data IS NOT NULL AND cancelled = 0 AND NOT EXISTS
+			(SELECT 1 FROM reply_notification_acks AS a WHERE a.id = n.id AND a.device_id = ?) ORDER BY n.rowid`)
+			.all(deviceId).map((row) => JSON.parse(row.data) as ReplyNotification);
+	}
+
+	ackReplyNotification(id: string, deviceId: string): void {
+		this.db.query("INSERT OR IGNORE INTO reply_notification_acks (id, device_id) VALUES (?, ?)").run(id, deviceId);
+	}
+
+	setNotificationMode(mode: NotificationMode): void {
+		this.db.transaction(() => {
+			if (mode === "inbox-only") this.db.query("UPDATE reply_notifications SET cancelled = 1 WHERE data IS NOT NULL").run();
+			this.setSetting("notifications.mode", mode);
+			this.setSetting("notifications.revision", String(Number(this.getSetting("notifications.revision") ?? 0) + 1));
+		}).immediate();
+	}
+
 	getMemo(): Memo {
 		const row = this.db
 			.query<{ text: string; width: number | null; height: number | null; images: string; updated_at: string }, []>(
@@ -1476,6 +1696,13 @@ export class Store {
 			}
 			if (unreported.length !== updates.length) throw new WorkStoreError("publish_conflict", unreported.map((u) => u.id));
 			const event = this.appendEvent(ownerConv, "message.final", { text, work_update_ids: updates.map((update) => update.id) });
+			// Publishing is a distinct complete chat reply, not a replay of the worker's native message.
+			// Admit it in this transaction so a restart between commit and fan-out cannot lose it.
+			this.recordReplyNotification("gateway:work-publication", String(event.seq),
+				this.getSetting("notifications.mode") === "all-replies" && text.trim() ? {
+					id: crypto.randomUUID(), conv: ownerConv,
+					title: this.getConversation(ownerConv)?.title ?? "Reply", text,
+				} : null);
 			for (const update of updates) this.db.query("UPDATE work_updates SET reported_event_seq = ? WHERE id = ?").run(event.seq, update.id);
 			return [event];
 		}).immediate();
@@ -1523,6 +1750,7 @@ export class Store {
 	 * for sibling A cannot invalidate sibling B's options.
 	 */
 	decisionContextReason(decision: Decision): string | null {
+		if (securityDecision(decision)) return null;
 		if (decision.workId !== null) {
 			const work = this.getWork(decision.workId);
 			if (!work) return "owner_unknown";
@@ -1555,6 +1783,7 @@ export class Store {
 		const result = this.db.transaction((): DecisionClaim | DecisionStoreError => {
 			let decision = this.getDecision(id);
 			if (!decision) throw new DecisionStoreError("decision_not_found");
+			if (securityDecision(decision)) throw new DecisionStoreError("security_endpoint_required");
 			if (!Number.isSafeInteger(request.expectedRevision) || request.expectedRevision < 1 ||
 				!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(request.submissionId)) {
 				throw new DecisionStoreError("invalid_decision_answer", decision);
@@ -2205,6 +2434,7 @@ export class Store {
 		return this.db.transaction((): DecisionDismissal => {
 			const d = this.getDecision(id);
 			if (!d) throw new DecisionStoreError("decision_not_found");
+			if (securityDecision(d)) throw new DecisionStoreError("security_endpoint_required");
 			if (d.revision !== expectedRevision || d.status === "delivered" || d.status === "closed" || d.status === "submitted") {
 				throw new DecisionStoreError("decision_conflict", d);
 			}

package/src/turn-stats.ts

@@ -0,0 +1,49 @@
+import type { TurnStats } from "./protocol.ts";
+
+export interface NativeTurnStats {
+	readonly version: 1;
+	readonly turnId: string;
+	readonly finalMessageTimestamp: number;
+	readonly finalMessageIndex: number;
+	readonly stats: TurnStats;
+}
+
+function record(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+export function turnId(value: unknown): string | null {
+	return typeof value === "string" && /^[a-zA-Z0-9_-]{1,128}$/.test(value) ? value : null;
+}
+
+export function messageTimestamp(value: unknown): value is number {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+
+/** Parse the engine boundary once. Unknown fields never reach stored/client data. */
+export function nativeTurnStats(value: unknown): NativeTurnStats | null {
+	if (!record(value) || value.version !== 1) return null;
+	const id = turnId(value.turnId);
+	if (!id || !messageTimestamp(value.finalMessageTimestamp) || !record(value.stats)) return null;
+	if (typeof value.finalMessageIndex !== "number" || !Number.isSafeInteger(value.finalMessageIndex) || value.finalMessageIndex <= 0) return null;
+	const { tokensPerSecond, modelDurationMs, cacheHitPercent } = value.stats;
+	if (tokensPerSecond !== undefined &&
+		(typeof tokensPerSecond !== "number" || !Number.isFinite(tokensPerSecond) || tokensPerSecond <= 0)) return null;
+	if (modelDurationMs !== undefined &&
+		(typeof modelDurationMs !== "number" || !Number.isFinite(modelDurationMs) || modelDurationMs <= 0)) return null;
+	if (cacheHitPercent !== undefined &&
+		(typeof cacheHitPercent !== "number" || !Number.isFinite(cacheHitPercent) || cacheHitPercent < 0 || cacheHitPercent > 100)) return null;
+	if (tokensPerSecond === undefined && modelDurationMs === undefined && cacheHitPercent === undefined) return null;
+	return {
+		version: 1, turnId: id, finalMessageTimestamp: value.finalMessageTimestamp, finalMessageIndex: value.finalMessageIndex,
+		stats: {
+			...(tokensPerSecond === undefined ? {} : { tokensPerSecond }),
+			...(modelDurationMs === undefined ? {} : { modelDurationMs }),
+			...(cacheHitPercent === undefined ? {} : { cacheHitPercent }),
+		},
+	};
+}
+
+export function nativeTurnStarted(value: unknown): string | null {
+	return record(value) && value.version === 1 ? turnId(value.turnId) : null;
+}

package/src/work-watch.ts

@@ -1,4 +1,4 @@
-import type { OmoEvent } from "./omo/client.ts";
+import { blockingCompaction, COMPACTION_FAILURE_KINDS, compactionOutcome, type OmoEvent } from "./omo/client.ts";
 import type { Store, WorkCommand, WorkItem, WorkUpdate } from "./store.ts";
 
 /**
@@ -68,7 +68,7 @@ export interface Verdict {
 	readonly evidence?: Readonly<Record<string, unknown>>;
 }
 
-/** Live signals of one work session, kept in memory only and reset whenever the OMO connection changes. */
+/** Live runtime signals reset on connection changes; safe compaction outcomes reload from work observations. */
 export interface Live {
 	observedSince: number;
 	lastActivityAt: number;
@@ -81,11 +81,12 @@ export interface Live {
 	readonly openTools: Map<string, { name: string; at: number }>;
 	/** Running sub-tasks from senpi-task's `omo.task.updated`; null while unknown. */
 	children: { active: number; at: number } | null;
+	readonly compactionTerminals: Set<string>;
 	lastError: { kind: "model_error" | "compaction_failed" | "retry_exhausted"; message: string; at: number } | null;
 }
 
 export function newLive(now: number): Live {
-	return { observedSince: now, lastActivityAt: now, streaming: null, runStartedAt: null, runObserved: false, stoppedAt: null, openTools: new Map(), children: null, lastError: null };
+	return { observedSince: now, lastActivityAt: now, streaming: null, runStartedAt: null, runObserved: false, stoppedAt: null, openTools: new Map(), children: null, compactionTerminals: new Set(), lastError: null };
 }
 
 export interface JudgeInput {
@@ -270,6 +271,15 @@ export class WorkWatcher {
 		let live = this.lives.get(workId);
 		if (!live) {
 			live = newLive(this.clock());
+			for (const update of this.store.listWorkUpdates(workId)) {
+				const details = update.details;
+				if (update.kind !== "observation" || !record(details) || details.source !== "compaction-watcher" ||
+					typeof details.at !== "number" || !Number.isFinite(new Date(details.at).getTime())) continue;
+				if (typeof details.requestId === "string") live.compactionTerminals.add(details.requestId);
+				const failureKind = COMPACTION_FAILURE_KINDS.find((kind) => kind === details.failureKind);
+				if (failureKind) live.lastError = { kind: "compaction_failed", message: failureKind, at: details.at };
+				else if (details.failureKind === null) live.lastError = null;
+			}
 			this.lives.set(workId, live);
 		}
 		return live;
@@ -306,8 +316,22 @@ export class WorkWatcher {
 		const now = this.clock();
 		const live = this.live(workId);
 		live.lastActivityAt = now;
+		const previousError = live.lastError;
+		const changed = this.apply(live, event, now);
+		if (previousError !== live.lastError &&
+			(previousError?.kind === "compaction_failed" || live.lastError?.kind === "compaction_failed")) {
+			this.store.recordWorkUpdate(workId, {
+				sourceKey: `watch:compaction:${crypto.randomUUID()}`,
+				kind: "observation",
+				commandSeq: null,
+				summary: "compaction_state",
+				details: { source: "compaction-watcher", at: now,
+					failureKind: live.lastError?.kind === "compaction_failed" ? live.lastError.message : null,
+					requestId: event.type === "compaction_end" && typeof event.requestId === "string" ? event.requestId : null },
+			});
+		}
 		// Plain activity changes a verdict only when it clears an unresponsive or broken one.
-		if (this.apply(live, event, now) || this.flagged(workId)) this.schedule();
+		if (changed || this.flagged(workId)) this.schedule();
 	}
 
 	private flagged(workId: string): boolean {
@@ -351,12 +375,14 @@ export class WorkWatcher {
 				return true;
 			}
 			case "compaction_end": {
-				if (event.aborted === true) return false;
-				const failed = typeof event.errorMessage === "string" || event.accepted === false ||
-					(event.accepted !== true && !record(event.result));
-				if (!failed) return false;
-				const cause = typeof event.errorMessage === "string" ? event.errorMessage : typeof event.rejectionCause === "string" ? event.rejectionCause : "완료 결과가 없습니다";
-				live.lastError = { kind: "compaction_failed", message: cause, at: now };
+				if (!blockingCompaction(event)) return false;
+				if (typeof event.requestId === "string") {
+					if (live.compactionTerminals.has(event.requestId)) return false;
+					live.compactionTerminals.add(event.requestId);
+				}
+				const outcome = compactionOutcome(event);
+				if (outcome.status !== "failed") return false;
+				live.lastError = { kind: "compaction_failed", message: outcome.failureKind, at: now };
 				return true;
 			}
 			case "auto_retry_end":

package/src/work.ts

@@ -3,6 +3,8 @@ import { isAbsolute, join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { OmoCommandError, type OmoClient, type OmoEvent, type OmoStatus } from "./omo/client.ts";
 import { DecisionStoreError, Store, WorkStoreError, type LedgerState, type MainInput, type StoredEvent, type WorkCommand, type WorkItem, type WorkReport, type WorkUpdateKind } from "./store.ts";
+import { nativeReplyEntry, type NativeReplyEntry, type NativeReplyObserver } from "./reply-notifications.ts";
+import { notificationHistory } from "./notification-history.ts";
 
 const ACK_TIMEOUT_MS = 30_000;
 const PREFIX = "ZGW_WORK_COMMAND ";
@@ -15,7 +17,7 @@ type State = {
 	ordered?: { text: string; mode?: string; clientInputId?: string }[];
 	pendingQuestions?: OmoEvent[]; atomicQueuedResume?: boolean; queueEpoch?: string;
 };
-type Entry = { id: string; type: string; customType?: string; data?: unknown; message?: { role: string; content: unknown } };
+type Entry = NativeReplyEntry & { id: string; type: string; customType?: string; data?: unknown };
 export interface WorkSessionOwner {
 	readonly conv: string;
 	readonly scope: `work:${string}`;
@@ -30,6 +32,7 @@ export interface WorkRequest {
 	payload: RecordValue;
 }
 export interface WorkRouterOptions {
+	replies?: NativeReplyObserver;
 	sessionDir: string;
 	permissionPreset: string;
 	/** Invoked only for newly committed events. Task 6 also uses this boundary for report-turn metadata. */
@@ -121,6 +124,20 @@ export class WorkRouter {
 	}
 
 	private get ready(): boolean { return !this.stopped && this.status === "ready" && this.omo.currentStatus === "ready"; }
+	/** Includes finished, normally lazy sources so enabling never backfills their old replies. */
+	async notificationBaseline(): Promise<void> {
+		for (const work of this.allWorks()) {
+			const generation = this.generation;
+			const revision = this.options.replies?.revision();
+			const current = () => !this.stopped && generation === this.generation &&
+				this.store.getWork(work.id)?.sessionPath === work.sessionPath;
+			await notificationHistory(work.sessionPath, (entry) => {
+				if (!current()) throw new Error("reply_baseline_discarded");
+				if (revision !== undefined) this.options.replies?.observe({ sessionPath: work.sessionPath, conv: work.ownerConv, workId: work.id, title: work.title }, [entry], revision);
+			}, true);
+			if (!current()) throw new Error("reply_baseline_discarded");
+		}
+	}
 	private allWorks(): WorkItem[] { return this.store.listConversations().flatMap((conv) => this.store.listWorks(conv.id)); }
 	private work(id: string): WorkItem { const work = this.store.getWork(id); if (!work) throw new RoutingError("work_not_found", 404); return work; }
 	private current(workId: string, binding: Binding): boolean { return this.ready && binding.generation === this.generation && this.bindings.get(workId) === binding; }
@@ -463,7 +480,7 @@ export class WorkRouter {
 		const saved = this.store.getSetting("omo.model");
 		const model: { provider: string; modelId: string } | null = saved ? JSON.parse(saved) : null;
 		const promise = this.omo.command<{ sessionId: string; attached?: boolean; state?: State }>("open_session", {
-			sessionPath: work.sessionPath, cwd: work.cwd, permissionPreset: this.options.permissionPreset, kind: "worker", retain_on_disconnect: true, auto_title: false,
+			sessionPath: work.sessionPath, cwd: work.cwd, permissionPreset: this.options.permissionPreset, kind: "worker", promptSurface: "app", retain_on_disconnect: true, auto_title: false,
 			// Native applies these only on first creation, never on a persisted resume.
 			...(model ? { provider: model.provider, modelId: model.modelId } : {}),
 			context: { zgw_role: "work", zgw_work: work.id, zgw_conv: work.ownerConv },
@@ -580,11 +597,16 @@ export class WorkRouter {
 	private async readEvidence(workId: string): Promise<void> {
 		const work = this.work(workId);
 		const binding = await this.ensure(work);
+		let replyRevision = this.options.replies?.revision();
 		const [entries, state] = await Promise.all([
-			this.entriesAfter(binding.sessionId, this.store.workEntryCursor(workId), () => this.current(workId, binding)),
+			this.entriesAfter(binding.sessionId, this.store.workEntryCursor(workId), () => {
+				replyRevision = this.options.replies?.revision();
+				return this.current(workId, binding);
+			}),
 			this.omo.command<State>("get_state", { sessionId: binding.sessionId }),
 		]);
 		if (!entries || !this.current(workId, binding)) return;
+		if (replyRevision !== undefined) this.options.replies?.observe({ sessionPath: work.sessionPath, conv: work.ownerConv, workId, title: work.title }, entries, replyRevision);
 		if (typeof state.isStreaming === "boolean") this.options.onRuntime?.(workId, state.isStreaming);
 		for (const entry of entries) {
 			if (entry.type === "custom" && (entry.customType === "zgw.native_permission_asked" || entry.customType === "zgw.native_permission_replied")) {
@@ -644,6 +666,12 @@ export class WorkRouter {
 		const [workId, binding] = found;
 		if (!this.current(workId, binding)) return false;
 		this.options.onWorkEvent?.(workId, event);
+		if (this.options.replies && event.type === "entry_appended") {
+			const entry = nativeReplyEntry(event.entry);
+			const work = this.work(workId);
+			if (entry) this.options.replies.observe({ sessionPath: work.sessionPath, conv: work.ownerConv, workId, title: work.title },
+				[entry], this.options.replies.revision());
+		}
 		if (event.type === "extension_ui_request" && event.method === "notify" && this.store.isOmoCheckWork(workId)) {
 			// Preserve attribution before Hub turns the frame into an unattributed main-chat notice.
 			const sourceKey = `omo-check-notice:${typeof event.id === "string" ? event.id : crypto.randomUUID()}`;
@@ -725,10 +753,21 @@ export class WorkRouter {
 		// the native per-connection queue and the bridge frontend budget, dropping this connection.
 		for (const work of works) {
 			if (!this.ready || generation !== this.generation) return;
-			// Finished sessions are opened on demand by owner(), reconcile() or dispatch().
-			if (["completed", "failed", "cancelled"].includes(work.status) &&
-				!this.store.listWorkCommands(work.id).some((command) => ["pending", "sending", "unknown"].includes(command.delivery))) continue;
+			// A completed report may precede the final assistant reply. Enabled notifications
+			// must recover that tail even when command delivery already reached its terminal state.
 			try {
+				if (["completed", "failed", "cancelled"].includes(work.status) &&
+					!this.store.listWorkCommands(work.id).some((command) => ["pending", "sending", "unknown"].includes(command.delivery))) {
+					if (this.options.replies?.settings().mode === "all-replies") {
+						const revision = this.options.replies.revision();
+						await notificationHistory(work.sessionPath, (entry) => {
+							if (!this.ready || generation !== this.generation ||
+								this.store.getWork(work.id)?.sessionPath !== work.sessionPath) throw new Error("reply_history_discarded");
+							this.options.replies?.observe({ sessionPath: work.sessionPath, conv: work.ownerConv, workId: work.id, title: work.title }, [entry], revision);
+						});
+					}
+					continue;
+				}
 				await this.reconcile(work.id);
 				this.schedule(work.id);
 			} catch (error) { this.fail(error); }

package/web/DESIGN.md

@@ -14,6 +14,10 @@ The chat retains its bounded scroll area. The memo remains an anchored,
 resizable panel inside `messages-wrap`, constrained to the available width
 and height. Text owns the remaining panel height; image controls do not
 overlap the composer or resize handle.
+The message viewport reserves a 64px right gutter outside its scroll area.
+The existing 34px navigation buttons and their 20px right offset occupy this
+gutter, with 10px clearance. All message kinds share this boundary, including
+system notices. The message list remains the only vertical scroll owner.
 
 ## 4. Typography and spacing
 Keep existing 12px panel labels, 14px memo text, 8/12px control spacing,
@@ -105,6 +109,16 @@ image-specific remove labels. Keyboard focus remains visible. Closing or
 reopening the memo must not lose saved text or image references.
 
 ## 8. Verification and retained debt
+Security confirmation reuses the same inbox item, text buttons and inline delete
+confirmation. Chat and inbox share the held identity. Pending, processing, sent,
+cancelled, failed and unconfirmed states have text labels; only confirmed sent
+uses `--ok`. Canonical values preserve whitespace and wrap at narrow widths.
+Allowed values remain inside the existing security settings section. The list
+uses 12px metadata, 8px spacing, 4px radii and existing border/muted tokens.
+Loading, offline, empty, error, retry and busy states use live status regions.
+Delete confirmation focuses the keep action and explains future-check effects.
+Real desktop/mobile and light/dark QA is assigned to the integration lead.
+
 Exercise empty/one/two/full/uploading/error/remove/reopen/remote-update states
 at narrow and wide sizes. Preserve the existing theme and unrelated controls.
 Existing broad application-script size is outside this feature; extract only
@@ -139,3 +153,28 @@ A sent message shows the references it carried above its text as quotes: the 1px
 as the title; reference text is set as DOM text only, never HTML. No new tokens or motion; autocomplete, IME, autocopy,
 마지막 보냄 includes the reference count, including a reference-only send. ArrowUp still recalls typed text only,
 as it already does for image-only messages.
+
+## 10. Inline chat diagrams (180)
+Only complete top-level, unindented triple-backtick `zigmini-diagram` fences
+become diagrams. Invalid and unfinished fences retain the existing source view.
+The figure uses `--bg-card`, `--bg-input`, `--border`, `--text` and `--muted`.
+Native node text inherits the message font and stays selectable. Nodes use
+8px/12px padding, a 4px radius and a 1px border; the figure uses an 8px radius.
+Top-to-bottom levels use intrinsic max-content columns, 24px column gaps and
+48px row gaps. A 24px right gutter carries edges that skip a level; their
+horizontal segments stay in the row gaps, never through intermediate labels.
+Labels never scale down or truncate, including at enlarged text.
+The diagram viewport alone owns horizontal and vertical diagram scrolling,
+bounded to the message width and 24rem height. The transcript retains normal
+scroll chaining. At phone widths up to 640px, the figure leaves 48px on its right
+for the existing transcript navigation buttons, keeping its source and scroll
+controls clear without changing those buttons or other message layouts.
+The viewport is a named keyboard-focusable region with a visible
+text-colour focus outline. A native details/summary source foldout follows it,
+with a 44px minimum summary target and selectable complete fence source.
+The title and a native text list describe every directed edge for assistive
+technology; SVG connectors are inert and hidden from it. Disconnected nodes
+remain visible. No animation, network, remote fonts, new settings or exports.
+Source foldouts retain their local open state across streaming updates.
+Desktop/phone light/dark, enlarged text, source/copy and reference QA belong
+to the parent integration lane; local unit checks do not claim visual approval.