@gajae-code/coding-agent 0.18.7 → 0.18.9

package/src/runtime-mcp/config-writer.ts

@@ -50,13 +50,17 @@ export async function writeMCPConfigFile(filePath: string, config: MCPConfigFile
 	const dir = path.dirname(filePath);
 	await fs.promises.mkdir(dir, { recursive: true, mode: 0o700 });
 
-	// Write to temp file first (atomic write)
-	const tmpPath = `${filePath}.tmp`;
+	// A predictable `${file}.tmp` can already be a symlink planted in the project.
+	// Write a unique sibling and fail closed if that path exists.
+	const tmpPath = `${filePath}.${crypto.randomUUID()}.tmp`;
 	const content = JSON.stringify(withSchema(config), null, 2);
-	await fs.promises.writeFile(tmpPath, content, { encoding: "utf-8", mode: 0o600 });
-
-	// Rename to final path (atomic on most systems)
-	await fs.promises.rename(tmpPath, filePath);
+	try {
+		await fs.promises.writeFile(tmpPath, content, { encoding: "utf-8", mode: 0o600, flag: "wx" });
+		await fs.promises.rename(tmpPath, filePath);
+	} catch (error) {
+		await fs.promises.rm(tmpPath, { force: true });
+		throw error;
+	}
 	// Invalidate the capability fs cache so subsequent reads see the new content
 	invalidateFsCache(filePath);
 }

package/src/runtime-mcp/config.ts

@@ -103,6 +103,7 @@ function convertToLegacyConfig(server: MCPServer): MCPServerConfig {
 			url: server.url ?? "",
 		};
 		if (server.headers) config.headers = server.headers;
+		if (server.publicNetwork === true) config.publicNetwork = true;
 		canonicalizeMCPEndpoint(config.url);
 		return config;
 	}

package/src/runtime-mcp/json-rpc.ts

@@ -6,6 +6,7 @@
  */
 import { logger } from "@gajae-code/utils";
 import { cancelMCPStream, MCP_HTTP_TIMEOUT_MS, MCP_MAX_CONTENT_BYTES, readMCPResponseText } from "./content-limits";
+import { fetchMcpRespectingOrigin } from "./mcp-redirect";
 import { redactMCPDiagnosticValue, redactMCPEndpoint } from "./redaction";
 
 /** Parse SSE response format (lines starting with "data: ") */
@@ -70,7 +71,7 @@ export async function callMCP<T = unknown>(
 
 	const signal = AbortSignal.timeout(MCP_HTTP_TIMEOUT_MS);
 	const response = await translateMCPTimeout(
-		fetch(url, {
+		fetchMcpRespectingOrigin(url, {
 			method: "POST",
 			headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
 			body: JSON.stringify(body),

package/src/runtime-mcp/manager.ts

@@ -34,6 +34,7 @@ import {
 	MCPPoolLeaseObsoleteError,
 	MCPPoolLeaseReleaseError,
 } from "./pool";
+import { decideUntrustedProjectConfigValue, isUntrustedProjectMcpSource } from "./project-host-values";
 import type { MCPProtocolObservation } from "./protocol";
 import { DEFAULT_MCP_STARTUP_WAIT_MS, MAX_MCP_STARTUP_WAIT_MS, MCP_STARTUP_WAIT_GRACE_MS } from "./startup-policy";
 import type { MCPToolDetails } from "./tool-bridge";
@@ -1313,8 +1314,9 @@ export class MCPManager {
 			const connectionAbort = new AbortController();
 			this.#pendingConnectionControllers.set(name, connectionAbort);
 			// Resolve auth config before connecting, but do so per-server in parallel.
+			const configSource = sources[name] ?? this.#sources.get(name);
 			const acquireInitialLease = async (): Promise<MCPPoolLease> => {
-				const resolvedConfig = await this.#resolveAuthConfig(config);
+				const resolvedConfig = await this.#resolveAuthConfig(config, false, configSource);
 				let lease: MCPPoolLease | undefined;
 				try {
 					lease = await this.#acquireLease(name, resolvedConfig, config, connectionAbort);
@@ -1371,7 +1373,7 @@ export class MCPManager {
 						// Wire auth refresh for HTTP transports, and reconnect for any transport.
 						if (connection.transport instanceof HttpTransport && config.auth?.type === "oauth") {
 							connection.transport.onAuthError = async () => {
-								const refreshed = await this.#resolveAuthConfig(config, true);
+								const refreshed = await this.#resolveAuthConfig(config, true, configSource);
 								if (refreshed.type === "http" || refreshed.type === "sse") {
 									return refreshed.headers ?? null;
 								}
@@ -2152,7 +2154,11 @@ export class MCPManager {
 		const config = this.#serverConfigs.get(name);
 		if (!config) throw new Error(`MCP server unavailable: ${name}`);
 		await this.#closePendingConnectionCleanup(name);
-		const resolved = await this.#resolveAuthConfig(config);
+		const resolved = await this.#resolveAuthConfig(
+			config,
+			false,
+			this.#sources.get(name) ?? this.#connections.get(name)?._source,
+		);
 		const abort = new AbortController();
 		this.#pendingConnectionControllers.set(name, abort);
 		let prepared:
@@ -2308,9 +2314,9 @@ export class MCPManager {
 	/**
 	 * Resolve auth and shell-command substitutions in config before connecting.
 	 */
-	async prepareConfig(config: MCPServerConfig): Promise<MCPServerConfig> {
+	async prepareConfig(config: MCPServerConfig, source?: SourceMeta): Promise<MCPServerConfig> {
 		this.#assertRawMCPAccessAllowed();
-		return this.#resolveAuthConfig(config);
+		return this.#resolveAuthConfig(config, false, source);
 	}
 
 	/** Acquire a prepared, pool-owned lease for a scoped transient operation. */
@@ -2318,7 +2324,7 @@ export class MCPManager {
 		name: string,
 		config: MCPServerConfig,
 		fn: (lease: MCPPoolLease) => Promise<T> | T,
-		options: { signal?: AbortSignal } = {},
+		options: { signal?: AbortSignal; source?: SourceMeta } = {},
 	): Promise<T> {
 		this.#assertRawMCPAccessAllowed();
 		const lifecycleEpoch = this.#assertScopedAdmission();
@@ -2347,7 +2353,7 @@ export class MCPManager {
 		operation: ScopedOperation,
 		config: MCPServerConfig,
 		fn: (lease: MCPPoolLease) => Promise<T> | T,
-		options: { signal?: AbortSignal },
+		options: { signal?: AbortSignal; source?: SourceMeta },
 	): Promise<T> {
 		const callerSignal = options.signal;
 		const onAbort = () =>
@@ -2376,7 +2382,11 @@ export class MCPManager {
 		let failed = false;
 		let primaryError: unknown;
 		try {
-			const resolvedConfigPromise = this.#resolveAuthConfig(config);
+			const resolvedConfigPromise = this.#resolveAuthConfig(
+				config,
+				false,
+				options.source ?? this.#sources.get(operation.name),
+			);
 			void resolvedConfigPromise.catch(() => {});
 			const resolvedConfig = await Promise.race([resolvedConfigPromise, abortPromise]);
 			if (operation.lifecycleEpoch !== this.#scopedLifecycleEpoch || this.#scopedLifecycle !== "open") {
@@ -2857,7 +2867,7 @@ export class MCPManager {
 			throw new MCPManagerLifecycleError(this.#scopedLifecycle === "disconnecting" ? "disconnect" : "reconnect");
 		};
 		assertLifecycle();
-		const resolvedConfig = await this.#resolveAuthConfig(config);
+		const resolvedConfig = await this.#resolveAuthConfig(config, false, source);
 		assertLifecycle();
 		const connectionAbort = new AbortController();
 		this.#pendingConnectionControllers.set(name, connectionAbort);
@@ -2909,7 +2919,7 @@ export class MCPManager {
 		// Wire auth refresh for HTTP transports, and reconnect for any transport.
 		if (connection.transport instanceof HttpTransport && config.auth?.type === "oauth") {
 			connection.transport.onAuthError = async () => {
-				const refreshed = await this.#resolveAuthConfig(config, true);
+				const refreshed = await this.#resolveAuthConfig(config, true, source);
 				if (refreshed.type === "http" || refreshed.type === "sse") {
 					return refreshed.headers ?? null;
 				}
@@ -3174,7 +3184,11 @@ export class MCPManager {
 	/**
 	 * Resolve OAuth credentials and shell commands in config.
 	 */
-	async #resolveAuthConfig(config: MCPServerConfig, forceRefresh = false): Promise<MCPServerConfig> {
+	async #resolveAuthConfig(
+		config: MCPServerConfig,
+		forceRefresh = false,
+		source?: SourceMeta,
+	): Promise<MCPServerConfig> {
 		let resolved: MCPServerConfig = { ...config };
 
 		const auth = config.auth;
@@ -3240,7 +3254,11 @@ export class MCPManager {
 			resolved = { ...resolved, noInheritEnv: true };
 		}
 
+		const untrustedProject = isUntrustedProjectMcpSource(source, this.#toolsOnly);
 		const resolveValue = async (value: string): Promise<string | undefined> => {
+			const decision = decideUntrustedProjectConfigValue(value, untrustedProject);
+			if (decision.action === "drop") return undefined;
+			if (decision.action === "literal") return decision.value;
 			try {
 				const resolvedValue = await configValue.resolveConfigValue(value);
 				if (this.#toolsOnly && !resolvedValue) throw new MCPExpectedFailure();

package/src/runtime-mcp/mcp-redirect.ts

@@ -0,0 +1,73 @@
+import { cancelMCPStream } from "./content-limits";
+
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const MAX_REDIRECTS = 20;
+const REQUEST_BODY_HEADERS = [
+	"content-encoding",
+	"content-language",
+	"content-length",
+	"content-location",
+	"content-type",
+] as const;
+
+function rewritesToGet(status: number, method: string): boolean {
+	return (
+		((status === 301 || status === 302) && method === "POST") ||
+		(status === 303 && method !== "GET" && method !== "HEAD")
+	);
+}
+
+/**
+ * Follow same-origin MCP redirects only.
+ *
+ * A cross-origin 307/308 would carry custom credential headers, `Mcp-Session-Id`,
+ * and the JSON-RPC body. The first request uses `rawUrl` unchanged so a caller
+ * that cannot be parsed (diagnostic redaction) still reaches fetch, but with
+ * `redirect: "manual"` so that hop is not followed either.
+ */
+export async function fetchMcpRespectingOrigin(rawUrl: string, init: BunFetchRequestInit): Promise<Response> {
+	let currentUrl: URL;
+	try {
+		currentUrl = new URL(rawUrl);
+	} catch {
+		return fetch(rawUrl, { ...init, redirect: "manual" });
+	}
+
+	let requestTarget = rawUrl;
+	let currentInit: BunFetchRequestInit = { ...init, redirect: "manual" };
+	for (let redirectCount = 0; ; redirectCount++) {
+		const response = await fetch(requestTarget, currentInit);
+		if (!REDIRECT_STATUSES.has(response.status)) return response;
+
+		const location = response.headers.get("location");
+		if (!location) return response;
+		if (redirectCount >= MAX_REDIRECTS) {
+			cancelMCPStream(response.body);
+			throw new Error("MCP redirect limit exceeded");
+		}
+
+		let nextUrl: URL;
+		try {
+			nextUrl = new URL(location, currentUrl);
+		} catch (error) {
+			cancelMCPStream(response.body);
+			throw error;
+		}
+		if (nextUrl.origin !== currentUrl.origin) {
+			cancelMCPStream(response.body);
+			throw new Error("cross-origin redirects are not allowed");
+		}
+
+		const headers = new Headers(currentInit.headers);
+		const method = (currentInit.method ?? "GET").toUpperCase();
+		if (rewritesToGet(response.status, method)) {
+			for (const name of REQUEST_BODY_HEADERS) headers.delete(name);
+			currentInit = { ...currentInit, method: "GET", headers, body: undefined, redirect: "manual" };
+		} else {
+			currentInit = { ...currentInit, headers, redirect: "manual" };
+		}
+		currentUrl = nextUrl;
+		requestTarget = nextUrl.toString();
+		cancelMCPStream(response.body);
+	}
+}

package/src/runtime-mcp/oauth-flow.ts

@@ -8,6 +8,8 @@
 import type { OAuthCallbackFlowOptions } from "@gajae-code/ai/utils/oauth/callback-server";
 import { OAuthCallbackFlow } from "@gajae-code/ai/utils/oauth/callback-server";
 import type { OAuthController, OAuthCredentials } from "@gajae-code/ai/utils/oauth/types";
+import { guardedPublicFetch } from "../web/insane/url-guard";
+import { assertPublicOAuthUrl } from "./oauth-public-url";
 
 const DEFAULT_PORT = 3000;
 const CALLBACK_PATH = "/callback";
@@ -261,8 +263,10 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 			params.set("client_secret", clientSecret);
 		}
 
+		await assertPublicOAuthUrl(this.config.tokenUrl, { signal: this.ctrl.signal });
 		const response = await fetch(this.config.tokenUrl, {
 			method: "POST",
+			redirect: "error",
 			headers: {
 				"Content-Type": "application/x-www-form-urlencoded",
 			},
@@ -340,8 +344,10 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 		if (!registrationEndpoint) return;
 
 		try {
+			await assertPublicOAuthUrl(registrationEndpoint, { signal });
 			const response = await fetch(registrationEndpoint, {
 				method: "POST",
+				redirect: "error",
 				headers: {
 					"Content-Type": "application/json",
 					Accept: "application/json",
@@ -380,8 +386,10 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 		try {
 			const authorizationEndpoint = new URL(this.config.authorizationUrl);
 			const metadataUrl = new URL("/.well-known/oauth-authorization-server", authorizationEndpoint.origin);
+			await assertPublicOAuthUrl(metadataUrl.toString(), { signal });
 			const response = await fetch(metadataUrl.toString(), {
 				method: "GET",
+				redirect: "error",
 				headers: { Accept: "application/json" },
 				signal,
 			});
@@ -401,12 +409,16 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 
 	async #assertClientIdNotRequired(authorizationUrl: string, signal?: AbortSignal): Promise<void> {
 		try {
-			const response = await fetch(authorizationUrl, {
+			// Pin the GET to the addresses that passed validation. A plain fetch would
+			// resolve the hostname again. Skip the probe when that route cannot be
+			// established; the flow signal cancels the DNS lookup.
+			const probed = await guardedPublicFetch(authorizationUrl, {
 				method: "GET",
-				redirect: "manual",
 				headers: { Accept: "text/plain,text/html,application/json" },
 				signal,
 			});
+			if (!probed.ok) return;
+			const response = probed.response;
 			if (response.status < 400) return;
 			const body = await response.text();
 			if (/client[_-]?id/i.test(body) && /(required|missing|invalid)/i.test(body)) {

package/src/runtime-mcp/oauth-public-url.ts

@@ -0,0 +1,14 @@
+import { validatePublicHttpUrl } from "../web/insane/url-guard";
+
+export async function assertPublicOAuthUrl(url: string, options: { signal?: AbortSignal } = {}): Promise<void> {
+	if (options.signal?.aborted) throw abortReason(options.signal);
+	const checked = await validatePublicHttpUrl(url, { signal: options.signal });
+	if (options.signal?.aborted) throw abortReason(options.signal);
+	if (!checked.ok) {
+		throw new Error(`Refusing non-public OAuth endpoint: ${checked.reason ?? url}`);
+	}
+}
+
+function abortReason(signal: AbortSignal): Error {
+	return signal.reason instanceof Error ? signal.reason : new Error("OAuth URL validation aborted");
+}

package/src/runtime-mcp/plugin-network-boundary.ts

@@ -19,6 +19,10 @@ export function bindPluginMcpToPublicNetwork<T extends MCPHttpServerConfig | MCP
 }
 
 /** The marker is an internal symbol, so persisted user MCP configs cannot opt into or forge this path. */
+export function usesPublicNetworkMcpFetch(config: MCPHttpServerConfig | MCPSseServerConfig): boolean {
+	return ("publicNetwork" in config && config.publicNetwork === true) || isPluginMcpPublicNetworkBound(config);
+}
+
 export function isPluginMcpPublicNetworkBound(config: MCPHttpServerConfig | MCPSseServerConfig): boolean {
 	return (
 		(config as MCPHttpServerConfig & { [PLUGIN_MCP_PUBLIC_NETWORK_BOUNDARY]?: boolean })[

package/src/runtime-mcp/pool.ts

@@ -307,6 +307,12 @@ class MCPPoolLeaseImpl implements MCPPoolLease {
 				notify: (method, params) => lease.notify(method, params),
 				close: () => lease.release(),
 				closeBeforeReconnect: physical.transport.closeBeforeReconnect,
+				get onRequest() {
+					return physical.transport.onRequest;
+				},
+				set onRequest(handler) {
+					physical.transport.onRequest = handler;
+				},
 			};
 			const facade = { ...physical, transport };
 			for (const property of ["tools", "resources", "resourceTemplates", "prompts"] as const) {

package/src/runtime-mcp/project-host-values.ts

@@ -0,0 +1,46 @@
+/**
+ * Host-value policy for MCP config that comes from an untrusted project file.
+ *
+ * User mcp.json and an explicit `--mcp-config` file may still substitute
+ * secret-named environment variables and run `!` shell commands. A project
+ * file (native `.gjc/mcp.json` or a repo-root `mcp.json`) uses the same
+ * sensitive-name rule as project `ssh.json`: do not copy those host values
+ * into server env or headers, and do not execute `!`.
+ */
+
+import type { SourceMeta } from "../capability/types";
+import { isSensitiveEnvName } from "../discovery/helpers";
+
+const UNTRUSTED_PROJECT_MCP_PROVIDERS = new Set(["native", "mcp-json"]);
+
+export function nativeMcpSource(level: "user" | "project", filePath: string): SourceMeta {
+	return {
+		provider: "native",
+		providerName: "GJC",
+		path: filePath,
+		level,
+	};
+}
+
+/** True when this server was loaded from untrusted project MCP config. */
+export function isUntrustedProjectMcpSource(source: SourceMeta | undefined, toolsOnly: boolean): boolean {
+	if (toolsOnly || !source || source.level !== "project") return false;
+	return UNTRUSTED_PROJECT_MCP_PROVIDERS.has(source.provider);
+}
+
+export type ProjectHostValueDecision =
+	| { action: "resolve" }
+	| { action: "drop" }
+	| { action: "literal"; value: string };
+
+/**
+ * Decide how to interpret one env or header value.
+ * `drop` means "do not run the shell, and omit the value".
+ * `literal` means "do not read process.env".
+ */
+export function decideUntrustedProjectConfigValue(value: string, untrusted: boolean): ProjectHostValueDecision {
+	if (!untrusted) return { action: "resolve" };
+	if (value.startsWith("!")) return { action: "drop" };
+	if (isSensitiveEnvName(value)) return { action: "literal", value };
+	return { action: "resolve" };
+}

package/src/runtime-mcp/smithery-registry.ts

@@ -1,4 +1,5 @@
 import { logger } from "@gajae-code/utils";
+import { type AddressResolver, validatePublicHttpUrl } from "../web/insane/url-guard";
 import type { MCPServerConfig } from "./types";
 
 const SMITHERY_REGISTRY_BASE_URL = "https://registry.smithery.ai";
@@ -289,6 +290,20 @@ function chooseConnection(
 	return null;
 }
 
+export async function resolveSmitheryServerConfig(
+	qualifiedName: string,
+	selected: { connection: SmitheryConnection; useDirectHttp: boolean },
+	options?: { resolver?: AddressResolver },
+): Promise<MCPServerConfig | null> {
+	let useDirectHttp = selected.useDirectHttp;
+	const deploymentUrl = selected.connection.deploymentUrl;
+	if (useDirectHttp && selected.connection.type === "http" && deploymentUrl) {
+		const checked = await validatePublicHttpUrl(deploymentUrl, { resolver: options?.resolver });
+		if (!checked.ok) useDirectHttp = false;
+	}
+	return createConfig(qualifiedName, { connection: selected.connection, useDirectHttp });
+}
+
 function createConfig(
 	qualifiedName: string,
 	selected: { connection: SmitheryConnection; useDirectHttp: boolean },
@@ -297,6 +312,7 @@ function createConfig(
 		return {
 			type: "http",
 			url: selected.connection.deploymentUrl,
+			publicNetwork: true,
 		};
 	}
 
@@ -335,7 +351,10 @@ async function fetchServerDetailsFromEntry(
 	return null;
 }
 
-function toSearchResult(entry: SmitherySearchEntry, details: SmitheryServerDetails): SmitherySearchResult | null {
+async function toSearchResult(
+	entry: SmitherySearchEntry,
+	details: SmitheryServerDetails,
+): Promise<SmitherySearchResult | null> {
 	if (!entry.id) return null;
 	const qualifiedName = normalizeQualifiedName(
 		details.qualifiedName ?? entry.qualifiedName ?? `${entry.namespace}/${entry.slug}`,
@@ -343,7 +362,7 @@ function toSearchResult(entry: SmitherySearchEntry, details: SmitheryServerDetai
 	const selected = chooseConnection(details);
 	if (!selected) return null;
 
-	const config = createConfig(qualifiedName, selected);
+	const config = await resolveSmitheryServerConfig(qualifiedName, selected);
 	if (!config) return null;
 
 	const requiredInputs = getSchemaInputs(selected.connection.configSchema);
@@ -450,7 +469,7 @@ export async function searchSmitheryRegistry(
 			try {
 				const details = await fetchServerDetailsFromEntry(entry, { apiKey: options?.apiKey });
 				if (!details) return null;
-				return toSearchResult(entry, details);
+				return await toSearchResult(entry, details);
 			} catch (error) {
 				detailFailures.push({
 					identity: getEntryIdentityKey(entry) ?? entry.id ?? "unknown",

package/src/runtime-mcp/transports/http.ts

@@ -28,7 +28,8 @@ import {
 	MCP_MAX_SSE_REQUEST_MESSAGES,
 	readMCPResponseText,
 } from "../content-limits";
-import { fetchPluginMcpRequest, isPluginMcpPublicNetworkBound } from "../plugin-network-boundary";
+import { fetchMcpRespectingOrigin } from "../mcp-redirect";
+import { fetchPluginMcpRequest, usesPublicNetworkMcpFetch } from "../plugin-network-boundary";
 import { buildModernMcpHeaders, type MCPModernClientContext, type MCPProtocolEra, withModernMeta } from "../protocol";
 
 /**
@@ -155,9 +156,9 @@ export class HttpTransport implements MCPTransport {
 	}
 
 	#fetch(init: BunFetchRequestInit): Promise<Response> {
-		return isPluginMcpPublicNetworkBound(this.config)
+		return usesPublicNetworkMcpFetch(this.config)
 			? fetchPluginMcpRequest(this.config.url, init)
-			: fetch(this.config.url, init);
+			: fetchMcpRespectingOrigin(this.config.url, init);
 	}
 
 	#trackReader(promise: Promise<void>, controller?: AbortController): void {

package/src/runtime-mcp/types.ts

@@ -139,6 +139,12 @@ export interface MCPHttpServerConfig extends MCPServerConfigBase {
 	type: "http";
 	url: string;
 	headers?: Record<string, string>;
+	/**
+	 * When true, every request and redirect for this URL is rechecked against
+	 * the public-network policy. Persisted so a later process cannot fall back
+	 * to an unguarded fetch. Ordinary localhost MCP servers leave this unset.
+	 */
+	publicNetwork?: boolean;
 }
 
 /** SSE server configuration (deprecated, use HTTP) */

package/src/sdk/acp/adapter.ts

@@ -1,7 +1,13 @@
 import { randomUUID } from "node:crypto";
 import { logger } from "@gajae-code/utils";
 import { lifecycleRequestTimeoutMs } from "../broker/startup-budget";
-import { type SdkClient, SdkClientError } from "../client";
+import {
+	DEFAULT_SDK_REQUEST_TIMEOUT_MS,
+	type SdkClient,
+	SdkClientError,
+	type SdkDispatchContext,
+	type SdkSentRecord,
+} from "../client";
 import type { AbortScope } from "../host/control/operations";
 import { assertReverseResponseFrame, ReverseLeaseError } from "../host/reverse-leases";
 import {
@@ -143,6 +149,9 @@ const ACP_MCP_PRESERVED_LAUNCH_CODES = new Set([
 	"readiness_timeout",
 	"spawn_failed",
 	"worktree_in_use",
+	"uncertain_after_send",
+	// Attach-only refusal: raised by ensureBroker before any lifecycle request or MCP server.
+	"broker_unavailable",
 ]);
 
 /**
@@ -531,7 +540,11 @@ export class AcpSdkAdapter {
 		return envelope?.result ?? response;
 	}
 
-	async #requestSession(frame: JsonObject, raw = false, options?: { timeoutMs: number }): Promise<unknown> {
+	async #requestSession(
+		frame: JsonObject,
+		raw = false,
+		options?: { timeoutMs: number; deadline?: number },
+	): Promise<unknown> {
 		const router = this.#router;
 		if (!router)
 			throw new AcpSdkAdapterError(
@@ -603,11 +616,68 @@ export class AcpSdkAdapter {
 		// request that named no readiness budget is queued for the default one, so it
 		// needs the same extension rather than the client's generic request deadline.
 		const timeoutMs = lifecycleRequestTimeoutMs(operation, input);
-		const response = await this.#client.global(operation, input, {
+		const budgetMs = timeoutMs ?? DEFAULT_SDK_REQUEST_TIMEOUT_MS;
+		const deadline = Date.now() + budgetMs;
+		let sent = false;
+		let sentRecord: SdkSentRecord | undefined;
+		let uncertainty: SdkClientError | undefined;
+		const deadlineFailure = () =>
+			uncertainty ??
+			(sent
+				? new SdkClientError(
+						"uncertain_after_send",
+						"ACP lifecycle deadline elapsed after dispatch.",
+						sentRecord ?? {
+							operation,
+							idempotencyKey,
+						},
+					)
+				: new SdkClientError("timeout", "ACP lifecycle deadline elapsed before dispatch.", undefined, undefined, {
+						transport: true,
+					}));
+		const options = {
 			idempotencyKey,
-			...(timeoutMs === undefined ? {} : { timeoutMs }),
-		});
-		return response;
+			deadline,
+			// SdkClient reads this after connecting, so reconnect and replay spend the same allowance.
+			get timeoutMs() {
+				return Math.max(0, deadline - Date.now());
+			},
+			beforeDispatch: () => {
+				if (Date.now() >= deadline) throw deadlineFailure();
+			},
+			onDispatch: (context: SdkDispatchContext) => {
+				sent = true;
+				if (typeof context.frame.id === "string") sentRecord = client.getSentRecord(context.frame.id);
+			},
+		};
+		const expired = Promise.withResolvers<never>();
+		const timer = setTimeout(() => expired.reject(deadlineFailure()), budgetMs);
+		const recover = async () => {
+			try {
+				const result = await client.global(operation, input, options);
+				if (Date.now() >= deadline) throw deadlineFailure();
+				return result;
+			} catch (firstError) {
+				if (!(firstError instanceof SdkClientError) || firstError.code !== "uncertain_after_send") throw firstError;
+				uncertainty = firstError;
+				// Same-key replay joins the original durable claim, within the original deadline.
+				// Failure to recover does not prove that the committed operation failed.
+				if (Date.now() >= deadline) throw firstError;
+				try {
+					const result = await client.global(operation, input, options);
+					if (Date.now() >= deadline) throw firstError;
+					return result;
+				} catch (replayError) {
+					if (replayError !== firstError) Object.assign(firstError, { recovery: replayError });
+					throw firstError;
+				}
+			}
+		};
+		try {
+			return await Promise.race([recover(), expired.promise]);
+		} finally {
+			clearTimeout(timer);
+		}
 	}
 
 	async sdkControl(params: { operation: string; input?: JsonObject }): Promise<unknown> {
@@ -646,7 +716,7 @@ export class AcpSdkAdapter {
 		throw new AcpSdkAdapterError("method_not_found", `Unsupported ACP SDK method: ${method}`);
 	}
 
-	async registerProvider(provider: AcpProviderRegistration): Promise<void> {
+	async registerProvider(provider: AcpProviderRegistration, timeoutMs?: number, deadline?: number): Promise<void> {
 		if (!this.#router)
 			throw new AcpSdkAdapterError(
 				"operation_prohibited",
@@ -665,10 +735,15 @@ export class AcpSdkAdapter {
 				...(previousLeaseId ? { expectedLeaseId: previousLeaseId } : {}),
 			},
 			true,
+			timeoutMs === undefined ? undefined : { timeoutMs, ...(deadline === undefined ? {} : { deadline }) },
 		);
 		const result = object(object(response)?.result) ?? object(response) ?? {};
 		if (typeof result.leaseId !== "string")
 			throw new AcpSdkAdapterError("invalid_reverse_frame", "Provider registration omitted leaseId.");
+		if (this.#closed)
+			throw new AcpSdkAdapterError("connection_closed", "ACP provider activation closed before acknowledgement.");
+		if (deadline !== undefined && Date.now() >= deadline)
+			throw new AcpSdkAdapterError("provider_activation_exhausted", "ACP provider activation deadline elapsed.");
 		this.#leases.set(provider.capability, result.leaseId);
 		if (previousLeaseId && previousLeaseId !== result.leaseId) this.#abortReverseForCapability(provider.capability);
 	}
@@ -694,9 +769,20 @@ export class AcpSdkAdapter {
 				const connectionId = attachment?.connectionId;
 				try {
 					for (const provider of this.#providers) {
+						const providerRemainingMs = PROVIDER_ACTIVATION_BUDGET_MS - (Date.now() - startedAt);
+						if (providerRemainingMs <= 0) throw this.#providerActivationExhausted(attempt, startedAt);
 						try {
-							await this.registerProvider(provider);
+							await this.registerProvider(
+								provider,
+								Math.max(1, providerRemainingMs),
+								startedAt + PROVIDER_ACTIVATION_BUDGET_MS,
+							);
+							if (Date.now() - startedAt >= PROVIDER_ACTIVATION_BUDGET_MS)
+								throw this.#providerActivationExhausted(attempt, startedAt);
 						} catch (error) {
+							if (providerErrorCode(error) === "uncertain_after_send") throw error;
+							if (Date.now() - startedAt >= PROVIDER_ACTIVATION_BUDGET_MS)
+								throw this.#providerActivationExhausted(attempt, startedAt);
 							if (providerErrorCode(error) === "provider_lease_conflict") {
 								this.#leases.delete(provider.capability);
 								this.#abortReverseForCapability(provider.capability);
@@ -725,6 +811,7 @@ export class AcpSdkAdapter {
 					this.#providersActivated = true;
 					return;
 				} catch (error) {
+					if (providerErrorCode(error) === "uncertain_after_send") throw error;
 					if (this.#router && attachment !== this.#attachment && !this.#closed) {
 						this.#providersActivated = false;
 						continue;