@ours.network/fleet 0.18.0-nightly.6 → 0.18.1

package/dist/session/acp.js

@@ -16,6 +16,21 @@ const PERMISSION_TIMEOUT_MS = 10 * 60_000;
 const CONTROLLER_GRACE_MS = 12_000;
 /** Bound safe-boundary waiting without turning a hung tool into cancellation. */
 export const AFTER_TOOL_BOUNDARY_TIMEOUT_MS = 120_000;
+/**
+ * How long a steering-started turn is presumed to still own the adapter after
+ * its last update. Such a turn has no prompt id, so it never reports a
+ * stopReason and there is no exact end to observe — silence is the only signal
+ * available, and this is the bound that turns it into a decision.
+ *
+ * Sized from the fleet's own scheduled-run history: across 1513 completed
+ * scheduled runs the longest silence WITHIN a working turn was 120.2 s (p99
+ * 41.0 s; 5 runs above 60 s). A shorter grace would release the lease while the
+ * adapter is still working and re-admit a prompt into a busy turn, which is the
+ * FLEET-003 failure itself. The costs are deliberately asymmetric: holding too
+ * long skips one best-effort maintenance tick, releasing too early SIGTERMs a
+ * live role.
+ */
+export const STEERING_OCCUPANCY_IDLE_MS = 150_000;
 const TERMINAL_TOOL_STATUSES = new Set(['completed', 'failed']);
 const SCHEDULED_LOOP_REDACTION = '[scheduled-loop content redacted]';
 const OWNER_COMMENTARY_REDACTION = '[assistant commentary redacted]';
@@ -193,6 +208,8 @@ export class AcpSession {
     child;
     events;
     conversation;
+    /** Cursor before this runner generation began; older durable events stay off the live console. */
+    conversationStartCursor;
     /** New on every runner start; permission/turn IDs from prior generations are stale. */
     sessionGeneration = randomUUID();
     /** True while `session/load` replays history as ordinary updates. */
@@ -202,6 +219,12 @@ export class AcpSession {
     connection;
     sessionId;
     readiness = 'starting';
+    /**
+     * Last non-replayed session update from the agent. `readiness` cannot answer
+     * "is this agent working" for a steered turn (FLEET-002), and this is the
+     * evidence that can.
+     */
+    lastUpdateAt;
     lastError;
     promptTail = Promise.resolve();
     queueDepth = 0;
@@ -217,6 +240,13 @@ export class AcpSession {
     cancelEscalation;
     cancelForceKill;
     cancelRecoveryReason;
+    /**
+     * Held while a steering-started turn is believed to own the adapter. It is a
+     * lease, not a latch: `steeringRelease` always fires, so the role can never be
+     * stranded busy by a wake whose turn ended without telling anyone.
+     */
+    steeringOccupied = false;
+    steeringRelease;
     /**
      * Rejects the moment the adapter process is gone. Every in-flight ACP request
      * races it, so a dead adapter can never leave a turn — and therefore a
@@ -237,6 +267,7 @@ export class AcpSession {
         this.conversation = new ConversationEventStore(join(options.stateDir, '.conversation'), {
             roleId: options.name, log: line => options.log(`[${options.name}] ${line}`),
         });
+        this.conversationStartCursor = this.conversation.lastCursor();
         this.sessionFile = join(options.stateDir, '.acp-session-id');
         this.terminated = new Promise((_resolve, reject) => { this.terminate = reject; });
         // Nothing awaits this promise until a request races it; an unobserved
@@ -247,6 +278,7 @@ export class AcpSession {
             if (this.cancelForceKill)
                 clearTimeout(this.cancelForceKill);
             this.cancelForceKill = undefined;
+            this.releaseSteeringOccupancy('adapter exited');
             // Record the child's real exit code/signal. The tmux path can only see a
             // shell's `$?`; here the truth is available, so keep it.
             const classified = classifyChildExit(code, signal);
@@ -347,17 +379,60 @@ export class AcpSession {
         // terminal fact (signal exits deliberately leave exitCode null).
         return this.child.exitCode === null && (this.child.signalCode ?? null) === null;
     }
+    /**
+     * Take the occupancy lease for a turn the adapter started on its own behalf.
+     * Refreshed by every adapter update, so it tracks work actually happening
+     * rather than a fixed guess at how long a wake takes.
+     */
+    holdSteeringOccupancy() {
+        if (this.closing || !this.isAlive())
+            return;
+        this.steeringOccupied = true;
+        this.refreshSteeringOccupancy();
+    }
+    refreshSteeringOccupancy() {
+        if (!this.steeringOccupied)
+            return;
+        if (this.steeringRelease)
+            clearTimeout(this.steeringRelease);
+        this.steeringRelease = setTimeout(() => this.releaseSteeringOccupancy('adapter silent'), this.options.steeringOccupancyIdleMs ?? STEERING_OCCUPANCY_IDLE_MS);
+        this.steeringRelease.unref?.();
+    }
+    /**
+     * Every exit from occupancy comes through here, including the ones that are
+     * not the timer: a real turn boundary, close, and adapter exit. A lease that
+     * can leak is worse than the bug it fixes — it would leave the role reporting
+     * `running` forever and starve scheduled admission permanently.
+     */
+    releaseSteeringOccupancy(reason) {
+        if (this.steeringRelease)
+            clearTimeout(this.steeringRelease);
+        this.steeringRelease = undefined;
+        if (!this.steeringOccupied)
+            return;
+        this.steeringOccupied = false;
+        this.options.log(`[${this.options.name}] steering-started turn no longer holds the adapter (${reason})`);
+    }
     snapshot() {
         return {
             backend: 'acp',
             alive: this.isAlive(),
-            readiness: this.readiness,
+            // A steering-started turn is real work with no prompt id. Reporting the
+            // session idle while it runs is what let the arbiter admit a scheduled
+            // prompt into a busy adapter, whose `session/prompt` then never returned
+            // a stopReason and ended in a cancellation deadline and a SIGTERM.
+            readiness: this.readiness === 'idle' && this.steeringOccupied
+                ? 'running' : this.readiness,
             sessionId: this.sessionId,
             lastError: this.lastError,
             pendingPermissionId: this.pendingPermissions.keys().next().value,
             runtimeModel: this.runtimeModel,
             reasoningEffort: this.reasoningEffort,
             permissionMode: this.options.permissionMode,
+            activity: {
+                activeToolCalls: this.activeToolCalls.size,
+                ...(this.lastUpdateAt ? { lastUpdateAt: this.lastUpdateAt } : {}),
+            },
         };
     }
     toolCall(toolCallId) {
@@ -526,15 +601,19 @@ export class AcpSession {
             throw new SessionControlError('control-unavailable', 'ACP adapter restart is in progress after the cancellation deadline', ACP_CANCEL_DEADLINE_EXCEEDED);
         if (this.closing || !this.sessionId || !this.isAlive())
             throw new SessionControlError('offline', this.lastError ?? 'ACP session is offline');
-        if (options.interrupt)
-            await this.cancelActive(options.interruptSource ?? 'local-console');
+        const delivery = options.interrupt
+            ? await this.prepareInterruptingDelivery(options.interruptSource ?? 'local-console')
+            : undefined;
         // Interrupting delivery must still use steering when supported. With no
         // live turn, the extension starts one and acknowledges `startedNewTurn`
         // immediately; a normal session/prompt would keep the monitor blocked until
         // the entire wake-triggered turn terminated.
         if (options.steer && this.steeringSupported) {
             const promptId = randomUUID();
-            return { promptId, queuedBehind: 0, completion: this.steerPrompt(text), origin: options.origin };
+            return {
+                promptId, queuedBehind: 0, completion: this.steerPrompt(text), origin: options.origin,
+                ...(delivery ? { delivery } : {}),
+            };
         }
         const promptId = randomUUID();
         const queuedBehind = this.queueDepth;
@@ -546,7 +625,46 @@ export class AcpSession {
             this.queueDepth = Math.max(0, this.queueDepth - 1);
             return turnResult(false, 'failed', error?.message ?? String(error));
         });
-        return { promptId, queuedBehind, completion, origin: options.origin };
+        return {
+            promptId, queuedBehind, completion, origin: options.origin,
+            delivery: delivery ?? (queuedBehind > 0 ? 'queued' : 'started'),
+        };
+    }
+    /**
+     * Prepare the session for a prompt that asked to pre-empt current work.
+     *
+     * The old behaviour was one unconditional `session/cancel` notification
+     * followed immediately by `session/prompt`. That is what produced the owner's
+     * "request failed before completion":
+     *
+     *  - `cancelActive` only awaits settlement when `this.activeTurn` is set, and
+     *    a turn the ADAPTER started (steering's `startedNewTurn`) is never tracked
+     *    here. So the cancel raced the adapter's own transcript repair and the new
+     *    prompt landed while the last assistant message still held an unresolved
+     *    `tool_use` — rejected with `stop_reason=tool_use`.
+     *  - With nothing running at all, it still sent the cancel, and the prompt
+     *    landed on a bare interrupted user message — rejected with
+     *    `stop_reason=null`.
+     *
+     * So: never cancel across a tool boundary, and never cancel something whose
+     * settlement cannot be awaited. Everything else is queued, which the ACP queue
+     * already does correctly. The returned state is what the caller may claim to a
+     * human — `interrupted` only when a turn really was cancelled.
+     */
+    async prepareInterruptingDelivery(source) {
+        if (!this.sessionId)
+            return 'started';
+        // No fleet-tracked turn to await. Either the session is idle — cancelling it
+        // corrupts the transcript for no gain — or the adapter is running a turn
+        // fleet never started, whose settlement nothing here can wait for. Queue in
+        // both cases: the ACP queue already orders this correctly.
+        if (!this.activeTurn)
+            return this.activeToolCalls.size > 0 ? 'deferred' : 'started';
+        // A tracked turn IS safe to cancel: cancelActive settles pending permissions
+        // and awaits the turn's own settlement before this returns, so the prompt
+        // below cannot race the adapter's transcript repair.
+        await this.cancelActive(source);
+        return 'interrupted';
     }
     /**
      * Durably record a prompt admission BEFORE acceptance is returned. Browser
@@ -855,6 +973,7 @@ export class AcpSession {
         if (this.controllerGrace)
             clearTimeout(this.controllerGrace);
         this.controllerGrace = undefined;
+        this.releaseSteeringOccupancy('session closed');
         for (const [permissionId, pending] of [...this.pendingPermissions])
             this.settlePendingAutomatically(permissionId, pending, 'cancelled', undefined, 'the session closed while this request was pending');
         this.releaseAllTools();
@@ -872,6 +991,17 @@ export class AcpSession {
         });
         this.conversation.close();
     }
+    /**
+     * The role's declared MCP servers, or `[]`.
+     *
+     * Sent on resume and load as well as on new: the agent builds its server set
+     * once per session, so a resumed session that omitted them would come back
+     * without the tools the role's config declares — which is exactly the shape of
+     * silent drop this plumbing exists to end.
+     */
+    declaredMcpServers() {
+        return this.options.mcpServers ?? [];
+    }
     async initialize() {
         const initialized = await this.connection.agent.request(acp.methods.agent.initialize, {
             protocolVersion: acp.PROTOCOL_VERSION,
@@ -891,7 +1021,7 @@ export class AcpSession {
             const resumed = await this.connection.agent.request(acp.methods.agent.session.resume, {
                 sessionId: persisted,
                 cwd: this.options.cwd,
-                mcpServers: [],
+                mcpServers: this.declaredMcpServers(),
             });
             this.captureRuntimeMetadata(resumed.configOptions);
             this.sessionId = persisted;
@@ -904,7 +1034,7 @@ export class AcpSession {
                 const loaded = await this.connection.agent.request(acp.methods.agent.session.load, {
                     sessionId: persisted,
                     cwd: this.options.cwd,
-                    mcpServers: [],
+                    mcpServers: this.declaredMcpServers(),
                 });
                 this.captureRuntimeMetadata(loaded.configOptions);
             }
@@ -916,7 +1046,8 @@ export class AcpSession {
         else {
             const created = await this.connection.agent.request(acp.methods.agent.session.new, {
                 cwd: this.options.cwd,
-                mcpServers: [],
+                mcpServers: this.declaredMcpServers(),
+                ...(this.options.sessionMeta ? { _meta: this.options.sessionMeta } : {}),
             });
             this.sessionId = created.sessionId;
             this.captureRuntimeMetadata(created.configOptions);
@@ -1013,6 +1144,10 @@ export class AcpSession {
         }
         finally {
             this.releaseAllTools();
+            // A turn this client owned has ended, so the adapter has reported a
+            // boundary: whatever a steering call started before it is over too. This
+            // is the release path that does not depend on the silence timer.
+            this.releaseSteeringOccupancy('turn boundary');
             if (this.activeTurn?.id === turnId) {
                 this.activeTurn.settle();
                 if (this.cancelEscalation)
@@ -1035,6 +1170,12 @@ export class AcpSession {
             ]);
             if (response.outcome === 'failed')
                 return turnResult(false, 'failed', 'ACP steering failed');
+            // `injected` joined a turn this client already owns and will settle.
+            // `startedNewTurn` created one nobody owns: the adapter is working and
+            // will never answer for it, so admission has to learn about it here or
+            // not at all.
+            if (response.outcome === 'startedNewTurn')
+                this.holdSteeringOccupancy();
             return turnResult(true, 'inconclusive', response.outcome);
         }
         catch (error) {
@@ -1062,6 +1203,17 @@ export class AcpSession {
         // Permission is part of the tool lifecycle. Reserve before any policy or
         // human decision so a monitor wake cannot slip between request and answer.
         this.reservePermission(toolCallId, permissionId);
+        if (this.isEffectiveCodexProtectedMcpApproval(params)) {
+            // Protected MCP approval is already the tool's narrow gate. Never turn
+            // this one decision into an adapter-wide standing grant.
+            const option = choose(['allow_once']);
+            const response = this.settleAutomatically(params, option, 'allowed', 'permissionMode.fleetMode=allow', 'the trusted Codex adapter authenticated a protected MCP approval request');
+            if (option)
+                this.allowPermission(toolCallId, permissionId);
+            else
+                this.releasePermission(toolCallId, permissionId);
+            return Promise.resolve(response);
+        }
         if (this.options.permissions.approval === 'allow' && this.withinAutomaticBoundary(params)) {
             const option = choose(['allow_always', 'allow_once']);
             const response = this.settleAutomatically(params, option, 'allowed', 'permissions.approval=allow', `the request is inside the ${this.options.permissions.filesystem} boundary`);
@@ -1188,7 +1340,34 @@ export class AcpSession {
         const cwd = resolve(this.options.cwd);
         return canonicallyWithin(cwd, locations.map(location => resolve(location.path)));
     }
+    /**
+     * Codex ACP 1.1.7 marks its protected MCP elicitation bridge on a locationless
+     * execute request. The marker is meaningful only together with the runner's
+     * independently supplied, adapter-authenticated metadata vocabulary and effective
+     * mode: an arbitrary ACP process cannot gain this path by copying `_meta` alone.
+     * Exact option ids/kinds bind recognition to the protected-MCP shape and keep
+     * malformed requests on the ordinary fail-closed path.
+     */
+    isEffectiveCodexProtectedMcpApproval(params) {
+        const locations = params.toolCall.locations ?? [];
+        return this.options.permissionMetadataSource === 'codex-acp'
+            && this.options.permissionMode?.fleetMode === 'allow'
+            && params.toolCall.kind === 'execute'
+            && params.toolCall.status === 'pending'
+            && locations.length === 0
+            && params._meta?.is_mcp_tool_approval === true
+            && params.options.some(option => option.optionId === 'allow_once' && option.kind === 'allow_once')
+            && params.options.some(option => option.optionId === 'decline' && option.kind === 'reject_once');
+    }
     recordUpdate(update) {
+        // Replayed history is not current activity: `session/load` would otherwise
+        // make a cold session look like it had just been working. The same reason
+        // keeps it from extending the steering lease, which is evidence the adapter
+        // is working right now — for a steering-started turn, the only evidence.
+        if (!this.replaying) {
+            this.lastUpdateAt = new Date().toISOString();
+            this.refreshSteeringOccupancy();
+        }
         const scheduled = this.activeTurn?.origin?.kind === 'scheduled-loop';
         const messagePhase = update.sessionUpdate === 'agent_message_chunk'
             ? this.codexMessagePhase(update) : undefined;
@@ -1288,7 +1467,25 @@ export class AcpSession {
     }
     // ── conversation ledger access (SessionHandle) ─────────────────────────────
     conversationPage(request = {}) {
-        return { ...this.conversation.page(request), snapshot: this.conversationSnapshot() };
+        const floor = Number(this.conversationStartCursor ?? 0);
+        const requested = Number(request.after ?? 0);
+        let after = String(Math.max(Number.isSafeInteger(floor) ? floor : 0, Number.isSafeInteger(requested) ? requested : 0));
+        const limit = Math.min(Math.max(request.limit ?? 200, 1), 1_000);
+        let page = this.conversation.page({ after, limit });
+        let visible = page.events.filter(event => this.isCurrentConversationEvent(event));
+        // A resumed adapter may replay a page made entirely of prior session/load
+        // history. Advance over it without exposing it or making the browser stop
+        // before later current-session records.
+        while (!visible.length && page.hasMore && page.nextCursor && page.nextCursor !== after) {
+            after = page.nextCursor;
+            page = this.conversation.page({ after, limit });
+            visible = page.events.filter(event => this.isCurrentConversationEvent(event));
+        }
+        return {
+            ...page,
+            events: visible,
+            snapshot: this.conversationSnapshot(),
+        };
     }
     conversationSnapshot() {
         return {
@@ -1300,7 +1497,13 @@ export class AcpSession {
         };
     }
     subscribeConversation(listener) {
-        return this.conversation.subscribe(listener);
+        return this.conversation.subscribe(event => {
+            if (this.isCurrentConversationEvent(event))
+                listener(event);
+        });
+    }
+    isCurrentConversationEvent(event) {
+        return event.sessionGeneration === this.sessionGeneration && event.source !== 'agent_replay';
     }
     fail(error) {
         this.lastError = error?.message ?? String(error);

package/dist/session/activity.d.ts

@@ -0,0 +1,31 @@
+import type { SessionActivity } from './types.js';
+/**
+ * How long after the agent's last session update it still counts as working.
+ *
+ * FLEET-002: a wake delivered by ACP steering answers `startedNewTurn` and runs
+ * an entire turn that fleet never receives a `session/prompt` response for (ACP
+ * has no turn-end session update), so `readiness` stays `idle` throughout. Tool
+ * reservations and update recency are the only activity evidence fleet holds.
+ * The trade-off is deliberate and one-directional: at worst a role reads busy
+ * for one window after it genuinely stopped, instead of reading ready — or
+ * being classified stalled — while it is executing tools.
+ */
+export declare const ACTIVITY_WINDOW_MS = 60000;
+export type ActivityState = 'active' | 'quiet' | 'unobservable';
+export interface ObservedActivity {
+    state: ActivityState;
+    activeToolCalls?: number;
+    lastUpdateAt?: string;
+}
+/**
+ * Classify agent-side activity. `unobservable` is NOT `quiet`: a backend that
+ * cannot see the agent (tmux) has no evidence, and no evidence must never be
+ * reported as "doing nothing".
+ */
+export declare function classifyActivity(activity: SessionActivity | undefined, now?: number): ObservedActivity;
+/**
+ * One operator-facing line that never lets turn occupancy pose as liveness:
+ * the readiness value is labelled as the turn field it is, and the activity
+ * verdict is stated separately with the evidence behind it.
+ */
+export declare function describeSessionState(readiness: string | undefined, activity: SessionActivity | undefined, now?: number): string;

package/dist/session/activity.js

@@ -0,0 +1,48 @@
+/**
+ * How long after the agent's last session update it still counts as working.
+ *
+ * FLEET-002: a wake delivered by ACP steering answers `startedNewTurn` and runs
+ * an entire turn that fleet never receives a `session/prompt` response for (ACP
+ * has no turn-end session update), so `readiness` stays `idle` throughout. Tool
+ * reservations and update recency are the only activity evidence fleet holds.
+ * The trade-off is deliberate and one-directional: at worst a role reads busy
+ * for one window after it genuinely stopped, instead of reading ready — or
+ * being classified stalled — while it is executing tools.
+ */
+export const ACTIVITY_WINDOW_MS = 60_000;
+/**
+ * Classify agent-side activity. `unobservable` is NOT `quiet`: a backend that
+ * cannot see the agent (tmux) has no evidence, and no evidence must never be
+ * reported as "doing nothing".
+ */
+export function classifyActivity(activity, now = Date.now()) {
+    if (!activity)
+        return { state: 'unobservable' };
+    const lastUpdate = activity.lastUpdateAt ? Date.parse(activity.lastUpdateAt) : NaN;
+    const recent = Number.isFinite(lastUpdate) && now - lastUpdate <= ACTIVITY_WINDOW_MS;
+    return {
+        state: activity.activeToolCalls > 0 || recent ? 'active' : 'quiet',
+        activeToolCalls: activity.activeToolCalls,
+        ...(activity.lastUpdateAt ? { lastUpdateAt: activity.lastUpdateAt } : {}),
+    };
+}
+/**
+ * One operator-facing line that never lets turn occupancy pose as liveness:
+ * the readiness value is labelled as the turn field it is, and the activity
+ * verdict is stated separately with the evidence behind it.
+ */
+export function describeSessionState(readiness, activity, now = Date.now()) {
+    const observed = classifyActivity(activity, now);
+    const evidence = [];
+    if (observed.activeToolCalls)
+        evidence.push(`${observed.activeToolCalls} tool calls in flight`);
+    if (observed.lastUpdateAt) {
+        const age = Math.max(0, Math.round((now - Date.parse(observed.lastUpdateAt)) / 1000));
+        if (Number.isFinite(age))
+            evidence.push(`last agent update ${age}s ago`);
+    }
+    const detail = observed.state === 'unobservable'
+        ? 'no agent-side evidence on this backend'
+        : evidence.join(', ') || 'no updates yet';
+    return `turn: ${readiness ?? 'unknown'} (turn occupancy only) | activity: ${observed.state} (${detail})`;
+}

package/dist/session/conversation-normalizer.d.ts

@@ -11,6 +11,12 @@ import type { AdapterMeta, ConversationEventKind, ConversationPayload } from './
  */
 /** Cap for any single normalized text payload (spec §5.3). */
 export declare const MAX_TEXT_BYTES: number;
+/** Cap for each retained side of an oversized snapshot-style file diff. */
+export declare const MAX_DIFF_TEXT_BYTES: number;
+/** Cap for attacker-controlled filesystem paths while retaining their useful basename tail. */
+export declare const MAX_PATH_BYTES: number;
+/** Hard cap for the complete normalized update before the durable event envelope is added. */
+export declare const MAX_NORMALIZED_UPDATE_BYTES: number;
 /** Cap for one adapter `_meta` namespace value. */
 export declare const MAX_META_BYTES: number;
 /** Cap for serialized raw tool input/output retained as structured JSON. */