@ours.network/fleet 0.9.3 → 0.10.0-nightly.1

package/dist/harness/codex.js

@@ -14,8 +14,16 @@ const APPROVAL_POLICIES = ['untrusted', 'on-request', 'never'];
 /** Resolve & validate the per-role sandbox mode, throwing on an unknown value. */
 function sandboxMode(role) {
     const s = role.harness_options?.sandbox;
-    if (s == null)
+    if (s == null) {
+        const filesystem = role.permissions?.filesystem;
+        if (filesystem === 'read-only')
+            return 'read-only';
+        if (filesystem === 'unrestricted')
+            return 'danger-full-access';
+        if (filesystem === 'workspace')
+            return 'workspace-write';
         return undefined;
+    }
     if (!SANDBOX_MODES.includes(s))
         throw new Error(`invalid harness_options.sandbox "${s}"; allowed: ${SANDBOX_MODES.join(', ')}`);
     return s;
@@ -24,8 +32,14 @@ function sandboxMode(role) {
 function approvalPolicy(role) {
     const o = role.harness_options;
     const a = o?.approval ?? o?.permission_mode;
-    if (a == null)
+    if (a == null) {
+        const approval = role.permissions?.approval;
+        if (approval === 'allow')
+            return 'never';
+        if (approval === 'ask' || approval === 'deny')
+            return 'on-request';
         return undefined;
+    }
     if (!APPROVAL_POLICIES.includes(a))
         throw new Error(`invalid harness_options.approval "${a}"; allowed: ${APPROVAL_POLICIES.join(', ')}`);
     return a;
@@ -173,6 +187,29 @@ export function makeCodexAdapter(exec = realExec) {
                     this.vocabulary.restartPrompt(role.identity, join(stateDir, 'WORKLOG.md'), role)];
             return { argv, env: prep.env };
         },
+        buildAcpLaunch(role, prep) {
+            const configured = role.session_options?.acp?.command;
+            const argv = Array.isArray(configured)
+                ? [...configured]
+                : typeof configured === 'string'
+                    ? ['sh', '-c', configured]
+                    : ['codex-acp'];
+            return { argv, env: prep.env };
+        },
+        translatePermissions(permissions) {
+            return {
+                native: {
+                    approval: permissions.approval === 'allow' ? 'never' : 'on-request',
+                    sandbox: permissions.filesystem === 'read-only'
+                        ? 'read-only'
+                        : permissions.filesystem === 'unrestricted'
+                            ? 'danger-full-access'
+                            : 'workspace-write',
+                },
+                exact: true,
+                warnings: [],
+            };
+        },
         vocabulary: {
             bindTool: 'choose_identity',
             createTool: 'create_identity',

package/dist/harness/types.d.ts

@@ -1,4 +1,4 @@
-import type { ResolvedRole } from '../config.js';
+import type { CommonPermissions, ResolvedRole } from '../config.js';
 export interface PrereqCheck {
     name: string;
     ok: boolean;
@@ -26,6 +26,15 @@ export interface Launch {
     argv: string[];
     env: Record<string, string>;
 }
+export interface AcpLaunch {
+    argv: string[];
+    env: Record<string, string>;
+}
+export interface PermissionTranslation {
+    native: Record<string, unknown>;
+    exact: boolean;
+    warnings: string[];
+}
 /** Harness-correct wording/tool names used to generate briefing.md. */
 export interface BriefingVocab {
     bindTool: string;
@@ -57,6 +66,8 @@ export interface HarnessAdapter {
     validateOptions(opts: unknown): ValidationError[];
     prepareSession(role: ResolvedRole, dirs: RoleDirs): Promise<SessionPrep>;
     buildLaunch(role: ResolvedRole, mode: 'fresh' | 'resume', s: SessionState, prep: SessionPrep): Launch;
+    buildAcpLaunch?(role: ResolvedRole, prep: SessionPrep): AcpLaunch;
+    translatePermissions?(permissions: CommonPermissions): PermissionTranslation;
     vocabulary: BriefingVocab;
     exitPolicy: ExitPolicy;
 }

package/dist/index.d.ts

@@ -1,6 +1,9 @@
-export { loadConfig, findRole, ConfigError } from './config.js';
-export type { FleetConfig, ResolvedRole, RoleConfig, OverseeEntry } from './config.js';
-export type { HarnessAdapter, BriefingVocab, ExitPolicy, PrereqReport, PrereqCheck, SessionPrep, SessionState, Launch, RoleDirs, ValidationError, } from './harness/types.js';
+export { loadConfig, findRole, resolvePermissions, ConfigError } from './config.js';
+export type { FleetConfig, ResolvedRole, RoleConfig, OverseeEntry, SessionBackendId, CommonPermissions, SessionOptions, } from './config.js';
+export type { HarnessAdapter, BriefingVocab, ExitPolicy, PrereqReport, PrereqCheck, SessionPrep, SessionState, Launch, AcpLaunch, PermissionTranslation, RoleDirs, ValidationError, } from './harness/types.js';
+export type { SessionHandle, SessionSnapshot, SessionEvent, TurnResult, } from './session/types.js';
+export { AcpSession } from './session/acp.js';
+export { TmuxSession } from './session/tmux.js';
 export { registerAdapter, getAdapter, knownAdapters } from './harness/registry.js';
 export { claudeCodeAdapter, makeClaudeCodeAdapter } from './harness/claude-code.js';
 export { codexAdapter, makeCodexAdapter } from './harness/codex.js';

package/dist/index.js

@@ -1,4 +1,6 @@
-export { loadConfig, findRole, ConfigError } from './config.js';
+export { loadConfig, findRole, resolvePermissions, ConfigError } from './config.js';
+export { AcpSession } from './session/acp.js';
+export { TmuxSession } from './session/tmux.js';
 export { registerAdapter, getAdapter, knownAdapters } from './harness/registry.js';
 export { claudeCodeAdapter, makeClaudeCodeAdapter } from './harness/claude-code.js';
 export { codexAdapter, makeCodexAdapter } from './harness/codex.js';

package/dist/monitor.d.ts

@@ -38,6 +38,13 @@ export interface MonitorDeps {
         set(fn: () => void, ms: number): ReturnType<typeof setTimeout>;
         clear(t: ReturnType<typeof setTimeout>): void;
     };
+    /** Structured prompt delivery used by ACP sessions. Tmux remains the fallback. */
+    delivery?: {
+        submit(text: string): Promise<{
+            accepted: boolean;
+            detail?: string;
+        }>;
+    };
 }
 /** Best-effort daemon config (issue #17): the fields the MCP client reads. */
 interface DaemonConfig {
@@ -80,9 +87,19 @@ export declare function filterEvents(events: NotifyEvent[], wakeSources: string[
 export declare function formatNotificationLine(events: NotifyEvent[]): string;
 /**
  * Heuristic: does the pane show a modal selection dialog we must not `Enter`
- * into? Markers are the deployed Claude Code trust/permission dialogs — a `❯`
- * pointer beside numbered options, or a "Do you want …" prompt (design §3.2,
- * open question (a): refine empirically). A running turn is NOT modal.
+ * into? Two independent signals, both requiring the *option* shape, not just a
+ * loose numbered line:
+ *
+ *  1. the `❯` pointer sitting on a numbered option — `❯ 1. Use this MCP server`;
+ *  2. a dialog marker ("Do you want …", "Enter to confirm") with ≥2 numbered
+ *     options within `OPTION_WINDOW` lines — this still catches a dialog captured
+ *     mid-redraw, before its pointer row is painted.
+ *
+ * A running turn, a prose list, and a markdown step list are all NOT modal.
+ * Erring modal is the safe direction (a wake is retried; an `Enter` into a live
+ * permission dialog is not undoable), which is why signal 2 is kept — but a bare
+ * marker with no options no longer suffices, because Claude Code closes turns
+ * with exactly that prose ("Do you want me to open the PR?").
  */
 export declare function looksModal(pane: string): boolean;
 /**
@@ -102,6 +119,8 @@ export declare function looksApiError(pane: string): boolean;
 export declare function looksRunning(pane: string): boolean;
 export interface MonitorOpts {
     name: string;
+    /** Ours identity whose notification stream is authoritative (may differ from role name). */
+    identity?: string;
     agentDir: string;
     cfg: MonitorConfig;
     deps: MonitorDeps;
@@ -114,12 +133,16 @@ export interface MonitorHandle {
 }
 export declare class Monitor {
     private readonly name;
+    private readonly identity;
     private readonly cfg;
     private readonly deps;
     private readonly ep;
     private readonly statusPath;
     private readonly cursorPath;
+    private readonly statePath;
     private cursor;
+    private deliveredCursor;
+    private pendingState;
     private fatal;
     private stopped;
     private bootDeadline;
@@ -127,7 +150,7 @@ export declare class Monitor {
     private apiErrorStreak;
     private readonly turnFailThreshold;
     constructor(o: MonitorOpts);
-    /** Prime at the stream tip (or resume a persisted cursor if the daemon is down). */
+    /** Resume the last delivered cursor; only a brand-new monitor primes at stream tip. */
     prime(): Promise<void>;
     /** Long-poll → filter → coalesce → inject, until the pane pid dies or stop(). */
     run(pid: number): Promise<void>;
@@ -154,12 +177,19 @@ export declare class Monitor {
      * no-ops (delivery is still verified downstream).
      */
     private clearComposer;
-    /** Block until the console can accept input; classify offline/stopped/ready. */
+    /**
+     * Block until the console can accept input; classify offline/stopped/ready, or
+     * `modal` when the pane still looks modal after `MODAL_GIVE_UP_MS`. The bound is
+     * what keeps a modal from wedging delivery silently: we still never `Enter` into
+     * the dialog, but the give-up is reported instead of retried forever.
+     */
     private awaitInjectable;
     private doFetch;
     private advance;
     private persistCursor;
     private readPersistedCursor;
+    /** Atomically persist body-free delivery state; restart always resumes from deliveredCursor. */
+    private persistState;
     private setStatus;
 }
 export declare function createMonitor(o: MonitorOpts): Monitor;

package/dist/monitor.js

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 // Code constants (not config — YAGNI, design §2).
@@ -9,6 +9,15 @@ const BOOT_GRACE_MS = 15_000; // hold injection until the TUI is up
 const POST_VERIFY_MS = 1_000;
 const MAX_ENTER_RETRIES = 2;
 const MODAL_RETRY_MS = 5_000;
+// How long delivery may wait on a modal before giving up. Unbounded waiting made
+// any modal — real or false-positive — wedge wake delivery forever while
+// `.monitor-status` still read `armed`, so the failure was invisible from outside.
+// 2 minutes: long enough that a human answering a real dialog is not punished with
+// a spurious `degraded`, short enough that a wedge shows up in the status while
+// it still matters. Giving up drops nothing — the events stay covered by
+// unread.json / the SessionStart backlog, and the next wake retries.
+const MODAL_GIVE_UP_MS = 120_000;
+const MAX_MODAL_WAITS = Math.floor(MODAL_GIVE_UP_MS / MODAL_RETRY_MS);
 // Keys that reset the composer to empty before we type a wake, so a human's
 // unsubmitted keystrokes can't concatenate with — or wedge (e.g. via an open
 // slash-command menu that captures Enter) — the injected line. C-e moves to end
@@ -148,18 +157,57 @@ export function formatNotificationLine(events) {
     ].filter(Boolean).join(', ');
     return `${PREFIX} ${compact} — run get_messages`;
 }
+// ─── Modal-dialog detection (design §3.2, refined empirically) ────────────────
+//
+// `❯` is Claude Code's ordinary composer prompt, so it is on screen in nearly
+// every capture. Testing for it *anywhere* in the pane therefore says nothing;
+// paired with "a numbered line anywhere", it flagged every prose list ("1) foo
+// 2) bar") and every markdown step list as a dialog. What actually distinguishes
+// a select dialog is that its pointer sits ON one of the numbered options.
+//
+// `[^\S\n]` is horizontal whitespace: unlike `\s` it cannot span a line break,
+// so these patterns can't stitch a `❯` in the composer onto a number ten lines up.
+/** `❯ 1. Yes` — the pointer on a numbered option. The shape of every CC dialog. */
+const POINTED_OPTION = /❯[^\S\n]*\d+[.)][^\S\n]+\S/;
+/** A dialog's own chrome. Neither is sufficient alone — see `looksModal`. */
+const DIALOG_MARKERS = [/\bDo you want\b/i, /\bEnter to confirm\b/i];
+/**
+ * A numbered option as a dialog paints it: line start (or a box border), then the
+ * number. Anchored so prose can't match mid-sentence ("…rewrote 3. Then we…").
+ */
+const OPTION_LINE = /^[^\S\n]*(?:[│┃|][^\S\n]*)?(?:❯[^\S\n]*)?\d+[.)][^\S\n]+\S/;
+/** How far from a marker line the options may sit (footers trail them, questions lead). */
+const OPTION_WINDOW = 10;
+/** Options rendered inline on the marker's own line: "…? 1. Yes 2. No". */
+const INLINE_OPTION = /\d+[.)][^\S\n]+\S/g;
 /**
  * Heuristic: does the pane show a modal selection dialog we must not `Enter`
- * into? Markers are the deployed Claude Code trust/permission dialogs — a `❯`
- * pointer beside numbered options, or a "Do you want …" prompt (design §3.2,
- * open question (a): refine empirically). A running turn is NOT modal.
+ * into? Two independent signals, both requiring the *option* shape, not just a
+ * loose numbered line:
+ *
+ *  1. the `❯` pointer sitting on a numbered option — `❯ 1. Use this MCP server`;
+ *  2. a dialog marker ("Do you want …", "Enter to confirm") with ≥2 numbered
+ *     options within `OPTION_WINDOW` lines — this still catches a dialog captured
+ *     mid-redraw, before its pointer row is painted.
+ *
+ * A running turn, a prose list, and a markdown step list are all NOT modal.
+ * Erring modal is the safe direction (a wake is retried; an `Enter` into a live
+ * permission dialog is not undoable), which is why signal 2 is kept — but a bare
+ * marker with no options no longer suffices, because Claude Code closes turns
+ * with exactly that prose ("Do you want me to open the PR?").
  */
 export function looksModal(pane) {
-    if (/Do you want\b/i.test(pane))
+    if (POINTED_OPTION.test(pane))
         return true;
-    const hasPointer = /❯/.test(pane);
-    const hasNumbered = /(^|\n)\s*[❯>]?\s*\d+[.)]\s+\S/.test(pane);
-    return hasPointer && hasNumbered;
+    const lines = pane.split('\n');
+    const marker = lines.findIndex(l => DIALOG_MARKERS.some(re => re.test(l)));
+    if (marker < 0)
+        return false;
+    const from = Math.max(0, marker - OPTION_WINDOW);
+    const near = lines.slice(from, marker + OPTION_WINDOW + 1);
+    if (near.filter(l => OPTION_LINE.test(l)).length >= 2)
+        return true;
+    return (lines[marker].match(INLINE_OPTION) ?? []).length >= 2;
 }
 /**
  * Heuristic: did the turn shown in this pane TERMINATE in an API-level error?
@@ -194,12 +242,16 @@ function stillInComposer(pane, line) {
 }
 export class Monitor {
     name;
+    identity;
     cfg;
     deps;
     ep;
     statusPath;
     cursorPath;
+    statePath;
     cursor = null;
+    deliveredCursor = null;
+    pendingState = null;
     fatal = false;
     stopped = false;
     bootDeadline = 0;
@@ -210,16 +262,25 @@ export class Monitor {
     turnFailThreshold;
     constructor(o) {
         this.name = o.name;
+        this.identity = o.identity ?? o.name;
         this.cfg = o.cfg;
         this.deps = o.deps;
         this.ep = resolveEndpoint(o.deps.env);
         this.statusPath = join(o.agentDir, '.monitor-status');
         this.cursorPath = join(o.agentDir, '.notify-cursor');
+        this.statePath = join(o.agentDir, '.monitor-state.json');
         const n = o.cfg.turn_fail_threshold;
         this.turnFailThreshold = typeof n === 'number' && n >= 1 ? n : DEFAULT_TURN_FAIL_THRESHOLD;
     }
-    /** Prime at the stream tip (or resume a persisted cursor if the daemon is down). */
+    /** Resume the last delivered cursor; only a brand-new monitor primes at stream tip. */
     async prime() {
+        const persisted = this.readPersistedCursor();
+        if (persisted !== null) {
+            this.cursor = persisted;
+            this.deliveredCursor = persisted;
+            this.setStatus('armed');
+            return;
+        }
         try {
             const body = await this.doFetch('tip', LONGPOLL_TIMEOUT_MS);
             this.cursor = typeof body.cursor === 'number' ? body.cursor : 0;
@@ -232,7 +293,7 @@ export class Monitor {
                 this.setStatus(`failed: ${e.message}`);
             }
             else {
-                this.cursor = this.readPersistedCursor();
+                this.cursor = null;
                 this.setStatus(`degraded: prime failed (${msg(e)})`);
             }
         }
@@ -243,6 +304,7 @@ export class Monitor {
             return;
         this.bootDeadline = this.deps.now() + BOOT_GRACE_MS;
         let backoff = 0;
+        const pending = [];
         while (!this.stopped) {
             if (!this.deps.isAlive(pid)) {
                 this.setStatus('degraded: session offline');
@@ -266,12 +328,35 @@ export class Monitor {
                 await this.deps.sleep(backoff);
                 continue;
             }
-            this.advance(body.cursor);
+            this.advance(body.cursor, false);
             const batch = filterEvents(body.events ?? [], this.cfg.wake_sources);
-            if (batch.length === 0)
+            pending.push(...batch);
+            if (pending.length === 0) {
+                this.persistCursor();
                 continue;
-            await this.coalesce(batch);
-            await this.deliver(pid, batch);
+            }
+            this.pendingState = {
+                count: pending.length,
+                eventTypes: uniq(pending.map(event => event.event ?? 'unknown')),
+                attempts: (this.pendingState?.attempts ?? 0) + 1,
+            };
+            this.persistState();
+            await this.coalesce(pending);
+            // Do not durably commit this cursor until the session explicitly accepts
+            // the wake. If delivery fails or the runner crashes, the daemon replays
+            // from the last committed cursor and the wake is attempted again.
+            let accepted = false;
+            try {
+                accepted = await this.deliver(pid, pending);
+            }
+            catch (e) {
+                this.setStatus(`degraded: delivery failed (${msg(e)})`);
+            }
+            if (accepted) {
+                pending.length = 0;
+                this.pendingState = null;
+                this.persistCursor();
+            }
         }
     }
     stop() {
@@ -288,19 +373,31 @@ export class Monitor {
             return;
         try {
             const more = await this.doFetch(String(this.cursor ?? 0), COALESCE_HOLD_MS);
-            this.advance(more.cursor);
+            this.advance(more.cursor, false);
             batch.push(...filterEvents(more.events ?? [], this.cfg.wake_sources));
         }
         catch { /* no stragglers / abort — deliver what we have */ }
     }
     async deliver(pid, batch) {
+        const line = formatNotificationLine(batch);
+        if (this.deps.delivery) {
+            const result = await this.deps.delivery.submit(line);
+            if (!result.accepted) {
+                this.setStatus(`degraded: ACP prompt not accepted${result.detail ? ` (${result.detail})` : ''}`);
+                return false;
+            }
+            this.recordTurn('completed');
+            return true;
+        }
         const state = await this.awaitInjectable(pid);
         if (state !== 'ready') {
             if (state === 'offline')
                 this.setStatus('degraded: offline during delivery');
-            return; // events remain covered by unread.json / SessionStart backlog
+            else if (state === 'modal')
+                this.setStatus(`degraded: modal wedge — pane held a dialog for ` +
+                    `${MODAL_GIVE_UP_MS / 1000}s, wake not injected`);
+            return false;
         }
-        const line = formatNotificationLine(batch);
         await this.clearComposer(); // start from an empty composer
         await this.deps.tmux.sendText(this.name, line); // send-keys -l + Enter
         let delivered = false;
@@ -309,8 +406,12 @@ export class Monitor {
         // dead pane makes safeCapture return '' ⇒ not-in-composer ⇒ breaks, no wasted Enter.
         for (let i = 0; i < MAX_ENTER_RETRIES; i++) {
             await this.deps.sleep(POST_VERIFY_MS);
-            const pane = await safeCapture(this.deps.tmux, this.name);
-            if (!stillInComposer(pane, line)) {
+            const capture = await safeCapture(this.deps.tmux, this.name);
+            if (!capture.ok) {
+                this.setStatus('degraded: capture failed during injection verification');
+                return false;
+            }
+            if (!stillInComposer(capture.pane, line)) {
                 delivered = true;
                 break;
             }
@@ -318,12 +419,13 @@ export class Monitor {
         }
         if (!delivered) {
             this.setStatus('degraded: injection unverified');
-            return;
+            return false;
         }
         // The wake landed and a turn started; observe how that turn terminates so a
         // refusal-wedge (every turn dies with `API Error:` while delivery stays green)
         // becomes visible in `.monitor-status` instead of masquerading as armed (#19).
         await this.observeTurnOutcome(pid);
+        return true;
     }
     /**
      * Watch the pane until the just-triggered turn settles, then fold its outcome
@@ -338,12 +440,16 @@ export class Monitor {
                 return; // shutting down — leave status
             if (!this.deps.isAlive(pid) || !(await this.deps.tmux.has(this.name)))
                 return; // loop marks offline
-            const pane = await safeCapture(this.deps.tmux, this.name);
-            if (looksApiError(pane)) {
+            const capture = await safeCapture(this.deps.tmux, this.name);
+            if (!capture.ok) {
+                this.setStatus('degraded: capture failed during turn observation');
+                return;
+            }
+            if (looksApiError(capture.pane)) {
                 this.recordTurn('api-error');
                 return;
             }
-            if (!looksRunning(pane)) {
+            if (!looksRunning(capture.pane)) {
                 this.recordTurn('completed');
                 return;
             }
@@ -374,8 +480,14 @@ export class Monitor {
         for (const key of COMPOSER_CLEAR_KEYS)
             await this.deps.tmux.sendKey(this.name, key);
     }
-    /** Block until the console can accept input; classify offline/stopped/ready. */
+    /**
+     * Block until the console can accept input; classify offline/stopped/ready, or
+     * `modal` when the pane still looks modal after `MODAL_GIVE_UP_MS`. The bound is
+     * what keeps a modal from wedging delivery silently: we still never `Enter` into
+     * the dialog, but the give-up is reported instead of retried forever.
+     */
     async awaitInjectable(pid) {
+        let modalWaits = 0;
         for (;;) {
             if (this.stopped)
                 return 'stopped';
@@ -386,12 +498,17 @@ export class Monitor {
                 await this.deps.sleep(this.bootDeadline - now);
                 continue;
             }
-            const pane = await safeCapture(this.deps.tmux, this.name);
-            if (looksModal(pane)) {
+            const capture = await safeCapture(this.deps.tmux, this.name);
+            if (!capture.ok) {
+                this.setStatus('degraded: capture failed while checking session readiness');
                 await this.deps.sleep(MODAL_RETRY_MS);
                 continue;
             }
-            return 'ready';
+            if (!looksModal(capture.pane))
+                return 'ready';
+            if (modalWaits++ >= MAX_MODAL_WAITS)
+                return 'modal';
+            await this.deps.sleep(MODAL_RETRY_MS);
         }
     }
     async doFetch(since, holdMs) {
@@ -400,7 +517,7 @@ export class Monitor {
         const timer = this.deps.timers.set(() => ctrl.abort(), holdMs);
         let resp;
         try {
-            resp = await this.deps.fetch(`${this.ep.url(this.name)}?since=${since}`, { headers: this.ep.headers, signal: ctrl.signal });
+            resp = await this.deps.fetch(`${this.ep.url(this.identity)}?since=${since}`, { headers: this.ep.headers, signal: ctrl.signal });
         }
         finally {
             this.deps.timers.clear(timer);
@@ -412,16 +529,22 @@ export class Monitor {
             throw new Error(`daemon returned HTTP ${resp.status}`);
         return resp.json();
     }
-    advance(cursor) {
+    advance(cursor, persist = true) {
         if (typeof cursor === 'number' && cursor !== this.cursor) {
             this.cursor = cursor;
-            this.persistCursor();
+            if (persist)
+                this.persistCursor();
+            else
+                this.persistState();
         }
     }
     persistCursor() {
         try {
-            if (this.cursor !== null)
+            if (this.cursor !== null) {
+                this.deliveredCursor = this.cursor;
                 writeFileSync(this.cursorPath, `${this.cursor}\n`);
+                this.persistState();
+            }
         }
         catch (e) {
             this.deps.log(`[${this.name}] monitor: failed to persist cursor: ${msg(e)}`);
@@ -429,15 +552,46 @@ export class Monitor {
     }
     readPersistedCursor() {
         try {
+            if (existsSync(this.statePath)) {
+                const state = JSON.parse(readFileSync(this.statePath, 'utf8'));
+                if ((state.identity !== undefined && state.identity !== this.identity)
+                    || (state.profileKey !== undefined && state.profileKey !== this.ep.origin))
+                    return null;
+                if (typeof state.deliveredCursor === 'number') {
+                    this.deliveredCursor = state.deliveredCursor;
+                    return state.deliveredCursor;
+                }
+            }
             if (!existsSync(this.cursorPath))
                 return null;
             const n = parseInt(readFileSync(this.cursorPath, 'utf8').trim(), 10);
+            if (Number.isFinite(n))
+                this.deliveredCursor = n;
             return Number.isFinite(n) ? n : null;
         }
         catch {
             return null;
         }
     }
+    /** Atomically persist body-free delivery state; restart always resumes from deliveredCursor. */
+    persistState() {
+        try {
+            const tmp = `${this.statePath}.${process.pid}.tmp`;
+            writeFileSync(tmp, JSON.stringify({
+                version: 1,
+                identity: this.identity,
+                profileKey: this.ep.origin,
+                observedCursor: this.cursor,
+                deliveredCursor: this.deliveredCursor,
+                pending: this.pendingState,
+                updatedAt: new Date(this.deps.now()).toISOString(),
+            }, null, 2) + '\n', { mode: 0o600 });
+            renameSync(tmp, this.statePath);
+        }
+        catch (e) {
+            this.deps.log(`[${this.name}] monitor: failed to persist state: ${msg(e)}`);
+        }
+    }
     setStatus(s) {
         try {
             writeFileSync(this.statusPath, `${s}\n`);
@@ -454,10 +608,10 @@ export function createMonitor(o) {
 }
 async function safeCapture(tmux, name) {
     try {
-        return await tmux.capture(name);
+        return { ok: true, pane: await tmux.capture(name) };
     }
     catch {
-        return '';
+        return { ok: false, pane: '' };
     }
 }
 const msg = (e) => e?.message ?? String(e);