@ours.network/fleet 0.18.1 → 0.19.0-nightly.1

package/dist/session/acp.js

@@ -16,21 +16,6 @@ const PERMISSION_TIMEOUT_MS = 10 * 60_000;
 const CONTROLLER_GRACE_MS = 12_000;
 /** Bound safe-boundary waiting without turning a hung tool into cancellation. */
 export const AFTER_TOOL_BOUNDARY_TIMEOUT_MS = 120_000;
-/**
- * How long a steering-started turn is presumed to still own the adapter after
- * its last update. Such a turn has no prompt id, so it never reports a
- * stopReason and there is no exact end to observe — silence is the only signal
- * available, and this is the bound that turns it into a decision.
- *
- * Sized from the fleet's own scheduled-run history: across 1513 completed
- * scheduled runs the longest silence WITHIN a working turn was 120.2 s (p99
- * 41.0 s; 5 runs above 60 s). A shorter grace would release the lease while the
- * adapter is still working and re-admit a prompt into a busy turn, which is the
- * FLEET-003 failure itself. The costs are deliberately asymmetric: holding too
- * long skips one best-effort maintenance tick, releasing too early SIGTERMs a
- * live role.
- */
-export const STEERING_OCCUPANCY_IDLE_MS = 150_000;
 const TERMINAL_TOOL_STATUSES = new Set(['completed', 'failed']);
 const SCHEDULED_LOOP_REDACTION = '[scheduled-loop content redacted]';
 const OWNER_COMMENTARY_REDACTION = '[assistant commentary redacted]';
@@ -208,8 +193,6 @@ export class AcpSession {
     child;
     events;
     conversation;
-    /** Cursor before this runner generation began; older durable events stay off the live console. */
-    conversationStartCursor;
     /** New on every runner start; permission/turn IDs from prior generations are stale. */
     sessionGeneration = randomUUID();
     /** True while `session/load` replays history as ordinary updates. */
@@ -219,12 +202,6 @@ export class AcpSession {
     connection;
     sessionId;
     readiness = 'starting';
-    /**
-     * Last non-replayed session update from the agent. `readiness` cannot answer
-     * "is this agent working" for a steered turn (FLEET-002), and this is the
-     * evidence that can.
-     */
-    lastUpdateAt;
     lastError;
     promptTail = Promise.resolve();
     queueDepth = 0;
@@ -240,13 +217,6 @@ export class AcpSession {
     cancelEscalation;
     cancelForceKill;
     cancelRecoveryReason;
-    /**
-     * Held while a steering-started turn is believed to own the adapter. It is a
-     * lease, not a latch: `steeringRelease` always fires, so the role can never be
-     * stranded busy by a wake whose turn ended without telling anyone.
-     */
-    steeringOccupied = false;
-    steeringRelease;
     /**
      * Rejects the moment the adapter process is gone. Every in-flight ACP request
      * races it, so a dead adapter can never leave a turn — and therefore a
@@ -267,7 +237,6 @@ export class AcpSession {
         this.conversation = new ConversationEventStore(join(options.stateDir, '.conversation'), {
             roleId: options.name, log: line => options.log(`[${options.name}] ${line}`),
         });
-        this.conversationStartCursor = this.conversation.lastCursor();
         this.sessionFile = join(options.stateDir, '.acp-session-id');
         this.terminated = new Promise((_resolve, reject) => { this.terminate = reject; });
         // Nothing awaits this promise until a request races it; an unobserved
@@ -278,7 +247,6 @@ export class AcpSession {
             if (this.cancelForceKill)
                 clearTimeout(this.cancelForceKill);
             this.cancelForceKill = undefined;
-            this.releaseSteeringOccupancy('adapter exited');
             // Record the child's real exit code/signal. The tmux path can only see a
             // shell's `$?`; here the truth is available, so keep it.
             const classified = classifyChildExit(code, signal);
@@ -379,60 +347,17 @@ export class AcpSession {
         // terminal fact (signal exits deliberately leave exitCode null).
         return this.child.exitCode === null && (this.child.signalCode ?? null) === null;
     }
-    /**
-     * Take the occupancy lease for a turn the adapter started on its own behalf.
-     * Refreshed by every adapter update, so it tracks work actually happening
-     * rather than a fixed guess at how long a wake takes.
-     */
-    holdSteeringOccupancy() {
-        if (this.closing || !this.isAlive())
-            return;
-        this.steeringOccupied = true;
-        this.refreshSteeringOccupancy();
-    }
-    refreshSteeringOccupancy() {
-        if (!this.steeringOccupied)
-            return;
-        if (this.steeringRelease)
-            clearTimeout(this.steeringRelease);
-        this.steeringRelease = setTimeout(() => this.releaseSteeringOccupancy('adapter silent'), this.options.steeringOccupancyIdleMs ?? STEERING_OCCUPANCY_IDLE_MS);
-        this.steeringRelease.unref?.();
-    }
-    /**
-     * Every exit from occupancy comes through here, including the ones that are
-     * not the timer: a real turn boundary, close, and adapter exit. A lease that
-     * can leak is worse than the bug it fixes — it would leave the role reporting
-     * `running` forever and starve scheduled admission permanently.
-     */
-    releaseSteeringOccupancy(reason) {
-        if (this.steeringRelease)
-            clearTimeout(this.steeringRelease);
-        this.steeringRelease = undefined;
-        if (!this.steeringOccupied)
-            return;
-        this.steeringOccupied = false;
-        this.options.log(`[${this.options.name}] steering-started turn no longer holds the adapter (${reason})`);
-    }
     snapshot() {
         return {
             backend: 'acp',
             alive: this.isAlive(),
-            // A steering-started turn is real work with no prompt id. Reporting the
-            // session idle while it runs is what let the arbiter admit a scheduled
-            // prompt into a busy adapter, whose `session/prompt` then never returned
-            // a stopReason and ended in a cancellation deadline and a SIGTERM.
-            readiness: this.readiness === 'idle' && this.steeringOccupied
-                ? 'running' : this.readiness,
+            readiness: this.readiness,
             sessionId: this.sessionId,
             lastError: this.lastError,
             pendingPermissionId: this.pendingPermissions.keys().next().value,
             runtimeModel: this.runtimeModel,
             reasoningEffort: this.reasoningEffort,
             permissionMode: this.options.permissionMode,
-            activity: {
-                activeToolCalls: this.activeToolCalls.size,
-                ...(this.lastUpdateAt ? { lastUpdateAt: this.lastUpdateAt } : {}),
-            },
         };
     }
     toolCall(toolCallId) {
@@ -601,19 +526,15 @@ export class AcpSession {
             throw new SessionControlError('control-unavailable', 'ACP adapter restart is in progress after the cancellation deadline', ACP_CANCEL_DEADLINE_EXCEEDED);
         if (this.closing || !this.sessionId || !this.isAlive())
             throw new SessionControlError('offline', this.lastError ?? 'ACP session is offline');
-        const delivery = options.interrupt
-            ? await this.prepareInterruptingDelivery(options.interruptSource ?? 'local-console')
-            : undefined;
+        if (options.interrupt)
+            await this.cancelActive(options.interruptSource ?? 'local-console');
         // Interrupting delivery must still use steering when supported. With no
         // live turn, the extension starts one and acknowledges `startedNewTurn`
         // immediately; a normal session/prompt would keep the monitor blocked until
         // the entire wake-triggered turn terminated.
         if (options.steer && this.steeringSupported) {
             const promptId = randomUUID();
-            return {
-                promptId, queuedBehind: 0, completion: this.steerPrompt(text), origin: options.origin,
-                ...(delivery ? { delivery } : {}),
-            };
+            return { promptId, queuedBehind: 0, completion: this.steerPrompt(text), origin: options.origin };
         }
         const promptId = randomUUID();
         const queuedBehind = this.queueDepth;
@@ -625,46 +546,7 @@ export class AcpSession {
             this.queueDepth = Math.max(0, this.queueDepth - 1);
             return turnResult(false, 'failed', error?.message ?? String(error));
         });
-        return {
-            promptId, queuedBehind, completion, origin: options.origin,
-            delivery: delivery ?? (queuedBehind > 0 ? 'queued' : 'started'),
-        };
-    }
-    /**
-     * Prepare the session for a prompt that asked to pre-empt current work.
-     *
-     * The old behaviour was one unconditional `session/cancel` notification
-     * followed immediately by `session/prompt`. That is what produced the owner's
-     * "request failed before completion":
-     *
-     *  - `cancelActive` only awaits settlement when `this.activeTurn` is set, and
-     *    a turn the ADAPTER started (steering's `startedNewTurn`) is never tracked
-     *    here. So the cancel raced the adapter's own transcript repair and the new
-     *    prompt landed while the last assistant message still held an unresolved
-     *    `tool_use` — rejected with `stop_reason=tool_use`.
-     *  - With nothing running at all, it still sent the cancel, and the prompt
-     *    landed on a bare interrupted user message — rejected with
-     *    `stop_reason=null`.
-     *
-     * So: never cancel across a tool boundary, and never cancel something whose
-     * settlement cannot be awaited. Everything else is queued, which the ACP queue
-     * already does correctly. The returned state is what the caller may claim to a
-     * human — `interrupted` only when a turn really was cancelled.
-     */
-    async prepareInterruptingDelivery(source) {
-        if (!this.sessionId)
-            return 'started';
-        // No fleet-tracked turn to await. Either the session is idle — cancelling it
-        // corrupts the transcript for no gain — or the adapter is running a turn
-        // fleet never started, whose settlement nothing here can wait for. Queue in
-        // both cases: the ACP queue already orders this correctly.
-        if (!this.activeTurn)
-            return this.activeToolCalls.size > 0 ? 'deferred' : 'started';
-        // A tracked turn IS safe to cancel: cancelActive settles pending permissions
-        // and awaits the turn's own settlement before this returns, so the prompt
-        // below cannot race the adapter's transcript repair.
-        await this.cancelActive(source);
-        return 'interrupted';
+        return { promptId, queuedBehind, completion, origin: options.origin };
     }
     /**
      * Durably record a prompt admission BEFORE acceptance is returned. Browser
@@ -973,7 +855,6 @@ export class AcpSession {
         if (this.controllerGrace)
             clearTimeout(this.controllerGrace);
         this.controllerGrace = undefined;
-        this.releaseSteeringOccupancy('session closed');
         for (const [permissionId, pending] of [...this.pendingPermissions])
             this.settlePendingAutomatically(permissionId, pending, 'cancelled', undefined, 'the session closed while this request was pending');
         this.releaseAllTools();
@@ -991,17 +872,6 @@ export class AcpSession {
         });
         this.conversation.close();
     }
-    /**
-     * The role's declared MCP servers, or `[]`.
-     *
-     * Sent on resume and load as well as on new: the agent builds its server set
-     * once per session, so a resumed session that omitted them would come back
-     * without the tools the role's config declares — which is exactly the shape of
-     * silent drop this plumbing exists to end.
-     */
-    declaredMcpServers() {
-        return this.options.mcpServers ?? [];
-    }
     async initialize() {
         const initialized = await this.connection.agent.request(acp.methods.agent.initialize, {
             protocolVersion: acp.PROTOCOL_VERSION,
@@ -1021,7 +891,7 @@ export class AcpSession {
             const resumed = await this.connection.agent.request(acp.methods.agent.session.resume, {
                 sessionId: persisted,
                 cwd: this.options.cwd,
-                mcpServers: this.declaredMcpServers(),
+                mcpServers: [],
             });
             this.captureRuntimeMetadata(resumed.configOptions);
             this.sessionId = persisted;
@@ -1034,7 +904,7 @@ export class AcpSession {
                 const loaded = await this.connection.agent.request(acp.methods.agent.session.load, {
                     sessionId: persisted,
                     cwd: this.options.cwd,
-                    mcpServers: this.declaredMcpServers(),
+                    mcpServers: [],
                 });
                 this.captureRuntimeMetadata(loaded.configOptions);
             }
@@ -1046,8 +916,7 @@ export class AcpSession {
         else {
             const created = await this.connection.agent.request(acp.methods.agent.session.new, {
                 cwd: this.options.cwd,
-                mcpServers: this.declaredMcpServers(),
-                ...(this.options.sessionMeta ? { _meta: this.options.sessionMeta } : {}),
+                mcpServers: [],
             });
             this.sessionId = created.sessionId;
             this.captureRuntimeMetadata(created.configOptions);
@@ -1144,10 +1013,6 @@ export class AcpSession {
         }
         finally {
             this.releaseAllTools();
-            // A turn this client owned has ended, so the adapter has reported a
-            // boundary: whatever a steering call started before it is over too. This
-            // is the release path that does not depend on the silence timer.
-            this.releaseSteeringOccupancy('turn boundary');
             if (this.activeTurn?.id === turnId) {
                 this.activeTurn.settle();
                 if (this.cancelEscalation)
@@ -1170,12 +1035,6 @@ export class AcpSession {
             ]);
             if (response.outcome === 'failed')
                 return turnResult(false, 'failed', 'ACP steering failed');
-            // `injected` joined a turn this client already owns and will settle.
-            // `startedNewTurn` created one nobody owns: the adapter is working and
-            // will never answer for it, so admission has to learn about it here or
-            // not at all.
-            if (response.outcome === 'startedNewTurn')
-                this.holdSteeringOccupancy();
             return turnResult(true, 'inconclusive', response.outcome);
         }
         catch (error) {
@@ -1203,17 +1062,6 @@ export class AcpSession {
         // Permission is part of the tool lifecycle. Reserve before any policy or
         // human decision so a monitor wake cannot slip between request and answer.
         this.reservePermission(toolCallId, permissionId);
-        if (this.isEffectiveCodexProtectedMcpApproval(params)) {
-            // Protected MCP approval is already the tool's narrow gate. Never turn
-            // this one decision into an adapter-wide standing grant.
-            const option = choose(['allow_once']);
-            const response = this.settleAutomatically(params, option, 'allowed', 'permissionMode.fleetMode=allow', 'the trusted Codex adapter authenticated a protected MCP approval request');
-            if (option)
-                this.allowPermission(toolCallId, permissionId);
-            else
-                this.releasePermission(toolCallId, permissionId);
-            return Promise.resolve(response);
-        }
         if (this.options.permissions.approval === 'allow' && this.withinAutomaticBoundary(params)) {
             const option = choose(['allow_always', 'allow_once']);
             const response = this.settleAutomatically(params, option, 'allowed', 'permissions.approval=allow', `the request is inside the ${this.options.permissions.filesystem} boundary`);
@@ -1340,34 +1188,7 @@ export class AcpSession {
         const cwd = resolve(this.options.cwd);
         return canonicallyWithin(cwd, locations.map(location => resolve(location.path)));
     }
-    /**
-     * Codex ACP 1.1.7 marks its protected MCP elicitation bridge on a locationless
-     * execute request. The marker is meaningful only together with the runner's
-     * independently supplied, adapter-authenticated metadata vocabulary and effective
-     * mode: an arbitrary ACP process cannot gain this path by copying `_meta` alone.
-     * Exact option ids/kinds bind recognition to the protected-MCP shape and keep
-     * malformed requests on the ordinary fail-closed path.
-     */
-    isEffectiveCodexProtectedMcpApproval(params) {
-        const locations = params.toolCall.locations ?? [];
-        return this.options.permissionMetadataSource === 'codex-acp'
-            && this.options.permissionMode?.fleetMode === 'allow'
-            && params.toolCall.kind === 'execute'
-            && params.toolCall.status === 'pending'
-            && locations.length === 0
-            && params._meta?.is_mcp_tool_approval === true
-            && params.options.some(option => option.optionId === 'allow_once' && option.kind === 'allow_once')
-            && params.options.some(option => option.optionId === 'decline' && option.kind === 'reject_once');
-    }
     recordUpdate(update) {
-        // Replayed history is not current activity: `session/load` would otherwise
-        // make a cold session look like it had just been working. The same reason
-        // keeps it from extending the steering lease, which is evidence the adapter
-        // is working right now — for a steering-started turn, the only evidence.
-        if (!this.replaying) {
-            this.lastUpdateAt = new Date().toISOString();
-            this.refreshSteeringOccupancy();
-        }
         const scheduled = this.activeTurn?.origin?.kind === 'scheduled-loop';
         const messagePhase = update.sessionUpdate === 'agent_message_chunk'
             ? this.codexMessagePhase(update) : undefined;
@@ -1467,25 +1288,7 @@ export class AcpSession {
     }
     // ── conversation ledger access (SessionHandle) ─────────────────────────────
     conversationPage(request = {}) {
-        const floor = Number(this.conversationStartCursor ?? 0);
-        const requested = Number(request.after ?? 0);
-        let after = String(Math.max(Number.isSafeInteger(floor) ? floor : 0, Number.isSafeInteger(requested) ? requested : 0));
-        const limit = Math.min(Math.max(request.limit ?? 200, 1), 1_000);
-        let page = this.conversation.page({ after, limit });
-        let visible = page.events.filter(event => this.isCurrentConversationEvent(event));
-        // A resumed adapter may replay a page made entirely of prior session/load
-        // history. Advance over it without exposing it or making the browser stop
-        // before later current-session records.
-        while (!visible.length && page.hasMore && page.nextCursor && page.nextCursor !== after) {
-            after = page.nextCursor;
-            page = this.conversation.page({ after, limit });
-            visible = page.events.filter(event => this.isCurrentConversationEvent(event));
-        }
-        return {
-            ...page,
-            events: visible,
-            snapshot: this.conversationSnapshot(),
-        };
+        return { ...this.conversation.page(request), snapshot: this.conversationSnapshot() };
     }
     conversationSnapshot() {
         return {
@@ -1497,13 +1300,7 @@ export class AcpSession {
         };
     }
     subscribeConversation(listener) {
-        return this.conversation.subscribe(event => {
-            if (this.isCurrentConversationEvent(event))
-                listener(event);
-        });
-    }
-    isCurrentConversationEvent(event) {
-        return event.sessionGeneration === this.sessionGeneration && event.source !== 'agent_replay';
+        return this.conversation.subscribe(listener);
     }
     fail(error) {
         this.lastError = error?.message ?? String(error);

package/dist/session/conversation-normalizer.d.ts

@@ -11,12 +11,6 @@ import type { AdapterMeta, ConversationEventKind, ConversationPayload } from './
  */
 /** Cap for any single normalized text payload (spec §5.3). */
 export declare const MAX_TEXT_BYTES: number;
-/** Cap for each retained side of an oversized snapshot-style file diff. */
-export declare const MAX_DIFF_TEXT_BYTES: number;
-/** Cap for attacker-controlled filesystem paths while retaining their useful basename tail. */
-export declare const MAX_PATH_BYTES: number;
-/** Hard cap for the complete normalized update before the durable event envelope is added. */
-export declare const MAX_NORMALIZED_UPDATE_BYTES: number;
 /** Cap for one adapter `_meta` namespace value. */
 export declare const MAX_META_BYTES: number;
 /** Cap for serialized raw tool input/output retained as structured JSON. */

package/dist/session/conversation-normalizer.js

@@ -10,12 +10,6 @@ import { createHash } from 'node:crypto';
  */
 /** Cap for any single normalized text payload (spec §5.3). */
 export const MAX_TEXT_BYTES = 256 * 1024;
-/** Cap for each retained side of an oversized snapshot-style file diff. */
-export const MAX_DIFF_TEXT_BYTES = 64 * 1024;
-/** Cap for attacker-controlled filesystem paths while retaining their useful basename tail. */
-export const MAX_PATH_BYTES = 4 * 1024;
-/** Hard cap for the complete normalized update before the durable event envelope is added. */
-export const MAX_NORMALIZED_UPDATE_BYTES = 320 * 1024;
 /** Cap for one adapter `_meta` namespace value. */
 export const MAX_META_BYTES = 16 * 1024;
 /** Cap for serialized raw tool input/output retained as structured JSON. */
@@ -33,28 +27,6 @@ function truncateUtf8(text, maxBytes) {
     const buffer = Buffer.from(text).subarray(0, maxBytes);
     return buffer.toString('utf8').replace(/�+$/u, '');
 }
-/** Keep a UTF-8-safe suffix. Paths and identifiers have no line semantics. */
-function truncateUtf8Tail(text, maxBytes) {
-    const buffer = Buffer.from(text);
-    let start = Math.max(0, buffer.length - maxBytes);
-    while (start < buffer.length && (buffer[start] & 0xc0) === 0x80)
-        start++;
-    return { text: buffer.subarray(start).toString('utf8'), omittedPrefixBytes: start };
-}
-function boundedPath(raw) {
-    const path = asString(raw) ?? '';
-    const pathBytes = Buffer.byteLength(path);
-    if (pathBytes <= MAX_PATH_BYTES)
-        return { path };
-    const retained = truncateUtf8Tail(path, MAX_PATH_BYTES);
-    return {
-        path: retained.text,
-        pathBytes,
-        pathTruncated: true,
-        pathDigest: digest24(path),
-        pathOmittedPrefixBytes: retained.omittedPrefixBytes,
-    };
-}
 function cappedText(raw, redact) {
     const text = asString(raw) ?? '';
     const bytes = Buffer.byteLength(text);
@@ -67,95 +39,6 @@ function cappedText(raw, redact) {
         truncated: true, digest: digest24(text),
     };
 }
-/** Keep the newest UTF-8 tail, aligning to a whole line whenever one fits. */
-function cappedTextTail(text, maxBytes) {
-    const buffer = Buffer.from(text);
-    const bytes = buffer.length;
-    if (bytes <= maxBytes)
-        return { text, bytes };
-    let start = bytes - maxBytes;
-    while (start < bytes && (buffer[start] & 0xc0) === 0x80)
-        start++;
-    let startsMidLine = start > 0 && buffer[start - 1] !== 0x0a;
-    if (startsMidLine) {
-        const newline = buffer.indexOf(0x0a, start);
-        if (newline >= 0 && newline + 1 < bytes) {
-            start = newline + 1;
-            startsMidLine = false;
-        }
-    }
-    return {
-        text: buffer.subarray(start).toString('utf8'), bytes,
-        truncated: true, digest: digest24(text), omittedPrefixBytes: start,
-        ...(startsMidLine ? { startsMidLine: true } : {}),
-    };
-}
-/** Common unchanged edges in UTF-16 indices, adjusted away from split surrogates. */
-function commonEdges(oldText, newText) {
-    const limit = Math.min(oldText.length, newText.length);
-    let prefix = 0;
-    while (prefix < limit && oldText.charCodeAt(prefix) === newText.charCodeAt(prefix))
-        prefix++;
-    if (prefix > 0 && prefix < limit
-        && oldText.charCodeAt(prefix) >= 0xdc00 && oldText.charCodeAt(prefix) <= 0xdfff)
-        prefix--;
-    let oldEnd = oldText.length;
-    let newEnd = newText.length;
-    while (oldEnd > prefix && newEnd > prefix
-        && oldText.charCodeAt(oldEnd - 1) === newText.charCodeAt(newEnd - 1)) {
-        oldEnd--;
-        newEnd--;
-    }
-    // A suffix must never begin at the low half of a surrogate pair.
-    if (oldEnd < oldText.length && oldText.charCodeAt(oldEnd) >= 0xdc00
-        && oldText.charCodeAt(oldEnd) <= 0xdfff) {
-        oldEnd++;
-        newEnd++;
-    }
-    return { prefix, suffix: oldText.length - oldEnd };
-}
-function normalizedDiff(item, redact) {
-    const path = boundedPath(item.path);
-    const oldText = asString(item.oldText);
-    const newText = asString(item.newText) ?? '';
-    // Preserve the established small-diff contract exactly. Redacted turns also
-    // retain their established placeholder shape and never derive private text.
-    if (redact !== undefined || oldText === undefined
-        || (Buffer.byteLength(oldText) <= MAX_TEXT_BYTES
-            && Buffer.byteLength(newText) <= MAX_TEXT_BYTES)) {
-        return {
-            type: 'diff', ...path,
-            newText: cappedText(newText, redact),
-            ...(oldText !== undefined ? { oldText: cappedText(oldText, redact) } : {}),
-        };
-    }
-    // ACP adapters may describe an append by sending two complete file snapshots.
-    // Persist only the changed region: otherwise a multi-megabyte historical file
-    // contributes its prefix twice while the current append disappears past the cap.
-    const { prefix, suffix } = commonEdges(oldText, newText);
-    const oldEnd = oldText.length - suffix;
-    const newEnd = newText.length - suffix;
-    const oldDelta = oldText.slice(prefix, oldEnd);
-    const newDelta = newText.slice(prefix, newEnd);
-    const beforeBytes = Buffer.byteLength(oldText);
-    const afterBytes = Buffer.byteLength(newText);
-    const commonPrefixBytes = Buffer.byteLength(oldText.slice(0, prefix));
-    const commonSuffixBytes = Buffer.byteLength(oldText.slice(oldEnd));
-    const operation = oldDelta.length === 0 && newDelta.length === 0
-        ? 'noop'
-        : oldDelta.length === 0 && prefix === oldText.length
-            ? 'append'
-            : newDelta.length === 0
-                ? 'delete'
-                : prefix === 0 && suffix === 0 ? 'replace' : 'edit';
-    return {
-        type: 'diff', ...path, operation, beforeBytes, afterBytes,
-        commonPrefixBytes, commonSuffixBytes, bounded: true,
-        newText: cappedTextTail(newDelta, MAX_DIFF_TEXT_BYTES),
-        ...(oldDelta.length > 0
-            ? { oldText: cappedTextTail(oldDelta, MAX_DIFF_TEXT_BYTES) } : {}),
-    };
-}
 function normalizedText(raw, redact) {
     const text = asString(raw) ?? '';
     const bytes = Buffer.byteLength(text);
@@ -306,7 +189,12 @@ function normalizeToolContent(raw, redact) {
     return raw.filter(isRecord).map((item) => {
         switch (item.type) {
             case 'diff':
-                return normalizedDiff(item, redact);
+                return {
+                    type: 'diff',
+                    path: asString(item.path) ?? '',
+                    newText: cappedText(item.newText, redact),
+                    ...(item.oldText != null ? { oldText: cappedText(item.oldText, redact) } : {}),
+                };
             case 'terminal':
                 return { type: 'terminal', terminalId: asString(item.terminalId) ?? '' };
             case 'content':
@@ -332,7 +220,7 @@ function toolUpsert(update, snapshot, options) {
         payload.content = content;
     if (Array.isArray(update.locations)) {
         payload.locations = update.locations.filter(isRecord).map(location => ({
-            ...boundedPath(location.path),
+            path: asString(location.path) ?? '',
             ...(asFiniteNumber(location.line) !== undefined ? { line: asFiniteNumber(location.line) } : {}),
         }));
     }
@@ -352,49 +240,18 @@ function unsupported(update) {
     }
     const kind = isRecord(update) ? asString(update.sessionUpdate) : undefined;
     return {
-        sessionUpdate: truncateUtf8(kind ?? 'unknown', 256),
+        sessionUpdate: kind ?? 'unknown',
         bytes: Buffer.byteLength(serialized),
         preview: serialized.slice(0, MAX_UNSUPPORTED_PREVIEW_CHARS),
-        ...(Buffer.byteLength(serialized) > Buffer.byteLength(serialized.slice(0, MAX_UNSUPPORTED_PREVIEW_CHARS))
-            ? { digest: digest24(serialized) } : {}),
-    };
-}
-function capNormalizedUpdate(result, sessionUpdate) {
-    let serialized;
-    try {
-        serialized = JSON.stringify(result);
-    }
-    catch {
-        return {
-            kind: 'unsupported',
-            payload: {
-                sessionUpdate: truncateUtf8(sessionUpdate, 256),
-                bytes: 0,
-                preview: '[normalized update was not serializable]',
-            },
-        };
-    }
-    const bytes = Buffer.byteLength(serialized);
-    if (bytes <= MAX_NORMALIZED_UPDATE_BYTES)
-        return result;
-    return {
-        kind: 'unsupported',
-        payload: {
-            sessionUpdate: truncateUtf8(sessionUpdate, 256),
-            bytes,
-            digest: digest24(serialized),
-            preview: `[normalized update exceeded ${MAX_NORMALIZED_UPDATE_BYTES}-byte durable-event cap]`,
-        },
     };
 }
 export function normalizeSessionUpdate(update, options = {}) {
     const redact = options.redactText;
     const raw = update;
     if (!isRecord(raw) || typeof raw.sessionUpdate !== 'string')
-        return capNormalizedUpdate({ kind: 'unsupported', payload: unsupported(raw) }, 'unknown');
-    const sessionUpdate = raw.sessionUpdate;
+        return { kind: 'unsupported', payload: unsupported(raw) };
     const adapterMeta = quarantineMeta(raw._meta);
-    const withMeta = (result) => capNormalizedUpdate(adapterMeta ? { ...result, adapterMeta } : result, sessionUpdate);
+    const withMeta = (result) => adapterMeta ? { ...result, adapterMeta } : result;
     switch (raw.sessionUpdate) {
         case 'user_message_chunk':
         case 'agent_message_chunk': {

package/dist/session/conversation-types.d.ts

@@ -48,33 +48,15 @@ export interface CappedText {
     bytes: number;
     truncated?: true;
     digest?: string;
-    /** Bytes omitted from the front when the retained fragment is a tail. */
-    omittedPrefixBytes?: number;
-    /** The retained tail starts inside one logical line because that line alone exceeded the cap. */
-    startsMidLine?: true;
-}
-/** A path kept as a UTF-8-safe tail, with additive provenance only when capped. */
-export interface BoundedPath {
-    path: string;
-    pathBytes?: number;
-    pathTruncated?: true;
-    pathDigest?: string;
-    pathOmittedPrefixBytes?: number;
 }
 export type NormalizedToolContent = {
     type: 'content';
     content: NormalizedContentBlock;
-} | BoundedPath & {
+} | {
     type: 'diff';
+    path: string;
     newText: CappedText;
     oldText?: CappedText;
-    /** Additive provenance for oversized snapshot diffs reduced to their changed region. */
-    operation?: 'append' | 'edit' | 'delete' | 'noop' | 'replace';
-    beforeBytes?: number;
-    afterBytes?: number;
-    commonPrefixBytes?: number;
-    commonSuffixBytes?: number;
-    bounded?: true;
 }
 /** A tool-owned display terminal reference — never a PTY attachment. */
  | {
@@ -123,7 +105,8 @@ export interface ToolUpsertPayload {
     kind?: string;
     status?: string;
     content?: NormalizedToolContent[];
-    locations?: Array<BoundedPath & {
+    locations?: Array<{
+        path: string;
         line?: number;
     }>;
     rawInput?: BoundedJson;
@@ -157,8 +140,6 @@ export interface UnsupportedPayload {
     /** The wire discriminant (or 'unknown' when even that was absent). */
     sessionUpdate: string;
     bytes: number;
-    /** Digest of the omitted original/normalized representation when it was bounded. */
-    digest?: string;
     /** Sanitized JSON preview, capped; enough to diagnose, never to exhaust. */
     preview?: string;
 }