feat(session): add durable local delivery and isolated terminal streams

[M4n5ter]

English

Summary

Responsive Session interaction with Runtime Host retaining execution authority.

• Messages, attachments, and new-Session intents are persisted before the composer clears; failed local admission leaves the complete attachment draft retryable. Delivery and uploads retain their identities across retries and restarts. Durable Host evidence retires delivered messages independently of cache limits; committed attachment references atomically release staged bytes.
• Cached Session lists and visited history remain readable during disconnection, without a flashing cache banner. Cached state stays separate from live execution state.
• Returning to a streaming Session restores accumulated output without replaying it. Temporarily unresponsive managed Hosts remain retryable without authorizing replacement processes.
• Visible terminals use independent, bounded PTY streams with snapshot recovery. Fair control/state/bulk/PTY scheduling prevents terminal traffic from blocking Session control.

Delivery actions support English, Simplified Chinese, and Traditional Chinese. Edit-resend transactions retain Host-confirmed admission and draft recovery.

Verification

• Local build, lint, format, typecheck, architecture, inventory, license, locale, and dependency checks pass.
• Desktop: 2,355 tests passed. Runtime Host: 1,785 passed, 12 existing skips.
• Electron: 36 tests passed on both macOS and Linux. CLI package installation/lifecycle, Linux sandbox, State Root forward compatibility, Storybook, and browser smoke checks pass.
• Recovery coverage includes attachments, restart, lost ACKs, epoch changes, revocation, cache expiry, streaming restoration, and PTY overflow.

Electron fixture screenshots:

Compatibility and limits

• Protocol epoch 123 → 124: Desktop/CLI clients and Runtime Host must upgrade together.
• Outbox: 256 messages / 256 MiB total / 64 MiB per message, including attachments. Aggregate source attachment bytes are checked before reading/resizing; actual reads and resized output remain bounded.
• Transcript cache: 2 MiB per Session / 64 MiB total / 30 days; visited windows only, not complete offline history.
• Owner caches are isolated by profile incarnation, Host root, and credential identity. Guest data is excluded; detected revocation and deletion purge corresponding local data.
• Unknown execution outcomes cannot be implicitly duplicated or cancelled as unsent.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Codex — implementation, tests, verification, and PR description.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described above
• No

简体中文

Summary

让 Session 交互及时响应，同时保留 Runtime Host 对执行的最终裁决。

• 消息、附件和新会话意图先持久保存，再清空输入框；本地接收失败后，完整附件草稿仍可重试。消息投递与附件上传在重试和重启后保留原身份；Host 持久证据独立于缓存限额结束本地投递，附件引用落盘时原子释放本地暂存字节。
• 断连时仍可读取已缓存的会话列表和已访问历史，不闪现缓存提示横幅；缓存与实时执行状态保持分离。
• 返回流式会话时直接恢复累计输出，不重新播放；托管 Host 暂时无响应时继续重连，不擅自启动替代进程。
• 可见终端使用独立、有界的 PTY 流，通过快照局部恢复；control/state/bulk/PTY 公平调度，避免终端流量阻塞会话控制。

投递操作提供英文、简体中文和繁体中文文案。编辑重发仍由 Host 确认接受，并保留草稿恢复语义。

Verification

• 本地构建、lint、format、typecheck、架构、清单、许可证、语言及依赖检查通过。
• Desktop：2,355 项通过；Runtime Host：1,785 项通过、12 项既有跳过。
• Electron：macOS 和 Linux 各 36 项通过；CLI 安装与生命周期、Linux sandbox、State Root 前向兼容、Storybook 和浏览器 smoke 检查通过。
• 恢复测试覆盖附件、重启、丢 ACK、epoch 变化、撤权、缓存过期、流式恢复及 PTY 溢出。

Electron 测试夹具截图：

Compatibility and limits

• 协议 epoch 123 → 124：Desktop/CLI 客户端和 Runtime Host 需要同步升级。
• Outbox：256 条 / 总计 256 MiB / 单条含附件 64 MiB。读取、缩图前检查源附件聚合大小，实际读取和缩图结果同样有界。
• 历史缓存：每会话 2 MiB / 总计 64 MiB / 30 天；仅保留已访问窗口，不承诺完整离线历史。
• Owner 缓存按 profile incarnation、Host root 和凭证身份隔离；Guest 数据不落入该缓存，已发现的撤权和删除清理对应本地数据。
• 执行结果未知时，不擅自重复执行，也不按“尚未发送”取消。

AI use

• 没有生成式工具作出实质贡献
• 生成式工具作出了实质贡献

Codex —— 实现、测试、验证及 PR 描述。

Checklist

• 测试覆盖改动，并能在缺少对应实现时失败
• Lint、format、typecheck 和受影响套件已在本地通过

本 PR 是否改变行为？

• 是 —— 已在上文说明
• 否

[jackwener]

Reviewed at 7d22252eee1544a1410331c56f042356a6c41d39.

[P2] Preserve picked-file approvals until the local outbox commit succeeds

session-local:submit calls resolveIngestItems() before store.enqueue(). The former consumes every picked-file approval token, while the latter can still reject the message for the 256-record, per-message, or total outbox limit. The renderer keeps the draft when that rejection occurs, but its one-shot attachment approvals are already invalid, so retrying the unchanged draft fails and the user must select the files again.

I reproduced this through the registered production IPC handler: after filling the outbox with 256 records, a valid one-byte picked file first failed with Local message storage is full; keep the draft and resolve pending messages first; the same draft's next attempt then failed because its attachment approval had expired.

Please make approval consumption commit together with successful durable admission, or restore/reserve the approvals across every pre-admission failure. Add an IPC-level regression that fills the outbox, fails once, frees capacity, and retries the same attachment draft successfully. The aggregate 64 MiB message limit should also be checked before reading, resizing, and base64-encoding all selected files.

The focused Runtime Host continuity/PTY tests, Desktop local-store/cache/observer/PTY tests, Desktop typecheck, renderer architecture checks, and E2E budget checks passed on this head. The current-main synthetic merge is clean. I did not approve or merge because this retry failure remains unresolved.

---

Automated review notice: This comment was posted by an automated review agent operated by jackwener. It is not an independent human review and does not replace one.

[M4n5ter]

Confirmed and fixed in 0d5665aba.

Picked-file approvals are revalidated as a set and consumed only after synchronous SQLite admission succeeds. Failed preparation or admission preserves the original approvals without extending their lifetime; competing sends and sender teardown remain fenced.

Aggregate source bytes are checked before file reads/resizing, with capped reads and resized-output checks covering growth during preparation. The final outbox quota check remains authoritative.

Regression coverage includes the production IPC path with 256 occupied slots → failed submit → one slot freed → the unchanged attachment draft succeeds, aggregate-size rejection before resizing, and competing approval commits. Local verification: 48 focused tests, 2,355 Desktop tests, and 36 Electron tests on each of macOS and Linux pass.

[jackwener]

Approved at 8112988e7630428e3a0a0aae0b3654abfbf67cc2.

The prior picked-file retry finding is closed. Approval tokens now remain valid through asynchronous preparation and are consumed only after synchronous durable outbox admission succeeds. The production IPC regression fills all 256 outbox slots, observes the failed submission, frees one slot, and successfully retries the unchanged attachment draft; aggregate attachment sizes are also rejected before file reads or resizing.

This head contains current main, the combined Astryx surface inventory matches the generator, the focused attachment/local-submit suite passes 42/42, and the Desktop main build passes after rebuilding its workspace dependency. I found no remaining merge-blocking defect in this incremental repair. Hosted checks are still running and are not represented by this approval.

---

Automated review notice: This comment was posted by an automated review agent operated by jackwener. It is not an independent human review and does not replace one.