@gajae-code/coding-agent 0.17.4 → 0.17.6

package/src/sdk/broker/spawn-authority.ts

@@ -170,7 +170,8 @@ export type SpawnClaimDecision =
 	| { kind: "replay"; claim: SpawnClaimV2 }
 	| { kind: "terminal"; claim: SpawnClaimV2 }
 	| { kind: "terminal_uncertain"; claim: SpawnClaimV2 }
-	| { kind: "idempotency_conflict"; claim: SpawnClaimV2 };
+	| { kind: "idempotency_conflict"; claim: SpawnClaimV2 }
+	| { kind: "managed_key_conflict" };
 
 type StoredClaim = {
 	version: 1;
@@ -179,6 +180,15 @@ type StoredClaim = {
 	integrity: string;
 };
 
+type ManagedKeyReservation = {
+	version: 1;
+	kind: "managed_key_reservation";
+	aliasIdentities: string[];
+	managedIdentity: string;
+	controlRoot: string;
+	integrity: string;
+};
+
 type SpawnAuthorityDurableWrite = {
 	claim: SpawnClaimV2;
 	authority?: SpawnAuthorityV1;
@@ -560,6 +570,8 @@ export class SpawnAuthorityStore {
 	readonly #options: SpawnAuthorityStoreOptions;
 	readonly #latest = new Map<string, SpawnClaimV2>();
 	readonly #authorities = new Map<string, SpawnAuthorityV1>();
+	readonly #managedKeyAliases = new Map<string, Map<string, string>>();
+	readonly #managedIdentityBindings = new Map<string, { aliasIdentities: string[]; controlRoot: string }>();
 	readonly #active = new Set<string>();
 	#tail: Promise<void> = Promise.resolve();
 
@@ -592,6 +604,8 @@ export class SpawnAuthorityStore {
 			await fs.mkdir(path.dirname(this.#file), { recursive: true, mode: 0o700 });
 			this.#latest.clear();
 			this.#authorities.clear();
+			this.#managedKeyAliases.clear();
+			this.#managedIdentityBindings.clear();
 			let source = "";
 			try {
 				source = await Bun.file(this.#file).text();
@@ -606,6 +620,12 @@ export class SpawnAuthorityStore {
 				} catch {
 					throw new Error("Spawn authority journal contains malformed durable evidence.");
 				}
+				if (this.#isManagedKeyReservation(row)) {
+					const reservation = row as ManagedKeyReservation;
+					if (!this.#rememberManagedKeyReservation(reservation))
+						throw new Error("Spawn authority journal managed key history is invalid.");
+					continue;
+				}
 				if (!this.#isStoredClaim(row))
 					throw new Error("Spawn authority journal contains invalid durable evidence.");
 				const stored = row as StoredClaim;
@@ -616,6 +636,52 @@ export class SpawnAuthorityStore {
 				if (stored.authority) this.#authorities.set(stored.claim.lifecycleIdentity, stored.authority);
 				else this.#authorities.delete(stored.claim.lifecycleIdentity);
 			}
+			for (const alias of this.#managedKeyAliases.keys())
+				if (this.#latest.has(alias)) throw new Error("Spawn authority journal aliases an ordinary claim.");
+		});
+	}
+
+	/**
+	 * Durably reserves an ordinary session.spawn idempotency identity for one
+	 * managed native identity. Multiple managed roots may share the alias, but an
+	 * ordinary claim and a managed reservation can never both win.
+	 */
+	async reserveManagedKeyAliases(
+		aliasIdentities: readonly string[],
+		managedIdentity: string,
+		controlRoot: string,
+	): Promise<boolean> {
+		const aliases = [...new Set(aliasIdentities)].sort();
+		if (
+			aliases.length === 0 ||
+			aliases.some(identity => !/^[0-9a-f]{64}$/i.test(identity)) ||
+			!/^[0-9a-f]{64}$/i.test(managedIdentity) ||
+			!path.isAbsolute(controlRoot) ||
+			path.normalize(controlRoot) !== controlRoot
+		)
+			throw new Error("Invalid managed spawn key reservation.");
+		return await this.#serial(async () => {
+			if (aliases.some(alias => this.#latest.has(alias))) return false;
+			const prior = this.#managedIdentityBindings.get(managedIdentity);
+			if (prior)
+				return prior.controlRoot === controlRoot && canonicalJson(prior.aliasIdentities) === canonicalJson(aliases);
+			for (const alias of aliases) {
+				const roots = this.#managedKeyAliases.get(alias);
+				const existingRoot = roots?.get(managedIdentity);
+				if (existingRoot !== undefined && existingRoot !== controlRoot) return false;
+			}
+			const reservation: ManagedKeyReservation = {
+				version: 1,
+				kind: "managed_key_reservation",
+				aliasIdentities: aliases,
+				managedIdentity,
+				controlRoot,
+				integrity: "",
+			};
+			reservation.integrity = this.#managedKeyReservationIntegrity(reservation);
+			await this.#appendRow(reservation);
+			this.#rememberManagedKeyReservation(reservation);
+			return true;
 		});
 	}
 
@@ -632,6 +698,7 @@ export class SpawnAuthorityStore {
 		)
 			throw new Error("Invalid opaque spawn claim key.");
 		return await this.#serial(async () => {
+			if (this.#managedKeyAliases.has(lifecycleIdentity)) return { kind: "managed_key_conflict" };
 			const current = this.#latest.get(lifecycleIdentity);
 			if (!current) {
 				if (bindingMac === undefined) throw new Error("A canonical spawn binding is required for a new claim.");
@@ -964,6 +1031,68 @@ export class SpawnAuthorityStore {
 			.digest("hex");
 	}
 
+	#managedKeyReservationIntegrity(reservation: ManagedKeyReservation): string {
+		const { integrity: _integrity, ...facts } = reservation;
+		return createHmac("sha256", this.#identityKey).update(canonicalJson(facts)).digest("hex");
+	}
+
+	#isManagedKeyReservation(value: unknown): value is ManagedKeyReservation {
+		if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+		const row = value as Partial<ManagedKeyReservation>;
+		return (
+			Object.keys(row).every(
+				key =>
+					key === "version" ||
+					key === "kind" ||
+					key === "aliasIdentities" ||
+					key === "managedIdentity" ||
+					key === "controlRoot" ||
+					key === "integrity",
+			) &&
+			row.version === 1 &&
+			row.kind === "managed_key_reservation" &&
+			Array.isArray(row.aliasIdentities) &&
+			row.aliasIdentities.length > 0 &&
+			row.aliasIdentities.every(identity => typeof identity === "string" && /^[0-9a-f]{64}$/i.test(identity)) &&
+			new Set(row.aliasIdentities).size === row.aliasIdentities.length &&
+			canonicalJson(row.aliasIdentities) === canonicalJson([...row.aliasIdentities].sort()) &&
+			typeof row.managedIdentity === "string" &&
+			/^[0-9a-f]{64}$/i.test(row.managedIdentity) &&
+			typeof row.controlRoot === "string" &&
+			path.isAbsolute(row.controlRoot) &&
+			path.normalize(row.controlRoot) === row.controlRoot &&
+			typeof row.integrity === "string" &&
+			/^[0-9a-f]{64}$/i.test(row.integrity) &&
+			timingSafeEqual(
+				Buffer.from(row.integrity, "hex"),
+				Buffer.from(this.#managedKeyReservationIntegrity(row as ManagedKeyReservation), "hex"),
+			)
+		);
+	}
+
+	#rememberManagedKeyReservation(reservation: ManagedKeyReservation): boolean {
+		const prior = this.#managedIdentityBindings.get(reservation.managedIdentity);
+		if (
+			prior &&
+			(prior.controlRoot !== reservation.controlRoot ||
+				canonicalJson(prior.aliasIdentities) !== canonicalJson(reservation.aliasIdentities))
+		)
+			return false;
+		if (prior) return false;
+		this.#managedIdentityBindings.set(reservation.managedIdentity, {
+			aliasIdentities: [...reservation.aliasIdentities],
+			controlRoot: reservation.controlRoot,
+		});
+		for (const alias of reservation.aliasIdentities) {
+			const roots = this.#managedKeyAliases.get(alias) ?? new Map<string, string>();
+			const existingRoot = roots.get(reservation.managedIdentity);
+			if (existingRoot !== undefined && existingRoot !== reservation.controlRoot) return false;
+			roots.set(reservation.managedIdentity, reservation.controlRoot);
+			this.#managedKeyAliases.set(alias, roots);
+		}
+		return true;
+	}
+
 	#isStoredClaim(value: unknown): value is StoredClaim {
 		if (!value || typeof value !== "object" || Array.isArray(value)) return false;
 		const row = value as Partial<StoredClaim>;
@@ -989,6 +1118,13 @@ export class SpawnAuthorityStore {
 			throw new Error("Refusing to persist invalid spawn authority evidence.");
 		const write: SpawnAuthorityDurableWrite = { claim, ...(authority === undefined ? {} : { authority }) };
 		const row: StoredClaim = { version: 1, ...write, integrity: this.#integrity(claim, authority) };
+		await this.#appendRow(row, write);
+		this.#latest.set(claim.lifecycleIdentity, claim);
+		if (authority) this.#authorities.set(claim.lifecycleIdentity, authority);
+		else this.#authorities.delete(claim.lifecycleIdentity);
+	}
+
+	async #appendRow(row: unknown, write?: SpawnAuthorityDurableWrite): Promise<void> {
 		// The row is appended before the durability barrier, so a barrier failure
 		// can leave a physically written line that in-memory state never accepted.
 		// A retry would then append a second row for the same claim and reopen
@@ -1009,13 +1145,13 @@ export class SpawnAuthorityStore {
 		try {
 			try {
 				await handle.writeFile(`${canonicalJson(row)}\n`);
-				await this.#options.beforeSyncForTest?.(write);
+				if (write) await this.#options.beforeSyncForTest?.(write);
 				await handle.sync();
 				// The parent-directory barrier belongs INSIDE the rolled-back region:
 				// a throw here would otherwise leave a durable row that in-memory
 				// state never accepted, and the retry would append a duplicate that
 				// makes the journal unreopenable.
-				await this.#options.beforeDirectorySyncForTest?.(write);
+				if (write) await this.#options.beforeDirectorySyncForTest?.(write);
 				const directory = await fs.open(path.dirname(this.#file), fsSync.constants.O_RDONLY);
 				try {
 					await directory.sync();
@@ -1039,10 +1175,7 @@ export class SpawnAuthorityStore {
 		} finally {
 			await handle.close();
 		}
-		this.#latest.set(claim.lifecycleIdentity, claim);
-		if (authority) this.#authorities.set(claim.lifecycleIdentity, authority);
-		else this.#authorities.delete(claim.lifecycleIdentity);
-		await this.#options.afterSyncForTest?.(write);
+		if (write) await this.#options.afterSyncForTest?.(write);
 	}
 
 	async #serial<T>(operation: () => Promise<T>): Promise<T> {

package/src/sdk/broker/startup-failure.ts

@@ -5,6 +5,8 @@ import { processIncarnation } from "./process-incarnation";
 export interface BrokerStartupFailureMarker {
 	version: 2;
 	reason: string;
+	/** Validated manual lock cleanup command, stored separately when it cannot fit in `reason`. */
+	cleanupCommand?: string;
 	exitCode: number | null;
 	signal: string | null;
 	writtenAt: number;
@@ -23,11 +25,82 @@ export interface BrokerStartupFailureMarker {
 
 const BROKER_STARTUP_FAILURE_FILE = "broker.startup-failure.json";
 const MAX_BROKER_STARTUP_FAILURE_REASON = 512;
+// Windows extended paths can be 32,767 UTF-16 code units and PowerShell quoting
+// can double every apostrophe; this also comfortably covers POSIX PATH_MAX paths.
+const MAX_BROKER_STARTUP_FAILURE_CLEANUP_COMMAND = 66_000;
+const FILE_LOCK_CLEANUP_GUIDANCE =
+	"; manual cleanup is appropriate only after independently verifying this exact directory still belongs to the dead owner and no successor has taken it: ";
+const FILE_LOCK_OWNER_GUIDANCE =
+	"; a live owner is never displaced — if this is an SDK broker (gjc sdk session list), it must finish or be stopped before retrying";
+const COMPACT_FILE_LOCK_CLEANUP_GUIDANCE =
+	"Manual cleanup is appropriate only after independently verifying this exact directory still belongs to the dead owner and no successor has taken it: ";
+
+function decodeFileLockCleanupCommand(command: string): string | undefined {
+	if (command.length === 0 || command.length > MAX_BROKER_STARTUP_FAILURE_CLEANUP_COMMAND) return undefined;
+	const prefix = process.platform === "win32" ? "Remove-Item -LiteralPath '" : "rm -rf -- '";
+	const suffix = process.platform === "win32" ? "' -Recurse -Force" : "'";
+	if (!command.startsWith(prefix) || !command.endsWith(suffix)) return undefined;
+
+	const encodedPath = command.slice(prefix.length, -suffix.length);
+	const quoteEscape = process.platform === "win32" ? "''" : "'\\''";
+	const decodedPath = encodedPath.replaceAll(quoteEscape, "'");
+	if (!decodedPath || decodedPath.replaceAll("'", quoteEscape) !== encodedPath) return undefined;
+	return decodedPath;
+}
+
+function validatedFileLockCleanupCommand(reason: string): string | undefined {
+	let guidanceIndex = reason.indexOf(FILE_LOCK_CLEANUP_GUIDANCE);
+	while (guidanceIndex >= 0) {
+		const command = reason.slice(guidanceIndex + FILE_LOCK_CLEANUP_GUIDANCE.length);
+		const lockPath = decodeFileLockCleanupCommand(command);
+		if (lockPath) {
+			const beforeCleanup = reason.slice(0, guidanceIndex);
+			const lockAndOwnerGuidance = ` (${lockPath})${FILE_LOCK_OWNER_GUIDANCE}`;
+			const acquisition = beforeCleanup.endsWith(lockAndOwnerGuidance)
+				? beforeCleanup.slice(0, -lockAndOwnerGuidance.length)
+				: "";
+			if (/^Failed to acquire lock for [\s\S]+ after \d+ attempts: [\s\S]+$/.test(acquisition)) {
+				return command;
+			}
+		}
+		guidanceIndex = reason.indexOf(FILE_LOCK_CLEANUP_GUIDANCE, guidanceIndex + 1);
+	}
+	return undefined;
+}
+
+function boundedFailureDetails(reason: string): { reason: string; cleanupCommand?: string } {
+	if (reason.length <= MAX_BROKER_STARTUP_FAILURE_REASON) return { reason };
+
+	const cleanupCommand = validatedFileLockCleanupCommand(reason);
+	if (cleanupCommand) {
+		const compactReason = `${COMPACT_FILE_LOCK_CLEANUP_GUIDANCE}${cleanupCommand}`;
+		if (compactReason.length <= MAX_BROKER_STARTUP_FAILURE_REASON) return { reason: compactReason };
+		return { reason: COMPACT_FILE_LOCK_CLEANUP_GUIDANCE, cleanupCommand };
+	}
+
+	return { reason: reason.slice(0, MAX_BROKER_STARTUP_FAILURE_REASON) };
+}
 
 export function brokerStartupFailurePath(agentDir: string): string {
 	return path.join(agentDir, "sdk", BROKER_STARTUP_FAILURE_FILE);
 }
 
+/** Whether validated compact cleanup guidance targets the exact lock path. */
+export function brokerStartupFailureCleanupTargetsLock(
+	marker: BrokerStartupFailureMarker | undefined,
+	lockPath: string,
+): boolean {
+	if (!marker) return false;
+	if (marker.cleanupCommand !== undefined) {
+		return (
+			marker.reason === COMPACT_FILE_LOCK_CLEANUP_GUIDANCE &&
+			decodeFileLockCleanupCommand(marker.cleanupCommand) === lockPath
+		);
+	}
+	if (!marker.reason.startsWith(COMPACT_FILE_LOCK_CLEANUP_GUIDANCE)) return false;
+	return decodeFileLockCleanupCommand(marker.reason.slice(COMPACT_FILE_LOCK_CLEANUP_GUIDANCE.length)) === lockPath;
+}
+
 function boundedMarker(
 	reason: string,
 	exitCode: number | null,
@@ -35,9 +108,10 @@ function boundedMarker(
 	pid: number,
 	incarnation: string,
 ): BrokerStartupFailureMarker {
+	const boundedFailure = boundedFailureDetails(reason);
 	return {
 		version: 2,
-		reason: reason.slice(0, MAX_BROKER_STARTUP_FAILURE_REASON),
+		...boundedFailure,
 		exitCode,
 		signal,
 		writtenAt: Date.now(),
@@ -84,6 +158,11 @@ export async function readBrokerStartupFailureMarker(
 			marker.version !== 2 ||
 			typeof marker.reason !== "string" ||
 			marker.reason.length === 0 ||
+			marker.reason.length > MAX_BROKER_STARTUP_FAILURE_REASON ||
+			(marker.cleanupCommand !== undefined &&
+				(typeof marker.cleanupCommand !== "string" ||
+					marker.reason !== COMPACT_FILE_LOCK_CLEANUP_GUIDANCE ||
+					decodeFileLockCleanupCommand(marker.cleanupCommand) === undefined)) ||
 			(marker.exitCode !== null && typeof marker.exitCode !== "number") ||
 			(marker.signal !== null && typeof marker.signal !== "string") ||
 			typeof marker.writtenAt !== "number" ||

package/src/sdk/broker/transport.ts

@@ -25,6 +25,7 @@ const BROKER_OPERATIONS = new Set([
 	"broker.lookup_lifecycle",
 	"model.resolve",
 	"session.spawn",
+	"task.dag",
 ]);
 type RequestInput = Record<string, unknown>;
 type BrokerRequest = {

package/src/sdk/bus/chat-daemon-control.ts

@@ -141,8 +141,8 @@ export type ChatDaemonAction = "stop" | "reload";
  * crashes, recovery, and attachment retirement cannot replay ambiguous work.
  */
 export const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>> = {
-	discord: 79,
-	slack: 86,
+	discord: 80,
+	slack: 87,
 };
 
 export function chatDaemonGeneration(kind: ChatDaemonKind): number {

package/src/sdk/bus/index.ts

@@ -4874,6 +4874,8 @@ export function createNotificationsExtension(
 		const gatePresentations = new PresentationArbiter(server, () => runtime?.redact ?? true);
 		gatePresentations.setPublicationSuspended(true);
 		let inboundSdkFrame: ((connectionId: string, frame: Record<string, unknown>) => void) | undefined;
+		let negotiatedCapabilitiesHandler: ((connectionId: string, capabilities: readonly string[]) => void) | undefined;
+		let connectionCloseHandler: ((connectionId: string) => void) | undefined;
 		const inFlightGateResolutions = new Set<Promise<void>>();
 		const trackGateResolution = <T>(resolution: Promise<T>): Promise<T> => {
 			const quiesced = resolution.then(
@@ -6009,6 +6011,7 @@ export function createNotificationsExtension(
 					const explicitOptIn = hasExplicitSetting === true && configured === true;
 					await runBoundedDeadlineFlush(signal =>
 						flushWorktreeOnPromptDeadline(ctx.cwd, {
+							agentDir: settings?.getAgentDir(),
 							explicitOptIn,
 							isCurrent: () =>
 								deadlineAttemptStatus(promptSubmissionKey(correlation), submission, deadlineAttempt) ===
@@ -7402,6 +7405,18 @@ export function createNotificationsExtension(
 				start: async () => await server.start(),
 				stop: async () => await server.stopAndWait(),
 				broadcastFrame: frame => broadcastEventFrame(frame),
+				onConnectionClose(handler) {
+					connectionCloseHandler = handler;
+					return () => {
+						if (connectionCloseHandler === handler) connectionCloseHandler = undefined;
+					};
+				},
+				onNegotiatedCapabilities(handler) {
+					negotiatedCapabilitiesHandler = handler;
+					return () => {
+						if (negotiatedCapabilitiesHandler === handler) negotiatedCapabilitiesHandler = undefined;
+					};
+				},
 			},
 			...(preparesExistingThread ? { readiness: "deferred" as const } : {}),
 			...(activationGate ? { activationGate } : {}),
@@ -7985,19 +8000,20 @@ export function createNotificationsExtension(
 				const tuple = Array.isArray(connectionId) ? (connectionId as unknown[]) : undefined;
 				const id = tuple?.[0] ?? connectionId;
 				const negotiated = tuple?.[1] ?? capabilities;
-				if (typeof id === "string" && Array.isArray(negotiated))
-					rememberHostCapabilities(
-						id,
-						negotiated.filter((capability): capability is string => typeof capability === "string"),
-					);
+				if (typeof id !== "string" || !Array.isArray(negotiated)) return;
+				const normalized = negotiated.filter((capability): capability is string => typeof capability === "string");
+				rememberHostCapabilities(id, normalized);
+				if (liveHostCapabilities(id) === undefined) return;
+				hostAttachedConnections.add(id);
+				negotiatedCapabilitiesHandler?.(id, normalized);
 			});
 			server.onConnectionClose((_err, connectionId) => {
 				if (!connectionId) return;
 				closeHostConnection(connectionId);
+				connectionCloseHandler?.(connectionId);
 				void controlSurface
 					.cancelPendingPreflightsForConnection(connectionId)
 					.catch(error => logger.warn(`sdk: failed to cancel disconnected preflight: ${String(error)}`));
-				host.handleDisconnect(connectionId);
 				// The socket is gone, so its fence has nothing left to refuse. Dropping the
 				// entry keeps the set bounded by live connections instead of growing forever.
 				fencedConnections.delete(connectionId);

package/src/sdk/bus/telegram-daemon-contract.ts

@@ -292,8 +292,12 @@ export const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * replaced across this upgrade.
  * Generation 190 acknowledges the protected prompt-deadline boundary change,
  * so generation-189 owners are replaced instead of retaining the old path.
+ * Generation 192 makes session-host liveness a reference-counted work lease,
+ * so generation-191 owners cannot reap hosts with queued or promoted work.
+ * Generation 193 gates streamed content on negotiated observer capabilities,
+ * so existing owners are replaced before exposing the new observer path.
  */
-export const DAEMON_GENERATION = 192;
+export const DAEMON_GENERATION = 194;
 
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7

package/src/sdk/cli/session-cli.ts

@@ -2341,6 +2341,20 @@ function rawKind(action: string, args: SdkSessionCliArgs): SdkSessionCliRawKind
 	return action === "control" || action === "query" || action === "global" ? action : undefined;
 }
 
+function warnIfRepoIgnoredForExactSession(args: SdkSessionCliArgs): void {
+	const action = args.action;
+	const exactSessionAction =
+		action === "inspect" ||
+		action === "send" ||
+		action === "status" ||
+		action === "query" ||
+		(action === "raw" && args.rawAction === "query");
+	if (args.repo !== undefined && exactSessionAction)
+		process.stderr.write(
+			"Warning: --repo is ignored for exact-session commands; the session ID selects the broker target.\n",
+		);
+}
+
 /** Runs the broker-bound `gjc sdk session` command family without exposing endpoint credentials. */
 export async function runSdkSessionCli(
 	args: SdkSessionCliArgs,
@@ -2383,10 +2397,12 @@ export async function runSdkSessionCli(
 		}
 		if (action === "inspect") {
 			writeOutput(stripSecretFields(await runInspect(agentDir, requireValue(args.sessionId, "<sessionId>"))));
+			warnIfRepoIgnoredForExactSession(args);
 			return;
 		}
 		if (action === "send") {
 			writeOutput(stripSecretFields(await runSend(agentDir, requireValue(args.sessionId, "<sessionId>"), args)));
+			warnIfRepoIgnoredForExactSession(args);
 			return;
 		}
 		if (action === "status") {
@@ -2400,6 +2416,7 @@ export async function runSdkSessionCli(
 					),
 				),
 			);
+			warnIfRepoIgnoredForExactSession(args);
 			return;
 		}
 		if (action === "tail") {
@@ -2506,6 +2523,7 @@ export async function runSdkSessionCli(
 					: await runRawQuery(agentDir, sessionId, operation, input, args),
 			),
 		);
+		warnIfRepoIgnoredForExactSession(args);
 	} catch (error) {
 		throw normalizeSessionFailure(error, args);
 	}

package/src/sdk/host/session-runtime.test.ts

@@ -1282,6 +1282,52 @@ describe("SessionSdkSessionRuntime", () => {
 		expect(transport.sent).toContainEqual({ type: "event", kind: "message_update", payload: {} });
 		await runtime.stop();
 	});
+	test("ignores late negotiated capabilities after the authoritative connection closes", async () => {
+		const transport = memoryTransport();
+		let closeConnection: ((connectionId: string) => void) | undefined;
+		let negotiateCapabilities: ((connectionId: string, capabilities: readonly string[]) => void) | undefined;
+		const hookedTransport: SessionSdkTransport = {
+			...transport,
+			onConnectionClose(handler) {
+				closeConnection = handler;
+				return () => {
+					if (closeConnection === handler) closeConnection = undefined;
+				};
+			},
+			onNegotiatedCapabilities(handler) {
+				negotiateCapabilities = handler;
+				return () => {
+					if (negotiateCapabilities === handler) negotiateCapabilities = undefined;
+				};
+			},
+		};
+		const liveCapabilities = new Map<string, ReadonlySet<string>>();
+		const providerReads: string[] = [];
+		const runtime = new SessionSdkSessionRuntime({
+			transport: hookedTransport,
+			connectionCapabilities: connectionId => {
+				providerReads.push(connectionId);
+				return liveCapabilities.get(connectionId);
+			},
+		});
+		await runtime.start();
+		try {
+			if (!closeConnection || !negotiateCapabilities) throw new Error("transport callbacks were not registered");
+			const capabilities = [TURN_STREAM_CAPABILITY, SESSION_HOST_OBSERVER_CAPABILITY];
+			liveCapabilities.set("observer", new Set(capabilities));
+			negotiateCapabilities("observer", capabilities);
+			expect(runtime.connectionIdsWithCapabilities(capabilities)).toEqual(["observer"]);
+
+			liveCapabilities.delete("observer");
+			closeConnection("observer");
+			negotiateCapabilities("observer", capabilities);
+			providerReads.length = 0;
+			expect(runtime.connectionIdsWithCapabilities(capabilities)).toEqual([]);
+			expect(providerReads).toEqual([]);
+		} finally {
+			await runtime.stop();
+		}
+	});
 	test("SDK-only host publishes one replayable bash_folded frame per fold and drops the subscription on shutdown", async () => {
 		const cwd = await mkdtemp(path.join(os.tmpdir(), "gjc-sdk-bash-folded-"));
 		const handlers = new Map<string, (event: unknown, ctx: ExtensionContext) => Promise<void> | void>();

package/src/sdk/host/session-runtime.ts

@@ -437,6 +437,7 @@ export class SessionSdkSessionRuntime {
 			this.host.handleDisconnect(connectionId);
 		});
 		this.#capabilitiesDisposer = options.transport.onNegotiatedCapabilities?.((connectionId, negotiated) => {
+			if (options.connectionCapabilities && this.#connectionCapabilitiesProvider(connectionId) === undefined) return;
 			this.#connectionIds.add(connectionId);
 			this.#connectionCapabilities.set(connectionId, new Set(negotiated));
 		});
@@ -500,7 +501,6 @@ export class SessionSdkSessionRuntime {
 				: [];
 		});
 	}
-
 	/** Deliver a non-replayable frame to connections with an explicit capability intersection. */
 	sendFrameToCapabilities(
 		required: readonly string[],
@@ -4535,10 +4535,12 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 		return task;
 	};
 	/**
-	 * Publish one content frame per owning invocation, each carrying its own
-	 * correlation, so a shared run lets every submitter attribute the content to
-	 * its own prompt. Content is best-effort and bypasses the lifecycle replay
-	 * ring; the turn producing it is authoritative.
+	 * Publish one correlated content frame per owning invocation, plus one
+	 * unpositioned copy for connections that explicitly negotiated observer
+	 * streaming. A shared run therefore lets every submitter attribute the content
+	 * to its own prompt without exposing it to ordinary attached clients.
+	 * Content is best-effort and bypasses the lifecycle replay ring; the turn
+	 * producing it is authoritative.
 	 */
 	const publishContentFrames = (
 		current: RuntimeState,
@@ -5438,7 +5440,12 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 						? options.settings.has("sdk.flushWorktreeOnDeadline" as never)
 						: configured === true;
 				const explicitOptIn = hasExplicitSetting === true && configured === true;
-				await flushWorktreeOnPromptDeadline(ctx.cwd, { explicitOptIn, isCurrent, signal });
+				await flushWorktreeOnPromptDeadline(ctx.cwd, {
+					agentDir: options.settings?.getAgentDir(),
+					explicitOptIn,
+					isCurrent,
+					signal,
+				});
 			},
 			onExpired: (correlation, deadlineOutcome) => {
 				const owner = lifecycleOwnerHolder.state;

package/src/sdk/lifecycle/service.ts

@@ -804,6 +804,7 @@ const TRANSPORT_ERROR_CODES = new Set([
 	"timeout",
 	"connection_closed",
 	"reconnect_exhausted",
+	"uncertain_after_send",
 	"unavailable",
 	"protocol_error",
 ]);
@@ -812,6 +813,7 @@ function certaintyForThrownError(error: {
 	readonly code: string;
 	readonly requestSent?: boolean;
 }): SessionLifecycleCertainty {
+	if (error.code === "uncertain_after_send") return "uncertain";
 	if (error.code === "protocol_error") return error.requestSent === false ? "retryable" : "uncertain";
 	if (!TRANSPORT_ERROR_CODES.has(error.code)) return certaintyForBrokerCode(error.code);
 	if (error.requestSent === false) return "retryable";