webbee 0.3.8__tar.gz → 0.3.9__tar.gz

{webbee-0.3.8 → webbee-0.3.9}/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.3.9
+
+- Internal restructure: the session engine was split into focused modules
+  (consent handling, coding context, boot) — no behavior change.
+
+
 ## 0.3.8
 
 - No more sign-in races: token refresh is serialized and retries once after

{webbee-0.3.8 → webbee-0.3.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webbee
-Version: 0.3.8
+Version: 0.3.9
 Summary: Webbee 🐝 — the Imperal Cloud coding agent in your terminal
 Project-URL: Homepage, https://imperal.io
 Project-URL: Documentation, https://docs.imperal.io

{webbee-0.3.8 → webbee-0.3.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "webbee"
-version = "0.3.8"
+version = "0.3.9"
 description = "Webbee 🐝 — the Imperal Cloud coding agent in your terminal"
 readme = "README.md"
 license = "MIT"

webbee-0.3.9/src/webbee/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.9"

{webbee-0.3.8 → webbee-0.3.9}/src/webbee/account.py

@@ -39,6 +39,21 @@ async def _default_get(cfg, token: str, path: str) -> dict:
         return r.json()
 
 
+async def login_device_flow(cfg, auth, sink) -> str:
+    """ONE shared imperal_mcp mechanism: device-code flow (RFC 8628), async,
+    so the caller awaits it directly on the dock's event loop (the /login turn
+    runs as a background task, so the dock stays responsive while it polls).
+    on_prompt renders the code + URL into the feed — a bare print would be
+    invisible in the dock. Returns the signed-in email."""
+    def _login_prompt(user_code, uri, uri_complete):
+        show = getattr(sink, "login_prompt", None)
+        if show:
+            show(user_code, uri)
+        else:
+            sink.note(f"Open {uri} and enter code: {user_code}")
+    return await auth.login_device(cfg, on_prompt=_login_prompt)
+
+
 async def fetch_account(cfg, token_provider, *, get=None) -> Account:
     """Best-effort account summary for the welcome screen. NEVER raises: no
     token or a failed /v1/auth/me -> Account(signed_in=False); a failed

webbee-0.3.9/src/webbee/boot.py

@@ -0,0 +1,108 @@
+"""REPL boot helpers (extracted verbatim from webbee.repl): everything the
+dock sets up before the first prompt — the cached git branch, the dock's
+stderr log file, the intel/shadow default factories and their guarded
+starters, and the best-effort boot replay of the durable coding thread.
+All fail-soft: boot must never crash over a nice-to-have."""
+import asyncio
+import os
+import subprocess
+
+
+def _git_branch(workspace: str) -> str:
+    try:
+        p = subprocess.run(["git", "rev-parse", "--abbrev-ref", "HEAD"], cwd=workspace,
+                           capture_output=True, text=True, timeout=5)
+        return p.stdout.strip() if p.returncode == 0 else "-"
+    except (OSError, subprocess.SubprocessError):
+        return "-"
+
+
+def _open_dock_stderr_log():
+    """A file to swallow stderr for the full-screen dock's lifetime. The dock is
+    a prompt_toolkit full-screen Application that OWNS the terminal (it diffs the
+    screen); ANY stray write to stderr while it runs — a dependency's tqdm
+    download bar, a library warning, a background watcher-task traceback —
+    desyncs that diff and shows up as overlapping/duplicated text. Routing
+    stderr to ~/.cache/webbee/tui-stderr.log keeps the dock pixel-clean while
+    still preserving errors for debugging. Falls back to os.devnull if the cache
+    dir is unwritable; NEVER raises."""
+    try:
+        d = os.path.expanduser("~/.cache/webbee")
+        os.makedirs(d, exist_ok=True)
+        return open(os.path.join(d, "tui-stderr.log"), "a", buffering=1, encoding="utf-8")
+    except Exception:
+        try:
+            return open(os.devnull, "w")
+        except Exception:
+            import io
+            return io.StringIO()
+
+
+def _default_shadow_factory(cfg, workspace: str):
+    """The reversibility shadow git. Guarded like intel: any failure (no git
+    binary, cache not writable) degrades to None -- coding still works, just
+    without the time machine."""
+    from webbee.checkpoints import ShadowGit, shadow_key
+    from webbee.repo import find_repo_root
+    root = find_repo_root(workspace)
+    sg = ShadowGit(root, shadow_key(root), cache_dir=cfg.cache_dir)
+    return sg if sg.ensure() else None
+
+
+def _default_intel_factory(cfg, workspace: str):
+    """Lazy/guarded -- a base install (no tree-sitter/watchfiles extra) must
+    never fail to import here; the intel boot wraps the whole build in
+    try/except so any error (missing extra, indexing failure) degrades to
+    `intel=None` rather than crashing the REPL."""
+    from webbee.intel.service import IntelService
+    from webbee.repo import compute_repo_key, find_repo_root
+    root = find_repo_root(workspace)
+    return IntelService(root, compute_repo_key(root), cache_dir=cfg.cache_dir)
+
+
+async def replay_thread(cfg, token_provider, sink) -> None:
+    """Boot replay of the durable per-user thread (Task 9): best-effort,
+    entirely swallowed on any failure -- history is a nice-to-have,
+    never a boot blocker (network down, no such session yet, etc.)."""
+    try:
+        from imperal_mcp.client import ImperalClient
+        from webbee.thread import (conversational_text, fetch_recent_thread,
+                                   truncate_for_display)
+        _iid = await ImperalClient(cfg, token_provider).whoami()
+        _msgs = await fetch_recent_thread(cfg, token_provider, f"marathon-{_iid}-rboot")
+        _shown = 0
+        for _m in _msgs[-40:]:
+            _text = conversational_text(_m.get("content", ""))
+            if not _text:
+                continue  # pure tool traffic -- mind-food, not conversation
+            sink.foreign_turn(_m.get("surface", "terminal"), _m.get("role", ""),
+                              truncate_for_display(_text))
+            _shown += 1
+        if _shown:
+            sink.note("— live —")
+    except Exception:
+        pass  # replay is best-effort; never block boot
+
+
+async def start_intel(cfg, workspace: str, intel_factory):
+    """Off-loop intel build (indexing does sync file I/O + subprocess). Any
+    failure here (missing extra, bad repo, etc.) must degrade to
+    (None, None), never crash the boot -- coding still works, just
+    without repo intelligence. Returns (intel, watcher_task)."""
+    try:
+        svc = (intel_factory or _default_intel_factory)(cfg, workspace)
+        await asyncio.to_thread(svc.build)
+        from webbee.intel import watch
+        watcher_task = asyncio.ensure_future(watch.watch_workspace(svc.root, svc.apply_changes))
+        return svc, watcher_task
+    except Exception:
+        return None, None
+
+
+async def start_shadow(cfg, workspace: str, shadow_factory):
+    """Whole-mind P4: the reversibility shadow (never the user's VCS);
+    guarded -- boot must not fail over the time machine."""
+    try:
+        return await asyncio.to_thread(shadow_factory or _default_shadow_factory, cfg, workspace)
+    except Exception:
+        return None

webbee-0.3.9/src/webbee/coding_context.py

@@ -0,0 +1,83 @@
+"""Coding-context snapshot for the cloud brain (extracted verbatim from
+webbee.session): build_coding_context packages cwd/git/tree/repo identity
+(+ optional repo_profile), and detect_verify_cmd is the CLIENT-detected
+proof-of-done command a marathon carries in that context."""
+import os
+import subprocess
+
+
+def build_coding_context(workspace_root: str, intel=None) -> dict:
+    """Snapshot handed to the cloud brain: cwd (realpath), `git status -sb`
+    (empty for non-git/any error), a bounded newline-joined file tree, and —
+    when a ready intel service is injected — the precomputed repo_profile.
+    The profile is READ from the already-built index (cheap); indexing never
+    happens inline here."""
+    cwd = os.path.realpath(workspace_root)
+    try:
+        proc = subprocess.run(
+            ["git", "status", "-sb"], cwd=cwd,
+            capture_output=True, text=True, timeout=10,
+        )
+        git = proc.stdout if proc.returncode == 0 else ""
+    except (OSError, subprocess.SubprocessError):
+        git = ""
+    paths = []
+    for dirpath, dirnames, filenames in os.walk(cwd):
+        dirnames[:] = [d for d in dirnames if d != ".git" and not d.startswith(".")]
+        for fn in filenames:
+            paths.append(os.path.relpath(os.path.join(dirpath, fn), cwd))
+            if len(paths) >= 200:
+                break
+        if len(paths) >= 200:
+            break
+    from webbee.repo import compute_repo_key, find_repo_root
+    root = find_repo_root(cwd)
+    d = {"cwd": cwd, "git": git, "tree": "\n".join(paths),
+         "repo_key": compute_repo_key(root), "repo_root": root}
+    if intel is not None and getattr(intel, "ready", False):
+        try:
+            d["repo_profile"] = intel.repo_profile()
+        except Exception:
+            pass
+    return d
+
+
+def detect_verify_cmd(repo_root: str) -> str:
+    """Best-effort project test command, CLIENT-detected from the repo layout.
+
+    SECURITY-load-bearing: in a marathon the kernel runs ONLY this command as
+    proof-of-done — the cloud brain can never author a shell command. So this
+    is deliberately small + honest: a fixed command per recognised ecosystem,
+    NO guessing beyond these. An empty string means "no known runner" → the
+    kernel falls back to an LLM-judged done-check. Checked in a stable order."""
+    import json as _json
+
+    root = repo_root or "."
+
+    def _has(name: str) -> bool:
+        return os.path.isfile(os.path.join(root, name))
+
+    if _has("pyproject.toml") or _has("setup.cfg") or _has("tox.ini"):
+        return "pytest -q"
+    if _has("package.json"):
+        try:
+            with open(os.path.join(root, "package.json"), encoding="utf-8") as f:
+                pkg = _json.load(f)
+            scripts = pkg.get("scripts") if isinstance(pkg, dict) else None
+            if isinstance(scripts, dict) and scripts.get("test"):
+                return "npm test"
+        except (OSError, ValueError):
+            pass
+    if _has("Cargo.toml"):
+        return "cargo test"
+    if _has("go.mod"):
+        return "go test ./..."
+    if _has("Makefile"):
+        try:
+            import re as _re
+            with open(os.path.join(root, "Makefile"), encoding="utf-8") as f:
+                if _re.search(r"(?m)^test:", f.read()):
+                    return "make test"
+        except OSError:
+            pass
+    return ""

webbee-0.3.9/src/webbee/consent.py

@@ -0,0 +1,134 @@
+"""Consent path + the liveness-A consent race (extracted verbatim from
+webbee.session): handle_confirm_request relays the user's RAW reply for the
+kernel brain to interpret (ICNLI, safe-by-default), and race_consent lets a
+pending local prompt RACE the stream so a consent answered from ANOTHER
+surface (Telegram relay) unfreezes the terminal instead of leaving the dock
+stuck on `approve? y/n`."""
+import asyncio
+from dataclasses import dataclass
+
+from webbee.frames import _is_foreign_frame, render_foreign_frame
+
+
+async def handle_confirm_request(frame: dict, mode: str, ask_consent) -> dict:
+    """ICNLI consent path. The client does NOT interpret consent words — it
+    relays the user's RAW reply; the kernel brain interprets intent
+    (safe-by-default). autopilot/plan are explicit and never prompt.
+    `ask_consent(app_id, tool, args)` is an async coroutine returning the raw
+    reply (resolved through the pinned dock, or a sync fallback reader)."""
+    req_id = frame["req_id"]
+    if mode == "autopilot":
+        return {"req_id": req_id, "result": {"approved": True}}
+    if mode == "plan":
+        return {"req_id": req_id, "result": {"approved": False, "reason": "plan_mode"}}
+    try:
+        raw = await ask_consent(frame.get("app_id", ""), frame.get("tool", ""), frame.get("args", {}))
+    except Exception:
+        # Consent UI failed -> decline (safe-by-default). NEVER leave the kernel
+        # hanging on an unanswered confirm — an unposted result froze the dock.
+        return {"req_id": req_id, "result": {"approved": False, "reason": "consent_error"}}
+    return {"req_id": req_id, "result": {"consent_reply": raw}}
+
+
+async def _retire(task) -> None:
+    """Cancel + drain a racing task so it never outlives the frame loop
+    (liveness A hygiene). Absorbs the loser's outcome — CancelledError, a
+    late result, StopAsyncIteration, a transport error — retirement must
+    never introduce a new failure path. An externally-delivered cancellation
+    of the CALLER (task finished before our cancel landed) still propagates."""
+    task.cancel()
+    try:
+        await task
+    except asyncio.CancelledError:
+        if not task.cancelled():
+            raise                       # ours was the outer cancel — propagate
+    except Exception:
+        pass
+
+
+def _dismiss_consent(sink) -> None:
+    """Tell the UI the pending consent prompt was answered on ANOTHER surface
+    (liveness A). Guarded like the other optional sink hooks — a minimal sink
+    without `consent_dismissed` (or a UI bug) must never break the frame loop."""
+    fn = getattr(sink, "consent_dismissed", None)
+    if fn is None:
+        return
+    try:
+        fn("↩ answered from another surface")
+    except Exception:
+        pass
+
+
+@dataclass
+class _ConsentRace:
+    """Outcome of racing the local consent prompt against the stream
+    (liveness A). Exactly one shape per race:
+      * out          — the prompt resolved locally (today's path): POST it; a
+                       pulled-ahead __anext__ may ride along in carry_task.
+      * carry_frame  — the stream won: the park ended elsewhere; the prompt was
+                       cancelled + dismissed, nothing is posted, and the pulled
+                       frame is handed back to the loop for normal handling.
+      * stream_ended — StopAsyncIteration mid-consent: exit as stream end.
+    """
+    out: dict | None = None
+    carry_task: asyncio.Task | None = None
+    carry_frame: dict | None = None
+    stream_ended: bool = False
+
+
+async def race_consent(frame: dict, sink, stream, *, mode: str, task_id: str) -> _ConsentRace:
+    """LIVE BUG fix (Valentin, 2026-07-15): a consent answered from
+    Telegram resolves the kernel park, but the frame loop used to block
+    INLINE in handle_confirm_request — the dock froze on `approve? y/n`
+    and the rest of the turn never rendered until a local keypress. The
+    local prompt now RACES the stream:
+      * the prompt resolves first -> POST it (today's path, unchanged);
+        the pulled-ahead frame rides back to the loop in carry_task.
+      * a re-published confirm_request with the SAME req_id (kernel
+        I-MARATHON-USER-WAKE presence re-publish) -> NOT an answer; the
+        prompt stays up and both racers keep going.
+      * any other OWN-turn frame -> the park ended elsewhere (answered
+        from another surface / superseded): cancel the prompt, dismiss the
+        dock, POST NOTHING (the kernel accepts only the FIRST result per
+        issued req_id), hand the frame back for normal handling.
+      * foreign frames (C7) stay display-only and never end the park.
+    Consent is never auto-approved here — autopilot/plan resolve instantly
+    inside handle_confirm_request exactly as before."""
+    rid = frame.get("req_id")
+    consent_task = asyncio.ensure_future(
+        handle_confirm_request(frame, mode, sink.ask_consent))
+    pull = None
+    try:
+        while True:
+            if pull is None:
+                pull = asyncio.ensure_future(stream.__anext__())
+            await asyncio.wait({consent_task, pull},
+                               return_when=asyncio.FIRST_COMPLETED)
+            if consent_task.done():
+                # The local answer wins — even when both racers finished in
+                # the same cycle the pulled frame is NOT lost: the loop owns
+                # carry_task and processes it next.
+                return _ConsentRace(out=consent_task.result(), carry_task=pull)
+            nxt_pull, pull = pull, None
+            try:
+                nxt = nxt_pull.result()
+            except StopAsyncIteration:
+                # Stream ended mid-consent: retire the prompt safely and
+                # exit exactly as today's stream end (no result posted).
+                await _retire(consent_task)
+                return _ConsentRace(stream_ended=True)
+            if _is_foreign_frame(nxt, task_id):
+                render_foreign_frame(nxt, sink)
+                continue
+            if nxt.get("type") == "confirm_request" and nxt.get("req_id") == rid:
+                continue
+            await _retire(consent_task)
+            _dismiss_consent(sink)
+            return _ConsentRace(carry_frame=nxt)
+    except BaseException:
+        # Hygiene on any unexpected exit (StreamAuthError from the pull,
+        # outer cancellation, a consent-task crash): no racer may leak.
+        for t in (consent_task, pull):
+            if t is not None and not t.done():
+                await _retire(t)
+        raise

{webbee-0.3.8 → webbee-0.3.9}/src/webbee/frames.py

@@ -25,6 +25,13 @@ def _v2_step_label(frame: dict) -> str:
     return "·".join(x for x in (frame.get("app_id", ""), frame.get("tool", "")) if x)
 
 
+def _summary(result: dict) -> str:
+    """One-line summary of a tool result for the UI."""
+    content = str(result.get("content", ""))
+    first = content.strip().splitlines()[0] if content.strip() else ""
+    return first[:120]
+
+
 def _summary_from_facts(facts: dict) -> str:
     """Renderer-composed one-line summary from v2 structured summary_facts
     (I-FRAMES-FACTS-ONLY: the kernel emits facts, never prose here). Degrades
@@ -103,6 +110,21 @@ def handle_step_finished(frame: dict, sink, finished: set, step_labels: dict, st
     steps.append({"step_id": sid, "label": label, "ok": ok})
 
 
+def handle_tool_request(frame: dict, executor) -> dict:
+    """Run a (kernel-pre-approved) local tool. The kernel gates write/bash
+    consent via confirm_request BEFORE dispatching, so a tool_request here is
+    always cleared to run. NEVER raises: a tool that errored (or a bug in the
+    executor) must STILL return a result so the caller posts it back and the
+    kernel's dispatch unblocks — an unposted result hangs the turn and freezes
+    the whole dock."""
+    rid = frame.get("req_id")
+    try:
+        result = executor.run(frame.get("tool", ""), frame.get("args", {}))
+    except Exception as e:
+        result = {"ok": False, "content": f"local tool crashed: {type(e).__name__}: {e}"}
+    return {"req_id": rid, "result": result}
+
+
 def handle_action_frame(frame: dict, sink, started: set, finished: set, steps: list) -> None:
     """OLD R2 ext-tool 'action' start/done frame -> sink.tool_start/
     tool_result, deduped by step_id against the v2 twin (dual-emit compat
@@ -135,6 +157,16 @@ _FOREIGN_ACTIONABLE_TYPES = ("tool_request", "confirm_request", "final",
                              "marathon_complete", "panel_release_required")
 
 
+def _is_foreign_frame(frame: dict, own_task_id: str) -> bool:
+    """C7 filter predicate (extracted verbatim from run()'s inline check): a
+    frame stamped with a DIFFERENT task_id on the shared persistent stream,
+    when it is origin-stamped or actionable, belongs to another turn and is
+    DISPLAY-ONLY for this client. task_id absent (legacy kernels) -> own."""
+    ftid = frame.get("task_id", "")
+    return bool(ftid and own_task_id and ftid != own_task_id and (
+        frame.get("origin") or frame.get("type") in _FOREIGN_ACTIONABLE_TYPES))
+
+
 def _origin_tag(frame: dict) -> str:
     """Display prefix for an OWN-turn frame steered from another surface.
     Live steer topology: a Telegram/panel-steered turn keeps the terminal's

{webbee-0.3.8 → webbee-0.3.9}/src/webbee/repl.py

@@ -1,45 +1,16 @@
 import asyncio
 import contextlib
 import os
-import subprocess
 import sys
 
 from webbee import __version__
+from webbee.account import login_device_flow
+from webbee.boot import _git_branch, _open_dock_stderr_log, replay_thread, start_intel, start_shadow
 from webbee.commands import CommandContext, dispatch
 from webbee.session import AgentSession
 from webbee.tui import next_mode
 
 
-def _git_branch(workspace: str) -> str:
-    try:
-        p = subprocess.run(["git", "rev-parse", "--abbrev-ref", "HEAD"], cwd=workspace,
-                           capture_output=True, text=True, timeout=5)
-        return p.stdout.strip() if p.returncode == 0 else "-"
-    except (OSError, subprocess.SubprocessError):
-        return "-"
-
-
-def _open_dock_stderr_log():
-    """A file to swallow stderr for the full-screen dock's lifetime. The dock is
-    a prompt_toolkit full-screen Application that OWNS the terminal (it diffs the
-    screen); ANY stray write to stderr while it runs — a dependency's tqdm
-    download bar, a library warning, a background watcher-task traceback —
-    desyncs that diff and shows up as overlapping/duplicated text. Routing
-    stderr to ~/.cache/webbee/tui-stderr.log keeps the dock pixel-clean while
-    still preserving errors for debugging. Falls back to os.devnull if the cache
-    dir is unwritable; NEVER raises."""
-    try:
-        d = os.path.expanduser("~/.cache/webbee")
-        os.makedirs(d, exist_ok=True)
-        return open(os.path.join(d, "tui-stderr.log"), "a", buffering=1, encoding="utf-8")
-    except Exception:
-        try:
-            return open(os.devnull, "w")
-        except Exception:
-            import io
-            return io.StringIO()
-
-
 async def run_marathon(cfg, mode: str, goal: str, *, sink=None, auth=None,
                        agent_factory=None) -> str:
     """Launch ONE autonomous marathon toward `goal` and stream it to stdout.
@@ -82,28 +53,6 @@ async def run_marathon(cfg, mode: str, goal: str, *, sink=None, auth=None,
     return text
 
 
-def _default_shadow_factory(cfg, workspace: str):
-    """The reversibility shadow git. Guarded like intel: any failure (no git
-    binary, cache not writable) degrades to None -- coding still works, just
-    without the time machine."""
-    from webbee.checkpoints import ShadowGit, shadow_key
-    from webbee.repo import find_repo_root
-    root = find_repo_root(workspace)
-    sg = ShadowGit(root, shadow_key(root), cache_dir=cfg.cache_dir)
-    return sg if sg.ensure() else None
-
-
-def _default_intel_factory(cfg, workspace: str):
-    """Lazy/guarded -- a base install (no tree-sitter/watchfiles extra) must
-    never fail to import here; `_boot` wraps the whole intel boot in
-    try/except so any error (missing extra, indexing failure) degrades to
-    `intel=None` rather than crashing the REPL."""
-    from webbee.intel.service import IntelService
-    from webbee.repo import compute_repo_key, find_repo_root
-    root = find_repo_root(workspace)
-    return IntelService(root, compute_repo_key(root), cache_dir=cfg.cache_dir)
-
-
 async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None, read_line=input,
                    agent_factory=None, auth=None, account_fetcher=None,
                    sessions_client=None, intel_factory=None, shadow_factory=None) -> None:
@@ -158,18 +107,8 @@ async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None,
             if res.exit:
                 return "exit"
             if res.action == "login":
-                # ONE shared imperal_mcp mechanism: device-code flow (RFC 8628),
-                # async, so we await it directly on the dock's event loop (the
-                # /login turn runs as a background task, so the dock stays
-                # responsive while it polls). on_prompt renders the code + URL
-                # into the feed — a bare print would be invisible in the dock.
-                def _login_prompt(user_code, uri, uri_complete):
-                    show = getattr(_sink, "login_prompt", None)
-                    if show:
-                        show(user_code, uri)
-                    else:
-                        _sink.note(f"Open {uri} and enter code: {user_code}")
-                email = await auth.login_device(cfg, on_prompt=_login_prompt)
+                # Device-code flow (RFC 8628) — rendering + polling in webbee.account.
+                email = await login_device_flow(cfg, auth, _sink)
                 state["logged_in"] = True
                 _sink.note(f"Signed in as {email}.")
                 return "continue"
@@ -317,47 +256,16 @@ async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None,
         account = await account_fetcher(cfg, token_provider)
         state["logged_in"] = account.signed_in
         _sink.welcome(account, workspace, "terminal")
-        # Boot replay of the durable per-user thread (Task 9): best-effort,
-        # entirely swallowed on any failure -- history is a nice-to-have,
-        # never a boot blocker (network down, no such session yet, etc.).
-        try:
-            from imperal_mcp.client import ImperalClient
-            from webbee.thread import (conversational_text, fetch_recent_thread,
-                                       truncate_for_display)
-            _iid = await ImperalClient(cfg, token_provider).whoami()
-            _msgs = await fetch_recent_thread(cfg, token_provider, f"marathon-{_iid}-rboot")
-            _shown = 0
-            for _m in _msgs[-40:]:
-                _text = conversational_text(_m.get("content", ""))
-                if not _text:
-                    continue  # pure tool traffic -- mind-food, not conversation
-                _sink.foreign_turn(_m.get("surface", "terminal"), _m.get("role", ""),
-                                   truncate_for_display(_text))
-                _shown += 1
-            if _shown:
-                _sink.note("— live —")
-        except Exception:
-            pass  # replay is best-effort; never block boot
+        # Boot replay of the durable per-user thread (Task 9) — best-effort,
+        # never a boot blocker (webbee.boot.replay_thread swallows everything).
+        await replay_thread(cfg, token_provider, _sink)
         if cfg.intel_enabled:
-            # Off-loop build (indexing does sync file I/O + subprocess). Any
-            # failure here (missing extra, bad repo, etc.) must degrade to
-            # intel=None, never crash the boot -- coding still works, just
-            # without repo intelligence.
-            try:
-                svc = (intel_factory or _default_intel_factory)(cfg, workspace)
-                await asyncio.to_thread(svc.build)
-                intel = svc
-                from webbee.intel import watch
-                watcher_task = asyncio.ensure_future(watch.watch_workspace(intel.root, intel.apply_changes))
-            except Exception:
-                intel = None
-                watcher_task = None
+            # Guarded off-loop build + watcher; any failure degrades to
+            # intel=None, never crashes the boot (webbee.boot.start_intel).
+            intel, watcher_task = await start_intel(cfg, workspace, intel_factory)
         # Whole-mind P4: the reversibility shadow (never the user's VCS);
         # guarded -- boot must not fail over the time machine.
-        try:
-            shadow = await asyncio.to_thread(shadow_factory or _default_shadow_factory, cfg, workspace)
-        except Exception:
-            shadow = None
+        shadow = await start_shadow(cfg, workspace, shadow_factory)
         agent = agent_factory(cfg, token_provider, workspace, state["mode"])
         # Liveness v2 §B: idle-steer pickup. All poll/drain logic lives in
         # webbee.steer -- this is wiring only: the sink's live turn state

{webbee-0.3.8 → webbee-0.3.9}/src/webbee/session.py

@@ -1,197 +1,23 @@
 import asyncio
-import os
-import subprocess
-from dataclasses import dataclass
 
+from webbee.coding_context import build_coding_context, detect_verify_cmd
+from webbee.consent import _retire, race_consent
 from webbee.frames import (
-    _FOREIGN_ACTIONABLE_TYPES,
     _MARATHON_FACT_TYPES,
     _first_time,
+    _is_foreign_frame,
     _origin_tag,
     _progress_text,
+    _summary,
     handle_action_frame,
     handle_step_finished,
     handle_step_started,
+    handle_tool_request,
     marathon_note,
     render_foreign_frame,
 )
 
 
-def _is_foreign_frame(frame: dict, own_task_id: str) -> bool:
-    """C7 filter predicate (extracted verbatim from run()'s inline check): a
-    frame stamped with a DIFFERENT task_id on the shared persistent stream,
-    when it is origin-stamped or actionable, belongs to another turn and is
-    DISPLAY-ONLY for this client. task_id absent (legacy kernels) -> own."""
-    ftid = frame.get("task_id", "")
-    return bool(ftid and own_task_id and ftid != own_task_id and (
-        frame.get("origin") or frame.get("type") in _FOREIGN_ACTIONABLE_TYPES))
-
-
-async def _retire(task) -> None:
-    """Cancel + drain a racing task so it never outlives the frame loop
-    (liveness A hygiene). Absorbs the loser's outcome — CancelledError, a
-    late result, StopAsyncIteration, a transport error — retirement must
-    never introduce a new failure path. An externally-delivered cancellation
-    of the CALLER (task finished before our cancel landed) still propagates."""
-    task.cancel()
-    try:
-        await task
-    except asyncio.CancelledError:
-        if not task.cancelled():
-            raise                       # ours was the outer cancel — propagate
-    except Exception:
-        pass
-
-
-def _dismiss_consent(sink) -> None:
-    """Tell the UI the pending consent prompt was answered on ANOTHER surface
-    (liveness A). Guarded like the other optional sink hooks — a minimal sink
-    without `consent_dismissed` (or a UI bug) must never break the frame loop."""
-    fn = getattr(sink, "consent_dismissed", None)
-    if fn is None:
-        return
-    try:
-        fn("↩ answered from another surface")
-    except Exception:
-        pass
-
-
-@dataclass
-class _ConsentRace:
-    """Outcome of racing the local consent prompt against the stream
-    (liveness A). Exactly one shape per race:
-      * out          — the prompt resolved locally (today's path): POST it; a
-                       pulled-ahead __anext__ may ride along in carry_task.
-      * carry_frame  — the stream won: the park ended elsewhere; the prompt was
-                       cancelled + dismissed, nothing is posted, and the pulled
-                       frame is handed back to the loop for normal handling.
-      * stream_ended — StopAsyncIteration mid-consent: exit as stream end.
-    """
-    out: dict | None = None
-    carry_task: asyncio.Task | None = None
-    carry_frame: dict | None = None
-    stream_ended: bool = False
-
-
-def handle_tool_request(frame: dict, executor) -> dict:
-    """Run a (kernel-pre-approved) local tool. The kernel gates write/bash
-    consent via confirm_request BEFORE dispatching, so a tool_request here is
-    always cleared to run. NEVER raises: a tool that errored (or a bug in the
-    executor) must STILL return a result so the caller posts it back and the
-    kernel's dispatch unblocks — an unposted result hangs the turn and freezes
-    the whole dock."""
-    rid = frame.get("req_id")
-    try:
-        result = executor.run(frame.get("tool", ""), frame.get("args", {}))
-    except Exception as e:
-        result = {"ok": False, "content": f"local tool crashed: {type(e).__name__}: {e}"}
-    return {"req_id": rid, "result": result}
-
-
-async def handle_confirm_request(frame: dict, mode: str, ask_consent) -> dict:
-    """ICNLI consent path. The client does NOT interpret consent words — it
-    relays the user's RAW reply; the kernel brain interprets intent
-    (safe-by-default). autopilot/plan are explicit and never prompt.
-    `ask_consent(app_id, tool, args)` is an async coroutine returning the raw
-    reply (resolved through the pinned dock, or a sync fallback reader)."""
-    req_id = frame["req_id"]
-    if mode == "autopilot":
-        return {"req_id": req_id, "result": {"approved": True}}
-    if mode == "plan":
-        return {"req_id": req_id, "result": {"approved": False, "reason": "plan_mode"}}
-    try:
-        raw = await ask_consent(frame.get("app_id", ""), frame.get("tool", ""), frame.get("args", {}))
-    except Exception:
-        # Consent UI failed -> decline (safe-by-default). NEVER leave the kernel
-        # hanging on an unanswered confirm — an unposted result froze the dock.
-        return {"req_id": req_id, "result": {"approved": False, "reason": "consent_error"}}
-    return {"req_id": req_id, "result": {"consent_reply": raw}}
-
-
-def build_coding_context(workspace_root: str, intel=None) -> dict:
-    """Snapshot handed to the cloud brain: cwd (realpath), `git status -sb`
-    (empty for non-git/any error), a bounded newline-joined file tree, and —
-    when a ready intel service is injected — the precomputed repo_profile.
-    The profile is READ from the already-built index (cheap); indexing never
-    happens inline here."""
-    cwd = os.path.realpath(workspace_root)
-    try:
-        proc = subprocess.run(
-            ["git", "status", "-sb"], cwd=cwd,
-            capture_output=True, text=True, timeout=10,
-        )
-        git = proc.stdout if proc.returncode == 0 else ""
-    except (OSError, subprocess.SubprocessError):
-        git = ""
-    paths = []
-    for dirpath, dirnames, filenames in os.walk(cwd):
-        dirnames[:] = [d for d in dirnames if d != ".git" and not d.startswith(".")]
-        for fn in filenames:
-            paths.append(os.path.relpath(os.path.join(dirpath, fn), cwd))
-            if len(paths) >= 200:
-                break
-        if len(paths) >= 200:
-            break
-    from webbee.repo import compute_repo_key, find_repo_root
-    root = find_repo_root(cwd)
-    d = {"cwd": cwd, "git": git, "tree": "\n".join(paths),
-         "repo_key": compute_repo_key(root), "repo_root": root}
-    if intel is not None and getattr(intel, "ready", False):
-        try:
-            d["repo_profile"] = intel.repo_profile()
-        except Exception:
-            pass
-    return d
-
-
-def detect_verify_cmd(repo_root: str) -> str:
-    """Best-effort project test command, CLIENT-detected from the repo layout.
-
-    SECURITY-load-bearing: in a marathon the kernel runs ONLY this command as
-    proof-of-done — the cloud brain can never author a shell command. So this
-    is deliberately small + honest: a fixed command per recognised ecosystem,
-    NO guessing beyond these. An empty string means "no known runner" → the
-    kernel falls back to an LLM-judged done-check. Checked in a stable order."""
-    import json as _json
-
-    root = repo_root or "."
-
-    def _has(name: str) -> bool:
-        return os.path.isfile(os.path.join(root, name))
-
-    if _has("pyproject.toml") or _has("setup.cfg") or _has("tox.ini"):
-        return "pytest -q"
-    if _has("package.json"):
-        try:
-            with open(os.path.join(root, "package.json"), encoding="utf-8") as f:
-                pkg = _json.load(f)
-            scripts = pkg.get("scripts") if isinstance(pkg, dict) else None
-            if isinstance(scripts, dict) and scripts.get("test"):
-                return "npm test"
-        except (OSError, ValueError):
-            pass
-    if _has("Cargo.toml"):
-        return "cargo test"
-    if _has("go.mod"):
-        return "go test ./..."
-    if _has("Makefile"):
-        try:
-            import re as _re
-            with open(os.path.join(root, "Makefile"), encoding="utf-8") as f:
-                if _re.search(r"(?m)^test:", f.read()):
-                    return "make test"
-        except OSError:
-            pass
-    return ""
-
-
-def _summary(result: dict) -> str:
-    """One-line summary of a tool result for the UI."""
-    content = str(result.get("content", ""))
-    first = content.strip().splitlines()[0] if content.strip() else ""
-    return first[:120]
-
-
 class AgentSession:
     """Client-side driver for one coding turn against the Imperal cloud.
     The brain runs server-side; this is the hands — it streams kernel-
@@ -357,7 +183,8 @@ class AgentSession:
                             # consent answered from ANOTHER surface (Telegram
                             # relay) unfreezes this terminal instead of leaving
                             # the dock stuck on `approve? y/n`.
-                            race = await self._race_consent(frame, sink, stream)
+                            race = await race_consent(frame, sink, stream,
+                                                      mode=self.mode, task_id=self._task_id)
                             carry_task, carry_frame = race.carry_task, race.carry_frame
                             if race.stream_ended:
                                 break
@@ -425,63 +252,6 @@ class AgentSession:
 
         return ""
 
-    async def _race_consent(self, frame: dict, sink, stream) -> _ConsentRace:
-        """LIVE BUG fix (Valentin, 2026-07-15): a consent answered from
-        Telegram resolves the kernel park, but the frame loop used to block
-        INLINE in handle_confirm_request — the dock froze on `approve? y/n`
-        and the rest of the turn never rendered until a local keypress. The
-        local prompt now RACES the stream:
-          * the prompt resolves first -> POST it (today's path, unchanged);
-            the pulled-ahead frame rides back to the loop in carry_task.
-          * a re-published confirm_request with the SAME req_id (kernel
-            I-MARATHON-USER-WAKE presence re-publish) -> NOT an answer; the
-            prompt stays up and both racers keep going.
-          * any other OWN-turn frame -> the park ended elsewhere (answered
-            from another surface / superseded): cancel the prompt, dismiss the
-            dock, POST NOTHING (the kernel accepts only the FIRST result per
-            issued req_id), hand the frame back for normal handling.
-          * foreign frames (C7) stay display-only and never end the park.
-        Consent is never auto-approved here — autopilot/plan resolve instantly
-        inside handle_confirm_request exactly as before."""
-        rid = frame.get("req_id")
-        consent_task = asyncio.ensure_future(
-            handle_confirm_request(frame, self.mode, sink.ask_consent))
-        pull = None
-        try:
-            while True:
-                if pull is None:
-                    pull = asyncio.ensure_future(stream.__anext__())
-                await asyncio.wait({consent_task, pull},
-                                   return_when=asyncio.FIRST_COMPLETED)
-                if consent_task.done():
-                    # The local answer wins — even when both racers finished in
-                    # the same cycle the pulled frame is NOT lost: the loop owns
-                    # carry_task and processes it next.
-                    return _ConsentRace(out=consent_task.result(), carry_task=pull)
-                nxt_pull, pull = pull, None
-                try:
-                    nxt = nxt_pull.result()
-                except StopAsyncIteration:
-                    # Stream ended mid-consent: retire the prompt safely and
-                    # exit exactly as today's stream end (no result posted).
-                    await _retire(consent_task)
-                    return _ConsentRace(stream_ended=True)
-                if _is_foreign_frame(nxt, self._task_id):
-                    render_foreign_frame(nxt, sink)
-                    continue
-                if nxt.get("type") == "confirm_request" and nxt.get("req_id") == rid:
-                    continue
-                await _retire(consent_task)
-                _dismiss_consent(sink)
-                return _ConsentRace(carry_frame=nxt)
-        except BaseException:
-            # Hygiene on any unexpected exit (StreamAuthError from the pull,
-            # outer cancellation, a consent-task crash): no racer may leak.
-            for t in (consent_task, pull):
-                if t is not None and not t.done():
-                    await _retire(t)
-            raise
-
     async def _post_result(self, client, session_id: str, out: dict) -> None:
         # Best-effort: a result POST must NEVER raise into the stream loop — that
         # would abort the turn and leave the kernel's dispatch hanging (frozen

{webbee-0.3.8 → webbee-0.3.9}/src/webbee/steer.py

@@ -27,7 +27,7 @@ async def derive_session_id(cfg, token_provider, workspace: str, *,
     turn has run: the gateway keys coding sessions stable per user+repo as
     `{marathon|coding}-{imperal_id}-r{repo_key}` (agent_sessions/router.py)
     from the repo_key the client itself sends in coding_context
-    (session.build_coding_context -> repo.compute_repo_key). The boot-replay
+    (coding_context.build_coding_context -> repo.compute_repo_key). The boot-replay
     placeholder (`marathon-{iid}-rboot`) would pass the gateway's ownership
     prefix check but MISS the per-session remote-control state key
     (resolve_state reads k_state(session_id) -- set by /notify under the real

{webbee-0.3.8 → webbee-0.3.9}/tests/test_freeze_fix.py

@@ -7,7 +7,8 @@ terminal). Every path must return a result so the kernel unblocks."""
 import asyncio
 
 from webbee.tools import LocalToolExecutor
-from webbee.session import handle_tool_request, handle_confirm_request
+from webbee.consent import handle_confirm_request
+from webbee.frames import handle_tool_request
 
 
 def test_outside_workspace_returns_result_not_raise(tmp_path):

{webbee-0.3.8 → webbee-0.3.9}/tests/test_marathon.py

@@ -10,7 +10,7 @@ Covers the two SECURITY/behaviour-load-bearing pieces:
 """
 import asyncio
 
-from webbee.session import detect_verify_cmd
+from webbee.coding_context import detect_verify_cmd
 
 
 # --- detect_verify_cmd -------------------------------------------------------

{webbee-0.3.8 → webbee-0.3.9}/tests/test_session.py

@@ -1,6 +1,8 @@
 import asyncio
 
-from webbee.session import handle_tool_request, handle_confirm_request, build_coding_context
+from webbee.coding_context import build_coding_context
+from webbee.consent import handle_confirm_request
+from webbee.frames import handle_tool_request
 
 
 class RecordingExecutor:
@@ -529,7 +531,7 @@ def test_local_tool_v2_frames_dont_double_the_tool_request_render():
     # EXISTING mechanism, then step_finished. Only ONE start/result pair
     # must reach the sink.
     from webbee.frames import handle_step_started, handle_step_finished, _first_time
-    from webbee.session import _summary
+    from webbee.frames import _summary
     sink = RecSink()
     started, finished, labels, steps, local_ids = set(), set(), {}, [], set()
     handle_step_started({"step_id": "toolu_1", "kind": "local_tool", "tool": "read_file"},

{webbee-0.3.8 → webbee-0.3.9}/tests/test_tui_hardening.py

@@ -8,8 +8,8 @@ download progress bars at the entry point; (2) route stderr to a log file for
 the dock's whole lifetime."""
 import os
 
+from webbee.boot import _open_dock_stderr_log
 from webbee.cli import _quiet_downloads
-from webbee.repl import _open_dock_stderr_log
 
 
 def test_quiet_downloads_sets_env(monkeypatch):

webbee-0.3.8/src/webbee/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.3.8"