@ours.network/fleet 1.2.0-nightly.53 → 1.2.0-nightly.55

package/dist/rooms-tasks/task-state.js

@@ -664,6 +664,8 @@ function findCursorForSeat(id, stored, seat) {
     if (cursor && seat.identity_cid
         && cursor.identity_cid.toLowerCase() !== seat.identity_cid.toLowerCase())
         throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' identity CID mismatch between cursor and room seat`);
+    if (cursor?.action_id && seat.launch?.action_id && cursor.action_id !== seat.launch.action_id)
+        throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' creation ownership proof changed`);
     return cursor;
 }
 /**
@@ -684,11 +686,20 @@ export function upsertTaskDeletionMembersFromSeats(id, seats) {
         for (const seat of seats) {
             if (!seat.identity_cid)
                 continue;
-            if (!findCursorForSeat(id, stored, seat)) {
+            const cursor = findCursorForSeat(id, stored, seat);
+            if (!cursor) {
                 stored.deletion.members.push({
                     name: seat.role_name, identity_cid: seat.identity_cid, phase: 'pending', updated_at: now,
+                    ...(seat.launch?.action_id ? { action_id: seat.launch.action_id } : {}),
+                    ...(seat.launch?.task_supervised ? { task_supervised: true } : {}),
                 });
             }
+            else {
+                if (seat.launch?.action_id)
+                    cursor.action_id ??= seat.launch.action_id;
+                if (seat.launch?.task_supervised)
+                    cursor.task_supervised = true;
+            }
         }
         writeTask(stored);
         return presentTaskLenient(stored);
@@ -747,6 +758,10 @@ export function importTaskDeletionRetirementEvidence(id, seats, proofs = []) {
                 cursor = { name: seat.role_name, identity_cid: seat.identity_cid, phase: 'pending', updated_at: now };
                 stored.deletion.members.push(cursor);
             }
+            if (seat.launch?.action_id)
+                cursor.action_id ??= seat.launch.action_id;
+            if (seat.launch?.task_supervised)
+                cursor.task_supervised = true;
             if (DELETION_MEMBER_PHASE_ORDER[evidence.phase] < DELETION_MEMBER_PHASE_ORDER[cursor.phase])
                 continue;
             if (cursor.launch_id !== undefined && cursor.launch_id !== evidence.launch_id)

package/dist/rooms-tasks/types.d.ts

@@ -62,6 +62,8 @@ export type TaskDeletionMemberPhase = 'pending' | 'stop_requested' | 'liveness_a
 export interface TaskDeletionMemberCursor {
     name: string;
     identity_cid: string;
+    action_id?: string;
+    task_supervised?: boolean;
     phase: TaskDeletionMemberPhase;
     launch_id?: string;
     archive_path?: string;
@@ -170,6 +172,7 @@ export interface RoomRoleBriefingDefinition {
     last_error?: string;
 }
 export interface RoomMemberLaunchState {
+    task_supervised?: boolean;
     state: 'pending' | 'intent' | 'launched' | 'stopped' | 'failed';
     attempt: number;
     action_id?: string;

package/dist/rooms-tasks/workspace.d.ts

@@ -11,6 +11,8 @@ export declare class WorkspaceError extends Error {
 export declare function assertSafeAncestors(path: string): void;
 export declare function planWorkspace(owner: OwnedWorkspace['owner'], id: string): OwnedWorkspace;
 export declare function validateWorkspace(w: OwnedWorkspace, owner?: "task" | "room", id?: string): void;
+/** Read-only recovery proof; never allocate a replacement for a missing workspace. */
+export declare function assertWorkspacePresent(w: OwnedWorkspace, owner: OwnedWorkspace['owner'], id: string): void;
 /** Caller must first prove the exact workspace marker or retired archive
  * provenance, and hold its lifecycle lock with all managed writers retired.
  * Directories need owner rwx for recursive removal; ordinary files do not.

package/dist/rooms-tasks/workspace.js

@@ -54,6 +54,11 @@ function marked(path, w) {
     if (JSON.stringify(actual) !== JSON.stringify(w))
         fail('ownership marker mismatch');
 }
+/** Read-only recovery proof; never allocate a replacement for a missing workspace. */
+export function assertWorkspacePresent(w, owner, id) {
+    validateWorkspace(w, owner, id);
+    marked(w.path, w);
+}
 function staging(w, phase) {
     return join(dirname(w.path), `.${w.id}.${w.token}.${phase}`);
 }

package/dist/runner.d.ts

@@ -39,6 +39,8 @@ export interface RunnerDeps {
     reportOwnerStartupFailure(stateDir: string): Promise<'delivered' | 'duplicate'>;
     /** Lets a test (or a shutdown path) end the supervised restart loop. */
     shouldStop?(): boolean;
+    /** Parent shutdown suspends a managed transient member; explicit stop still retires. */
+    suspendOnStop?: boolean;
 }
 export declare const SUPERVISOR_RECYCLE_REQUIRED = "OWNER_CHANNEL_SUPERVISOR_RECYCLE_REQUIRED";
 export declare class SupervisorRecycleRequiredError extends Error {
@@ -201,9 +203,13 @@ export declare function runOnce(name: string, opts?: {
  */
 export declare function runSupervised(name: string, opts?: {
     configPath?: string;
+    temp?: boolean;
 }, partialDeps?: Partial<RunnerDeps>, attempt?: (n: string, o: {
     configPath?: string;
     allowResumeRotation?: boolean;
+    temp?: boolean;
 }, d: Partial<RunnerDeps>) => Promise<AttemptResult>): Promise<RestartLedger>;
 /** Temp-agent entrypoint: run once, journal why it ended, then archive its evidence. */
+/** The parent uses the same adapter-relative sustained-uptime reset boundary. */
+export declare function stableSupervisorWindow(name: string, temp: boolean, configPath?: string): number;
 export declare function runTemp(name: string, deps?: Partial<RunnerDeps>, attempt?: typeof runOnce): Promise<void>;

package/dist/runner.js

@@ -1,7 +1,10 @@
+import { readProvenance } from './creation.js';
+import { firstManagedSessionMayStart, managedRecoveryPath, readManagedRecovery, writeManagedRecovery } from './managed-recovery.js';
 import { StartupTelemetry } from './startup-telemetry.js';
 import { managedStartupPrompt, managedTaskPrompt } from './startup-prompt.js';
 import { createLayoutControl } from './rooms-tasks/layout-control.js';
 import { TemporaryChatIdle } from './temp-idle.js';
+import { taskSupervisorMayRun, taskMemberRetirementProof } from './task-supervision.js';
 import { prepareManagedAgent, releaseManagedAgent } from './agent-ours/service.js';
 import { prepareManagedHarness } from './agent-ours/harness.js';
 import { prepareManagedCliLaunch } from './managed-cli.js';
@@ -33,7 +36,7 @@ import { ScheduledLoopManager, } from './loops/manager.js';
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from './fleet-proxy.js';
 import { effectivePermissionMode } from './permissions.js';
 import { assertModelPinReachesChild, effectiveRoleModel, repinModelEnv } from './model-env.js';
-import { archiveTempState, markTempSupervisorActive, requestedTempStopReason, } from './temp-lifecycle.js';
+import { archiveTempState, markTempSupervisorActive, requestedTempStopReason, readTempSupervisor, } from './temp-lifecycle.js';
 import { FleetCommandAuditStore } from './fleet-command-audit.js';
 export const SUPERVISOR_RECYCLE_REQUIRED = 'OWNER_CHANNEL_SUPERVISOR_RECYCLE_REQUIRED';
 export class SupervisorRecycleRequiredError extends Error {
@@ -511,14 +514,43 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         deps.log(`[${name}] worklog rotation deferred: concurrent modification detected`);
     else if (rotation.rotated)
         deps.log(`[${name}] worklog rotated: ${rotation.beforeBytes} -> ${rotation.afterBytes} bytes`);
+    const durableTask = Boolean(readTempSupervisor(dir)?.taskOwner);
+    const retainedManaged = durableTask || Boolean(deps.suspendOnStop && adapter.supportsResume);
     const sidFile = join(dir, '.session-id');
+    const backendSidFile = join(dir, role.session === 'codex-app-server' ? '.session-id' : '.acp-session-id');
+    let recovery = retainedManaged ? readManagedRecovery(dir) : undefined;
+    // Native Codex shares .session-id with the runner's pre-launch UUID, so file
+    // existence alone is not evidence that its first backend thread was created.
+    const firstSessionRetry = retainedManaged && existsSync(join(dir, '.booted'))
+        && (!existsSync(backendSidFile) || (role.session === 'codex-app-server' && recovery?.session === 'pending'))
+        && firstManagedSessionMayStart(dir);
+    if (retainedManaged && existsSync(join(dir, '.booted'))
+        && (!existsSync(sidFile) || !existsSync(backendSidFile)) && !firstSessionRetry)
+        throw Error('TASK_CONTEXT_RESUME_UNAVAILABLE');
     if (!existsSync(sidFile))
         writeFileSync(sidFile, randomUUID() + '\n');
     const sessionId = readFileSync(sidFile, 'utf8').trim();
     const bootedFile = join(dir, '.booted');
     const exitFile = join(dir, '.exit-status');
     const booted = existsSync(bootedFile);
-    const mode = booted && adapter.supportsResume ? 'resume' : 'fresh';
+    if (durableTask && !adapter.supportsResume)
+        throw Error('TASK_HARNESS_RESUME_UNSUPPORTED');
+    const mode = booted && adapter.supportsResume && !firstSessionRetry ? 'resume' : 'fresh';
+    const requireResume = retainedManaged && mode === 'resume';
+    if (retainedManaged && !recovery) {
+        // Older admitted sessions have no cursor. Continue once, without replaying
+        // their assignment; fresh sessions record intent before the first attempt.
+        recovery = { version: 1, session: booted ? 'established' : 'pending', readiness: booted,
+            initial: booted ? 'dispatching' : 'pending', active: booted };
+        writeManagedRecovery(dir, recovery);
+    }
+    const recoveryBefore = recovery ? { ...recovery } : undefined;
+    const saveRecovery = (update) => {
+        if (!recovery)
+            return;
+        recovery = { ...recovery, ...update };
+        writeManagedRecovery(dir, recovery);
+    };
     // Stamp EVERY attempt, not just the first. `.booted` used to be written only
     // on the fresh path, so after a restart — including one the supervisor never
     // saw, like an OOM-kill — its mtime still read the original boot and any
@@ -672,10 +704,12 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 managedOurs: managedHarness.ours,
                 role, prep,
                 launch: { ...launch, argv: wrappedArgv, env: managedHarness.env },
-                cwd: runCwd, stateDir: dir, mode, permissions: perms,
+                cwd: runCwd, stateDir: dir, mode, requireResume, permissions: perms,
                 permissionMode: effectivePermissionMode(role), log: deps.log,
             }));
+            managedService.setFileDelivery?.(agentSession.sendFileToChat?.bind(agentSession));
             startupTelemetry.mark('harness_ready');
+            saveRecovery({ session: 'established' });
             pid = agentSession.pid;
             arbiter = new RoleTurnArbiter(agentSession);
             sessionHandle = arbiter;
@@ -696,7 +730,25 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                     startMonitorAfterStartup();
                 }
             });
-            unsubscribeRecovery = () => { unsubscribeFailure(); unsubscribeStartup?.(); unsubscribeTelemetry?.(); };
+            const activePrompts = new Set();
+            const unsubscribeContinuity = agentSession.subscribeConversation?.(event => {
+                if (!recovery?.readiness)
+                    return;
+                if (event.kind === 'prompt.started') {
+                    if (event.promptId)
+                        activePrompts.add(event.promptId);
+                    saveRecovery({ active: true });
+                }
+                else if (event.kind === 'turn.completed' && 'outcome' in event.payload) {
+                    if (event.promptId)
+                        activePrompts.delete(event.promptId);
+                    // A shutdown/failed turn needs continuation; a successful terminal turn
+                    // proves it may stay idle. Never store prompt bodies in this cursor.
+                    if (event.payload.outcome === 'completed')
+                        saveRecovery({ active: activePrompts.size > 0 });
+                }
+            });
+            unsubscribeRecovery = () => { unsubscribeFailure(); unsubscribeStartup?.(); unsubscribeTelemetry?.(); unsubscribeContinuity?.(); };
             if (role.owner_channel) {
                 try {
                     ownerBinder = await deps.acquireOwnerBinder(dir, name, role.owner_channel.identity);
@@ -817,8 +869,14 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             // Wait for the first turn's TERMINAL result. An agent that accepts the
             // startup prompt and then refuses it has not started; logging the role as
             // up would hide a role that never completed its readiness turn.
-            startupTelemetry.mark('startup_submitted');
-            const starting = arbiter.submitPrompt(firstPrompt, { origin: { kind: 'startup' } });
+            const retainedResume = retainedManaged && mode === 'resume' && recoveryBefore?.readiness === true;
+            if (!retainedResume)
+                startupTelemetry.mark('startup_submitted');
+            // The backend already verified the saved conversation. Resuming a managed
+            // member admits new wakes/console input without replaying startup or work.
+            const starting = retainedResume
+                ? Promise.resolve({ accepted: false, succeeded: true, outcome: 'completed', detail: 'retained backend resumed; no readiness prompt submitted' })
+                : arbiter.submitPrompt(firstPrompt, { origin: { kind: 'startup' } });
             // Keep the early cursor baseline; do not deliver wakes into the protected
             // first turn. Steering can pre-empt startup just like cancellation.
             // Owner traffic and agent replies must be observed during a long first
@@ -883,20 +941,36 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                     + 'keeping temporary supervisor alive');
             startupRecoveryAllowed = interruptedForWake;
             sessionStartupComplete = started.succeeded || (interruptedForWake && successfulTurnObserved);
-            if (started.succeeded)
+            if (started.succeeded && !retainedResume)
                 startupTelemetry.mark('readiness_turn_completed');
+            if (started.succeeded)
+                saveRecovery({ readiness: true });
             // Readiness is now complete. Configured work (or retained continuity) is
             // admitted as a distinct turn; its terminal result must not block console
             // readiness, mail delivery, or supervisor liveness. Empty fresh agents wait
             // for authenticated console input or the monitor's unread/arrival wake.
-            if (started.succeeded && !deps.shouldStop?.() && (role.mission?.trim() || role.roomMemberStartup?.task?.trim() || role.briefing_file?.trim() || booted)) {
-                const queued = await arbiter.queuePrompt(managedTaskPrompt(dir, mode, booted), {
+            const configuredWork = Boolean(role.mission?.trim() || role.roomMemberStartup?.task?.trim() || role.briefing_file?.trim());
+            const initialPending = retainedManaged && recoveryBefore?.initial === 'pending';
+            const interruptedWork = retainedManaged && (recoveryBefore?.active || recoveryBefore?.initial === 'dispatching');
+            const workPrompt = retainedManaged
+                ? initialPending && configuredWork ? managedTaskPrompt(dir, 'fresh', false)
+                    : interruptedWork ? 'Fleet supervisor restarted. Continue pending work in the restored conversation; do not redo completed steps. '
+                        + (recoveryBefore?.initial === 'dispatching' ? `If you have not yet received your assignment, read ${join(dir, 'briefing.md')} once before acting. ` : '')
+                        + 'Read the continuation log only as needed to recover your next action. If no work remains, end this turn and wait for a concrete task or supervisor wake.' : undefined
+                : configuredWork || booted ? managedTaskPrompt(dir, mode, booted) : undefined;
+            if (started.succeeded && !deps.shouldStop?.() && workPrompt) {
+                saveRecovery({ initial: 'dispatching', active: true });
+                const queued = await arbiter.queuePrompt(workPrompt, {
                     origin: { kind: 'startup' },
                 });
                 void queued.completion.then(result => {
+                    if (result.succeeded)
+                        saveRecovery({ initial: 'completed', active: activePrompts.size > 0 });
                     deps.log(`[${name}] configured task turn ${result.outcome}`);
                 }, () => deps.log(`[${name}] configured task turn failed`));
             }
+            else if (started.succeeded && initialPending && !configuredWork)
+                saveRecovery({ initial: 'completed' });
             reloadLoopConfig = async () => {
                 const nextRole = findRole(loadConfig(configPath), name);
                 const definitions = nextRole.loops ?? [];
@@ -985,7 +1059,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         });
         let chatIdle;
         try {
-            if (temp && !role.roomMemberStartup)
+            if (temp && !role.roomMemberStartup && !readTempSupervisor(dir)?.taskOwner)
                 chatIdle = new TemporaryChatIdle(dir, deps.now());
         }
         catch {
@@ -1121,11 +1195,12 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         const rotate = (why) => {
             writeFileSync(sidFile, randomUUID() + '\n');
             rmSync(bootedFile, { force: true });
+            rmSync(managedRecoveryPath(dir), { force: true });
             rotated = true;
             deps.log(`[${name}] ${why} -> rotated session-id; next start is FRESH`);
         };
-        if (!temp && deps.shouldStop?.())
-            deps.log(`[${name}] supervisor stop requested -> next start RESUMES context`);
+        if (readTempSupervisor(dir)?.taskOwner || ((!temp || deps.suspendOnStop) && deps.shouldStop?.()))
+            deps.log(`[${name}] supervisor/context retained -> next start RESUMES context`);
         else if (exitRecord.detail.includes(ACP_CANCEL_DEADLINE_EXCEEDED)
             || exitRecord.detail.includes(CODEX_APP_SERVER_CANCEL_DEADLINE_EXCEEDED))
             // This is a deliberate adapter reclamation, not evidence that resume state
@@ -1175,11 +1250,13 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
  */
 export async function runSupervised(name, opts = {}, partialDeps = {}, attempt = runOnce) {
     const deps = { ...defaultDeps(), ...partialDeps };
-    const dir = agentDir(name);
+    const taskMember = opts.temp === true;
+    const dir = agentDir(name, taskMember);
     mkdirSync(dir, { recursive: true });
     let stopping = false;
     const requestStop = () => { stopping = true; };
-    const shouldStop = () => stopping || (partialDeps.shouldStop?.() ?? false);
+    const shouldStop = () => stopping || (partialDeps.shouldStop?.() ?? false)
+        || (taskMember && requestedTempStopReason(dir) === 'operator-stop');
     deps.shouldStop = shouldStop;
     const stamp = () => new Date(deps.now()).toISOString();
     // Record how the PREVIOUS supervisor process ended before doing anything
@@ -1207,10 +1284,12 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
     process.on('SIGINT', requestStop);
     try {
         while (!shouldStop()) {
+            if (taskMember && !taskSupervisorMayRun(name))
+                break;
             let ledger = readRestartLedger(dir);
             try {
                 const configPath = resolveConfigPath(dir, opts.configPath);
-                const role = findRole(loadConfig(configPath), name);
+                const role = taskMember ? loadTempRole(name) : findRole(loadConfig(configPath), name);
                 reconcileModelRecovery(dir, role, stamp());
                 if (modelRecoveryHeld(dir)) {
                     await deps.sleep(HELD_DOWN_POLL_MS);
@@ -1226,18 +1305,26 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
                 await deps.sleep(HELD_DOWN_POLL_MS);
                 continue;
             }
+            if (attempt === runOnce && taskMember) {
+                // Boot-time daemon unavailability must not consume the harness crash budget.
+                const { waitForRoleDaemon } = await import('./startup-readiness.js');
+                await waitForRoleDaemon(name, undefined, {}, true);
+            }
+            if (taskMember && (shouldStop() || !taskSupervisorMayRun(name)))
+                break;
             let result;
             try {
                 // Service-manager boot and automatic retry bypass the operator-facing
                 // up/restart commands. Reconcile again immediately before every real
                 // permanent harness attempt; the operation is idempotent and releases its
                 // provisioning lease before the agent or owner channel binds.
-                if (attempt === runOnce) {
+                if (attempt === runOnce && !taskMember) {
                     const configPath = resolveConfigPath(dir, opts.configPath);
                     const role = findRole(loadConfig(configPath), name);
                     await reconcilePermanentRoleIdentities(role, undefined, deps.log);
                 }
-                result = await attempt(name, { configPath: opts.configPath, allowResumeRotation: !ledger.resumeDiscarded }, deps);
+                result = await attempt(name, { configPath: opts.configPath, ...(taskMember ? { temp: true } : {}),
+                    allowResumeRotation: taskMember ? false : !ledger.resumeDiscarded }, deps);
             }
             catch (e) {
                 if (e instanceof SupervisorRecycleRequiredError) {
@@ -1259,7 +1346,7 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
                     mode: 'fresh',
                 };
             }
-            if (stopping)
+            if (stopping || (taskMember && (shouldStop() || result.retirementReason)))
                 break;
             // Re-read: the attempt itself may have taken minutes, and an operator may
             // have reset the ledger meanwhile.
@@ -1277,7 +1364,8 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
                 await deps.sleep(HELD_DOWN_POLL_MS);
                 continue;
             }
-            const fastFailSecs = fastFailSecsFor(name, opts.configPath);
+            const fastFailSecs = taskMember ? getAdapter(loadTempRole(name).harness).exitPolicy.fastFailSecs
+                : fastFailSecsFor(name, opts.configPath);
             // The fast-fail boundary starts a recovery episode; it must not also be
             // the boundary that declares recovery successful. Otherwise alternating
             // 19s and 20s deaths erase one another forever. Require the configured
@@ -1314,7 +1402,7 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
                 next.nextDelayMs = 0;
                 writeRestartLedger(dir, next);
                 deps.log(`[${name}] HELD DOWN after ${failures} immediate failures at ${next.openedAt} — ` +
-                    `${reason}; the agent will not be restarted until: ours-fleet restart ${name}`);
+                    `${reason}; recover with: ${taskMember ? `ours-fleet task recover-members ${readTempSupervisor(dir).taskOwner.taskId}` : `ours-fleet restart ${name}`}`);
                 continue;
             }
             writeRestartLedger(dir, next);
@@ -1329,7 +1417,7 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
         process.off('SIGINT', requestStop);
         // An orderly shutdown clears the marker; an unhandled signal or OOM-kill
         // leaves it so the successor can identify an abrupt termination.
-        if (shouldStop())
+        if (!taskMember && shouldStop())
             await deps.releaseAgentOurs(findRole(loadConfig(opts.configPath), name));
         releaseSupervisorRun(dir);
     }
@@ -1349,8 +1437,58 @@ function fastFailSecsFor(name, configPath) {
     }
 }
 /** Temp-agent entrypoint: run once, journal why it ended, then archive its evidence. */
+/** The parent uses the same adapter-relative sustained-uptime reset boundary. */
+export function stableSupervisorWindow(name, temp, configPath) {
+    try {
+        const role = temp ? loadTempRole(name) : findRole(loadConfig(configPath), name);
+        return getAdapter(role.harness).exitPolicy.fastFailSecs * RESTART_FAIL_THRESHOLD;
+    }
+    catch {
+        return 20 * RESTART_FAIL_THRESHOLD;
+    }
+}
 export async function runTemp(name, deps = {}, attempt = runOnce) {
     const dir = agentDir(name, true);
+    const metadata = readTempSupervisor(dir);
+    // Non-resumable standalone temporaries retain their prior finite lifecycle:
+    // a parent stop retires them rather than promising retained conversation.
+    if (!metadata?.taskOwner && deps.suspendOnStop && !getAdapter(loadTempRole(name).harness).supportsResume)
+        deps = { ...deps, suspendOnStop: false };
+    if (!metadata?.taskOwner) {
+        const role = loadTempRole(name);
+        const provenance = readProvenance(dir);
+        if (role.roomMemberStartup?.task_id
+            || (name.startsWith('layout-') && provenance?.creationActionId?.startsWith('task-')))
+            throw Error('TASK_SUPERVISOR_OWNER_MISSING');
+    }
+    if (metadata?.taskOwner) {
+        // Serialize the entire process lifetime before metadata/session writes.
+        const lease = await acquireOwnerBinderLease(join(dir, '.task-supervisor'), 'task-supervisor', name);
+        let ownershipVerified = false;
+        try {
+            const mayRun = taskSupervisorMayRun(name);
+            ownershipVerified = true;
+            if (!mayRun)
+                return;
+            await markTempSupervisorActive(dir);
+            await runSupervised(name, { temp: true }, deps, attempt);
+        }
+        finally {
+            try {
+                if (ownershipVerified && requestedTempStopReason(dir)) {
+                    // Parent shutdown suspends; an explicit stop retires the exact saved
+                    // owner even when no harness attempt ran (for example held circuits).
+                    await (deps.releaseAgentOurs ?? releaseManagedAgent)(loadTempRole(name), taskMemberRetirementProof(name));
+                    const archived = archiveTempState(name, 'operator-stop', 'retired', 'explicit task member retirement');
+                    deps.log?.(`[${name}] task member retired: operator-stop${archived ? `; evidence archived at ${archived}` : ''}`);
+                }
+            }
+            finally {
+                lease.release();
+            }
+        }
+        return;
+    }
     await markTempSupervisorActive(dir);
     let signal;
     const onTerm = () => { signal = 'SIGTERM'; };
@@ -1377,7 +1515,8 @@ export async function runTemp(name, deps = {}, attempt = runOnce) {
         process.off('SIGTERM', onTerm);
         process.off('SIGINT', onInt);
         // A recycle replaces the supervisor process, not the logical temporary agent.
-        if (!(failure instanceof SupervisorRecycleRequiredError) || signal || deps.shouldStop?.()) {
+        if (!((signal || deps.shouldStop?.()) && deps.suspendOnStop && !requestedTempStopReason(dir))
+            && (!(failure instanceof SupervisorRecycleRequiredError) || signal || deps.shouldStop?.())) {
             const requested = requestedTempStopReason(dir);
             const reason = requested
                 ?? result?.retirementReason

package/dist/session/acp.d.ts

@@ -1,3 +1,4 @@
+import type { FileDeliveryInput, CopyChatFile, DeliveredFile } from '../file-delivery/types.js';
 import { type TaskNoticeBinding, type TaskCreatedNotice } from './task-notice.js';
 import * as acp from '@agentclientprotocol/sdk';
 import type { CommonPermissions } from '../config.js';
@@ -50,6 +51,7 @@ export interface AcpSessionOptions {
     inheritEnvironment?: boolean;
     stateDir: string;
     mode: 'fresh' | 'resume';
+    requireResume?: boolean;
     permissions: CommonPermissions;
     /** Native permission-mode id to request via session/set_mode; undefined keeps the agent default. */
     modeId?: string;
@@ -176,6 +178,7 @@ export declare class AcpSession implements AgentSession {
     private stallTimer?;
     private stallAttempt?;
     private readonly toolBoundaryWaiters;
+    private fileExportBusy;
     private activeTurn?;
     private constructor();
     static start(options: AcpSessionOptions): Promise<AcpSession>;
@@ -303,6 +306,8 @@ export declare class AcpSession implements AgentSession {
      */
     private settlePendingAutomatically;
     exitResult(): ExitRecord | null;
+    /** One attempt, tied to the managed live turn captured before any approval/read. */
+    sendFileToChat(input: FileDeliveryInput, signal: AbortSignal, copy: CopyChatFile, policy: CommonPermissions): Promise<DeliveredFile>;
     close(): Promise<void>;
     /** ACP requires the field. Bundled agents treat [] as no client-added servers. */
     private declaredMcpServers;

package/dist/session/acp.js

@@ -278,6 +278,7 @@ export class AcpSession {
     stallTimer;
     stallAttempt;
     toolBoundaryWaiters = new Set();
+    fileExportBusy = false;
     activeTurn;
     constructor(options, child, connection) {
         this.options = options;
@@ -466,6 +467,7 @@ export class AcpSession {
             readiness: this.readiness === 'idle' && this.steeringOccupied
                 ? 'running' : this.readiness,
             sessionId: this.sessionId,
+            ...(this.activeTurn?.origin ? { activePromptSource: this.activeTurn.origin.kind } : {}),
             lastError: this.lastError,
             pendingPermissionId: this.pendingPermissions.keys().next().value,
             runtimeModel: this.runtimeModel,
@@ -580,6 +582,10 @@ export class AcpSession {
      * steering response from becoming a tight replay loop.
      */
     async steerOrQueueWake(text, options) {
+        // A tool-boundary wait may outlive its original turn. Recheck the current
+        // typed source at delivery, since an Owner turn can begin during the wait.
+        if (options.origin?.kind === 'fleet-monitor' && this.activeTurn?.origin?.kind === 'owner-admin-console')
+            return this.submitPrompt(text, { ...options, interrupt: false, steer: false });
         if (this.stallRecoveryClaimed)
             return this.submitPrompt(text, { ...options, interrupt: false, steer: false });
         const steered = await this.steerPrompt(text);
@@ -823,6 +829,8 @@ export class AcpSession {
         if (!this.sessionId)
             return;
         const active = this.activeTurn;
+        if (active)
+            active.fileDeliveryRevoked = true;
         const previousSource = active?.cancellationSource;
         if (active && (source === 'owner' || source === 'local-console' || !previousSource))
             active.cancellationSource = source;
@@ -1026,6 +1034,54 @@ export class AcpSession {
     exitResult() {
         return this.exit;
     }
+    /** One attempt, tied to the managed live turn captured before any approval/read. */
+    async sendFileToChat(input, signal, copy, policy) {
+        const active = this.activeTurn, sessionId = this.sessionId;
+        const check = () => {
+            signal.throwIfAborted();
+            if (!active || !sessionId || this.activeTurn !== active || this.sessionId !== sessionId || active.fileDeliveryRevoked
+                || active.cancellationSource || this.closing || !this.isAlive() || this.replaying || this.steeringOccupied
+                || active.origin?.kind === 'scheduled-loop' || policy.approval === 'deny')
+                throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE');
+        };
+        check();
+        if (this.fileExportBusy)
+            throw Error('FILE_DELIVERY_BUSY');
+        this.fileExportBusy = true;
+        const toolCallId = 'fleet-file-export-' + randomUUID();
+        try {
+            const onAbort = () => {
+                for (const [id, pending] of this.pendingPermissions)
+                    if (pending.toolCallId === toolCallId)
+                        this.settlePendingAutomatically(id, pending, 'cancelled', undefined, 'File send cancelled');
+            };
+            signal.addEventListener('abort', onAbort, { once: true });
+            let answer;
+            try {
+                answer = await this.requestPermission({ sessionId: sessionId, toolCall: {
+                        toolCallId, title: 'Send file to this ACP chat: ' + (input.filename ?? input.path), kind: 'read', status: 'pending',
+                        locations: [{ path: resolve(this.options.cwd, input.path) }],
+                    }, options: [{ optionId: 'send', name: 'Send file', kind: 'allow_once' }, { optionId: 'deny', name: 'Do not send', kind: 'reject_once' }] }, policy);
+            }
+            finally {
+                signal.removeEventListener('abort', onAbort);
+            }
+            check();
+            if (answer.outcome.outcome !== 'selected' || answer.outcome.optionId !== 'send')
+                throw Error('FILE_SEND_DENIED');
+            const attachment = await copy({ sessionGeneration: this.sessionGeneration, acpSessionId: sessionId, turnId: active.id });
+            // Synchronous check + durable append establishes order with cancellation/stop.
+            // No await, pending-send journal, replay or recovery exists after this point.
+            check();
+            this.conversation.append({ kind: 'file.attached', source: 'agent', sessionGeneration: this.sessionGeneration,
+                acpSessionId: sessionId, promptId: active.id, turnId: active.id, payload: { attachment } });
+            return attachment;
+        }
+        finally {
+            this.releaseTool(toolCallId);
+            this.fileExportBusy = false;
+        }
+    }
     async close() {
         this.closing = true;
         if (this.stallTimer)
@@ -1079,6 +1135,8 @@ export class AcpSession {
         const persisted = this.options.mode === 'resume' && existsSync(this.sessionFile)
             ? readFileSync(this.sessionFile, 'utf8').trim()
             : '';
+        if (this.options.requireResume && (!persisted || !(this.agentCapabilities?.sessionCapabilities?.resume != null || this.agentCapabilities?.loadSession)))
+            throw new Error('TASK_CONTEXT_RESUME_UNAVAILABLE');
         let advertisedConfigOptions;
         let advertisedModes;
         let advertisedModelId;
@@ -1414,6 +1472,8 @@ export class AcpSession {
     }
     async steerPrompt(text) {
         this.steeringWasUsed = true;
+        if (this.activeTurn)
+            this.activeTurn.fileDeliveryRevoked = true;
         if (!this.sessionId || !this.isAlive())
             return turnResult(false, 'failed', this.lastError ?? 'ACP session is offline');
         this.steeringRequests++;
@@ -1445,7 +1505,7 @@ export class AcpSession {
             this.steeringRequests--;
         }
     }
-    requestPermission(params) {
+    requestPermission(params, neutralPolicy) {
         // `kinds` is a PRIORITY order. Scanning the agent's option array instead
         // (`options.find(o => kinds.includes(o.kind))`) hands the choice to whatever
         // order the agent happened to list, which is exactly how an automatic denial
@@ -1463,7 +1523,7 @@ export class AcpSession {
         // Permission is part of the tool lifecycle. Reserve before any policy or
         // human decision so a monitor wake cannot slip between request and answer.
         this.reservePermission(toolCallId, permissionId);
-        if (this.isEffectiveCodexProtectedMcpApproval(params)) {
+        if (!neutralPolicy && this.isEffectiveCodexProtectedMcpApproval(params)) {
             // Protected MCP approval is already the tool's narrow gate. Never turn
             // this one decision into an adapter-wide standing grant.
             const option = choose(['allow_once']);
@@ -1474,9 +1534,9 @@ export class AcpSession {
                 this.releasePermission(toolCallId, permissionId);
             return Promise.resolve(response);
         }
-        if (this.options.permissions.approval === 'allow' && this.withinAutomaticBoundary(params)) {
+        if ((neutralPolicy ?? this.options.permissions).approval === 'allow' && this.withinAutomaticBoundary(params, neutralPolicy)) {
             const option = choose(['allow_always', 'allow_once']);
-            const response = this.settleAutomatically(params, option, 'allowed', 'permissions.approval=allow', `the request is inside the ${this.options.permissions.filesystem} boundary`);
+            const response = this.settleAutomatically(params, option, 'allowed', 'permissions.approval=allow', `the request is inside the ${(neutralPolicy ?? this.options.permissions).filesystem} boundary`);
             if (option)
                 this.allowPermission(toolCallId, permissionId);
             else
@@ -1486,8 +1546,8 @@ export class AcpSession {
         // A live grace window still counts as attended: the controller may be
         // mid-reconnect, and denying instantly is exactly what the grace prevents.
         const unattended = this.controllerCount === 0 && !this.controllerGrace
-            && this.options.permissions.unattended === 'deny';
-        if (this.options.permissions.approval === 'deny' || unattended) {
+            && (neutralPolicy ?? this.options.permissions).unattended === 'deny';
+        if ((neutralPolicy ?? this.options.permissions).approval === 'deny' || unattended) {
             // reject_once FIRST: `reject_always` teaches the agent a standing rule from
             // a decision no human made, so one unattended denial would silently disable
             // the tool for the rest of the session.
@@ -1588,8 +1648,8 @@ export class AcpSession {
             ? { outcome: { outcome: 'selected', optionId: option.optionId } }
             : { outcome: { outcome: 'cancelled' } };
     }
-    withinAutomaticBoundary(params) {
-        const filesystem = this.options.permissions.filesystem;
+    withinAutomaticBoundary(params, policy) {
+        const filesystem = (policy ?? this.options.permissions).filesystem;
         if (filesystem === 'unrestricted')
             return true;
         if (filesystem === 'read-only' && params.toolCall.kind !== 'read')