@ours.network/fleet 0.19.0-nightly.9 → 1.0.1

package/dist/session/acp.d.ts

@@ -1,10 +1,26 @@
 import * as acp from '@agentclientprotocol/sdk';
 import type { CommonPermissions } from '../config.js';
+import type { AcpMcpServer } from '../harness/types.js';
 import { ConversationEventStore } from './conversation-store.js';
 import type { ConversationSnapshot, PromptOrigin, PromptReceipt, SubmitPromptCommand } from './conversation-types.js';
 import type { ConversationHandlePage, ExitRecord, InterruptOutcome, QueuedPrompt, SessionEvent, RuntimeSelectorMetadata, SessionHandle, SessionSnapshot, SubmitPromptOptions, TurnCancellationSource, TurnOutcome, TurnResult } from './types.js';
 /** Bound safe-boundary waiting without turning a hung tool into cancellation. */
 export declare const AFTER_TOOL_BOUNDARY_TIMEOUT_MS = 120000;
+/**
+ * How long a steering-started turn is presumed to still own the adapter after
+ * its last update. Such a turn has no prompt id, so it never reports a
+ * stopReason and there is no exact end to observe — silence is the only signal
+ * available, and this is the bound that turns it into a decision.
+ *
+ * Sized from the fleet's own scheduled-run history: across 1513 completed
+ * scheduled runs the longest silence WITHIN a working turn was 120.2 s (p99
+ * 41.0 s; 5 runs above 60 s). A shorter grace would release the lease while the
+ * adapter is still working and re-admit a prompt into a busy turn, which is the
+ * FLEET-003 failure itself. The costs are deliberately asymmetric: holding too
+ * long skips one best-effort maintenance tick, releasing too early SIGTERMs a
+ * live role.
+ */
+export declare const STEERING_OCCUPANCY_IDLE_MS = 150000;
 /** Server-generated typed provenance followed by the exact human-authored body. */
 export declare function promptContentBlocks(text: string, origin?: PromptOrigin): acp.ContentBlock[];
 export declare function runtimeSelector(options: acp.SessionConfigOption[] | null | undefined, category: string): RuntimeSelectorMetadata | undefined;
@@ -20,6 +36,22 @@ export interface AcpSessionOptions {
     modeId?: string;
     /** Adapter-resolved live permission policy; separate from ACP agent-specific session modes. */
     permissionMode?: NonNullable<SessionSnapshot['permissionMode']>;
+    /** Adapter-authenticated request-metadata vocabulary; never inferred from ACP `_meta`. */
+    permissionMetadataSource?: 'codex-acp';
+    /**
+     * MCP servers the ROLE declares, for every session/new, resume and load. Empty
+     * or omitted sends `[]`, which is what fleet has always sent and leaves the
+     * agent's own configuration untouched.
+     */
+    mcpServers?: AcpMcpServer[];
+    /**
+     * Adapter-supplied `_meta` for session/new — the only route by which a
+     * capability the CLI takes as a flag reaches an agent that accepts none.
+     * Per-agent vocabulary, so the ADAPTER decides whether there is anything to
+     * send; this layer only forwards it. Never sent on resume or load: it carries
+     * session-creation options the agent has already applied.
+     */
+    sessionMeta?: Record<string, unknown>;
     log(line: string): void;
     /** Test seam for the cancel-escalation grace period; production uses the default. */
     cancelGraceMs?: number;
@@ -31,6 +63,8 @@ export interface AcpSessionOptions {
     controllerGraceMs?: number;
     /** Test seam; production uses AFTER_TOOL_BOUNDARY_TIMEOUT_MS. */
     afterToolBoundaryTimeoutMs?: number;
+    /** Test seam; production uses STEERING_OCCUPANCY_IDLE_MS. */
+    steeringOccupancyIdleMs?: number;
 }
 /**
  * Classify an ACP `stopReason` into a terminal outcome. A refusal and a
@@ -49,6 +83,8 @@ export declare class AcpSession implements SessionHandle {
     private readonly child;
     private readonly events;
     private readonly conversation;
+    /** Cursor before this runner generation began; older durable events stay off the live console. */
+    private readonly conversationStartCursor?;
     /** New on every runner start; permission/turn IDs from prior generations are stale. */
     private readonly sessionGeneration;
     /** True while `session/load` replays history as ordinary updates. */
@@ -58,6 +94,12 @@ export declare class AcpSession implements SessionHandle {
     private connection;
     private sessionId?;
     private readiness;
+    /**
+     * Last non-replayed session update from the agent. `readiness` cannot answer
+     * "is this agent working" for a steered turn (FLEET-002), and this is the
+     * evidence that can.
+     */
+    private lastUpdateAt?;
     private lastError?;
     private promptTail;
     private queueDepth;
@@ -73,6 +115,13 @@ export declare class AcpSession implements SessionHandle {
     private cancelEscalation?;
     private cancelForceKill?;
     private cancelRecoveryReason?;
+    /**
+     * Held while a steering-started turn is believed to own the adapter. It is a
+     * lease, not a latch: `steeringRelease` always fires, so the role can never be
+     * stranded busy by a wake whose turn ended without telling anyone.
+     */
+    private steeringOccupied;
+    private steeringRelease?;
     /**
      * Rejects the moment the adapter process is gone. Every in-flight ACP request
      * races it, so a dead adapter can never leave a turn — and therefore a
@@ -87,13 +136,27 @@ export declare class AcpSession implements SessionHandle {
     private constructor();
     static start(options: AcpSessionOptions): Promise<AcpSession>;
     /**
-     * Honest restart recovery (spec §5.3): a prompt that was admitted but never
+     * Honest restart recovery: a prompt that was admitted but never
      * started is safe to dispatch again; a turn that had already started may
      * have caused side effects, so it is closed as `unknown_after_restart` —
      * never silently replayed.
      */
     private recoverOpenPrompts;
     isAlive(): boolean;
+    /**
+     * Take the occupancy lease for a turn the adapter started on its own behalf.
+     * Refreshed by every adapter update, so it tracks work actually happening
+     * rather than a fixed guess at how long a wake takes.
+     */
+    private holdSteeringOccupancy;
+    private refreshSteeringOccupancy;
+    /**
+     * Every exit from occupancy comes through here, including the ones that are
+     * not the timer: a real turn boundary, close, and adapter exit. A lease that
+     * can leak is worse than the bug it fixes — it would leave the role reporting
+     * `running` forever and starve scheduled admission permanently.
+     */
+    private releaseSteeringOccupancy;
     snapshot(): SessionSnapshot;
     private toolCall;
     private reserveTool;
@@ -126,11 +189,33 @@ export declare class AcpSession implements SessionHandle {
      * for it is what turned a busy agent into a timeout and then into "dead".
      */
     queuePrompt(text: string, options?: SubmitPromptOptions): Promise<QueuedPrompt>;
+    /**
+     * Prepare the session for a prompt that asked to pre-empt current work.
+     *
+     * The old behaviour was one unconditional `session/cancel` notification
+     * followed immediately by `session/prompt`. That is what produced the owner's
+     * "request failed before completion":
+     *
+     *  - `cancelActive` only awaits settlement when `this.activeTurn` is set, and
+     *    a turn the ADAPTER started (steering's `startedNewTurn`) is never tracked
+     *    here. So the cancel raced the adapter's own transcript repair and the new
+     *    prompt landed while the last assistant message still held an unresolved
+     *    `tool_use` — rejected with `stop_reason=tool_use`.
+     *  - With nothing running at all, it still sent the cancel, and the prompt
+     *    landed on a bare interrupted user message — rejected with
+     *    `stop_reason=null`.
+     *
+     * So: never cancel across a tool boundary, and never cancel something whose
+     * settlement cannot be awaited. Everything else is queued, which the ACP queue
+     * already does correctly. The returned state is what the caller may claim to a
+     * human — `interrupted` only when a turn really was cancelled.
+     */
+    private prepareInterruptingDelivery;
     /**
      * Durably record a prompt admission BEFORE acceptance is returned. Browser
      * admissions are transactional — a prompt the ledger cannot hold is refused,
      * because an acknowledged-then-lost prompt is worse than an error. Every
-     * other source degrades to best-effort so the agent keeps working (§5.3).
+     * other source degrades to best-effort so the agent keeps working.
      */
     private admitToLedger;
     /** Idempotent browser prompt admission (control v3 `submit_prompt_v2`). */
@@ -173,6 +258,15 @@ export declare class AcpSession implements SessionHandle {
     private settlePendingAutomatically;
     exitResult(): ExitRecord | null;
     close(): Promise<void>;
+    /**
+     * The role's declared MCP servers, or `[]`.
+     *
+     * Sent on resume and load as well as on new: the agent builds its server set
+     * once per session, so a resumed session that omitted them would come back
+     * without the tools the role's config declares — which is exactly the shape of
+     * silent drop this plumbing exists to end.
+     */
+    private declaredMcpServers;
     private initialize;
     private captureRuntimeMetadata;
     private runPrompt;
@@ -185,6 +279,15 @@ export declare class AcpSession implements SessionHandle {
      */
     private settleAutomatically;
     private withinAutomaticBoundary;
+    /**
+     * Codex ACP 1.1.7 marks its protected MCP elicitation bridge on a locationless
+     * execute request. The marker is meaningful only together with the runner's
+     * independently supplied, adapter-authenticated metadata vocabulary and effective
+     * mode: an arbitrary ACP process cannot gain this path by copying `_meta` alone.
+     * Exact option ids/kinds bind recognition to the protected-MCP shape and keep
+     * malformed requests on the ordinary fail-closed path.
+     */
+    private isEffectiveCodexProtectedMcpApproval;
     private recordUpdate;
     /**
      * Codex ACP's phase extension is the only currently supported visibility
@@ -199,5 +302,6 @@ export declare class AcpSession implements SessionHandle {
     }): ConversationHandlePage;
     conversationSnapshot(): ConversationSnapshot;
     subscribeConversation(listener: Parameters<ConversationEventStore['subscribe']>[0]): () => void;
+    private isCurrentConversationEvent;
     private fail;
 }

package/dist/session/acp.js

@@ -12,10 +12,25 @@ const CANCEL_SETTLE_GRACE_MS = 15_000;
 const CANCEL_TERMINATE_GRACE_MS = 5_000;
 /** A permission no human answered is eventually a decision nobody made. */
 const PERMISSION_TIMEOUT_MS = 10 * 60_000;
-/** Spec §4.3: 10-15 s before a vanished controller triggers the unattended policy. */
+/** Wait 10–15 seconds before a vanished controller triggers the unattended policy. */
 const CONTROLLER_GRACE_MS = 12_000;
 /** Bound safe-boundary waiting without turning a hung tool into cancellation. */
 export const AFTER_TOOL_BOUNDARY_TIMEOUT_MS = 120_000;
+/**
+ * How long a steering-started turn is presumed to still own the adapter after
+ * its last update. Such a turn has no prompt id, so it never reports a
+ * stopReason and there is no exact end to observe — silence is the only signal
+ * available, and this is the bound that turns it into a decision.
+ *
+ * Sized from the fleet's own scheduled-run history: across 1513 completed
+ * scheduled runs the longest silence WITHIN a working turn was 120.2 s (p99
+ * 41.0 s; 5 runs above 60 s). A shorter grace would release the lease while the
+ * adapter is still working and re-admit a prompt into a busy turn, which is the
+ * FLEET-003 failure itself. The costs are deliberately asymmetric: holding too
+ * long skips one best-effort maintenance tick, releasing too early SIGTERMs a
+ * live role.
+ */
+export const STEERING_OCCUPANCY_IDLE_MS = 150_000;
 const TERMINAL_TOOL_STATUSES = new Set(['completed', 'failed']);
 const SCHEDULED_LOOP_REDACTION = '[scheduled-loop content redacted]';
 const OWNER_COMMENTARY_REDACTION = '[assistant commentary redacted]';
@@ -136,7 +151,7 @@ function canonicallyWithin(root, candidates) {
  * Map typed prompt provenance to the conversation ledger's source vocabulary.
  * Only operator-authored local sources may persist prompt bodies; external
  * E2E bodies (owner channel, monitor wakes) and scheduled-loop content are
- * recorded as digest/size placeholders (spec §8.3).
+ * recorded as digest/size placeholders.
  */
 function conversationSource(origin) {
     switch (origin?.kind) {
@@ -193,6 +208,8 @@ export class AcpSession {
     child;
     events;
     conversation;
+    /** Cursor before this runner generation began; older durable events stay off the live console. */
+    conversationStartCursor;
     /** New on every runner start; permission/turn IDs from prior generations are stale. */
     sessionGeneration = randomUUID();
     /** True while `session/load` replays history as ordinary updates. */
@@ -202,6 +219,12 @@ export class AcpSession {
     connection;
     sessionId;
     readiness = 'starting';
+    /**
+     * Last non-replayed session update from the agent. `readiness` cannot answer
+     * "is this agent working" for a steered turn (FLEET-002), and this is the
+     * evidence that can.
+     */
+    lastUpdateAt;
     lastError;
     promptTail = Promise.resolve();
     queueDepth = 0;
@@ -217,6 +240,13 @@ export class AcpSession {
     cancelEscalation;
     cancelForceKill;
     cancelRecoveryReason;
+    /**
+     * Held while a steering-started turn is believed to own the adapter. It is a
+     * lease, not a latch: `steeringRelease` always fires, so the role can never be
+     * stranded busy by a wake whose turn ended without telling anyone.
+     */
+    steeringOccupied = false;
+    steeringRelease;
     /**
      * Rejects the moment the adapter process is gone. Every in-flight ACP request
      * races it, so a dead adapter can never leave a turn — and therefore a
@@ -237,6 +267,7 @@ export class AcpSession {
         this.conversation = new ConversationEventStore(join(options.stateDir, '.conversation'), {
             roleId: options.name, log: line => options.log(`[${options.name}] ${line}`),
         });
+        this.conversationStartCursor = this.conversation.lastCursor();
         this.sessionFile = join(options.stateDir, '.acp-session-id');
         this.terminated = new Promise((_resolve, reject) => { this.terminate = reject; });
         // Nothing awaits this promise until a request races it; an unobserved
@@ -247,6 +278,7 @@ export class AcpSession {
             if (this.cancelForceKill)
                 clearTimeout(this.cancelForceKill);
             this.cancelForceKill = undefined;
+            this.releaseSteeringOccupancy('adapter exited');
             // Record the child's real exit code/signal. The tmux path can only see a
             // shell's `$?`; here the truth is available, so keep it.
             const classified = classifyChildExit(code, signal);
@@ -306,7 +338,7 @@ export class AcpSession {
         }
     }
     /**
-     * Honest restart recovery (spec §5.3): a prompt that was admitted but never
+     * Honest restart recovery: a prompt that was admitted but never
      * started is safe to dispatch again; a turn that had already started may
      * have caused side effects, so it is closed as `unknown_after_restart` —
      * never silently replayed.
@@ -347,17 +379,60 @@ export class AcpSession {
         // terminal fact (signal exits deliberately leave exitCode null).
         return this.child.exitCode === null && (this.child.signalCode ?? null) === null;
     }
+    /**
+     * Take the occupancy lease for a turn the adapter started on its own behalf.
+     * Refreshed by every adapter update, so it tracks work actually happening
+     * rather than a fixed guess at how long a wake takes.
+     */
+    holdSteeringOccupancy() {
+        if (this.closing || !this.isAlive())
+            return;
+        this.steeringOccupied = true;
+        this.refreshSteeringOccupancy();
+    }
+    refreshSteeringOccupancy() {
+        if (!this.steeringOccupied)
+            return;
+        if (this.steeringRelease)
+            clearTimeout(this.steeringRelease);
+        this.steeringRelease = setTimeout(() => this.releaseSteeringOccupancy('adapter silent'), this.options.steeringOccupancyIdleMs ?? STEERING_OCCUPANCY_IDLE_MS);
+        this.steeringRelease.unref?.();
+    }
+    /**
+     * Every exit from occupancy comes through here, including the ones that are
+     * not the timer: a real turn boundary, close, and adapter exit. A lease that
+     * can leak is worse than the bug it fixes — it would leave the role reporting
+     * `running` forever and starve scheduled admission permanently.
+     */
+    releaseSteeringOccupancy(reason) {
+        if (this.steeringRelease)
+            clearTimeout(this.steeringRelease);
+        this.steeringRelease = undefined;
+        if (!this.steeringOccupied)
+            return;
+        this.steeringOccupied = false;
+        this.options.log(`[${this.options.name}] steering-started turn no longer holds the adapter (${reason})`);
+    }
     snapshot() {
         return {
             backend: 'acp',
             alive: this.isAlive(),
-            readiness: this.readiness,
+            // A steering-started turn is real work with no prompt id. Reporting the
+            // session idle while it runs is what let the arbiter admit a scheduled
+            // prompt into a busy adapter, whose `session/prompt` then never returned
+            // a stopReason and ended in a cancellation deadline and a SIGTERM.
+            readiness: this.readiness === 'idle' && this.steeringOccupied
+                ? 'running' : this.readiness,
             sessionId: this.sessionId,
             lastError: this.lastError,
             pendingPermissionId: this.pendingPermissions.keys().next().value,
             runtimeModel: this.runtimeModel,
             reasoningEffort: this.reasoningEffort,
             permissionMode: this.options.permissionMode,
+            activity: {
+                activeToolCalls: this.activeToolCalls.size,
+                ...(this.lastUpdateAt ? { lastUpdateAt: this.lastUpdateAt } : {}),
+            },
         };
     }
     toolCall(toolCallId) {
@@ -526,15 +601,19 @@ export class AcpSession {
             throw new SessionControlError('control-unavailable', 'ACP adapter restart is in progress after the cancellation deadline', ACP_CANCEL_DEADLINE_EXCEEDED);
         if (this.closing || !this.sessionId || !this.isAlive())
             throw new SessionControlError('offline', this.lastError ?? 'ACP session is offline');
-        if (options.interrupt)
-            await this.cancelActive(options.interruptSource ?? 'local-console');
+        const delivery = options.interrupt
+            ? await this.prepareInterruptingDelivery(options.interruptSource ?? 'local-console')
+            : undefined;
         // Interrupting delivery must still use steering when supported. With no
         // live turn, the extension starts one and acknowledges `startedNewTurn`
         // immediately; a normal session/prompt would keep the monitor blocked until
         // the entire wake-triggered turn terminated.
         if (options.steer && this.steeringSupported) {
             const promptId = randomUUID();
-            return { promptId, queuedBehind: 0, completion: this.steerPrompt(text), origin: options.origin };
+            return {
+                promptId, queuedBehind: 0, completion: this.steerPrompt(text), origin: options.origin,
+                ...(delivery ? { delivery } : {}),
+            };
         }
         const promptId = randomUUID();
         const queuedBehind = this.queueDepth;
@@ -546,13 +625,52 @@ export class AcpSession {
             this.queueDepth = Math.max(0, this.queueDepth - 1);
             return turnResult(false, 'failed', error?.message ?? String(error));
         });
-        return { promptId, queuedBehind, completion, origin: options.origin };
+        return {
+            promptId, queuedBehind, completion, origin: options.origin,
+            delivery: delivery ?? (queuedBehind > 0 ? 'queued' : 'started'),
+        };
+    }
+    /**
+     * Prepare the session for a prompt that asked to pre-empt current work.
+     *
+     * The old behaviour was one unconditional `session/cancel` notification
+     * followed immediately by `session/prompt`. That is what produced the owner's
+     * "request failed before completion":
+     *
+     *  - `cancelActive` only awaits settlement when `this.activeTurn` is set, and
+     *    a turn the ADAPTER started (steering's `startedNewTurn`) is never tracked
+     *    here. So the cancel raced the adapter's own transcript repair and the new
+     *    prompt landed while the last assistant message still held an unresolved
+     *    `tool_use` — rejected with `stop_reason=tool_use`.
+     *  - With nothing running at all, it still sent the cancel, and the prompt
+     *    landed on a bare interrupted user message — rejected with
+     *    `stop_reason=null`.
+     *
+     * So: never cancel across a tool boundary, and never cancel something whose
+     * settlement cannot be awaited. Everything else is queued, which the ACP queue
+     * already does correctly. The returned state is what the caller may claim to a
+     * human — `interrupted` only when a turn really was cancelled.
+     */
+    async prepareInterruptingDelivery(source) {
+        if (!this.sessionId)
+            return 'started';
+        // No fleet-tracked turn to await. Either the session is idle — cancelling it
+        // corrupts the transcript for no gain — or the adapter is running a turn
+        // fleet never started, whose settlement nothing here can wait for. Queue in
+        // both cases: the ACP queue already orders this correctly.
+        if (!this.activeTurn)
+            return this.activeToolCalls.size > 0 ? 'deferred' : 'started';
+        // A tracked turn IS safe to cancel: cancelActive settles pending permissions
+        // and awaits the turn's own settlement before this returns, so the prompt
+        // below cannot race the adapter's transcript repair.
+        await this.cancelActive(source);
+        return 'interrupted';
     }
     /**
      * Durably record a prompt admission BEFORE acceptance is returned. Browser
      * admissions are transactional — a prompt the ledger cannot hold is refused,
      * because an acknowledged-then-lost prompt is worse than an error. Every
-     * other source degrades to best-effort so the agent keeps working (§5.3).
+     * other source degrades to best-effort so the agent keeps working.
      */
     admitToLedger(promptId, text, queuedBehind, options) {
         const { source, persistBody } = conversationSource(options.origin);
@@ -855,6 +973,7 @@ export class AcpSession {
         if (this.controllerGrace)
             clearTimeout(this.controllerGrace);
         this.controllerGrace = undefined;
+        this.releaseSteeringOccupancy('session closed');
         for (const [permissionId, pending] of [...this.pendingPermissions])
             this.settlePendingAutomatically(permissionId, pending, 'cancelled', undefined, 'the session closed while this request was pending');
         this.releaseAllTools();
@@ -872,6 +991,17 @@ export class AcpSession {
         });
         this.conversation.close();
     }
+    /**
+     * The role's declared MCP servers, or `[]`.
+     *
+     * Sent on resume and load as well as on new: the agent builds its server set
+     * once per session, so a resumed session that omitted them would come back
+     * without the tools the role's config declares — which is exactly the shape of
+     * silent drop this plumbing exists to end.
+     */
+    declaredMcpServers() {
+        return this.options.mcpServers ?? [];
+    }
     async initialize() {
         const initialized = await this.connection.agent.request(acp.methods.agent.initialize, {
             protocolVersion: acp.PROTOCOL_VERSION,
@@ -891,7 +1021,7 @@ export class AcpSession {
             const resumed = await this.connection.agent.request(acp.methods.agent.session.resume, {
                 sessionId: persisted,
                 cwd: this.options.cwd,
-                mcpServers: [],
+                mcpServers: this.declaredMcpServers(),
             });
             this.captureRuntimeMetadata(resumed.configOptions);
             this.sessionId = persisted;
@@ -904,7 +1034,7 @@ export class AcpSession {
                 const loaded = await this.connection.agent.request(acp.methods.agent.session.load, {
                     sessionId: persisted,
                     cwd: this.options.cwd,
-                    mcpServers: [],
+                    mcpServers: this.declaredMcpServers(),
                 });
                 this.captureRuntimeMetadata(loaded.configOptions);
             }
@@ -916,7 +1046,8 @@ export class AcpSession {
         else {
             const created = await this.connection.agent.request(acp.methods.agent.session.new, {
                 cwd: this.options.cwd,
-                mcpServers: [],
+                mcpServers: this.declaredMcpServers(),
+                ...(this.options.sessionMeta ? { _meta: this.options.sessionMeta } : {}),
             });
             this.sessionId = created.sessionId;
             this.captureRuntimeMetadata(created.configOptions);
@@ -1013,6 +1144,10 @@ export class AcpSession {
         }
         finally {
             this.releaseAllTools();
+            // A turn this client owned has ended, so the adapter has reported a
+            // boundary: whatever a steering call started before it is over too. This
+            // is the release path that does not depend on the silence timer.
+            this.releaseSteeringOccupancy('turn boundary');
             if (this.activeTurn?.id === turnId) {
                 this.activeTurn.settle();
                 if (this.cancelEscalation)
@@ -1035,6 +1170,12 @@ export class AcpSession {
             ]);
             if (response.outcome === 'failed')
                 return turnResult(false, 'failed', 'ACP steering failed');
+            // `injected` joined a turn this client already owns and will settle.
+            // `startedNewTurn` created one nobody owns: the adapter is working and
+            // will never answer for it, so admission has to learn about it here or
+            // not at all.
+            if (response.outcome === 'startedNewTurn')
+                this.holdSteeringOccupancy();
             return turnResult(true, 'inconclusive', response.outcome);
         }
         catch (error) {
@@ -1062,6 +1203,17 @@ export class AcpSession {
         // Permission is part of the tool lifecycle. Reserve before any policy or
         // human decision so a monitor wake cannot slip between request and answer.
         this.reservePermission(toolCallId, permissionId);
+        if (this.isEffectiveCodexProtectedMcpApproval(params)) {
+            // Protected MCP approval is already the tool's narrow gate. Never turn
+            // this one decision into an adapter-wide standing grant.
+            const option = choose(['allow_once']);
+            const response = this.settleAutomatically(params, option, 'allowed', 'permissionMode.fleetMode=allow', 'the trusted Codex adapter authenticated a protected MCP approval request');
+            if (option)
+                this.allowPermission(toolCallId, permissionId);
+            else
+                this.releasePermission(toolCallId, permissionId);
+            return Promise.resolve(response);
+        }
         if (this.options.permissions.approval === 'allow' && this.withinAutomaticBoundary(params)) {
             const option = choose(['allow_always', 'allow_once']);
             const response = this.settleAutomatically(params, option, 'allowed', 'permissions.approval=allow', `the request is inside the ${this.options.permissions.filesystem} boundary`);
@@ -1188,7 +1340,34 @@ export class AcpSession {
         const cwd = resolve(this.options.cwd);
         return canonicallyWithin(cwd, locations.map(location => resolve(location.path)));
     }
+    /**
+     * Codex ACP 1.1.7 marks its protected MCP elicitation bridge on a locationless
+     * execute request. The marker is meaningful only together with the runner's
+     * independently supplied, adapter-authenticated metadata vocabulary and effective
+     * mode: an arbitrary ACP process cannot gain this path by copying `_meta` alone.
+     * Exact option ids/kinds bind recognition to the protected-MCP shape and keep
+     * malformed requests on the ordinary fail-closed path.
+     */
+    isEffectiveCodexProtectedMcpApproval(params) {
+        const locations = params.toolCall.locations ?? [];
+        return this.options.permissionMetadataSource === 'codex-acp'
+            && this.options.permissionMode?.fleetMode === 'allow'
+            && params.toolCall.kind === 'execute'
+            && params.toolCall.status === 'pending'
+            && locations.length === 0
+            && params._meta?.is_mcp_tool_approval === true
+            && params.options.some(option => option.optionId === 'allow_once' && option.kind === 'allow_once')
+            && params.options.some(option => option.optionId === 'decline' && option.kind === 'reject_once');
+    }
     recordUpdate(update) {
+        // Replayed history is not current activity: `session/load` would otherwise
+        // make a cold session look like it had just been working. The same reason
+        // keeps it from extending the steering lease, which is evidence the adapter
+        // is working right now — for a steering-started turn, the only evidence.
+        if (!this.replaying) {
+            this.lastUpdateAt = new Date().toISOString();
+            this.refreshSteeringOccupancy();
+        }
         const scheduled = this.activeTurn?.origin?.kind === 'scheduled-loop';
         const messagePhase = update.sessionUpdate === 'agent_message_chunk'
             ? this.codexMessagePhase(update) : undefined;
@@ -1288,7 +1467,25 @@ export class AcpSession {
     }
     // ── conversation ledger access (SessionHandle) ─────────────────────────────
     conversationPage(request = {}) {
-        return { ...this.conversation.page(request), snapshot: this.conversationSnapshot() };
+        const floor = Number(this.conversationStartCursor ?? 0);
+        const requested = Number(request.after ?? 0);
+        let after = String(Math.max(Number.isSafeInteger(floor) ? floor : 0, Number.isSafeInteger(requested) ? requested : 0));
+        const limit = Math.min(Math.max(request.limit ?? 200, 1), 1_000);
+        let page = this.conversation.page({ after, limit });
+        let visible = page.events.filter(event => this.isCurrentConversationEvent(event));
+        // A resumed adapter may replay a page made entirely of prior session/load
+        // history. Advance over it without exposing it or making the browser stop
+        // before later current-session records.
+        while (!visible.length && page.hasMore && page.nextCursor && page.nextCursor !== after) {
+            after = page.nextCursor;
+            page = this.conversation.page({ after, limit });
+            visible = page.events.filter(event => this.isCurrentConversationEvent(event));
+        }
+        return {
+            ...page,
+            events: visible,
+            snapshot: this.conversationSnapshot(),
+        };
     }
     conversationSnapshot() {
         return {
@@ -1300,7 +1497,13 @@ export class AcpSession {
         };
     }
     subscribeConversation(listener) {
-        return this.conversation.subscribe(listener);
+        return this.conversation.subscribe(event => {
+            if (this.isCurrentConversationEvent(event))
+                listener(event);
+        });
+    }
+    isCurrentConversationEvent(event) {
+        return event.sessionGeneration === this.sessionGeneration && event.source !== 'agent_replay';
     }
     fail(error) {
         this.lastError = error?.message ?? String(error);

package/dist/session/activity.d.ts

@@ -0,0 +1,31 @@
+import type { SessionActivity } from './types.js';
+/**
+ * How long after the agent's last session update it still counts as working.
+ *
+ * FLEET-002: a wake delivered by ACP steering answers `startedNewTurn` and runs
+ * an entire turn that fleet never receives a `session/prompt` response for (ACP
+ * has no turn-end session update), so `readiness` stays `idle` throughout. Tool
+ * reservations and update recency are the only activity evidence fleet holds.
+ * The trade-off is deliberate and one-directional: at worst a role reads busy
+ * for one window after it genuinely stopped, instead of reading ready — or
+ * being classified stalled — while it is executing tools.
+ */
+export declare const ACTIVITY_WINDOW_MS = 60000;
+export type ActivityState = 'active' | 'quiet' | 'unobservable';
+export interface ObservedActivity {
+    state: ActivityState;
+    activeToolCalls?: number;
+    lastUpdateAt?: string;
+}
+/**
+ * Classify agent-side activity. `unobservable` is NOT `quiet`: a backend that
+ * cannot see the agent (tmux) has no evidence, and no evidence must never be
+ * reported as "doing nothing".
+ */
+export declare function classifyActivity(activity: SessionActivity | undefined, now?: number): ObservedActivity;
+/**
+ * One operator-facing line that never lets turn occupancy pose as liveness:
+ * the readiness value is labelled as the turn field it is, and the activity
+ * verdict is stated separately with the evidence behind it.
+ */
+export declare function describeSessionState(readiness: string | undefined, activity: SessionActivity | undefined, now?: number): string;