@ours.network/fleet 0.17.8 → 0.17.10

package/dist/runner.js

@@ -24,6 +24,7 @@ import { RoleTurnArbiter } from './session/arbiter.js';
 import { ScheduledLoopManager, } from './loops/manager.js';
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, inheritCallerSpawnDefaults, } from './fleet-proxy.js';
 import { effectivePermissionMode } from './permissions.js';
+import { assertModelPinReachesChild, effectiveRoleModel, repinModelEnv } from './model-env.js';
 import { archiveTempState, markTempSupervisorActive, requestedTempStopReason, } from './temp-lifecycle.js';
 const defaultDeps = () => ({
     tmux: new Tmux(),
@@ -72,6 +73,19 @@ export function managedFleetProxyEnv(role, stateDir) {
         [FLEET_PROXY_CALLER_ENV]: role.name,
     };
 }
+/**
+ * The environment a managed harness child actually receives, checked at the one
+ * point where it is composed. `role.env` deliberately wins over harness prep,
+ * which is exactly how a stale fleet-wide model pin used to outrank the model
+ * the role was spawned with — so the model pin is verified here rather than
+ * trusted, and a disagreement stops the launch instead of being reported as a
+ * success (see src/model-env.ts).
+ */
+export function harnessChildEnv(role, launchEnv, stateDir) {
+    const env = { ...(launchEnv ?? {}), ...managedFleetProxyEnv(role, stateDir) };
+    assertModelPinReachesChild(role, env);
+    return env;
+}
 /**
  * Execute a typed proxy request in the caller's supervisor. Dynamic imports
  * avoid a runner↔spawn initialization cycle (spawn imports runner constants).
@@ -109,7 +123,9 @@ async function executeManagedSpawn(caller, configPath, requested, log) {
         statePath,
         harness: preview.harness,
         session: preview.session,
-        ...(preview.model ? { model: preview.model } : {}),
+        // Read back from the resolved environment, not from the request: the banner
+        // must name the model the child will run, not the one that was asked for.
+        ...(effectiveRoleModel(preview) ? { model: effectiveRoleModel(preview) } : {}),
         monitor: { mode: preview.monitor.mode, interrupt: preview.monitor.interrupt },
         permissionMode: effectivePermissionMode(preview),
         inherited,
@@ -117,6 +133,7 @@ async function executeManagedSpawn(caller, configPath, requested, log) {
     };
     log(`[${caller.name}] managed fleet proxy spawned ${result.lifetime} role ${result.role} `
         + `harness=${result.harness} session=${result.session} `
+        + `model=${result.model ?? '(harness default)'} `
         + `permission=${result.permissionMode.fleetMode} `
         + `native=${result.permissionMode.nativeMode}`);
     return result;
@@ -230,6 +247,66 @@ const emptyLedger = () => ({
     circuit: 'closed',
     updatedAt: new Date(0).toISOString(),
 });
+/**
+ * Carried across a supervisor process's life so its successor can tell an
+ * orderly exit from a kill. Present on disk == "a supervisor believed it was
+ * running"; the next start finding one that is not its own is proof the
+ * previous process died without getting to write anything.
+ */
+export const RUN_MARKER_FILE = '.supervisor-run.json';
+function readRunMarker(dir) {
+    try {
+        const raw = JSON.parse(readFileSync(join(dir, RUN_MARKER_FILE), 'utf8'));
+        return raw.version === 1 && typeof raw.pid === 'number' && typeof raw.startedAt === 'string'
+            ? raw : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Claim this state directory for the current supervisor process and report how
+ * the previous one ended. Runs BEFORE the first attempt, which is the whole
+ * point: after an abrupt kill nothing else writes until an attempt finishes,
+ * and an attempt can take minutes.
+ */
+export function claimSupervisorRun(dir, startedAt, pid = process.pid) {
+    const previous = readRunMarker(dir);
+    const termination = previous && previous.pid !== pid
+        ? {
+            class: 'abrupt',
+            detail: `supervisor pid ${previous.pid} left an open run marker; `
+                + 'it was terminated without an orderly exit (signal, OOM-kill, or host reset)',
+            observedAt: startedAt,
+            runStartedAt: previous.startedAt,
+        }
+        : previous
+            ? { class: 'unknown', detail: 'run marker belongs to this process', observedAt: startedAt }
+            : { class: 'clean', detail: 'no previous run marker', observedAt: startedAt };
+    try {
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(join(dir, RUN_MARKER_FILE), JSON.stringify({ version: 1, pid, startedAt }, null, 2) + '\n');
+    }
+    catch { /* diagnostics must never take the role down */ }
+    return termination;
+}
+/** Orderly exit: the successor must not read this run as a kill. */
+export function releaseSupervisorRun(dir) {
+    try {
+        rmSync(join(dir, RUN_MARKER_FILE), { force: true });
+    }
+    catch { /* best effort */ }
+}
+/**
+ * Fields that describe THIS process's history rather than the current failure
+ * streak. Clearing the streak (recovery, an operator `up`, an approved model
+ * transition) must not erase the record that the role died and came back.
+ */
+const carriedForward = (previous) => ({
+    ...(previous.lastTermination ? { lastTermination: previous.lastTermination } : {}),
+    ...(previous.abruptTerminations ? { abruptTerminations: previous.abruptTerminations } : {}),
+    ...(previous.supervisorStartedAt ? { supervisorStartedAt: previous.supervisorStartedAt } : {}),
+});
 /** Bounded exponential backoff for the nth consecutive immediate failure. */
 export function backoffFor(consecutiveFailures) {
     if (consecutiveFailures <= 0)
@@ -264,7 +341,10 @@ export function writeRestartLedger(dir, ledger) {
 export function resetRestartLedger(dir) {
     if (!existsSync(dir))
         return;
-    writeRestartLedger(dir, { ...emptyLedger(), updatedAt: new Date().toISOString() });
+    const previous = readRestartLedger(dir);
+    writeRestartLedger(dir, {
+        ...emptyLedger(), ...carriedForward(previous), updatedAt: new Date().toISOString(),
+    });
 }
 /** Filename spawnTemp writes into a temp agent dir to carry the fleet start-stagger. */
 export const START_STAGGER_FILE = '.start-stagger-ms';
@@ -395,11 +475,18 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     const effectiveModel = effectiveModelForRole(dir, role);
     if (effectiveModel !== role.model) {
         deps.log(`[${name}] model recovery drift: declared=${role.model ?? '(none)'} effective=${effectiveModel}`);
-        role = { ...role, model: effectiveModel };
+        // The env pin has to move with it. A down-shift that changed only
+        // `role.model` was reported as a model change while the child kept running
+        // the model that had just failed, because the pin is what the harness reads.
+        role = { ...role, model: effectiveModel, env: repinModelEnv(role, effectiveModel) };
     }
     if (modelRecoveryHeld(dir))
         throw new Error(`[${name}] model chain exhausted — held down until config changes or recovery reset`);
     const adapter = getAdapter(role.harness);
+    // Say the running model out loud, once, from the resolved environment. The
+    // spawn banner is a claim made before the process exists; this is the log line
+    // that can be checked against the session afterwards.
+    deps.log(`[${name}] model: ${effectiveRoleModel(role) ?? '(harness default)'}`);
     mkdirSync(dir, { recursive: true });
     const rotation = rotateWorklog(join(dir, 'WORKLOG.md'), role.worklog);
     if (rotation.deferred)
@@ -414,8 +501,12 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     const exitFile = join(dir, '.exit-status');
     const booted = existsSync(bootedFile);
     const mode = booted && adapter.supportsResume ? 'resume' : 'fresh';
-    if (mode === 'fresh')
-        writeFileSync(bootedFile, '');
+    // Stamp EVERY attempt, not just the first. `.booted` used to be written only
+    // on the fresh path, so after a restart — including one the supervisor never
+    // saw, like an OOM-kill — its mtime still read the original boot and any
+    // health check reading it reported "no restarts". The existence test above
+    // already ran, so rewriting cannot change the fresh/resume decision.
+    writeFileSync(bootedFile, `${new Date(deps.now()).toISOString()} ${mode}\n`);
     const runCwd = role.cwd && existsSync(role.cwd) ? role.cwd : dir;
     const prep = await adapter.prepareSession(role, { stateDir: dir, runCwd });
     const sessionBackend = role.session ?? 'tmux';
@@ -536,11 +627,18 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             name,
             argv: wrappedArgv,
             cwd: runCwd,
-            env: { ...launch.env, ...managedFleetProxyEnv(role, dir) },
+            env: harnessChildEnv(role, launch.env, dir),
             stateDir: dir,
             mode,
             permissions: perms,
             modeId: adapter.acpPermissionModeId?.(role),
+            // The role's declared MCP servers, and the bundled agent's `_meta`
+            // vocabulary for the options it takes no flag for. Both come from the
+            // ADAPTER and from `prep`: the ACP launch cannot carry `prep.argv`, so this
+            // is the route by which harness_options that used to be silently dropped
+            // for an ACP role actually reach the session.
+            mcpServers: adapter.acpMcpServers?.(role),
+            sessionMeta: adapter.acpSessionMeta?.(role, prep),
             permissionMode: effectivePermissionMode(role),
             // Provenance travels with the exact ACP launch. Keeping it out of a
             // role-only adapter hook prevents a PATH fallback or resolver skew from
@@ -943,99 +1041,129 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
     mkdirSync(dir, { recursive: true });
     const shouldStop = deps.shouldStop ?? (() => false);
     const stamp = () => new Date(deps.now()).toISOString();
-    while (!shouldStop()) {
-        let ledger = readRestartLedger(dir);
-        try {
-            const configPath = resolveConfigPath(dir, opts.configPath);
-            const role = findRole(loadConfig(configPath), name);
-            reconcileModelRecovery(dir, role, stamp());
-            if (modelRecoveryHeld(dir)) {
+    // Record how the PREVIOUS supervisor process ended before doing anything
+    // else. An external kill writes nothing itself, and the next ledger write is
+    // an attempt away — which is why an OOM-kill used to leave every durable
+    // indicator describing the run that died.
+    const startedAt = stamp();
+    const termination = claimSupervisorRun(dir, startedAt);
+    {
+        const previous = readRestartLedger(dir);
+        const abrupt = (previous.abruptTerminations ?? 0) + (termination.class === 'abrupt' ? 1 : 0);
+        writeRestartLedger(dir, {
+            ...previous,
+            lastTermination: termination,
+            abruptTerminations: abrupt,
+            supervisorStartedAt: startedAt,
+            updatedAt: startedAt,
+        });
+        if (termination.class === 'abrupt')
+            deps.log(`[${name}] previous supervisor run (started ${termination.runStartedAt}) `
+                + `ended abruptly: ${termination.detail}; abrupt terminations recorded: ${abrupt}`);
+    }
+    try {
+        while (!shouldStop()) {
+            let ledger = readRestartLedger(dir);
+            try {
+                const configPath = resolveConfigPath(dir, opts.configPath);
+                const role = findRole(loadConfig(configPath), name);
+                reconcileModelRecovery(dir, role, stamp());
+                if (modelRecoveryHeld(dir)) {
+                    await deps.sleep(HELD_DOWN_POLL_MS);
+                    continue;
+                }
+            }
+            catch {
+                // Normal attempt path reports config errors through the restart circuit.
+            }
+            if (ledger.circuit === 'open') {
+                // Held down. Stay alive — exiting would hand the role straight back to
+                // the service manager — and watch for an operator reset.
                 await deps.sleep(HELD_DOWN_POLL_MS);
                 continue;
             }
-        }
-        catch {
-            // Normal attempt path reports config errors through the restart circuit.
-        }
-        if (ledger.circuit === 'open') {
-            // Held down. Stay alive — exiting would hand the role straight back to
-            // the service manager — and watch for an operator reset.
-            await deps.sleep(HELD_DOWN_POLL_MS);
-            continue;
-        }
-        let result;
-        try {
-            result = await attempt(name, { configPath: opts.configPath, allowResumeRotation: !ledger.resumeDiscarded }, deps);
-        }
-        catch (e) {
-            // A session that could not even start is an immediate failure like any
-            // other; it must count, or an unstartable role loops forever.
-            result = {
-                elapsedSecs: 0,
-                exit: { version: 1, class: 'unknown', detail: e instanceof Error ? e.message : String(e) },
-                rotated: false,
-                mode: 'fresh',
-            };
-        }
-        // Re-read: the attempt itself may have taken minutes, and an operator may
-        // have reset the ledger meanwhile.
-        ledger = readRestartLedger(dir);
-        if (result.modelRecovery === 'advance') {
-            writeRestartLedger(dir, {
-                ...emptyLedger(),
-                lastReason: 'approved model-chain transition',
-                updatedAt: stamp(),
-            });
-            continue;
-        }
-        if (result.modelRecovery === 'hold') {
-            await deps.sleep(HELD_DOWN_POLL_MS);
-            continue;
-        }
-        const fastFailSecs = fastFailSecsFor(name, opts.configPath);
-        // The fast-fail boundary starts a recovery episode; it must not also be
-        // the boundary that declares recovery successful. Otherwise alternating
-        // 19s and 20s deaths erase one another forever. Require the configured
-        // number of fast-fail windows to survive before closing an active streak.
-        // This hysteresis stays adapter-relative (100s for the current 20s/5-attempt
-        // policy) and still lets a genuinely sustained session reset the breaker.
-        const stableRecoverySecs = fastFailSecs * RESTART_FAIL_THRESHOLD;
-        const recoveryFailed = result.elapsedSecs < fastFailSecs
-            || (ledger.consecutiveImmediateFailures > 0 && result.elapsedSecs < stableRecoverySecs);
-        if (!recoveryFailed) {
-            // A session that ran for a while is not a restart loop, whatever ended it.
-            writeRestartLedger(dir, {
-                ...emptyLedger(),
-                lastReason: result.exit.detail,
+            let result;
+            try {
+                result = await attempt(name, { configPath: opts.configPath, allowResumeRotation: !ledger.resumeDiscarded }, deps);
+            }
+            catch (e) {
+                // A session that could not even start is an immediate failure like any
+                // other; it must count, or an unstartable role loops forever.
+                result = {
+                    elapsedSecs: 0,
+                    exit: { version: 1, class: 'unknown', detail: e instanceof Error ? e.message : String(e) },
+                    rotated: false,
+                    mode: 'fresh',
+                };
+            }
+            // Re-read: the attempt itself may have taken minutes, and an operator may
+            // have reset the ledger meanwhile.
+            ledger = readRestartLedger(dir);
+            if (result.modelRecovery === 'advance') {
+                writeRestartLedger(dir, {
+                    ...emptyLedger(),
+                    ...carriedForward(ledger),
+                    lastReason: 'approved model-chain transition',
+                    updatedAt: stamp(),
+                });
+                continue;
+            }
+            if (result.modelRecovery === 'hold') {
+                await deps.sleep(HELD_DOWN_POLL_MS);
+                continue;
+            }
+            const fastFailSecs = fastFailSecsFor(name, opts.configPath);
+            // The fast-fail boundary starts a recovery episode; it must not also be
+            // the boundary that declares recovery successful. Otherwise alternating
+            // 19s and 20s deaths erase one another forever. Require the configured
+            // number of fast-fail windows to survive before closing an active streak.
+            // This hysteresis stays adapter-relative (100s for the current 20s/5-attempt
+            // policy) and still lets a genuinely sustained session reset the breaker.
+            const stableRecoverySecs = fastFailSecs * RESTART_FAIL_THRESHOLD;
+            const recoveryFailed = result.elapsedSecs < fastFailSecs
+                || (ledger.consecutiveImmediateFailures > 0 && result.elapsedSecs < stableRecoverySecs);
+            if (!recoveryFailed) {
+                // A session that ran for a while is not a restart loop, whatever ended it.
+                writeRestartLedger(dir, {
+                    ...emptyLedger(),
+                    ...carriedForward(ledger),
+                    lastReason: result.exit.detail,
+                    updatedAt: stamp(),
+                });
+                continue;
+            }
+            const failures = ledger.consecutiveImmediateFailures + 1;
+            const reason = `${result.exit.detail} after ${result.elapsedSecs.toFixed(1)}s`;
+            const next = {
+                version: 1,
+                ...carriedForward(ledger),
+                consecutiveImmediateFailures: failures,
+                lastReason: reason,
+                nextDelayMs: backoffFor(failures),
+                resumeDiscarded: ledger.resumeDiscarded || result.rotated,
+                circuit: failures >= RESTART_FAIL_THRESHOLD ? 'open' : 'closed',
                 updatedAt: stamp(),
-            });
-            continue;
-        }
-        const failures = ledger.consecutiveImmediateFailures + 1;
-        const reason = `${result.exit.detail} after ${result.elapsedSecs.toFixed(1)}s`;
-        const next = {
-            version: 1,
-            consecutiveImmediateFailures: failures,
-            lastReason: reason,
-            nextDelayMs: backoffFor(failures),
-            resumeDiscarded: ledger.resumeDiscarded || result.rotated,
-            circuit: failures >= RESTART_FAIL_THRESHOLD ? 'open' : 'closed',
-            updatedAt: stamp(),
-        };
-        if (next.circuit === 'open') {
-            next.openedAt = stamp();
-            next.nextDelayMs = 0;
+            };
+            if (next.circuit === 'open') {
+                next.openedAt = stamp();
+                next.nextDelayMs = 0;
+                writeRestartLedger(dir, next);
+                deps.log(`[${name}] HELD DOWN after ${failures} immediate failures at ${next.openedAt} — ` +
+                    `${reason}; the agent will not be restarted until: ours-fleet restart ${name}`);
+                continue;
+            }
             writeRestartLedger(dir, next);
-            deps.log(`[${name}] HELD DOWN after ${failures} immediate failures at ${next.openedAt} — ` +
-                `${reason}; the agent will not be restarted until: ours-fleet restart ${name}`);
-            continue;
+            deps.log(`[${name}] immediate failure ${failures}/${RESTART_FAIL_THRESHOLD} (${reason}) ` +
+                `-> backing off ${next.nextDelayMs}ms`);
+            await deps.sleep(next.nextDelayMs);
         }
-        writeRestartLedger(dir, next);
-        deps.log(`[${name}] immediate failure ${failures}/${RESTART_FAIL_THRESHOLD} (${reason}) ` +
-            `-> backing off ${next.nextDelayMs}ms`);
-        await deps.sleep(next.nextDelayMs);
+        return readRestartLedger(dir);
+    }
+    finally {
+        // Only an orderly return through this loop clears the marker; a signal or
+        // an OOM-kill leaves it, which is exactly how the successor detects them.
+        releaseSupervisorRun(dir);
     }
-    return readRestartLedger(dir);
 }
 /**
  * How short an attempt has to be to count as immediate. The role's harness

package/dist/session/acp.d.ts

@@ -1,5 +1,6 @@
 import * as acp from '@agentclientprotocol/sdk';
 import type { CommonPermissions } from '../config.js';
+import type { AcpMcpServer } from '../harness/types.js';
 import { ConversationEventStore } from './conversation-store.js';
 import type { ConversationSnapshot, PromptOrigin, PromptReceipt, SubmitPromptCommand } from './conversation-types.js';
 import type { ConversationHandlePage, ExitRecord, InterruptOutcome, QueuedPrompt, SessionEvent, RuntimeSelectorMetadata, SessionHandle, SessionSnapshot, SubmitPromptOptions, TurnCancellationSource, TurnOutcome, TurnResult } from './types.js';
@@ -37,6 +38,20 @@ export interface AcpSessionOptions {
     permissionMode?: NonNullable<SessionSnapshot['permissionMode']>;
     /** Adapter-authenticated request-metadata vocabulary; never inferred from ACP `_meta`. */
     permissionMetadataSource?: 'codex-acp';
+    /**
+     * MCP servers the ROLE declares, for every session/new, resume and load. Empty
+     * or omitted sends `[]`, which is what fleet has always sent and leaves the
+     * agent's own configuration untouched.
+     */
+    mcpServers?: AcpMcpServer[];
+    /**
+     * Adapter-supplied `_meta` for session/new — the only route by which a
+     * capability the CLI takes as a flag reaches an agent that accepts none.
+     * Per-agent vocabulary, so the ADAPTER decides whether there is anything to
+     * send; this layer only forwards it. Never sent on resume or load: it carries
+     * session-creation options the agent has already applied.
+     */
+    sessionMeta?: Record<string, unknown>;
     log(line: string): void;
     /** Test seam for the cancel-escalation grace period; production uses the default. */
     cancelGraceMs?: number;
@@ -172,6 +187,28 @@ export declare class AcpSession implements SessionHandle {
      * for it is what turned a busy agent into a timeout and then into "dead".
      */
     queuePrompt(text: string, options?: SubmitPromptOptions): Promise<QueuedPrompt>;
+    /**
+     * Prepare the session for a prompt that asked to pre-empt current work.
+     *
+     * The old behaviour was one unconditional `session/cancel` notification
+     * followed immediately by `session/prompt`. That is what produced the owner's
+     * "request failed before completion":
+     *
+     *  - `cancelActive` only awaits settlement when `this.activeTurn` is set, and
+     *    a turn the ADAPTER started (steering's `startedNewTurn`) is never tracked
+     *    here. So the cancel raced the adapter's own transcript repair and the new
+     *    prompt landed while the last assistant message still held an unresolved
+     *    `tool_use` — rejected with `stop_reason=tool_use`.
+     *  - With nothing running at all, it still sent the cancel, and the prompt
+     *    landed on a bare interrupted user message — rejected with
+     *    `stop_reason=null`.
+     *
+     * So: never cancel across a tool boundary, and never cancel something whose
+     * settlement cannot be awaited. Everything else is queued, which the ACP queue
+     * already does correctly. The returned state is what the caller may claim to a
+     * human — `interrupted` only when a turn really was cancelled.
+     */
+    private prepareInterruptingDelivery;
     /**
      * Durably record a prompt admission BEFORE acceptance is returned. Browser
      * admissions are transactional — a prompt the ledger cannot hold is refused,
@@ -219,6 +256,15 @@ export declare class AcpSession implements SessionHandle {
     private settlePendingAutomatically;
     exitResult(): ExitRecord | null;
     close(): Promise<void>;
+    /**
+     * The role's declared MCP servers, or `[]`.
+     *
+     * Sent on resume and load as well as on new: the agent builds its server set
+     * once per session, so a resumed session that omitted them would come back
+     * without the tools the role's config declares — which is exactly the shape of
+     * silent drop this plumbing exists to end.
+     */
+    private declaredMcpServers;
     private initialize;
     private captureRuntimeMetadata;
     private runPrompt;

package/dist/session/acp.js

@@ -598,15 +598,19 @@ export class AcpSession {
             throw new SessionControlError('control-unavailable', 'ACP adapter restart is in progress after the cancellation deadline', ACP_CANCEL_DEADLINE_EXCEEDED);
         if (this.closing || !this.sessionId || !this.isAlive())
             throw new SessionControlError('offline', this.lastError ?? 'ACP session is offline');
-        if (options.interrupt)
-            await this.cancelActive(options.interruptSource ?? 'local-console');
+        const delivery = options.interrupt
+            ? await this.prepareInterruptingDelivery(options.interruptSource ?? 'local-console')
+            : undefined;
         // Interrupting delivery must still use steering when supported. With no
         // live turn, the extension starts one and acknowledges `startedNewTurn`
         // immediately; a normal session/prompt would keep the monitor blocked until
         // the entire wake-triggered turn terminated.
         if (options.steer && this.steeringSupported) {
             const promptId = randomUUID();
-            return { promptId, queuedBehind: 0, completion: this.steerPrompt(text), origin: options.origin };
+            return {
+                promptId, queuedBehind: 0, completion: this.steerPrompt(text), origin: options.origin,
+                ...(delivery ? { delivery } : {}),
+            };
         }
         const promptId = randomUUID();
         const queuedBehind = this.queueDepth;
@@ -618,7 +622,46 @@ export class AcpSession {
             this.queueDepth = Math.max(0, this.queueDepth - 1);
             return turnResult(false, 'failed', error?.message ?? String(error));
         });
-        return { promptId, queuedBehind, completion, origin: options.origin };
+        return {
+            promptId, queuedBehind, completion, origin: options.origin,
+            delivery: delivery ?? (queuedBehind > 0 ? 'queued' : 'started'),
+        };
+    }
+    /**
+     * Prepare the session for a prompt that asked to pre-empt current work.
+     *
+     * The old behaviour was one unconditional `session/cancel` notification
+     * followed immediately by `session/prompt`. That is what produced the owner's
+     * "request failed before completion":
+     *
+     *  - `cancelActive` only awaits settlement when `this.activeTurn` is set, and
+     *    a turn the ADAPTER started (steering's `startedNewTurn`) is never tracked
+     *    here. So the cancel raced the adapter's own transcript repair and the new
+     *    prompt landed while the last assistant message still held an unresolved
+     *    `tool_use` — rejected with `stop_reason=tool_use`.
+     *  - With nothing running at all, it still sent the cancel, and the prompt
+     *    landed on a bare interrupted user message — rejected with
+     *    `stop_reason=null`.
+     *
+     * So: never cancel across a tool boundary, and never cancel something whose
+     * settlement cannot be awaited. Everything else is queued, which the ACP queue
+     * already does correctly. The returned state is what the caller may claim to a
+     * human — `interrupted` only when a turn really was cancelled.
+     */
+    async prepareInterruptingDelivery(source) {
+        if (!this.sessionId)
+            return 'started';
+        // No fleet-tracked turn to await. Either the session is idle — cancelling it
+        // corrupts the transcript for no gain — or the adapter is running a turn
+        // fleet never started, whose settlement nothing here can wait for. Queue in
+        // both cases: the ACP queue already orders this correctly.
+        if (!this.activeTurn)
+            return this.activeToolCalls.size > 0 ? 'deferred' : 'started';
+        // A tracked turn IS safe to cancel: cancelActive settles pending permissions
+        // and awaits the turn's own settlement before this returns, so the prompt
+        // below cannot race the adapter's transcript repair.
+        await this.cancelActive(source);
+        return 'interrupted';
     }
     /**
      * Durably record a prompt admission BEFORE acceptance is returned. Browser
@@ -945,6 +988,17 @@ export class AcpSession {
         });
         this.conversation.close();
     }
+    /**
+     * The role's declared MCP servers, or `[]`.
+     *
+     * Sent on resume and load as well as on new: the agent builds its server set
+     * once per session, so a resumed session that omitted them would come back
+     * without the tools the role's config declares — which is exactly the shape of
+     * silent drop this plumbing exists to end.
+     */
+    declaredMcpServers() {
+        return this.options.mcpServers ?? [];
+    }
     async initialize() {
         const initialized = await this.connection.agent.request(acp.methods.agent.initialize, {
             protocolVersion: acp.PROTOCOL_VERSION,
@@ -964,7 +1018,7 @@ export class AcpSession {
             const resumed = await this.connection.agent.request(acp.methods.agent.session.resume, {
                 sessionId: persisted,
                 cwd: this.options.cwd,
-                mcpServers: [],
+                mcpServers: this.declaredMcpServers(),
             });
             this.captureRuntimeMetadata(resumed.configOptions);
             this.sessionId = persisted;
@@ -977,7 +1031,7 @@ export class AcpSession {
                 const loaded = await this.connection.agent.request(acp.methods.agent.session.load, {
                     sessionId: persisted,
                     cwd: this.options.cwd,
-                    mcpServers: [],
+                    mcpServers: this.declaredMcpServers(),
                 });
                 this.captureRuntimeMetadata(loaded.configOptions);
             }
@@ -989,7 +1043,8 @@ export class AcpSession {
         else {
             const created = await this.connection.agent.request(acp.methods.agent.session.new, {
                 cwd: this.options.cwd,
-                mcpServers: [],
+                mcpServers: this.declaredMcpServers(),
+                ...(this.options.sessionMeta ? { _meta: this.options.sessionMeta } : {}),
             });
             this.sessionId = created.sessionId;
             this.captureRuntimeMetadata(created.configOptions);

package/dist/session/types.d.ts

@@ -110,6 +110,15 @@ export declare function interruptOutcome(result: InterruptResult): InterruptOutc
  * stop here: the session has the prompt, and waiting for the turn to finish is
  * a different question with a different, much longer, timescale.
  */
+/**
+ * What actually happened to an admitted prompt, so a caller reporting to a
+ * human can be accurate instead of repeating what it asked for.
+ *
+ * `interrupted` is only ever returned when a turn was really cancelled for this
+ * prompt. `deferred` says the session is busy with work this prompt could not
+ * safely pre-empt — the prompt is admitted and will run, just not yet.
+ */
+export type PromptDelivery = 'started' | 'queued' | 'interrupted' | 'deferred';
 export interface QueuedPrompt {
     promptId: string;
     /** Turns already queued ahead of this one. 0 means it starts immediately. */
@@ -117,6 +126,8 @@ export interface QueuedPrompt {
     origin?: PromptOrigin;
     /** The turn's terminal result. Never rejects. */
     completion: Promise<TurnResult>;
+    /** Observed admission outcome. Absent on backends that do not report it. */
+    delivery?: PromptDelivery;
 }
 /**
  * How a session's process ended.