@intentius/chant-lexicon-fountain 0.124.31 → 0.124.32

package/README.md

@@ -2,12 +2,10 @@
 
 fountain lexicon plugin for [chant](https://github.com/intentius/chant).
 
-[fountain](https://github.com/managoat/fountain) runs coding agents in
-sandboxed VMs. This lexicon declares its workload layer as typed chant
-resources: `Environment` (sandbox baseline), `Vault` (env-var overrides),
-`Agent` (a runnable agent config), `Teammate` (an agent seated on the team,
-with a thread of its own), `Schedule` (a cron prompt into that thread), and
-`Webhook` (where the estate's events leave it). Conversations are runs, not
+[Managoat](https://github.com/managoat/managoat) (formerly fountain) runs
+coding agents in sandboxed VMs. This lexicon declares its workload layer as
+typed chant resources: `Environment` (sandbox baseline), `Vault` (env-var
+overrides) and `Agent` (a runnable agent config). Conversations are runs, not
 resources — start them with the `fountainRun` op.
 
 `chant build` serializes to fountain's own manifest YAML (`fountain apply -f`
@@ -15,7 +13,7 @@ accepts it verbatim) — the same YAML `fountainApply` sends to fountain's bulk
 `POST /api/apply` endpoint in one request.
 
 ```ts
-import { Environment, Agent, Teammate, Schedule } from "@intentius/chant-lexicon-fountain";
+import { Environment, Agent } from "@intentius/chant-lexicon-fountain";
 
 export const env = new Environment({
   name: "team-env",
@@ -28,24 +26,22 @@ export const helper = new Agent({
   name: "helper",
   model: "anthropic/claude-sonnet-4-6",
   runtime: "claude",
-  environment: env,                              // typed ref — dangling name = build error
-});
-
-export const helperSeat = new Teammate({ name: "helper", agent: helper });
-
-export const nightly = new Schedule({
-  name: "nightly-converge",
-  teammate: helperSeat,
-  cron: "0 3 * * *",                             // five fields, UTC (FTN020)
-  prompt: "chant run converge",
+  environment: env,                              // typed ref, serialized by name
 });
 ```
 
-Types are generated from fountain v0.21.0. That release describes
-`runtime: "acp"` and `runtime_command` on `Agent` itself, so an older instance
-rejects the pair at apply. `secrets` on `Environment` and `Vault` is the one
-field the lexicon adds to the request schemas, taken from fountain's manifest
-format.
+Types are generated from Managoat v0.29.0. `secrets` on `Environment` and
+`Vault` is the one field the lexicon adds to the request schemas, taken from
+fountain's manifest format.
+
+Managoat removed the team, its scheduler, webhooks and persistent sandboxes
+([managoat/managoat#2793](https://github.com/managoat/managoat/issues/2793)).
+`Teammate`, `Schedule` and `Webhook` are still exported so an older project
+builds far enough to be told what replaced them: declaring one, or an Agent
+with `sandbox_mode: "persistent"`, fails the build with FTN025. A `Steward`'s
+runs go to one conversation resumed by `channel_id`, and a cadence is a clock
+outside Managoat running `chant run <op> --on fountain`. The lexicon docs'
+overview has the full mapping.
 
 For agents handling anything sensitive, `ConciergeStack` bundles the
 locked-down defaults (deny-all egress, no vault overrides, ownership marker

package/dist/acp/command-line.js

@@ -0,0 +1,134 @@
+/**
+ * A prompt is a chant command line (#2125).
+ *
+ * That is the whole convention, and the reason a fountain thread reads as an
+ * environment's shell history: each turn is `chant run prod-apply --env prod`
+ * or `chant lifecycle diff --live`, so scrolling the thread is scrolling what
+ * was done to the environment.
+ *
+ * It is a *command line*, not a shell line. This module splits on whitespace
+ * with quote awareness and stops there: no expansion, no substitution, no
+ * pipes, no `&&`, no globbing, no `$VAR`. A prompt that does not parse to a
+ * chant verb is refused before anything runs, which is what keeps an agent
+ * that can be prompted by anyone from being an agent that can run anything.
+ * The verb list is core's own registry, so the set of things this accepts is
+ * exactly the set `chant --help` prints.
+ */
+/**
+ * Split a command line into argv the way a shell would *quote* it, and in no
+ * other way.
+ *
+ * Single and double quotes group, a backslash escapes the next character
+ * inside double quotes and outside them, and nothing else is special. An
+ * unterminated quote is an error rather than a silent join, because the
+ * silent reading changes which arguments a verb receives.
+ */
+export function tokenize(text) {
+    const tokens = [];
+    let current = "";
+    let has = false;
+    let quote;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (ch === "\\" && quote !== "'" && i + 1 < text.length) {
+            current += text[++i];
+            has = true;
+            continue;
+        }
+        if (quote) {
+            if (ch === quote)
+                quote = undefined;
+            else
+                current += ch;
+            has = true;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            has = true;
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            if (has)
+                tokens.push(current);
+            current = "";
+            has = false;
+            continue;
+        }
+        current += ch;
+        has = true;
+    }
+    if (quote)
+        throw new Error(`unterminated ${quote === '"' ? "double" : "single"} quote`);
+    if (has)
+        tokens.push(current);
+    return tokens;
+}
+/**
+ * Parse one prompt into a runnable chant command, or refuse it.
+ *
+ * Core's registry and argv parser are imported here rather than at module
+ * load: nothing about declaring the fountain lexicon should pull in every CLI
+ * handler, and only a live `chant acp` turn ever reaches this.
+ */
+export async function parseChantCommandLine(text) {
+    let tokens;
+    try {
+        tokens = tokenize(text);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            message: err instanceof Error ? err.message : String(err),
+            hint: "A prompt is a chant command line — quote arguments that contain spaces.",
+        };
+    }
+    if (tokens.length === 0) {
+        return { ok: false, message: "the prompt was empty", hint: usageHint() };
+    }
+    // `chant` may lead, and usually does — it is what a person types. Stripping
+    // it here means the same string works whether it was copied from a terminal
+    // or typed as a bare verb.
+    const argv = tokens[0] === "chant" ? tokens.slice(1) : tokens;
+    if (argv.length === 0) {
+        return { ok: false, message: "the prompt named no chant command", hint: usageHint() };
+    }
+    const { parseArgs, commandRegistry } = await import("@intentius/chant/cli/main");
+    const { resolveCommand } = await import("@intentius/chant/cli/registry");
+    let args;
+    try {
+        args = parseArgs(argv);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            message: err instanceof Error ? err.message : String(err),
+            hint: usageHint(),
+        };
+    }
+    const match = resolveCommand(args, commandRegistry);
+    if (!match) {
+        return {
+            ok: false,
+            message: `"${argv[0]}" is not a chant command`,
+            hint: usageHint(),
+        };
+    }
+    // `chant run <op>` is the one form that takes the provider path with a
+    // progress sink. Every other `run` word — `run list`, `run status <op>` —
+    // is a registered compound verb, so `resolveCommand` has already told us
+    // which this is and no second list of subcommands has to be kept in step
+    // with core's.
+    if (args.command === "run" && !match.compound && args.path && args.path !== ".") {
+        return { ok: true, command: { kind: "op-run", op: args.path, args, argv } };
+    }
+    return {
+        ok: true,
+        command: { kind: "verb", name: match.def.name, def: match.def, compound: match.compound, args, argv },
+    };
+}
+function usageHint() {
+    return ("A prompt is a chant command line, not a shell line — for example " +
+        '"chant run prod-apply --env prod" or "chant lifecycle diff --live". ' +
+        'Run "chant --help" for the verb list.');
+}

package/dist/acp/host.js

@@ -0,0 +1,78 @@
+/**
+ * What a turn needs from chant, stated once (#2125).
+ *
+ * The ACP server owns the protocol — sessions, updates, stop reasons — and
+ * nothing else. Everything it does *to a project* goes through this seam:
+ * finding an Op, starting it on a runtime provider, running any other chant
+ * verb, and recording a gate resolution. The conformance test drives the
+ * protocol through a stub host, so the tool-call ordering, the cancel path and
+ * the gated reply are tested without a checkout, a git branch or a real Op.
+ *
+ * The real implementation is `createChantHost`, and it is deliberately thin:
+ * `createLocalOpRuntime` from core is the provider (#2121), `discoverOps` is
+ * the lookup, and a verb runs through core's own registry handler rather than
+ * a reimplementation of it. Nothing here shells out — a prompt is parsed and
+ * dispatched in this process, so there is no line for a shell to interpret.
+ */
+/** How the real host identifies itself on a gate resolution it writes. */
+export const ACP_APPROVER = "chant-acp";
+/**
+ * The real host, bound to one session's working directory.
+ *
+ * Core's machinery reads the project from `process.cwd()`, so a turn changes
+ * into `cwd` for its duration (see ./turn.ts) rather than threading a path
+ * through every call — which is also why turns are serialized. Every import
+ * below is dynamic: declaring the fountain lexicon must not pull core's CLI
+ * handlers into a `chant build`.
+ */
+export function createChantHost(cwd) {
+    return {
+        cwd,
+        async findOp(name) {
+            const { discoverOps } = await import("@intentius/chant/op/discover");
+            const { ops, errors } = await discoverOps({ cwd });
+            return {
+                ...(ops.get(name) ? { config: ops.get(name)?.config } : {}),
+                names: [...ops.keys()],
+                errors,
+            };
+        },
+        async startOp(op, opts) {
+            const { createLocalOpRuntime } = await import("@intentius/chant/op/runtimes/local");
+            return createLocalOpRuntime({ projectPath: cwd }).start(op, opts);
+        },
+        async runVerb(command) {
+            const { loadPlugins, resolveProjectLexicons } = await import("@intentius/chant/cli/plugins");
+            const plugins = command.def.requiresPlugins
+                ? await loadPlugins(await resolveProjectLexicons(cwd).catch(() => [])).catch(() => [])
+                : [];
+            return command.def.handler({
+                args: command.args,
+                plugins,
+                serializers: plugins.map((p) => p.serializer),
+            });
+        },
+        async resolveGate(op, gate, resolvedBy) {
+            // chant#2400 — through `recordGateApproval`, the same function `chant
+            // approve` calls, rather than straight to `appendGateResolution`.
+            //
+            // Going direct wrote a line that looked like an approval and was missing
+            // every check one carries. It skipped #2300's plan binding, so the
+            // resolution named no plan and authorised whatever the next run produced
+            // rather than what anyone had read. It skipped the standing-pending-fact
+            // requirement, so it could answer a gate nothing had reached. And it
+            // skipped chant#2384's origin rule, which is the one that matters here:
+            // the pending fact and this resolution are both authored by the same ACP
+            // session, so the model that produced the gate was resolving it.
+            //
+            // With the rule applied, that case now refuses, which is the point. A
+            // Steward's gate reaches a person or it does not clear.
+            const { recordGateApproval } = await import("@intentius/chant/cli/handlers/operator");
+            const outcome = await recordGateApproval(op, gate, { actor: resolvedBy, origin: "acp" });
+            if (!outcome.ok) {
+                throw new Error(`the resolution for gate "${gate}" on "${op}" was refused. A gate reached over ACP cannot ` +
+                    `also be resolved over ACP — approve it with \`chant approve ${op} ${gate}\` at a shell.`);
+            }
+        },
+    };
+}

package/dist/acp/index.js

@@ -0,0 +1,58 @@
+/**
+ * `chant acp` — the CLI mount for the ACP server (#2125).
+ *
+ * A command group with a `defaultVerb`, so the bare `chant acp` an editor or a
+ * fountain Agent spawns (`runtime_command: "chant acp"`) reaches `serve`
+ * without the client having to know chant's verb grammar. `chant acp serve`
+ * is the same thing spelled out.
+ *
+ * The server itself is behind a dynamic import: mounting the group happens
+ * every time a plugin loads, and nothing about `chant build` should pay for a
+ * JSON-RPC peer it will never open.
+ */
+import { splitJoinedFlags, unknownFlagError } from "@intentius/chant/cli/command-group";
+const BOOLEAN_FLAGS = new Set(["--durable-requests"]);
+/** The verb group `chant acp` mounts. */
+export function acpCommandGroup() {
+    return {
+        name: "acp",
+        description: "Serve chant as an Agent Client Protocol agent over stdio",
+        defaultVerb: "serve",
+        commands: [
+            {
+                name: "serve",
+                description: "Speak ACP on stdin/stdout; each prompt is one chant command line",
+                handler: serveHandler,
+            },
+        ],
+    };
+}
+async function serveHandler(ctx) {
+    let durableRequests = false;
+    let steward;
+    const args = splitJoinedFlags(ctx.rawArgs, BOOLEAN_FLAGS);
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === "--durable-requests")
+            durableRequests = true;
+        else if (arg === "--steward") {
+            // The Steward composite's Agent runs `chant acp --steward <name>`
+            // (chant#2749), so every turn in this session is that steward's.
+            const name = args[++i];
+            if (!name || name.startsWith("--")) {
+                console.error(`"chant acp --steward" takes the steward's name.`);
+                return 1;
+            }
+            steward = name;
+        }
+        else {
+            // stdout carries the protocol and nothing else, so a usage error goes
+            // to stderr — the one place a spawned agent can say anything.
+            console.error(unknownFlagError(arg, `"chant acp" accepts --durable-requests and --steward <name>.`).message);
+            return 1;
+        }
+    }
+    const { serveAcpOverStdio } = await import("./serve.js");
+    await serveAcpOverStdio({ durableRequests, ...(steward ? { steward } : {}) });
+    return 0;
+}

package/dist/acp/jsonrpc.js

@@ -0,0 +1,198 @@
+/**
+ * Newline-delimited JSON-RPC 2.0, both directions (#2125).
+ *
+ * ACP frames one JSON value per line. That is the whole transport, which is
+ * why this is ~150 lines of local code instead of a dependency: an agent that
+ * speaks the protocol needs a line reader, a writer that serializes its two
+ * writers, and a table of outbound requests waiting on answers.
+ *
+ * The peer is stream-agnostic on purpose. `chant acp` hands it the process's
+ * stdin and stdout; the conformance test hands it a pair of in-memory pipes
+ * and drives the client side in the same process, so the test exercises the
+ * real framing rather than a mock of it.
+ */
+/** An error a handler wants reported with a specific JSON-RPC code. */
+export class JsonRpcError extends Error {
+    constructor(code, message, data) {
+        super(message);
+        this.code = code;
+        this.data = data;
+        this.name = "JsonRpcError";
+    }
+}
+/**
+ * A transport over a pair of Node streams — stdin and stdout, for `chant acp`.
+ *
+ * The writer is bound here, at construction, and that is load-bearing rather
+ * than tidy. A turn replaces `process.stdout.write` to stream a command's
+ * output (../acp/output.ts); if this looked the method up per call it would
+ * find the interceptor, every protocol line the turn emits would come back as
+ * another message chunk to emit, and the first notification sent inside a turn
+ * would recurse until V8 refused to grow the string. Binding once means the
+ * protocol always reaches the real stdout.
+ */
+export function streamTransport(input, output) {
+    const write = output.write.bind(output);
+    let buffer = "";
+    let lineCb;
+    let closeCb;
+    input.setEncoding("utf8");
+    input.on("data", (chunk) => {
+        buffer += chunk;
+        let nl = buffer.indexOf("\n");
+        while (nl >= 0) {
+            const line = buffer.slice(0, nl);
+            buffer = buffer.slice(nl + 1);
+            if (line.trim().length > 0)
+                lineCb?.(line);
+            nl = buffer.indexOf("\n");
+        }
+    });
+    input.on("end", () => closeCb?.());
+    input.on("close", () => closeCb?.());
+    return {
+        send(line) {
+            write(line + "\n");
+        },
+        onLine(cb) {
+            lineCb = cb;
+        },
+        onClose(cb) {
+            closeCb = cb;
+        },
+        close() {
+            input.destroy();
+        },
+    };
+}
+/** An in-memory transport pair — one end for each side of a connection. */
+export function memoryTransportPair() {
+    const cbs = [undefined, undefined];
+    const closes = [undefined, undefined];
+    let closed = false;
+    const end = (self) => ({
+        send(line) {
+            if (closed)
+                return;
+            // Deliver asynchronously so a `send` inside a handler never re-enters
+            // that handler through the peer's own dispatch — the same ordering a
+            // real pipe gives, without the pipe.
+            queueMicrotask(() => cbs[self === 0 ? 1 : 0]?.(line));
+        },
+        onLine(cb) {
+            cbs[self] = cb;
+        },
+        onClose(cb) {
+            closes[self] = cb;
+        },
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            queueMicrotask(() => {
+                closes[0]?.();
+                closes[1]?.();
+            });
+        },
+    });
+    return [end(0), end(1)];
+}
+/**
+ * One connection, serving a handler and able to originate requests of its own.
+ *
+ * The agent has two writers — request responses, and the `session/update`
+ * notifications a turn emits while a response is still pending. `send` is the
+ * single funnel for both, so two interleaved writes can never produce one
+ * unparseable line.
+ */
+export class JsonRpcPeer {
+    constructor(transport, handler) {
+        this.transport = transport;
+        this.handler = handler;
+        this.nextId = 1;
+        this.pending = new Map();
+        this.closed = false;
+        transport.onLine((line) => void this.receive(line));
+        transport.onClose(() => this.shutdown());
+    }
+    /** Send a notification. Fire and forget, by definition. */
+    notify(method, params) {
+        this.write({ jsonrpc: "2.0", method, params });
+    }
+    /** Send a request and resolve with its `result`, or reject with its `error`. */
+    request(method, params) {
+        const id = this.nextId++;
+        return new Promise((resolve, reject) => {
+            this.pending.set(id, { resolve, reject });
+            this.write({ jsonrpc: "2.0", id, method, params });
+        });
+    }
+    /** Stop serving and fail every outbound request still waiting. */
+    close() {
+        this.transport.close();
+        this.shutdown();
+    }
+    shutdown() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        for (const [, waiter] of this.pending) {
+            waiter.reject(new Error("the connection closed before the request was answered"));
+        }
+        this.pending.clear();
+    }
+    write(message) {
+        if (this.closed)
+            return;
+        this.transport.send(JSON.stringify(message));
+    }
+    async receive(line) {
+        let message;
+        try {
+            message = JSON.parse(line);
+        }
+        catch {
+            this.write({
+                jsonrpc: "2.0",
+                id: null,
+                error: { code: -32700, message: "the line was not JSON" },
+            });
+            return;
+        }
+        // A response to something we asked.
+        if (message.method === undefined && message.id !== undefined && message.id !== null) {
+            const waiter = this.pending.get(Number(message.id));
+            if (!waiter)
+                return;
+            this.pending.delete(Number(message.id));
+            if (message.error)
+                waiter.reject(new JsonRpcError(message.error.code, message.error.message));
+            else
+                waiter.resolve(message.result);
+            return;
+        }
+        if (!message.method)
+            return;
+        // A notification: no id, no reply.
+        if (message.id === undefined || message.id === null) {
+            try {
+                this.handler.notify(message.method, message.params);
+            }
+            catch {
+                // JSON-RPC has nowhere to put this, and a stdio agent's stdout is
+                // protocol only.
+            }
+            return;
+        }
+        const id = message.id;
+        try {
+            const result = await this.handler.request(message.method, message.params);
+            this.write({ jsonrpc: "2.0", id, result: result ?? null });
+        }
+        catch (err) {
+            const code = err instanceof JsonRpcError ? err.code : -32603;
+            const msg = err instanceof Error ? err.message : String(err);
+            this.write({ jsonrpc: "2.0", id, error: { code, message: msg } });
+        }
+    }
+}

package/dist/acp/output.js

@@ -0,0 +1,50 @@
+/**
+ * Capturing what a chant command prints, so a turn can stream it (#2125).
+ *
+ * chant's own handlers and its activities print through `console.log` /
+ * `console.error`, which means the process's stdout and stderr are where a
+ * step's output actually appears — there is no per-step output channel on the
+ * executor to subscribe to instead. So a turn borrows both writers for its
+ * duration and forwards every chunk as an `agent_message_chunk`.
+ *
+ * Two consequences worth stating rather than discovering:
+ *
+ * - The `chant acp` process writes the protocol on stdout, so a turn MUST
+ *   hold this capture over everything it runs. A stray `console.log` reaching
+ *   the real stdout mid-turn is an unparseable line to the client.
+ * - The capture is process-wide, so turns are serialized (see
+ *   ./server.ts). One stdio connection running one command at a time is the
+ *   honest shape anyway.
+ *
+ * Redaction is deliberately absent. A step's output is the environment's
+ * output, and fountain redacts a thread's secrets on the way in — the
+ * documented division of labour in ../skills/chant-fountain.md. This server
+ * never reads or prints the environment it inherits.
+ */
+/** Run `fn` with both process writers forwarded to `onChunk`, and restore them after. */
+export async function withCapturedOutput(onChunk, fn) {
+    const realOut = process.stdout.write.bind(process.stdout);
+    const realErr = process.stderr.write.bind(process.stderr);
+    const intercept = (stream) => (chunk, encoding, cb) => {
+        const text = typeof chunk === "string"
+            ? chunk
+            : Buffer.isBuffer(chunk)
+                ? chunk.toString("utf8")
+                : String(chunk);
+        if (text.length > 0)
+            onChunk(text, stream);
+        const done = typeof encoding === "function" ? encoding : cb;
+        if (typeof done === "function")
+            done();
+        return true;
+    };
+    process.stdout.write = intercept("stdout");
+    process.stderr.write = intercept("stderr");
+    try {
+        return await fn();
+    }
+    finally {
+        process.stdout.write = realOut;
+        process.stderr.write = realErr;
+    }
+}

package/dist/acp/protocol.js

@@ -0,0 +1,24 @@
+/**
+ * The Agent Client Protocol wire shapes `chant acp` speaks (#2125).
+ *
+ * ACP (<https://agentclientprotocol.com>) is JSON-RPC 2.0 between a *client*
+ * — an editor, or fountain — and an *agent*. chant is the agent half here: it
+ * is spawned, it answers `initialize`, it opens sessions, and every prompt it
+ * receives is one chant command line.
+ *
+ * These are hand-written rather than pulled from a package on purpose. The
+ * subset an agent has to speak is small enough to state in one file, and a
+ * dependency for it would be a dependency in every project that declares the
+ * fountain lexicon. Field names match what fountain's own ACP client sends
+ * and expects (fountain ADR 0014, `cli/internal/acp`), which is the same
+ * vocabulary the specification defines — a client of ours that is not
+ * fountain sees nothing fountain-specific.
+ */
+/** The ACP major version this agent speaks. */
+export const ACP_PROTOCOL_VERSION = 1;
+/** JSON-RPC 2.0 error codes, plus the one ACP adds. */
+export const JSONRPC_PARSE_ERROR = -32700;
+export const JSONRPC_INVALID_REQUEST = -32600;
+export const JSONRPC_METHOD_NOT_FOUND = -32601;
+export const JSONRPC_INVALID_PARAMS = -32602;
+export const JSONRPC_INTERNAL_ERROR = -32603;

package/dist/acp/serve.js

@@ -0,0 +1,61 @@
+/**
+ * `chant acp` on the process's own stdio (#2125).
+ *
+ * Split from ./index.ts so mounting the command group costs nothing: this
+ * module is imported only once a client has actually spawned the agent.
+ *
+ * stdout is the protocol. Nothing else may write to it for the life of the
+ * process — every turn holds the output capture (./output.ts) precisely so a
+ * command's `console.log` cannot land between two JSON-RPC lines.
+ */
+import { readFileSync } from "node:fs";
+import { setGateOrigin } from "@intentius/chant/lifecycle/gate-origin";
+import { setStewardTurn } from "@intentius/chant/op/steward-turn";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { AcpServer } from "./server.js";
+import { streamTransport } from "./jsonrpc.js";
+/** Serve until the client closes stdin, which is how it says the connection is over. */
+export async function serveAcpOverStdio(opts = {}) {
+    // chant#2384 — every prompt this session carries is authored by the model,
+    // and `approve` is a verb in chant's registry like any other, so nothing in
+    // the transport stops `chant run <op>` being followed by
+    // `chant approve <op> <gate>` as the next prompt. Declaring the channel is
+    // what makes the gate ledger able to tell that apart from a person at a
+    // shell; the same-origin rule then refuses it.
+    setGateOrigin("acp");
+    // chant#2749 — the session is a steward's. A decision point an Op asks during
+    // a turn names the steward, makes its model call through the steward's
+    // brokered capability, and is left open for a person; `points answer` from
+    // this session is refused, as the gate's resolution is above.
+    if (opts.steward)
+        setStewardTurn({ steward: opts.steward });
+    // chant#3539 — fountain gives the command it spawns the conversation's id
+    // in `FOUNTAIN_CONVERSATION_ID` (process env only, never on disk), and
+    // `chant run <op> --on fountain` names the run by that same id. Naming the
+    // sandbox's runs by it joins the two: the run record written here carries
+    // the id the caller's `chant run status` reports.
+    const conversationId = process.env.FOUNTAIN_CONVERSATION_ID?.trim();
+    const server = new AcpServer({
+        durableRequests: opts.durableRequests ?? false,
+        version: lexiconVersion(),
+        ...(conversationId ? { runId: conversationId } : {}),
+    });
+    const transport = streamTransport(process.stdin, process.stdout);
+    server.connect(transport);
+    await new Promise((resolve) => {
+        process.stdin.on("end", resolve);
+        process.stdin.on("close", resolve);
+    });
+}
+/** The lexicon's own version, reported as `agentInfo.version`. */
+function lexiconVersion() {
+    try {
+        const pkgPath = join(dirname(dirname(dirname(fileURLToPath(import.meta.url)))), "package.json");
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+        return pkg.version ?? "dev";
+    }
+    catch {
+        return "dev";
+    }
+}