webbee 0.3.7__tar.gz → 0.3.9__tar.gz

{webbee-0.3.7 → webbee-0.3.9}/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.3.9
+
+- Internal restructure: the session engine was split into focused modules
+  (consent handling, coding context, boot) — no behavior change.
+
+
+## 0.3.8
+
+- No more sign-in races: token refresh is serialized and retries once after
+  a sibling terminal rotates the session — multiple open terminals no longer
+  knock each other out with "session expired".
+- No more dock lockup: a turn that fails (for example, an expired session)
+  now clears the "working" state, and every key keeps responding even if the
+  turn state ever goes stale. The idle pickup poller also backs off instead
+  of hammering a signed-out session.
+
 ## 0.3.7
 
 - Terminal liveness: a consent answered from Telegram/panel no longer

{webbee-0.3.7 → webbee-0.3.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webbee
-Version: 0.3.7
+Version: 0.3.9
 Summary: Webbee 🐝 — the Imperal Cloud coding agent in your terminal
 Project-URL: Homepage, https://imperal.io
 Project-URL: Documentation, https://docs.imperal.io

{webbee-0.3.7 → webbee-0.3.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "webbee"
-version = "0.3.7"
+version = "0.3.9"
 description = "Webbee 🐝 — the Imperal Cloud coding agent in your terminal"
 readme = "README.md"
 license = "MIT"

webbee-0.3.9/src/webbee/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.9"

{webbee-0.3.7 → webbee-0.3.9}/src/webbee/account.py

@@ -39,6 +39,21 @@ async def _default_get(cfg, token: str, path: str) -> dict:
         return r.json()
 
 
+async def login_device_flow(cfg, auth, sink) -> str:
+    """ONE shared imperal_mcp mechanism: device-code flow (RFC 8628), async,
+    so the caller awaits it directly on the dock's event loop (the /login turn
+    runs as a background task, so the dock stays responsive while it polls).
+    on_prompt renders the code + URL into the feed — a bare print would be
+    invisible in the dock. Returns the signed-in email."""
+    def _login_prompt(user_code, uri, uri_complete):
+        show = getattr(sink, "login_prompt", None)
+        if show:
+            show(user_code, uri)
+        else:
+            sink.note(f"Open {uri} and enter code: {user_code}")
+    return await auth.login_device(cfg, on_prompt=_login_prompt)
+
+
 async def fetch_account(cfg, token_provider, *, get=None) -> Account:
     """Best-effort account summary for the welcome screen. NEVER raises: no
     token or a failed /v1/auth/me -> Account(signed_in=False); a failed

webbee-0.3.9/src/webbee/boot.py

@@ -0,0 +1,108 @@
+"""REPL boot helpers (extracted verbatim from webbee.repl): everything the
+dock sets up before the first prompt — the cached git branch, the dock's
+stderr log file, the intel/shadow default factories and their guarded
+starters, and the best-effort boot replay of the durable coding thread.
+All fail-soft: boot must never crash over a nice-to-have."""
+import asyncio
+import os
+import subprocess
+
+
+def _git_branch(workspace: str) -> str:
+    try:
+        p = subprocess.run(["git", "rev-parse", "--abbrev-ref", "HEAD"], cwd=workspace,
+                           capture_output=True, text=True, timeout=5)
+        return p.stdout.strip() if p.returncode == 0 else "-"
+    except (OSError, subprocess.SubprocessError):
+        return "-"
+
+
+def _open_dock_stderr_log():
+    """A file to swallow stderr for the full-screen dock's lifetime. The dock is
+    a prompt_toolkit full-screen Application that OWNS the terminal (it diffs the
+    screen); ANY stray write to stderr while it runs — a dependency's tqdm
+    download bar, a library warning, a background watcher-task traceback —
+    desyncs that diff and shows up as overlapping/duplicated text. Routing
+    stderr to ~/.cache/webbee/tui-stderr.log keeps the dock pixel-clean while
+    still preserving errors for debugging. Falls back to os.devnull if the cache
+    dir is unwritable; NEVER raises."""
+    try:
+        d = os.path.expanduser("~/.cache/webbee")
+        os.makedirs(d, exist_ok=True)
+        return open(os.path.join(d, "tui-stderr.log"), "a", buffering=1, encoding="utf-8")
+    except Exception:
+        try:
+            return open(os.devnull, "w")
+        except Exception:
+            import io
+            return io.StringIO()
+
+
+def _default_shadow_factory(cfg, workspace: str):
+    """The reversibility shadow git. Guarded like intel: any failure (no git
+    binary, cache not writable) degrades to None -- coding still works, just
+    without the time machine."""
+    from webbee.checkpoints import ShadowGit, shadow_key
+    from webbee.repo import find_repo_root
+    root = find_repo_root(workspace)
+    sg = ShadowGit(root, shadow_key(root), cache_dir=cfg.cache_dir)
+    return sg if sg.ensure() else None
+
+
+def _default_intel_factory(cfg, workspace: str):
+    """Lazy/guarded -- a base install (no tree-sitter/watchfiles extra) must
+    never fail to import here; the intel boot wraps the whole build in
+    try/except so any error (missing extra, indexing failure) degrades to
+    `intel=None` rather than crashing the REPL."""
+    from webbee.intel.service import IntelService
+    from webbee.repo import compute_repo_key, find_repo_root
+    root = find_repo_root(workspace)
+    return IntelService(root, compute_repo_key(root), cache_dir=cfg.cache_dir)
+
+
+async def replay_thread(cfg, token_provider, sink) -> None:
+    """Boot replay of the durable per-user thread (Task 9): best-effort,
+    entirely swallowed on any failure -- history is a nice-to-have,
+    never a boot blocker (network down, no such session yet, etc.)."""
+    try:
+        from imperal_mcp.client import ImperalClient
+        from webbee.thread import (conversational_text, fetch_recent_thread,
+                                   truncate_for_display)
+        _iid = await ImperalClient(cfg, token_provider).whoami()
+        _msgs = await fetch_recent_thread(cfg, token_provider, f"marathon-{_iid}-rboot")
+        _shown = 0
+        for _m in _msgs[-40:]:
+            _text = conversational_text(_m.get("content", ""))
+            if not _text:
+                continue  # pure tool traffic -- mind-food, not conversation
+            sink.foreign_turn(_m.get("surface", "terminal"), _m.get("role", ""),
+                              truncate_for_display(_text))
+            _shown += 1
+        if _shown:
+            sink.note("— live —")
+    except Exception:
+        pass  # replay is best-effort; never block boot
+
+
+async def start_intel(cfg, workspace: str, intel_factory):
+    """Off-loop intel build (indexing does sync file I/O + subprocess). Any
+    failure here (missing extra, bad repo, etc.) must degrade to
+    (None, None), never crash the boot -- coding still works, just
+    without repo intelligence. Returns (intel, watcher_task)."""
+    try:
+        svc = (intel_factory or _default_intel_factory)(cfg, workspace)
+        await asyncio.to_thread(svc.build)
+        from webbee.intel import watch
+        watcher_task = asyncio.ensure_future(watch.watch_workspace(svc.root, svc.apply_changes))
+        return svc, watcher_task
+    except Exception:
+        return None, None
+
+
+async def start_shadow(cfg, workspace: str, shadow_factory):
+    """Whole-mind P4: the reversibility shadow (never the user's VCS);
+    guarded -- boot must not fail over the time machine."""
+    try:
+        return await asyncio.to_thread(shadow_factory or _default_shadow_factory, cfg, workspace)
+    except Exception:
+        return None

webbee-0.3.9/src/webbee/coding_context.py

@@ -0,0 +1,83 @@
+"""Coding-context snapshot for the cloud brain (extracted verbatim from
+webbee.session): build_coding_context packages cwd/git/tree/repo identity
+(+ optional repo_profile), and detect_verify_cmd is the CLIENT-detected
+proof-of-done command a marathon carries in that context."""
+import os
+import subprocess
+
+
+def build_coding_context(workspace_root: str, intel=None) -> dict:
+    """Snapshot handed to the cloud brain: cwd (realpath), `git status -sb`
+    (empty for non-git/any error), a bounded newline-joined file tree, and —
+    when a ready intel service is injected — the precomputed repo_profile.
+    The profile is READ from the already-built index (cheap); indexing never
+    happens inline here."""
+    cwd = os.path.realpath(workspace_root)
+    try:
+        proc = subprocess.run(
+            ["git", "status", "-sb"], cwd=cwd,
+            capture_output=True, text=True, timeout=10,
+        )
+        git = proc.stdout if proc.returncode == 0 else ""
+    except (OSError, subprocess.SubprocessError):
+        git = ""
+    paths = []
+    for dirpath, dirnames, filenames in os.walk(cwd):
+        dirnames[:] = [d for d in dirnames if d != ".git" and not d.startswith(".")]
+        for fn in filenames:
+            paths.append(os.path.relpath(os.path.join(dirpath, fn), cwd))
+            if len(paths) >= 200:
+                break
+        if len(paths) >= 200:
+            break
+    from webbee.repo import compute_repo_key, find_repo_root
+    root = find_repo_root(cwd)
+    d = {"cwd": cwd, "git": git, "tree": "\n".join(paths),
+         "repo_key": compute_repo_key(root), "repo_root": root}
+    if intel is not None and getattr(intel, "ready", False):
+        try:
+            d["repo_profile"] = intel.repo_profile()
+        except Exception:
+            pass
+    return d
+
+
+def detect_verify_cmd(repo_root: str) -> str:
+    """Best-effort project test command, CLIENT-detected from the repo layout.
+
+    SECURITY-load-bearing: in a marathon the kernel runs ONLY this command as
+    proof-of-done — the cloud brain can never author a shell command. So this
+    is deliberately small + honest: a fixed command per recognised ecosystem,
+    NO guessing beyond these. An empty string means "no known runner" → the
+    kernel falls back to an LLM-judged done-check. Checked in a stable order."""
+    import json as _json
+
+    root = repo_root or "."
+
+    def _has(name: str) -> bool:
+        return os.path.isfile(os.path.join(root, name))
+
+    if _has("pyproject.toml") or _has("setup.cfg") or _has("tox.ini"):
+        return "pytest -q"
+    if _has("package.json"):
+        try:
+            with open(os.path.join(root, "package.json"), encoding="utf-8") as f:
+                pkg = _json.load(f)
+            scripts = pkg.get("scripts") if isinstance(pkg, dict) else None
+            if isinstance(scripts, dict) and scripts.get("test"):
+                return "npm test"
+        except (OSError, ValueError):
+            pass
+    if _has("Cargo.toml"):
+        return "cargo test"
+    if _has("go.mod"):
+        return "go test ./..."
+    if _has("Makefile"):
+        try:
+            import re as _re
+            with open(os.path.join(root, "Makefile"), encoding="utf-8") as f:
+                if _re.search(r"(?m)^test:", f.read()):
+                    return "make test"
+        except OSError:
+            pass
+    return ""

webbee-0.3.9/src/webbee/consent.py

@@ -0,0 +1,134 @@
+"""Consent path + the liveness-A consent race (extracted verbatim from
+webbee.session): handle_confirm_request relays the user's RAW reply for the
+kernel brain to interpret (ICNLI, safe-by-default), and race_consent lets a
+pending local prompt RACE the stream so a consent answered from ANOTHER
+surface (Telegram relay) unfreezes the terminal instead of leaving the dock
+stuck on `approve? y/n`."""
+import asyncio
+from dataclasses import dataclass
+
+from webbee.frames import _is_foreign_frame, render_foreign_frame
+
+
+async def handle_confirm_request(frame: dict, mode: str, ask_consent) -> dict:
+    """ICNLI consent path. The client does NOT interpret consent words — it
+    relays the user's RAW reply; the kernel brain interprets intent
+    (safe-by-default). autopilot/plan are explicit and never prompt.
+    `ask_consent(app_id, tool, args)` is an async coroutine returning the raw
+    reply (resolved through the pinned dock, or a sync fallback reader)."""
+    req_id = frame["req_id"]
+    if mode == "autopilot":
+        return {"req_id": req_id, "result": {"approved": True}}
+    if mode == "plan":
+        return {"req_id": req_id, "result": {"approved": False, "reason": "plan_mode"}}
+    try:
+        raw = await ask_consent(frame.get("app_id", ""), frame.get("tool", ""), frame.get("args", {}))
+    except Exception:
+        # Consent UI failed -> decline (safe-by-default). NEVER leave the kernel
+        # hanging on an unanswered confirm — an unposted result froze the dock.
+        return {"req_id": req_id, "result": {"approved": False, "reason": "consent_error"}}
+    return {"req_id": req_id, "result": {"consent_reply": raw}}
+
+
+async def _retire(task) -> None:
+    """Cancel + drain a racing task so it never outlives the frame loop
+    (liveness A hygiene). Absorbs the loser's outcome — CancelledError, a
+    late result, StopAsyncIteration, a transport error — retirement must
+    never introduce a new failure path. An externally-delivered cancellation
+    of the CALLER (task finished before our cancel landed) still propagates."""
+    task.cancel()
+    try:
+        await task
+    except asyncio.CancelledError:
+        if not task.cancelled():
+            raise                       # ours was the outer cancel — propagate
+    except Exception:
+        pass
+
+
+def _dismiss_consent(sink) -> None:
+    """Tell the UI the pending consent prompt was answered on ANOTHER surface
+    (liveness A). Guarded like the other optional sink hooks — a minimal sink
+    without `consent_dismissed` (or a UI bug) must never break the frame loop."""
+    fn = getattr(sink, "consent_dismissed", None)
+    if fn is None:
+        return
+    try:
+        fn("↩ answered from another surface")
+    except Exception:
+        pass
+
+
+@dataclass
+class _ConsentRace:
+    """Outcome of racing the local consent prompt against the stream
+    (liveness A). Exactly one shape per race:
+      * out          — the prompt resolved locally (today's path): POST it; a
+                       pulled-ahead __anext__ may ride along in carry_task.
+      * carry_frame  — the stream won: the park ended elsewhere; the prompt was
+                       cancelled + dismissed, nothing is posted, and the pulled
+                       frame is handed back to the loop for normal handling.
+      * stream_ended — StopAsyncIteration mid-consent: exit as stream end.
+    """
+    out: dict | None = None
+    carry_task: asyncio.Task | None = None
+    carry_frame: dict | None = None
+    stream_ended: bool = False
+
+
+async def race_consent(frame: dict, sink, stream, *, mode: str, task_id: str) -> _ConsentRace:
+    """LIVE BUG fix (Valentin, 2026-07-15): a consent answered from
+    Telegram resolves the kernel park, but the frame loop used to block
+    INLINE in handle_confirm_request — the dock froze on `approve? y/n`
+    and the rest of the turn never rendered until a local keypress. The
+    local prompt now RACES the stream:
+      * the prompt resolves first -> POST it (today's path, unchanged);
+        the pulled-ahead frame rides back to the loop in carry_task.
+      * a re-published confirm_request with the SAME req_id (kernel
+        I-MARATHON-USER-WAKE presence re-publish) -> NOT an answer; the
+        prompt stays up and both racers keep going.
+      * any other OWN-turn frame -> the park ended elsewhere (answered
+        from another surface / superseded): cancel the prompt, dismiss the
+        dock, POST NOTHING (the kernel accepts only the FIRST result per
+        issued req_id), hand the frame back for normal handling.
+      * foreign frames (C7) stay display-only and never end the park.
+    Consent is never auto-approved here — autopilot/plan resolve instantly
+    inside handle_confirm_request exactly as before."""
+    rid = frame.get("req_id")
+    consent_task = asyncio.ensure_future(
+        handle_confirm_request(frame, mode, sink.ask_consent))
+    pull = None
+    try:
+        while True:
+            if pull is None:
+                pull = asyncio.ensure_future(stream.__anext__())
+            await asyncio.wait({consent_task, pull},
+                               return_when=asyncio.FIRST_COMPLETED)
+            if consent_task.done():
+                # The local answer wins — even when both racers finished in
+                # the same cycle the pulled frame is NOT lost: the loop owns
+                # carry_task and processes it next.
+                return _ConsentRace(out=consent_task.result(), carry_task=pull)
+            nxt_pull, pull = pull, None
+            try:
+                nxt = nxt_pull.result()
+            except StopAsyncIteration:
+                # Stream ended mid-consent: retire the prompt safely and
+                # exit exactly as today's stream end (no result posted).
+                await _retire(consent_task)
+                return _ConsentRace(stream_ended=True)
+            if _is_foreign_frame(nxt, task_id):
+                render_foreign_frame(nxt, sink)
+                continue
+            if nxt.get("type") == "confirm_request" and nxt.get("req_id") == rid:
+                continue
+            await _retire(consent_task)
+            _dismiss_consent(sink)
+            return _ConsentRace(carry_frame=nxt)
+    except BaseException:
+        # Hygiene on any unexpected exit (StreamAuthError from the pull,
+        # outer cancellation, a consent-task crash): no racer may leak.
+        for t in (consent_task, pull):
+            if t is not None and not t.done():
+                await _retire(t)
+        raise

{webbee-0.3.7 → webbee-0.3.9}/src/webbee/frames.py

@@ -25,6 +25,13 @@ def _v2_step_label(frame: dict) -> str:
     return "·".join(x for x in (frame.get("app_id", ""), frame.get("tool", "")) if x)
 
 
+def _summary(result: dict) -> str:
+    """One-line summary of a tool result for the UI."""
+    content = str(result.get("content", ""))
+    first = content.strip().splitlines()[0] if content.strip() else ""
+    return first[:120]
+
+
 def _summary_from_facts(facts: dict) -> str:
     """Renderer-composed one-line summary from v2 structured summary_facts
     (I-FRAMES-FACTS-ONLY: the kernel emits facts, never prose here). Degrades
@@ -103,6 +110,21 @@ def handle_step_finished(frame: dict, sink, finished: set, step_labels: dict, st
     steps.append({"step_id": sid, "label": label, "ok": ok})
 
 
+def handle_tool_request(frame: dict, executor) -> dict:
+    """Run a (kernel-pre-approved) local tool. The kernel gates write/bash
+    consent via confirm_request BEFORE dispatching, so a tool_request here is
+    always cleared to run. NEVER raises: a tool that errored (or a bug in the
+    executor) must STILL return a result so the caller posts it back and the
+    kernel's dispatch unblocks — an unposted result hangs the turn and freezes
+    the whole dock."""
+    rid = frame.get("req_id")
+    try:
+        result = executor.run(frame.get("tool", ""), frame.get("args", {}))
+    except Exception as e:
+        result = {"ok": False, "content": f"local tool crashed: {type(e).__name__}: {e}"}
+    return {"req_id": rid, "result": result}
+
+
 def handle_action_frame(frame: dict, sink, started: set, finished: set, steps: list) -> None:
     """OLD R2 ext-tool 'action' start/done frame -> sink.tool_start/
     tool_result, deduped by step_id against the v2 twin (dual-emit compat
@@ -135,6 +157,16 @@ _FOREIGN_ACTIONABLE_TYPES = ("tool_request", "confirm_request", "final",
                              "marathon_complete", "panel_release_required")
 
 
+def _is_foreign_frame(frame: dict, own_task_id: str) -> bool:
+    """C7 filter predicate (extracted verbatim from run()'s inline check): a
+    frame stamped with a DIFFERENT task_id on the shared persistent stream,
+    when it is origin-stamped or actionable, belongs to another turn and is
+    DISPLAY-ONLY for this client. task_id absent (legacy kernels) -> own."""
+    ftid = frame.get("task_id", "")
+    return bool(ftid and own_task_id and ftid != own_task_id and (
+        frame.get("origin") or frame.get("type") in _FOREIGN_ACTIONABLE_TYPES))
+
+
 def _origin_tag(frame: dict) -> str:
     """Display prefix for an OWN-turn frame steered from another surface.
     Live steer topology: a Telegram/panel-steered turn keeps the terminal's

{webbee-0.3.7 → webbee-0.3.9}/src/webbee/repl.py

@@ -1,45 +1,16 @@
 import asyncio
 import contextlib
 import os
-import subprocess
 import sys
 
 from webbee import __version__
+from webbee.account import login_device_flow
+from webbee.boot import _git_branch, _open_dock_stderr_log, replay_thread, start_intel, start_shadow
 from webbee.commands import CommandContext, dispatch
 from webbee.session import AgentSession
 from webbee.tui import next_mode
 
 
-def _git_branch(workspace: str) -> str:
-    try:
-        p = subprocess.run(["git", "rev-parse", "--abbrev-ref", "HEAD"], cwd=workspace,
-                           capture_output=True, text=True, timeout=5)
-        return p.stdout.strip() if p.returncode == 0 else "-"
-    except (OSError, subprocess.SubprocessError):
-        return "-"
-
-
-def _open_dock_stderr_log():
-    """A file to swallow stderr for the full-screen dock's lifetime. The dock is
-    a prompt_toolkit full-screen Application that OWNS the terminal (it diffs the
-    screen); ANY stray write to stderr while it runs — a dependency's tqdm
-    download bar, a library warning, a background watcher-task traceback —
-    desyncs that diff and shows up as overlapping/duplicated text. Routing
-    stderr to ~/.cache/webbee/tui-stderr.log keeps the dock pixel-clean while
-    still preserving errors for debugging. Falls back to os.devnull if the cache
-    dir is unwritable; NEVER raises."""
-    try:
-        d = os.path.expanduser("~/.cache/webbee")
-        os.makedirs(d, exist_ok=True)
-        return open(os.path.join(d, "tui-stderr.log"), "a", buffering=1, encoding="utf-8")
-    except Exception:
-        try:
-            return open(os.devnull, "w")
-        except Exception:
-            import io
-            return io.StringIO()
-
-
 async def run_marathon(cfg, mode: str, goal: str, *, sink=None, auth=None,
                        agent_factory=None) -> str:
     """Launch ONE autonomous marathon toward `goal` and stream it to stdout.
@@ -58,8 +29,8 @@ async def run_marathon(cfg, mode: str, goal: str, *, sink=None, auth=None,
 
     workspace = os.getcwd()
 
-    async def token_provider() -> str:
-        return await auth.ensure_access_token(cfg)
+    from webbee.tokens import make_token_provider
+    token_provider = make_token_provider(cfg, auth)
 
     if agent_factory is None:
         agent_factory = lambda c, tp, ws, m: AgentSession(c, tp, ws, m)  # noqa: E731
@@ -72,36 +43,16 @@ async def run_marathon(cfg, mode: str, goal: str, *, sink=None, auth=None,
     except (KeyboardInterrupt, asyncio.CancelledError):
         await agent.stop()
         sink.note("Interrupted.")
+        sink.end_turn("")   # clear busy (poller starvation guard)
         return ""
     except Exception as e:  # network/auth/etc — never crash
         sink.note(f"Error: {type(e).__name__}: {e}")
+        sink.end_turn("")   # clear busy: a stuck 'working' also starves the idle-steer poller
         return ""
     sink.end_turn(text)
     return text
 
 
-def _default_shadow_factory(cfg, workspace: str):
-    """The reversibility shadow git. Guarded like intel: any failure (no git
-    binary, cache not writable) degrades to None -- coding still works, just
-    without the time machine."""
-    from webbee.checkpoints import ShadowGit, shadow_key
-    from webbee.repo import find_repo_root
-    root = find_repo_root(workspace)
-    sg = ShadowGit(root, shadow_key(root), cache_dir=cfg.cache_dir)
-    return sg if sg.ensure() else None
-
-
-def _default_intel_factory(cfg, workspace: str):
-    """Lazy/guarded -- a base install (no tree-sitter/watchfiles extra) must
-    never fail to import here; `_boot` wraps the whole intel boot in
-    try/except so any error (missing extra, indexing failure) degrades to
-    `intel=None` rather than crashing the REPL."""
-    from webbee.intel.service import IntelService
-    from webbee.repo import compute_repo_key, find_repo_root
-    root = find_repo_root(workspace)
-    return IntelService(root, compute_repo_key(root), cache_dir=cfg.cache_dir)
-
-
 async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None, read_line=input,
                    agent_factory=None, auth=None, account_fetcher=None,
                    sessions_client=None, intel_factory=None, shadow_factory=None) -> None:
@@ -122,8 +73,8 @@ async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None,
 
     workspace = os.getcwd()
 
-    async def token_provider() -> str:
-        return await auth.ensure_access_token(cfg)
+    from webbee.tokens import make_token_provider
+    token_provider = make_token_provider(cfg, auth)
 
     # Prod dock path = the default reader + a real tty + no injected sink; tests
     # inject sink/read_line and take the plain fallback loop.
@@ -156,18 +107,8 @@ async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None,
             if res.exit:
                 return "exit"
             if res.action == "login":
-                # ONE shared imperal_mcp mechanism: device-code flow (RFC 8628),
-                # async, so we await it directly on the dock's event loop (the
-                # /login turn runs as a background task, so the dock stays
-                # responsive while it polls). on_prompt renders the code + URL
-                # into the feed — a bare print would be invisible in the dock.
-                def _login_prompt(user_code, uri, uri_complete):
-                    show = getattr(_sink, "login_prompt", None)
-                    if show:
-                        show(user_code, uri)
-                    else:
-                        _sink.note(f"Open {uri} and enter code: {user_code}")
-                email = await auth.login_device(cfg, on_prompt=_login_prompt)
+                # Device-code flow (RFC 8628) — rendering + polling in webbee.account.
+                email = await login_device_flow(cfg, auth, _sink)
                 state["logged_in"] = True
                 _sink.note(f"Signed in as {email}.")
                 return "continue"
@@ -287,9 +228,11 @@ async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None,
         except (KeyboardInterrupt, asyncio.CancelledError):
             _sink.abort()
             _sink.note("Interrupted.")
+            _sink.end_turn("")   # clear busy (poller starvation guard)
             return
         except Exception as e:  # network/auth/etc — never crash the REPL
             _sink.note(f"Error: {type(e).__name__}: {e}")
+            _sink.end_turn("")   # clear busy: a stuck 'working' also starves the idle-steer poller
             return
         _sink.end_turn(text)
 
@@ -313,47 +256,16 @@ async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None,
         account = await account_fetcher(cfg, token_provider)
         state["logged_in"] = account.signed_in
         _sink.welcome(account, workspace, "terminal")
-        # Boot replay of the durable per-user thread (Task 9): best-effort,
-        # entirely swallowed on any failure -- history is a nice-to-have,
-        # never a boot blocker (network down, no such session yet, etc.).
-        try:
-            from imperal_mcp.client import ImperalClient
-            from webbee.thread import (conversational_text, fetch_recent_thread,
-                                       truncate_for_display)
-            _iid = await ImperalClient(cfg, token_provider).whoami()
-            _msgs = await fetch_recent_thread(cfg, token_provider, f"marathon-{_iid}-rboot")
-            _shown = 0
-            for _m in _msgs[-40:]:
-                _text = conversational_text(_m.get("content", ""))
-                if not _text:
-                    continue  # pure tool traffic -- mind-food, not conversation
-                _sink.foreign_turn(_m.get("surface", "terminal"), _m.get("role", ""),
-                                   truncate_for_display(_text))
-                _shown += 1
-            if _shown:
-                _sink.note("— live —")
-        except Exception:
-            pass  # replay is best-effort; never block boot
+        # Boot replay of the durable per-user thread (Task 9) — best-effort,
+        # never a boot blocker (webbee.boot.replay_thread swallows everything).
+        await replay_thread(cfg, token_provider, _sink)
         if cfg.intel_enabled:
-            # Off-loop build (indexing does sync file I/O + subprocess). Any
-            # failure here (missing extra, bad repo, etc.) must degrade to
-            # intel=None, never crash the boot -- coding still works, just
-            # without repo intelligence.
-            try:
-                svc = (intel_factory or _default_intel_factory)(cfg, workspace)
-                await asyncio.to_thread(svc.build)
-                intel = svc
-                from webbee.intel import watch
-                watcher_task = asyncio.ensure_future(watch.watch_workspace(intel.root, intel.apply_changes))
-            except Exception:
-                intel = None
-                watcher_task = None
+            # Guarded off-loop build + watcher; any failure degrades to
+            # intel=None, never crashes the boot (webbee.boot.start_intel).
+            intel, watcher_task = await start_intel(cfg, workspace, intel_factory)
         # Whole-mind P4: the reversibility shadow (never the user's VCS);
         # guarded -- boot must not fail over the time machine.
-        try:
-            shadow = await asyncio.to_thread(shadow_factory or _default_shadow_factory, cfg, workspace)
-        except Exception:
-            shadow = None
+        shadow = await start_shadow(cfg, workspace, shadow_factory)
         agent = agent_factory(cfg, token_provider, workspace, state["mode"])
         # Liveness v2 §B: idle-steer pickup. All poll/drain logic lives in
         # webbee.steer -- this is wiring only: the sink's live turn state