@cabane/companion 0.6.17 → 0.6.19

package/dist/cli.js

@@ -4726,6 +4726,16 @@ function readMcpError(error) {
 }
 
 // packages/agent-runtime/src/codex/session.ts
+function fingerprintPrompt(prompt) {
+  let fnv = 2166136261;
+  let djb = 5381;
+  for (let i = 0; i < prompt.length; i += 1) {
+    const code = prompt.charCodeAt(i);
+    fnv = Math.imul(fnv ^ code, 16777619);
+    djb = Math.imul(djb, 33) + code | 0;
+  }
+  return `${prompt.length}.${(fnv >>> 0).toString(36)}.${(djb >>> 0).toString(36)}`;
+}
 function encodeSession3(state) {
   return JSON.stringify(state);
 }
@@ -4745,7 +4755,10 @@ function decideResume3(stored, currentCwd) {
   if (storedCwd !== (currentCwd ?? "")) {
     return { fresh: true, reason: "cwd_mismatch" };
   }
-  return { resume: state.threadId };
+  return {
+    resume: state.threadId,
+    promptFingerprint: typeof state.promptFingerprint === "string" ? state.promptFingerprint : null
+  };
 }
 
 // packages/agent-runtime/src/codex/loop.ts
@@ -4768,13 +4781,20 @@ async function* decodeCodexStream(events, ctx) {
     if (ctx.signal.aborted) return;
     if (ev.type === "thread.started") {
       const threadId = readThreadId(ev);
-      if (!sessionEmitted && threadId && threadId !== ctx.resumedThreadId) {
-        sessionEmitted = true;
-        yield {
-          type: "session",
-          state: encodeSession3({ threadId, cwd: ctx.cwd ?? "" }),
-          ...ctx.degraded ? { degraded: true } : {}
-        };
+      if (threadId && !sessionEmitted) {
+        const state = encodeSession3({
+          threadId,
+          cwd: ctx.cwd ?? "",
+          promptFingerprint: ctx.promptFingerprint ?? null
+        });
+        if (threadId !== ctx.resumedThreadId || state !== ctx.storedState) {
+          sessionEmitted = true;
+          yield {
+            type: "session",
+            state,
+            ...ctx.degraded ? { degraded: true } : {}
+          };
+        }
       }
       continue;
     }
@@ -4897,7 +4917,7 @@ function codexToolPolicy(policy) {
     networkAccessEnabled: policy.web
   };
 }
-var CODEX_REASONING_EFFORTS = ["minimal", "low", "medium", "high", "xhigh"];
+var CODEX_REASONING_EFFORTS = ["low", "medium", "high", "xhigh", "max", "ultra"];
 var codexDialectSchema = z11.object({
   modelReasoningEffort: z11.enum(CODEX_REASONING_EFFORTS).optional()
 }).loose();
@@ -4919,7 +4939,7 @@ var CABANE_MCP_SERVER3 = "cabane";
 var TURN_CONTROL_MCP_SERVER2 = "cabane_companion";
 var ACTIVE_CONVERSATION_HEADER4 = "x-cabane-active-conversation";
 var ENV_ENVELOPE_KEYS = ["CABANE_ENV_TIER", "CABANE_ENV_KEY", "CABANE_ENV_BINDING"];
-function buildRunSpec2(req, resumeThreadId, instructionsFile = null) {
+function buildRunSpec2(req, resumeThreadId, instructionsFile = null, threadPromptFingerprint = null) {
   const { policy, config } = req;
   const directory = req.local.cwd ?? "";
   const dialect = readCodexDialect(config.runtimeOptions);
@@ -4930,6 +4950,9 @@ function buildRunSpec2(req, resumeThreadId, instructionsFile = null) {
       `[agent-runtime/codex] CT823: dispatching a subscription turn with NO concrete model (config.model=${JSON.stringify(config.model)}) \u2014 Codex will fall back to its own default. This should be unreachable post-CT823; the model resolver should have supplied a concrete house default.`
     );
   }
+  const promptFingerprint = fingerprintPrompt(req.systemPrompt);
+  const threadHasThisPrompt = resumeThreadId !== null && threadPromptFingerprint !== null && threadPromptFingerprint === promptFingerprint;
+  const promptRidesInput = baseInstructionsFile === null && !threadHasThisPrompt;
   return {
     resumeThreadId,
     directory,
@@ -4938,14 +4961,16 @@ function buildRunSpec2(req, resumeThreadId, instructionsFile = null) {
     skipGitRepoCheck: true,
     ...dialect.modelReasoningEffort ? { modelReasoningEffort: dialect.modelReasoningEffort } : {},
     baseInstructionsFile,
-    input: buildInput(req, baseInstructionsFile !== null),
+    input: buildInput(req, promptRidesInput),
+    promptRidesInput,
+    promptFingerprint,
     config: buildConfig(req, baseInstructionsFile)
   };
 }
-function buildInput(req, promptRidesInstructionsFile) {
+function buildInput(req, promptRidesInput) {
   const userText = req.content.filter((b) => b.type === "text").map((b) => b.text).join("\n\n");
   const body = userText.trim().length > 0 ? userText : req.prompt;
-  if (promptRidesInstructionsFile) return body;
+  if (!promptRidesInput) return body;
   const system = req.systemPrompt.trim();
   return system.length > 0 ? `${system}
 
@@ -5047,7 +5072,7 @@ function isStringRecord2(v) {
   return !!v && typeof v === "object" && Object.values(v).every((x) => typeof x === "string");
 }
 
-// node_modules/.pnpm/@openai+codex-sdk@0.146.0/node_modules/@openai/codex-sdk/dist/index.js
+// node_modules/.pnpm/@openai+codex-sdk@0.147.0/node_modules/@openai/codex-sdk/dist/index.js
 import { promises as fs } from "fs";
 import os from "os";
 import path from "path";
@@ -5630,6 +5655,7 @@ function createCodexAdapter(deps = {}) {
       const directory = req.local.cwd ?? "";
       const decision = decideResume3(req.session, directory);
       const resumeThreadId = "resume" in decision ? decision.resume : null;
+      const threadPromptFingerprint = "resume" in decision ? decision.promptFingerprint : null;
       if ("fresh" in decision && decision.reason === "cwd_mismatch") {
         deps.onWarn?.(
           "codex adapter: stored session directory no longer matches the current environment \u2014 starting a fresh thread (SJ527-analogue guard)",
@@ -5655,7 +5681,12 @@ function createCodexAdapter(deps = {}) {
         }
       }
       try {
-        const spec = buildRunSpec2(req, resumeThreadId, instructions?.path ?? null);
+        const spec = buildRunSpec2(
+          req,
+          resumeThreadId,
+          instructions?.path ?? null,
+          threadPromptFingerprint
+        );
         const result = await transport.run(spec, signal);
         if (signal.aborted) return;
         yield* decodeCodexStream(result.events, {
@@ -5663,6 +5694,14 @@ function createCodexAdapter(deps = {}) {
           cwd: req.local.cwd,
           resumedThreadId: resumeThreadId,
           degraded,
+          // CT1075: which prompt the thread carries once this turn lands. If we sent
+          // one, it's that one — a later copy is what the model reads, so a changed
+          // prompt supersedes the older copy still sitting above it. If we withheld
+          // it, the thread still carries whatever it did before. Read off the spec
+          // rather than recomputed, so the recorded fact can't disagree with what
+          // was actually sent.
+          promptFingerprint: spec.promptRidesInput ? spec.promptFingerprint : threadPromptFingerprint,
+          storedState: req.session,
           // CT601: Codex reports no model in-stream, so record what the thread was
           // started with (null on the default token). Same for the reasoning effort.
           resolvedModel: spec.model,
@@ -5697,9 +5736,10 @@ var COMPANION_POLICY2 = {
   uiPrompts: "never"
 };
 var DIR2 = "/env/here";
+var PROMPT = "system";
 function makeRequest3(overrides = {}) {
   return {
-    systemPrompt: "system",
+    systemPrompt: PROMPT,
     prompt: "hi there",
     content: [{ type: "text", text: "hi there" }],
     // CT601: the resolved model + reasoning effort ride the terminal `result` off
@@ -5742,9 +5782,9 @@ var errorItem = (id, message) => ({
   type: "item.completed",
   item: { id, type: "error", message }
 });
-var sessionEvent3 = (threadId, cwd = DIR2, degraded = false) => ({
+var sessionEvent3 = (threadId, cwd = DIR2, degraded = false, promptFingerprint = fingerprintPrompt(PROMPT)) => ({
   type: "session",
-  state: encodeSession3({ threadId, cwd }),
+  state: encodeSession3({ threadId, cwd, promptFingerprint }),
   ...degraded ? { degraded: true } : {}
 });
 var CODEX_CONFORMANCE_FIXTURES = [
@@ -6202,11 +6242,69 @@ var CODEX_CONFORMANCE_FIXTURES = [
   {
     // Session resume: the stored state matches the current directory, so the adapter
     // resumes its thread id and `thread.started` echoes the SAME id — NO session
-    // event fires (the id didn't change). This is what carries cross-turn memory.
+    // event fires (the id didn't change AND the state is unchanged). This is what
+    // carries cross-turn memory.
+    //
+    // CT1075: the stored state also says the thread already holds the composed
+    // prompt, so this turn withholds the preamble and the state it would write is
+    // byte-identical to the stored one. The silence is now proof of BOTH: an id that
+    // didn't change and a prompt that didn't need re-sending.
     name: "session resume (no re-emit on echo)",
-    request: makeRequest3({ session: encodeSession3({ threadId: "th1", cwd: DIR2 }) }),
+    request: makeRequest3({
+      session: encodeSession3({
+        threadId: "th1",
+        cwd: DIR2,
+        promptFingerprint: fingerprintPrompt(PROMPT)
+      })
+    }),
+    nativeStream: [threadStarted("th1"), agentMessage("m1", "Back again."), turnCompleted()],
+    expected: [
+      { type: "text", body: "Back again.", terminal: true },
+      { type: "result", ok: true }
+    ]
+  },
+  {
+    // CT1075: a resumed thread the platform's state does NOT vouch for — a state
+    // written before CT1075 existed, so it carries no `promptFingerprint` field. The
+    // adapter reads the absence as "we can't say which prompt this thread holds",
+    // sends the full prompt exactly as it did pre-CT1075, and re-emits the state with
+    // the fingerprint recorded — on the SAME thread id, which pre-CT1075 emitted
+    // nothing at all. That re-emit is the upgrade path: without it a long-lived
+    // thread would re-send the whole prompt forever.
+    //
+    // This is the fixture that fails if the static half is withheld on a thread we
+    // have no evidence about.
+    name: "session resume with a pre-CT1075 state re-emits with the prompt fingerprint",
+    request: makeRequest3({
+      session: JSON.stringify({ threadId: "th1", cwd: DIR2 })
+    }),
+    nativeStream: [threadStarted("th1"), agentMessage("m1", "Back again."), turnCompleted()],
+    expected: [
+      sessionEvent3("th1"),
+      { type: "text", body: "Back again.", terminal: true },
+      { type: "result", ok: true }
+    ]
+  },
+  {
+    // CT1075 (review finding): the thread carries a DIFFERENT prompt than the one
+    // this turn composed — a charter edit, a renamed agent, a redeployed prompt
+    // body. The stored fingerprint doesn't match, so the new prompt is sent exactly
+    // as on a fresh thread and the state is re-recorded against it.
+    //
+    // This is the fixture that fails if a stale prompt is treated as good enough. A
+    // boolean flag would have passed the resume fixture above and silently withheld
+    // every future charter edit from this thread.
+    name: "session resume with a stale prompt fingerprint re-sends the prompt",
+    request: makeRequest3({
+      session: encodeSession3({
+        threadId: "th1",
+        cwd: DIR2,
+        promptFingerprint: fingerprintPrompt("an older composed prompt")
+      })
+    }),
     nativeStream: [threadStarted("th1"), agentMessage("m1", "Back again."), turnCompleted()],
     expected: [
+      sessionEvent3("th1"),
       { type: "text", body: "Back again.", terminal: true },
       { type: "result", ok: true }
     ]
@@ -6217,8 +6315,18 @@ var CODEX_CONFORMANCE_FIXTURES = [
     // fresh — `thread.started` reports a NEW id, and the emitted session event
     // records the CURRENT directory with `degraded: true` so the host rewinds the
     // catch-up mark.
+    //
+    // CT1075: the refused resume means the new thread is EMPTY, so the full prompt
+    // goes in even though the stored state vouched for a copy — of a thread we're
+    // no longer in. The emitted state records the fresh thread's own answer.
     name: "session directory-mismatch degrades to fresh",
-    request: makeRequest3({ session: encodeSession3({ threadId: "old", cwd: "/env/gone" }) }),
+    request: makeRequest3({
+      session: encodeSession3({
+        threadId: "old",
+        cwd: "/env/gone",
+        promptFingerprint: fingerprintPrompt(PROMPT)
+      })
+    }),
     nativeStream: [
       threadStarted(NEW_THREAD_ID),
       agentMessage("m1", "Fresh start."),
@@ -6584,9 +6692,16 @@ function buildCompanionTurnRequest(params) {
       ...t.workspaceToolSurface ? { workspaceToolSurface: t.workspaceToolSurface } : {},
       // CT714: mount the turn-control surface ONLY when a real turn token backs
       // this turn — the surface admits `turn_token` auth exclusively, so a
-      // PAT-fallback bearer (older API / unresolved delegation) would be rejected
-      // there. Absent it, external adapters simply don't mount it that turn (the
-      // same graceful degrade as the rest of the OBO path).
+      // PAT-fallback bearer would be rejected there. Absent it, external adapters
+      // simply don't mount it that turn.
+      //
+      // CT1074: that fallback is now an OLD-API case only. The server mints a token
+      // for every turn it dispatched, so "no token" no longer means "no human behind
+      // the turn" — it means the API predates this change. The condition is right as
+      // it stands and stays where the failure is honest (a rejected bearer is worse
+      // than an unmounted server); what was wrong was upstream, where an undelegated
+      // turn minted nothing and this silently dropped all five verbs on Codex and
+      // opencode with no refusal anyone could see.
       ...params.turnToken ? { turnControlUrl: turnControlMcpUrl(params.baseUrl) } : {}
     },
     local: {
@@ -7199,7 +7314,12 @@ var Dispatcher = class {
   // clear is durable (CT93 outbox, last-writer-wins per pair), so a terminal
   // failure here just logs and the server age-sweep backstops it.
   async concludeBeforeRun(payload, turnLog, startedAt, reason, errorReason) {
-    const body = { activeRunStartedAt: null };
+    const body = {
+      activeRunStartedAt: null,
+      // CT1046: this dispatch is over before it ran — retire its evidence so it
+      // can't authorize a turn-token mint afterwards.
+      settledMessageId: payload.messageId
+    };
     if (errorReason) body.errorReason = errorReason.slice(0, 200);
     try {
       await this.opts.api.setActiveRun(
@@ -7959,7 +8079,12 @@ ${reason}`,
         // CT277: the server keys the turn-end metadata UPDATE (ended_at + tokens)
         // off this turn id, so the settle PATCH must carry it — the start PATCH
         // isn't enough. Always sent (every settle closes a real turn).
-        turnId
+        turnId,
+        // CT1046: and the trigger this turn answered, so the server retires the
+        // dispatch that authorized it. Always sent, unlike `lastSeenMessageId`
+        // below (which is a success-only catch-up advance): a failed or cancelled
+        // turn is just as over, and its evidence must die with it.
+        settledMessageId: payload.messageId
       };
       if (turnUsage) {
         body.usage = turnUsage;

package/dist/runtime.js

@@ -4379,6 +4379,16 @@ function readMcpError(error) {
 }
 
 // packages/agent-runtime/src/codex/session.ts
+function fingerprintPrompt(prompt) {
+  let fnv = 2166136261;
+  let djb = 5381;
+  for (let i = 0; i < prompt.length; i += 1) {
+    const code = prompt.charCodeAt(i);
+    fnv = Math.imul(fnv ^ code, 16777619);
+    djb = Math.imul(djb, 33) + code | 0;
+  }
+  return `${prompt.length}.${(fnv >>> 0).toString(36)}.${(djb >>> 0).toString(36)}`;
+}
 function encodeSession3(state) {
   return JSON.stringify(state);
 }
@@ -4398,7 +4408,10 @@ function decideResume3(stored, currentCwd) {
   if (storedCwd !== (currentCwd ?? "")) {
     return { fresh: true, reason: "cwd_mismatch" };
   }
-  return { resume: state.threadId };
+  return {
+    resume: state.threadId,
+    promptFingerprint: typeof state.promptFingerprint === "string" ? state.promptFingerprint : null
+  };
 }
 
 // packages/agent-runtime/src/codex/loop.ts
@@ -4421,13 +4434,20 @@ async function* decodeCodexStream(events, ctx) {
     if (ctx.signal.aborted) return;
     if (ev.type === "thread.started") {
       const threadId = readThreadId(ev);
-      if (!sessionEmitted && threadId && threadId !== ctx.resumedThreadId) {
-        sessionEmitted = true;
-        yield {
-          type: "session",
-          state: encodeSession3({ threadId, cwd: ctx.cwd ?? "" }),
-          ...ctx.degraded ? { degraded: true } : {}
-        };
+      if (threadId && !sessionEmitted) {
+        const state = encodeSession3({
+          threadId,
+          cwd: ctx.cwd ?? "",
+          promptFingerprint: ctx.promptFingerprint ?? null
+        });
+        if (threadId !== ctx.resumedThreadId || state !== ctx.storedState) {
+          sessionEmitted = true;
+          yield {
+            type: "session",
+            state,
+            ...ctx.degraded ? { degraded: true } : {}
+          };
+        }
       }
       continue;
     }
@@ -4550,7 +4570,7 @@ function codexToolPolicy(policy) {
     networkAccessEnabled: policy.web
   };
 }
-var CODEX_REASONING_EFFORTS = ["minimal", "low", "medium", "high", "xhigh"];
+var CODEX_REASONING_EFFORTS = ["low", "medium", "high", "xhigh", "max", "ultra"];
 var codexDialectSchema = z11.object({
   modelReasoningEffort: z11.enum(CODEX_REASONING_EFFORTS).optional()
 }).loose();
@@ -4572,7 +4592,7 @@ var CABANE_MCP_SERVER3 = "cabane";
 var TURN_CONTROL_MCP_SERVER2 = "cabane_companion";
 var ACTIVE_CONVERSATION_HEADER4 = "x-cabane-active-conversation";
 var ENV_ENVELOPE_KEYS = ["CABANE_ENV_TIER", "CABANE_ENV_KEY", "CABANE_ENV_BINDING"];
-function buildRunSpec2(req, resumeThreadId, instructionsFile = null) {
+function buildRunSpec2(req, resumeThreadId, instructionsFile = null, threadPromptFingerprint = null) {
   const { policy, config } = req;
   const directory = req.local.cwd ?? "";
   const dialect = readCodexDialect(config.runtimeOptions);
@@ -4583,6 +4603,9 @@ function buildRunSpec2(req, resumeThreadId, instructionsFile = null) {
       `[agent-runtime/codex] CT823: dispatching a subscription turn with NO concrete model (config.model=${JSON.stringify(config.model)}) \u2014 Codex will fall back to its own default. This should be unreachable post-CT823; the model resolver should have supplied a concrete house default.`
     );
   }
+  const promptFingerprint = fingerprintPrompt(req.systemPrompt);
+  const threadHasThisPrompt = resumeThreadId !== null && threadPromptFingerprint !== null && threadPromptFingerprint === promptFingerprint;
+  const promptRidesInput = baseInstructionsFile === null && !threadHasThisPrompt;
   return {
     resumeThreadId,
     directory,
@@ -4591,14 +4614,16 @@ function buildRunSpec2(req, resumeThreadId, instructionsFile = null) {
     skipGitRepoCheck: true,
     ...dialect.modelReasoningEffort ? { modelReasoningEffort: dialect.modelReasoningEffort } : {},
     baseInstructionsFile,
-    input: buildInput(req, baseInstructionsFile !== null),
+    input: buildInput(req, promptRidesInput),
+    promptRidesInput,
+    promptFingerprint,
     config: buildConfig(req, baseInstructionsFile)
   };
 }
-function buildInput(req, promptRidesInstructionsFile) {
+function buildInput(req, promptRidesInput) {
   const userText = req.content.filter((b) => b.type === "text").map((b) => b.text).join("\n\n");
   const body = userText.trim().length > 0 ? userText : req.prompt;
-  if (promptRidesInstructionsFile) return body;
+  if (!promptRidesInput) return body;
   const system = req.systemPrompt.trim();
   return system.length > 0 ? `${system}
 
@@ -4700,7 +4725,7 @@ function isStringRecord2(v) {
   return !!v && typeof v === "object" && Object.values(v).every((x) => typeof x === "string");
 }
 
-// node_modules/.pnpm/@openai+codex-sdk@0.146.0/node_modules/@openai/codex-sdk/dist/index.js
+// node_modules/.pnpm/@openai+codex-sdk@0.147.0/node_modules/@openai/codex-sdk/dist/index.js
 import { promises as fs } from "fs";
 import os from "os";
 import path from "path";
@@ -5283,6 +5308,7 @@ function createCodexAdapter(deps = {}) {
       const directory = req.local.cwd ?? "";
       const decision = decideResume3(req.session, directory);
       const resumeThreadId = "resume" in decision ? decision.resume : null;
+      const threadPromptFingerprint = "resume" in decision ? decision.promptFingerprint : null;
       if ("fresh" in decision && decision.reason === "cwd_mismatch") {
         deps.onWarn?.(
           "codex adapter: stored session directory no longer matches the current environment \u2014 starting a fresh thread (SJ527-analogue guard)",
@@ -5308,7 +5334,12 @@ function createCodexAdapter(deps = {}) {
         }
       }
       try {
-        const spec = buildRunSpec2(req, resumeThreadId, instructions?.path ?? null);
+        const spec = buildRunSpec2(
+          req,
+          resumeThreadId,
+          instructions?.path ?? null,
+          threadPromptFingerprint
+        );
         const result = await transport.run(spec, signal);
         if (signal.aborted) return;
         yield* decodeCodexStream(result.events, {
@@ -5316,6 +5347,14 @@ function createCodexAdapter(deps = {}) {
           cwd: req.local.cwd,
           resumedThreadId: resumeThreadId,
           degraded,
+          // CT1075: which prompt the thread carries once this turn lands. If we sent
+          // one, it's that one — a later copy is what the model reads, so a changed
+          // prompt supersedes the older copy still sitting above it. If we withheld
+          // it, the thread still carries whatever it did before. Read off the spec
+          // rather than recomputed, so the recorded fact can't disagree with what
+          // was actually sent.
+          promptFingerprint: spec.promptRidesInput ? spec.promptFingerprint : threadPromptFingerprint,
+          storedState: req.session,
           // CT601: Codex reports no model in-stream, so record what the thread was
           // started with (null on the default token). Same for the reasoning effort.
           resolvedModel: spec.model,
@@ -5350,9 +5389,10 @@ var COMPANION_POLICY2 = {
   uiPrompts: "never"
 };
 var DIR2 = "/env/here";
+var PROMPT = "system";
 function makeRequest3(overrides = {}) {
   return {
-    systemPrompt: "system",
+    systemPrompt: PROMPT,
     prompt: "hi there",
     content: [{ type: "text", text: "hi there" }],
     // CT601: the resolved model + reasoning effort ride the terminal `result` off
@@ -5395,9 +5435,9 @@ var errorItem = (id, message) => ({
   type: "item.completed",
   item: { id, type: "error", message }
 });
-var sessionEvent3 = (threadId, cwd = DIR2, degraded = false) => ({
+var sessionEvent3 = (threadId, cwd = DIR2, degraded = false, promptFingerprint = fingerprintPrompt(PROMPT)) => ({
   type: "session",
-  state: encodeSession3({ threadId, cwd }),
+  state: encodeSession3({ threadId, cwd, promptFingerprint }),
   ...degraded ? { degraded: true } : {}
 });
 var CODEX_CONFORMANCE_FIXTURES = [
@@ -5855,11 +5895,69 @@ var CODEX_CONFORMANCE_FIXTURES = [
   {
     // Session resume: the stored state matches the current directory, so the adapter
     // resumes its thread id and `thread.started` echoes the SAME id — NO session
-    // event fires (the id didn't change). This is what carries cross-turn memory.
+    // event fires (the id didn't change AND the state is unchanged). This is what
+    // carries cross-turn memory.
+    //
+    // CT1075: the stored state also says the thread already holds the composed
+    // prompt, so this turn withholds the preamble and the state it would write is
+    // byte-identical to the stored one. The silence is now proof of BOTH: an id that
+    // didn't change and a prompt that didn't need re-sending.
     name: "session resume (no re-emit on echo)",
-    request: makeRequest3({ session: encodeSession3({ threadId: "th1", cwd: DIR2 }) }),
+    request: makeRequest3({
+      session: encodeSession3({
+        threadId: "th1",
+        cwd: DIR2,
+        promptFingerprint: fingerprintPrompt(PROMPT)
+      })
+    }),
+    nativeStream: [threadStarted("th1"), agentMessage("m1", "Back again."), turnCompleted()],
+    expected: [
+      { type: "text", body: "Back again.", terminal: true },
+      { type: "result", ok: true }
+    ]
+  },
+  {
+    // CT1075: a resumed thread the platform's state does NOT vouch for — a state
+    // written before CT1075 existed, so it carries no `promptFingerprint` field. The
+    // adapter reads the absence as "we can't say which prompt this thread holds",
+    // sends the full prompt exactly as it did pre-CT1075, and re-emits the state with
+    // the fingerprint recorded — on the SAME thread id, which pre-CT1075 emitted
+    // nothing at all. That re-emit is the upgrade path: without it a long-lived
+    // thread would re-send the whole prompt forever.
+    //
+    // This is the fixture that fails if the static half is withheld on a thread we
+    // have no evidence about.
+    name: "session resume with a pre-CT1075 state re-emits with the prompt fingerprint",
+    request: makeRequest3({
+      session: JSON.stringify({ threadId: "th1", cwd: DIR2 })
+    }),
+    nativeStream: [threadStarted("th1"), agentMessage("m1", "Back again."), turnCompleted()],
+    expected: [
+      sessionEvent3("th1"),
+      { type: "text", body: "Back again.", terminal: true },
+      { type: "result", ok: true }
+    ]
+  },
+  {
+    // CT1075 (review finding): the thread carries a DIFFERENT prompt than the one
+    // this turn composed — a charter edit, a renamed agent, a redeployed prompt
+    // body. The stored fingerprint doesn't match, so the new prompt is sent exactly
+    // as on a fresh thread and the state is re-recorded against it.
+    //
+    // This is the fixture that fails if a stale prompt is treated as good enough. A
+    // boolean flag would have passed the resume fixture above and silently withheld
+    // every future charter edit from this thread.
+    name: "session resume with a stale prompt fingerprint re-sends the prompt",
+    request: makeRequest3({
+      session: encodeSession3({
+        threadId: "th1",
+        cwd: DIR2,
+        promptFingerprint: fingerprintPrompt("an older composed prompt")
+      })
+    }),
     nativeStream: [threadStarted("th1"), agentMessage("m1", "Back again."), turnCompleted()],
     expected: [
+      sessionEvent3("th1"),
       { type: "text", body: "Back again.", terminal: true },
       { type: "result", ok: true }
     ]
@@ -5870,8 +5968,18 @@ var CODEX_CONFORMANCE_FIXTURES = [
     // fresh — `thread.started` reports a NEW id, and the emitted session event
     // records the CURRENT directory with `degraded: true` so the host rewinds the
     // catch-up mark.
+    //
+    // CT1075: the refused resume means the new thread is EMPTY, so the full prompt
+    // goes in even though the stored state vouched for a copy — of a thread we're
+    // no longer in. The emitted state records the fresh thread's own answer.
     name: "session directory-mismatch degrades to fresh",
-    request: makeRequest3({ session: encodeSession3({ threadId: "old", cwd: "/env/gone" }) }),
+    request: makeRequest3({
+      session: encodeSession3({
+        threadId: "old",
+        cwd: "/env/gone",
+        promptFingerprint: fingerprintPrompt(PROMPT)
+      })
+    }),
     nativeStream: [
       threadStarted(NEW_THREAD_ID),
       agentMessage("m1", "Fresh start."),
@@ -6237,9 +6345,16 @@ function buildCompanionTurnRequest(params) {
       ...t.workspaceToolSurface ? { workspaceToolSurface: t.workspaceToolSurface } : {},
       // CT714: mount the turn-control surface ONLY when a real turn token backs
       // this turn — the surface admits `turn_token` auth exclusively, so a
-      // PAT-fallback bearer (older API / unresolved delegation) would be rejected
-      // there. Absent it, external adapters simply don't mount it that turn (the
-      // same graceful degrade as the rest of the OBO path).
+      // PAT-fallback bearer would be rejected there. Absent it, external adapters
+      // simply don't mount it that turn.
+      //
+      // CT1074: that fallback is now an OLD-API case only. The server mints a token
+      // for every turn it dispatched, so "no token" no longer means "no human behind
+      // the turn" — it means the API predates this change. The condition is right as
+      // it stands and stays where the failure is honest (a rejected bearer is worse
+      // than an unmounted server); what was wrong was upstream, where an undelegated
+      // turn minted nothing and this silently dropped all five verbs on Codex and
+      // opencode with no refusal anyone could see.
       ...params.turnToken ? { turnControlUrl: turnControlMcpUrl(params.baseUrl) } : {}
     },
     local: {
@@ -6852,7 +6967,12 @@ var Dispatcher = class {
   // clear is durable (CT93 outbox, last-writer-wins per pair), so a terminal
   // failure here just logs and the server age-sweep backstops it.
   async concludeBeforeRun(payload, turnLog, startedAt, reason, errorReason) {
-    const body = { activeRunStartedAt: null };
+    const body = {
+      activeRunStartedAt: null,
+      // CT1046: this dispatch is over before it ran — retire its evidence so it
+      // can't authorize a turn-token mint afterwards.
+      settledMessageId: payload.messageId
+    };
     if (errorReason) body.errorReason = errorReason.slice(0, 200);
     try {
       await this.opts.api.setActiveRun(
@@ -7612,7 +7732,12 @@ ${reason}`,
         // CT277: the server keys the turn-end metadata UPDATE (ended_at + tokens)
         // off this turn id, so the settle PATCH must carry it — the start PATCH
         // isn't enough. Always sent (every settle closes a real turn).
-        turnId
+        turnId,
+        // CT1046: and the trigger this turn answered, so the server retires the
+        // dispatch that authorized it. Always sent, unlike `lastSeenMessageId`
+        // below (which is a success-only catch-up advance): a failed or cancelled
+        // turn is just as over, and its evidence must die with it.
+        settledMessageId: payload.messageId
       };
       if (turnUsage) {
         body.usage = turnUsage;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.17",
+  "version": "0.6.19",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",
@@ -28,7 +28,7 @@
     "prepublishOnly": "pnpm build"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.226",
+    "@anthropic-ai/claude-agent-sdk": "0.3.233",
     "@hono/node-server": "1.19.14",
     "@inquirer/prompts": "7.10.1",
     "commander": "12.1.0",