@gajae-code/coding-agent 0.15.6 → 0.16.0

package/src/sdk/host/control/index.ts

@@ -6,6 +6,8 @@ export {
 	type ControlResponse,
 	controlRequestFromFrame,
 	dispatchControl,
+	type TerminalAbortIdentity,
 	TypedControlError,
+	terminalAbortIdentity,
 } from "./dispatch";
 export type { AbortScope, ControlInput, ControlSurface, ControlValue } from "./operations";

package/src/sdk/host/control/operations.ts

@@ -11,6 +11,8 @@ export type AbortScope = "turn" | "owned";
 export interface TerminalAbortInput {
 	mode: "terminal";
 	scope?: AbortScope;
+	/** Broker-authorized local override; public SDK callers cannot grant this authority. */
+	operator?: boolean;
 }
 export type ControlInput = Record<string, unknown>;
 

package/src/sdk/host/control/runtime-gate.ts

@@ -1,13 +1,19 @@
+import { findOperation } from "../../protocol/operation-registry";
+
 /**
- * Private field carried only on the Broker's endpoint close request.
+ * Private fields carried only on Broker-authorized endpoint controls.
  *
- * The value is the lifecycle effect marker bound to the serving process. It is
- * never published in endpoint discovery or lifecycle service results; callers
- * that do not hold the Broker's indexed lifecycle record cannot satisfy this
- * gate.
+ * Their values are lifecycle effect markers bound to the serving process. They
+ * are never published in endpoint discovery or lifecycle service results;
+ * callers that do not hold the Broker's indexed lifecycle record cannot satisfy
+ * either gate.
  */
 export const BROKER_RUNTIME_CLOSE_CAPABILITY_FIELD = "__gjcBrokerCloseCapability";
+/** Private field carried only on the Broker-authorized terminal-abort request. */
+export const BROKER_RUNTIME_ABORT_CAPABILITY_FIELD = "__gjcBrokerAbortCapability";
 const EXPECTED_BROKER_RUNTIME_CLOSE_CAPABILITY = process.env.GJC_LIFECYCLE_REQUEST_ID;
+const EXPECTED_BROKER_RUNTIME_ABORT_CAPABILITY = process.env.GJC_LIFECYCLE_REQUEST_ID;
+let brokerRuntimeAbortCapabilityOverrideForTest: string | undefined;
 
 function record(value: unknown): Record<string, unknown> | undefined {
 	return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;
@@ -18,13 +24,188 @@ export function brokerRuntimeCloseCapability(input: unknown): string | undefined
 	return typeof value === "string" && value.length > 0 ? value : undefined;
 }
 
-/** Remove the private close capability before a request is exposed to diagnostics. */
-export function redactBrokerRuntimeCloseCapability(frame: Record<string, unknown>): Record<string, unknown> {
-	if (frame.type !== "control_request" || frame.operation !== "session.close") return frame;
+export function brokerRuntimeAbortCapability(input: unknown): string | undefined {
+	const value = record(input)?.[BROKER_RUNTIME_ABORT_CAPABILITY_FIELD];
+	return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+
+/** Remove private Broker capabilities before a request is exposed to diagnostics. */
+export function redactBrokerRuntimeCapabilities(frame: Record<string, unknown>): Record<string, unknown> {
+	if (frame.type !== "control_request") return frame;
 	const input = record(frame.input);
-	if (!input || !Object.hasOwn(input, BROKER_RUNTIME_CLOSE_CAPABILITY_FIELD)) return frame;
-	const { [BROKER_RUNTIME_CLOSE_CAPABILITY_FIELD]: _capability, ...publicInput } = input;
-	return { ...frame, input: publicInput };
+	if (!input) return frame;
+	let redacted = false;
+	const publicInput: Record<string, unknown> = {};
+	for (const [key, value] of Object.entries(input)) {
+		if (key === BROKER_RUNTIME_CLOSE_CAPABILITY_FIELD || key === BROKER_RUNTIME_ABORT_CAPABILITY_FIELD) {
+			redacted = true;
+			continue;
+		}
+		publicInput[key] = value;
+	}
+	return redacted ? { ...frame, input: publicInput } : frame;
+}
+
+/**
+ * Frame-level keys an observer may see. `SdkFrame` is an open
+ * `Record<string, unknown>` and `#observeRequest` runs BEFORE dispatch
+ * validation, so an adversarial or malformed frame can carry content under any
+ * top-level key. Only structural routing values survive. `idempotencyKey`,
+ * `id`, and other correlation values are caller-chosen and are deliberately
+ * absent; so are `cursor` (a signed pagination token that can carry
+ * session/revision data) and `expectedRevision` (no diagnostic consumer reads
+ * it). Even allowlisted routing names are checked against their protocol
+ * values below: a field-name allowlist alone is fail-open for scalar secrets.
+ */
+const OBSERVABLE_FRAME_FIELDS = new Set(["type", "operation", "query"]);
+
+/**
+ * Frame keys whose value must match an exact expected type to survive.
+ * `confirm` is a structural destructive-op gate, so only the boolean form is
+ * routing information; a caller-authored string under that name is content.
+ */
+const OBSERVABLE_TYPED_FRAME_FIELDS: Readonly<Record<string, "boolean">> = { confirm: "boolean" };
+
+const OBSERVABLE_FRAME_LITERAL_FIELDS: Readonly<Record<string, ReadonlySet<string>>> = {
+	type: new Set(["control_request", "query_request"]),
+};
+
+const OBSERVER_MARKER_MAX_COUNT = 4096;
+
+/**
+ * Input fields an observer may see. This is an ALLOWLIST on purpose: a
+ * denylist is fail-open, so every unlisted or newly added field would leak by
+ * default. Only structural routing/correlation values are preserved; all other
+ * values are caller content and are replaced with a shape marker.
+ */
+const OBSERVABLE_INPUT_FIELDS = new Set(["mode", "scope", "kind", "level", "on", "confirm"]);
+
+/**
+ * Input fields that carry a finite protocol value. Correlation identifiers,
+ * names, and operation arguments remain redacted even when they look like
+ * ordinary identifiers: callers are free to put arbitrary content in them.
+ */
+const OBSERVABLE_INPUT_LITERAL_FIELDS: Readonly<Record<string, ReadonlySet<string>>> = {
+	mode: new Set([
+		"turn",
+		"terminal",
+		"owned",
+		"allow",
+		"always-allow",
+		"deny",
+		"always-deny",
+		"prompt",
+		"all",
+		"one-at-a-time",
+		"immediate",
+		"wait",
+	]),
+	scope: new Set(["turn", "owned"]),
+	kind: new Set(["prompt", "skill"]),
+	level: new Set(["inherit", "off", "minimal", "low", "medium", "high", "xhigh", "max"]),
+};
+
+const OBSERVABLE_INPUT_TYPED_FIELDS: Readonly<Record<string, "boolean">> = {
+	on: "boolean",
+	confirm: "boolean",
+};
+
+/** Replaces caller content with a shape-preserving marker for observers. */
+function redactedContentMarker(value: unknown): string {
+	if (typeof value === "string") {
+		const count = Math.min(value.length, OBSERVER_MARKER_MAX_COUNT);
+		return `[redacted ${count}${value.length > count ? "+" : ""} chars]`;
+	}
+	if (Array.isArray(value)) {
+		const count = Math.min(value.length, OBSERVER_MARKER_MAX_COUNT);
+		return `[redacted ${count}${value.length > count ? "+" : ""} items]`;
+	}
+	if (value !== null && typeof value === "object") {
+		const fields = Object.keys(value).length;
+		const count = Math.min(fields, OBSERVER_MARKER_MAX_COUNT);
+		return `[redacted ${count}${fields > count ? "+" : ""} fields]`;
+	}
+	return "[redacted]";
+}
+
+function setObservedField(target: Record<string, unknown>, key: string, value: unknown): void {
+	Object.defineProperty(target, key, { configurable: true, enumerable: true, writable: true, value });
+}
+
+function observableFrameValue(key: string, value: unknown): unknown {
+	const requiredType = OBSERVABLE_TYPED_FRAME_FIELDS[key];
+	if (requiredType !== undefined) return typeof value === requiredType ? value : redactedContentMarker(value);
+	if (key === "operation" || key === "query") {
+		const known =
+			findOperation("control", String(value)) ??
+			findOperation("global", String(value)) ??
+			findOperation("query", String(value)) ??
+			findOperation("reverse", String(value));
+		return typeof value === "string" && value.length <= 128 && known !== undefined
+			? value
+			: redactedContentMarker(value);
+	}
+	const allowed = OBSERVABLE_FRAME_LITERAL_FIELDS[key];
+	return allowed?.has(typeof value === "string" ? value : "") ? value : redactedContentMarker(value);
+}
+
+/**
+ * Strips caller content from a request frame before it reaches a diagnostic
+ * observer. Known protocol operation names and finite enum values survive so
+ * instrumentation stays useful; caller-chosen ids and all other values are
+ * redacted, including nested objects, so a field this module has never heard
+ * of cannot leak.
+ */
+export function redactObservedRequestContent(frame: Record<string, unknown>): Record<string, unknown> {
+	const observed: Record<string, unknown> = {};
+	for (const [key, value] of Object.entries(frame)) {
+		if (value === undefined) continue;
+		if (key === "input") {
+			const input = record(value);
+			// A non-record payload is content, not "nothing to redact". Returning
+			// early here would hand a string or array `input` through verbatim.
+			setObservedField(
+				observed,
+				key,
+				input === undefined ? redactedContentMarker(value) : redactObservedInput(input),
+			);
+			continue;
+		}
+		// Structural routing scalars survive; every other top-level key, including
+		// one this module has never heard of, is redacted.
+		setObservedField(
+			observed,
+			key,
+			OBSERVABLE_FRAME_FIELDS.has(key) || Object.hasOwn(OBSERVABLE_TYPED_FRAME_FIELDS, key)
+				? observableFrameValue(key, value)
+				: redactedContentMarker(value),
+		);
+	}
+	return observed;
+}
+
+/** Redacts one input payload, preserving only structural scalar routing fields. */
+function redactObservedInput(input: Record<string, unknown>): Record<string, unknown> {
+	const redacted: Record<string, unknown> = {};
+	for (const [field, value] of Object.entries(input)) {
+		if (value === undefined) continue;
+		const requiredType = OBSERVABLE_INPUT_TYPED_FIELDS[field];
+		if (requiredType !== undefined) {
+			setObservedField(redacted, field, typeof value === requiredType ? value : redactedContentMarker(value));
+			continue;
+		}
+		const allowed = OBSERVABLE_INPUT_LITERAL_FIELDS[field];
+		// A finite protocol value is safe; every caller-chosen scalar, including
+		// an allowlisted field with a forged string, is content and is redacted.
+		setObservedField(
+			redacted,
+			field,
+			OBSERVABLE_INPUT_FIELDS.has(field) && allowed?.has(typeof value === "string" ? value : "")
+				? value
+				: redactedContentMarker(value),
+		);
+	}
+	return redacted;
 }
 
 /**
@@ -38,3 +219,14 @@ export function hasBrokerRuntimeCloseCapability(input: unknown): boolean {
 	const actual = brokerRuntimeCloseCapability(input);
 	return typeof expected === "string" && expected.length > 0 && actual === expected;
 }
+
+/** Test-only override for the abort gate; production authority remains process-local. */
+export function setBrokerRuntimeAbortCapabilityForTest(capability: string | undefined): void {
+	brokerRuntimeAbortCapabilityOverrideForTest = capability;
+}
+
+export function hasBrokerRuntimeAbortCapability(input: unknown): boolean {
+	const expected = brokerRuntimeAbortCapabilityOverrideForTest ?? EXPECTED_BROKER_RUNTIME_ABORT_CAPABILITY;
+	const actual = brokerRuntimeAbortCapability(input);
+	return typeof expected === "string" && expected.length > 0 && actual === expected;
+}

package/src/sdk/host/host.ts

@@ -1,6 +1,6 @@
 import { logger } from "@gajae-code/utils";
 import { AUTOROUTING_INACTIVE_WARNING } from "../../config/autorouting-contract";
-import { redactBrokerRuntimeCloseCapability } from "./control/runtime-gate";
+import { redactBrokerRuntimeCapabilities, redactObservedRequestContent } from "./control/runtime-gate";
 import { type EventFrame, SessionEventStream } from "./events";
 import { isAutoroutingInactive } from "./internal-autorouting-state";
 import { type ProviderLease, ReverseLeaseError, ReverseLeaseRuntime } from "./reverse-leases";
@@ -88,6 +88,12 @@ export interface SessionSdkHostOptions extends HostEndpointAdapters {
 	 * that fails is never read as authorization.
 	 */
 	activationGate?: SessionActivationGate;
+	/** Private one-shot master-capability verification; never durable or public SDK surface. */
+	masterCapabilityVerify?: (frame: { nonce: unknown; attestationEpoch: unknown; capability: unknown }) => {
+		ok: boolean;
+		nonce: string;
+		attestationEpoch: string;
+	};
 }
 
 /** Shared by the replay filter and transport live broadcasts: a connection
@@ -416,6 +422,21 @@ export class SessionSdkHost {
 				return;
 			}
 			switch (frame.type) {
+				case "master_capability_verify": {
+					const result = this.#options.masterCapabilityVerify?.({
+						nonce: frame.nonce,
+						attestationEpoch: frame.attestationEpoch,
+						capability: frame.capability,
+					}) ?? { ok: false, nonce: "", attestationEpoch: "" };
+					await this.#send(connectionId, {
+						type: "master_capability_verify_result",
+						id: typeof frame.id === "string" ? frame.id : "",
+						ok: result.ok,
+						nonce: result.nonce,
+						attestationEpoch: result.attestationEpoch,
+					});
+					break;
+				}
 				case "control_request": {
 					this.#observeRequest("control", connectionId, frame);
 					// Deferred readiness withholds `session_ready`, but the control
@@ -616,7 +637,11 @@ export class SessionSdkHost {
 	}
 	#observeRequest(kind: "control" | "query", connectionId: string, frame: SdkFrame): void {
 		try {
-			this.#options.onRequest?.(kind, connectionId, redactBrokerRuntimeCloseCapability(frame));
+			this.#options.onRequest?.(
+				kind,
+				connectionId,
+				redactObservedRequestContent(redactBrokerRuntimeCapabilities(frame)),
+			);
 		} catch {
 			// Diagnostic observers must not change request handling.
 		}

package/src/sdk/host/session-runtime.test.ts

@@ -5,7 +5,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { AsyncJobManager } from "../../async";
 import type { Settings } from "../../config/settings";
-import type { ExtensionAPI, ExtensionContext } from "../../extensibility/extensions";
+import type { ExtensionAPI, ExtensionContext, ExtensionTranscriptEntry } from "../../extensibility/extensions";
 import {
 	registerOwnedRegistration,
 	resetTerminalAbortRegistriesForTests,
@@ -16,7 +16,8 @@ import { Broker } from "../broker/broker";
 import { createKindAwareReconciliation } from "../bus/kind-aware-reconciliation";
 import { createPromptReconciliation } from "../bus/prompt-reconciliation";
 import { createReconciliationStore } from "../bus/reconciliation-store";
-import { CursorRegistry, QueryHandlers, RevisionStore } from "./query";
+import { BROKER_RUNTIME_ABORT_CAPABILITY_FIELD, setBrokerRuntimeAbortCapabilityForTest } from "./control/runtime-gate";
+import { CursorRegistry, QueryHandlers, type QueryResponse, RevisionStore } from "./query";
 import {
 	createInvocationReconciliation,
 	createSdkSessionRuntimeExtension,
@@ -90,6 +91,7 @@ function extensionContext(
 		goalState?: unknown;
 		branch?: unknown[];
 		liveState?: { isStreaming: boolean; steeringQueueDepth: number; followupQueueDepth: number };
+		transcript?: ExtensionTranscriptEntry[];
 	} = {},
 ): ExtensionContext {
 	return {
@@ -102,6 +104,7 @@ function extensionContext(
 			getSessionName: () => undefined,
 			getBranch: () => options.branch ?? [],
 		},
+		getTranscript: () => options.transcript ?? [],
 		getGoalState: () => options.goalState,
 	} as unknown as ExtensionContext;
 }
@@ -148,6 +151,97 @@ async function queryGoalState(
 	return response.page?.items[0];
 }
 
+async function queryLastAssistant(ctx: ExtensionContext, sessionId: string): Promise<QueryResponse> {
+	const surface = createSdkSurfaceFactory({
+		ctx,
+		id: sessionId,
+		api: {} as ExtensionAPI,
+	}).query;
+	const store = new RevisionStore(sessionId);
+	const response = await new QueryHandlers(
+		surface,
+		sessionId,
+		store,
+		new CursorRegistry("last-assistant-test-token", store),
+	).dispatch({
+		query: "session.last_assistant",
+		connectionId: "last-assistant-test-connection",
+	});
+	return response;
+}
+
+test("session.last_assistant returns the latest projected readable text past non-text assistant tails", async () => {
+	const sessionId = "last-assistant-readable-tail";
+	const transcript: ExtensionTranscriptEntry[] = [
+		{
+			id: "visible-readable",
+			role: "assistant",
+			textSummary: "first line second line",
+			ts: new Date(1).toISOString(),
+			content: [
+				{ type: "text", text: "first line" },
+				{ type: "thinking", thinking: "private reasoning" },
+				{ type: "text", text: "second line" },
+			],
+		},
+		...Array.from(
+			{ length: 2_000 },
+			(_, index): ExtensionTranscriptEntry => ({
+				id: `tool-tail-${index}`,
+				role: "assistant",
+				textSummary: "",
+				ts: new Date(index + 2).toISOString(),
+				body: index % 3 === 0 ? "" : index % 3 === 1 ? " \n\t " : undefined,
+				content:
+					index % 3 === 2
+						? [
+								{ type: "thinking", thinking: "not readable" },
+								{ type: "toolCall", id: `call-${index}`, name: "read", arguments: {} },
+							]
+						: undefined,
+			}),
+		),
+	];
+	const ctx = extensionContext(sessionId, "/tmp", {
+		transcript,
+		branch: [
+			{
+				type: "message",
+				message: { role: "assistant", content: [{ type: "text", text: "raw private tail" }] },
+			},
+		],
+	});
+
+	expect(await queryLastAssistant(ctx, sessionId)).toMatchObject({
+		ok: true,
+		page: { items: ["first line\nsecond line"] },
+	});
+});
+
+test("session.last_assistant returns resource_gone when the projected transcript has no readable assistant text", async () => {
+	const sessionId = "last-assistant-empty";
+	const ctx = extensionContext(sessionId, "/tmp", {
+		transcript: [
+			{
+				id: "user",
+				role: "user",
+				textSummary: "hello",
+				ts: new Date(1).toISOString(),
+				body: "hello",
+			},
+			{
+				id: "thinking-only",
+				role: "assistant",
+				textSummary: "",
+				ts: new Date(2).toISOString(),
+				content: [{ type: "thinking", thinking: "private reasoning" }],
+			},
+		],
+	});
+
+	expect(await queryLastAssistant(ctx, sessionId)).toMatchObject({ ok: false, error: { code: "resource_gone" } });
+});
+
 test("native prompt reconciliation fails closed for an explicitly empty assistant result", () => {
 	const reconciliation = createPromptReconciliation();
 	const correlation = { commandId: "native-empty-command", turnId: "native-empty-turn" };
@@ -1010,6 +1104,8 @@ describe("SessionSdkSessionRuntime", () => {
 	});
 	test("SDK-only host admits, replays, and conflicts terminal abort requests durably", async () => {
 		const cwd = await mkdtemp(path.join(os.tmpdir(), "gjc-sdk-terminal-abort-"));
+		const operatorCapability = "runtime-terminal-abort-capability";
+		setBrokerRuntimeAbortCapabilityForTest(operatorCapability);
 		const handlers = new Map<string, (event: unknown, ctx: ExtensionContext) => Promise<void> | void>();
 		const api = {
 			on(event: string, handler: (event: unknown, ctx: ExtensionContext) => Promise<void> | void) {
@@ -1045,7 +1141,13 @@ describe("SessionSdkSessionRuntime", () => {
 				},
 				abortPromptAndWaitWithTerminal: async (handle, options) => {
 					seamCalls.push({ handle, scope: options.terminal?.scope ?? "none" });
-					return { status: "settled", terminalScope: {} };
+					return {
+						status: "settled",
+						terminalScope: {
+							abortedAttemptEpoch: activeEpoch,
+							lineageIdHash: "runtime-test-lineage",
+						},
+					};
 				},
 			},
 		});
@@ -1140,7 +1242,43 @@ describe("SessionSdkSessionRuntime", () => {
 					}),
 				]),
 			);
+
+			// A separately connected, explicitly confirmed local operator may stop
+			// the active turn and its exact owned work without weakening ordinary
+			// connection ownership checks.
+			transport.feed("local-operator", {
+				type: "control_request",
+				id: "terminal-operator-abort",
+				operation: "turn.abort",
+				input: {
+					mode: "terminal",
+					scope: "owned",
+					operator: true,
+					[BROKER_RUNTIME_ABORT_CAPABILITY_FIELD]: operatorCapability,
+				},
+				confirm: true,
+				idempotencyKey: "terminal-operator-key",
+			} as SdkFrame);
+			await waitForFrame("terminal-operator-abort");
+			expect(seamCalls).toEqual([
+				{ handle: "exact-run-handle", scope: "turn" },
+				{ handle: "later-run-handle", scope: "owned" },
+			]);
+			expect(transport.sent.find(frame => frame.id === "terminal-operator-abort")).toMatchObject({
+				ok: true,
+				result: expect.objectContaining({ turn: "stopped", ownedWork: "stopped" }),
+			});
+			const operatorKeyHash = createHash("sha256").update("terminal-operator-key").digest("hex");
+			const deliveryDeadline = Date.now() + 15_000;
+			while (
+				reconciliationStore.snapshotTerminalScopes().find(record => record.idempotencyKeyHash === operatorKeyHash)
+					?.responseState !== "sent"
+			) {
+				if (Date.now() > deliveryDeadline) throw new Error("Timed out waiting for operator delivery receipt");
+				await Bun.sleep(20);
+			}
 		} finally {
+			setBrokerRuntimeAbortCapabilityForTest(undefined);
 			await handlers.get("session_shutdown")?.({}, ctx);
 			await rm(cwd, { recursive: true, force: true });
 		}
@@ -1351,7 +1489,71 @@ describe("SessionSdkSessionRuntime", () => {
 		}
 	});
 
-	test("SDK-only host re-reads the active prompt AND its owner after an owner-mismatch reservation wins the race", async () => {
+	test("SDK-only operator abort never adopts a turn that starts after idle admission", async () => {
+		const cwd = await mkdtemp(path.join(os.tmpdir(), "gjc-sdk-operator-idle-race-"));
+		const capability = "operator-idle-race-capability";
+		setBrokerRuntimeAbortCapabilityForTest(capability);
+		const handlers = new Map<string, (event: unknown, ctx: ExtensionContext) => Promise<void> | void>();
+		const api = {
+			on(event: string, handler: (event: unknown, ctx: ExtensionContext) => Promise<void> | void) {
+				handlers.set(event, handler);
+			},
+		} as unknown as ExtensionAPI;
+		const transport = memoryTransport();
+		const reconciliationStore = createReconciliationStore({
+			sessionFile: path.join(cwd, "session.json"),
+			sessionId: transport.sessionId,
+		});
+		const seamCalls: string[] = [];
+		let promptReads = 0;
+		createSdkSessionRuntimeExtension(api, {
+			agentDir: cwd,
+			createTransport: async () => transport,
+			terminalAbortSeams: {
+				getReconciliationStore: () => reconciliationStore,
+				getTerminalTurnEpoch: () => (promptReads++ === 0 ? undefined : 9),
+				getActivePromptHandle: () => (promptReads === 0 ? undefined : "successor-handle"),
+				getActivePromptOwnerConnectionId: () => "successor-owner",
+				cancelPendingPreflightForTerminalAbort: () => {},
+				abortPromptAndWaitWithTerminal: async handle => {
+					seamCalls.push(handle);
+					return { status: "settled", terminalScope: {} };
+				},
+			},
+		});
+		const ctx = extensionContext(transport.sessionId, cwd);
+		try {
+			await handlers.get("session_start")?.({}, ctx);
+			transport.feed("local-operator", {
+				type: "control_request",
+				id: "operator-idle-race",
+				operation: "turn.abort",
+				input: {
+					mode: "terminal",
+					operator: true,
+					[BROKER_RUNTIME_ABORT_CAPABILITY_FIELD]: capability,
+				},
+				confirm: true,
+				idempotencyKey: "operator-idle-race-key",
+			} as SdkFrame);
+			const deadline = Date.now() + 15_000;
+			while (!transport.sent.some(frame => frame.id === "operator-idle-race")) {
+				if (Date.now() > deadline) throw new Error("Timed out waiting for operator idle-race response");
+				await Bun.sleep(20);
+			}
+			expect(transport.sent.find(frame => frame.id === "operator-idle-race")).toMatchObject({
+				ok: true,
+				result: expect.objectContaining({ turn: "no_active_turn", terminal: "terminal_no_effect" }),
+			});
+			expect(seamCalls).toHaveLength(0);
+		} finally {
+			setBrokerRuntimeAbortCapabilityForTest(undefined);
+			await handlers.get("session_shutdown")?.({}, ctx);
+			await rm(cwd, { recursive: true, force: true });
+		}
+	});
+
+	test("SDK-only host re-reads the active prompt AND its owner after an owner-mismatch reservation race", async () => {
 		const cwd = await mkdtemp(path.join(os.tmpdir(), "gjc-sdk-terminal-owner-race-"));
 		const handlers = new Map<string, (event: unknown, ctx: ExtensionContext) => Promise<void> | void>();
 		const api = {
@@ -3172,6 +3374,7 @@ describe("SessionSdkSessionRuntime", () => {
 			},
 		} as any;
 		const sessionId = "broker-recovery";
+		const endpointUrl = "ws://127.0.0.1:1";
 		createSdkSessionRuntimeExtension(api, {
 			agentDir,
 			createTransport: async ({ stateRoot, token }) => ({
@@ -3183,8 +3386,8 @@ describe("SessionSdkSessionRuntime", () => {
 				start: async () => {
 					const endpoint = path.join(stateRoot, "sdk", `${sessionId}.json`);
 					await mkdir(path.dirname(endpoint), { recursive: true });
-					await writeFile(endpoint, JSON.stringify({ sessionId, token, pid: process.pid }));
-					return { url: "ws://127.0.0.1:1" };
+					await writeFile(endpoint, JSON.stringify({ sessionId, token, pid: process.pid, url: endpointUrl }));
+					return { url: endpointUrl };
 				},
 				stop: async () => {},
 			}),
@@ -3241,6 +3444,7 @@ describe("SessionSdkSessionRuntime", () => {
 		createSdkSessionRuntimeExtension(api, {
 			agentDir,
 			brokerRegistrationRequired: true,
+			lifecycleRequestId: "broker-required-marker",
 			createTransport: async ({ sessionId, stateRoot, token }) => ({
 				sessionId,
 				stateRoot,