@ours.network/fleet 1.2.0-nightly.57 → 1.2.0-nightly.59

package/dist/file-delivery/reader.js

@@ -1,6 +1,6 @@
 import { constants } from 'node:fs';
-import { mkdir, open } from 'node:fs/promises';
-import { isAbsolute, relative, resolve } from 'node:path';
+import { open, readlink } from 'node:fs/promises';
+import { isAbsolute, resolve } from 'node:path';
 export const MAX_FILE_BYTES = 20 * 1024 * 1024;
 const FLAGS = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
 /** Pin every component; neither trusted root ancestors nor agent components follow symlinks. */
@@ -21,74 +21,43 @@ export async function openDirectory(path) {
         throw error;
     }
 }
-export async function pinExportRoot(path) {
-    const handle = await openDirectory(path);
+/** The agent's provided path, resolved from its working directory; no export subtree. */
+export function chatFilePath(cwd, input) {
+    if (typeof input !== 'string' || !input || input.length > 4096 || /[\x00-\x1f]/.test(input))
+        throw Error('INVALID_CHAT_FILE_PATH');
+    return resolve(cwd, input);
+}
+/**
+ * Runs in the harness bridge, never in the supervisor's OS context. Ancestor
+ * symlinks resolve normally; the named file itself must be one regular,
+ * singly-linked file within the size limit. `path` is the opened file's real path.
+ */
+export async function openChatFile(cwd, input) {
+    if (process.platform !== 'linux')
+        throw Error('CHAT_FILE_REQUIRES_LINUX');
+    let file;
     try {
-        const stat = await handle.stat();
-        if (stat.uid !== process.getuid?.() || (stat.mode & 0o022))
-            throw Error('EXPORT_ROOT_NOT_PRIVATE_OWNED');
-        return { root: { path, dev: stat.dev, ino: stat.ino }, handle };
+        file = await open(chatFilePath(cwd, input), FLAGS);
     }
     catch (error) {
-        await handle.close();
-        throw error;
-    }
-}
-export function exportPath(root, cwd, input) {
-    if (!input || input.length > 4096 || /[\\\x00-\x1f]/.test(input) || input.split('/').some(p => p === '.' || p === '..' || !p) && !isAbsolute(input))
-        throw Error('INVALID_EXPORT_PATH');
-    if (input.split('/').some(p => p === '..' || p === '.'))
-        throw Error('INVALID_EXPORT_PATH');
-    const path = relative(root.path, resolve(cwd, input));
-    const parts = path.split('/');
-    if (!path || isAbsolute(path) || parts.some(p => !p || p === '..' || p === '.' || p.startsWith('.') || /^(credentials?|secrets?|tokens?)(\.|$)/i.test(p)))
-        throw Error('OUTSIDE_EXPORT_DIRECTORY');
-    return parts;
-}
-/** Runs in the harness bridge, never in the supervisor's OS context. */
-export async function openExportFile(root, cwd, input) {
-    const parts = exportPath(root, cwd, input);
-    let dir = await openDirectory(root.path);
-    try {
-        const stat = await dir.stat();
-        if (stat.dev !== root.dev || stat.ino !== root.ino)
-            throw Error('EXPORT_ROOT_CHANGED');
-        for (const part of parts.slice(0, -1)) {
-            const next = await open(`/proc/self/fd/${dir.fd}/${part}`, FLAGS | constants.O_DIRECTORY);
-            await dir.close();
-            dir = next;
-        }
-        const file = await open(`/proc/self/fd/${dir.fd}/${parts.at(-1)}`, FLAGS);
-        try {
-            const stat = await file.stat();
-            if (!stat.isFile() || stat.uid !== process.getuid?.() || stat.nlink !== 1 || stat.size > MAX_FILE_BYTES)
-                throw Error('INVALID_EXPORT_FILE');
-            return file;
-        }
-        catch (error) {
-            await file.close();
+        const code = error.code;
+        if (error instanceof Error && error.message === 'INVALID_CHAT_FILE_PATH')
             throw error;
-        }
-    }
-    finally {
-        await dir.close();
+        throw Error(code === 'ELOOP' ? 'CHAT_FILE_IS_SYMLINK' : code === 'ENOENT' || code === 'ENOTDIR' ? 'CHAT_FILE_NOT_FOUND'
+            : code === 'EACCES' || code === 'EPERM' ? 'CHAT_FILE_NOT_READABLE' : 'CHAT_FILE_OPEN_FAILED');
     }
-}
-export async function ensureExportDirectory(cwd, directory) {
-    let dir = await openDirectory(cwd);
     try {
-        for (const part of directory.split('/')) {
-            if (!part || part.startsWith('.') || /[\\\x00-\x1f]/.test(part))
-                throw Error('INVALID_EXPORT_DIRECTORY');
-            const path = `/proc/self/fd/${dir.fd}/${part}`;
-            await mkdir(path, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST')
-                throw error; });
-            const next = await open(path, FLAGS | constants.O_DIRECTORY);
-            await dir.close();
-            dir = next;
-        }
+        const stat = await file.stat();
+        if (!stat.isFile())
+            throw Error('CHAT_FILE_NOT_REGULAR');
+        if (stat.nlink !== 1)
+            throw Error('CHAT_FILE_HARDLINKED');
+        if (stat.size > MAX_FILE_BYTES)
+            throw Error('FILE_EXCEEDS_20_MIB');
+        return { file, path: await readlink(`/proc/self/fd/${file.fd}`) };
     }
-    finally {
-        await dir.close();
+    catch (error) {
+        await file.close();
+        throw error;
     }
 }

package/dist/harness/codex-app-server-proxy.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { CodexFileInventory } from './codex-file-inventory.js';
 import { spawn } from 'node:child_process';
 import { createRequire } from 'node:module';
 import { createInterface } from 'node:readline';
@@ -447,7 +446,6 @@ export function runCodexAppServerProxy() {
             });
         }
     };
-    const inventory = process.env.FLEET_CURRENT_CHAT_FILES === '1' ? new CodexFileInventory(writeToChild, writeToClient) : undefined;
     const recovery = new CodexTerminalRecovery({
         sendToCodex: writeToChild,
         emitToClient: writeToClient,
@@ -458,7 +456,6 @@ export function runCodexAppServerProxy() {
             return;
         finished = true;
         recovery.close();
-        inventory?.close();
         input.close();
         process.stdin.destroy();
         // stdout/stderr are often pipes under Fleet and tests. Setting exitCode
@@ -491,11 +488,10 @@ export function runCodexAppServerProxy() {
             return;
         const rewritten = rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp, managedOursTools);
         recovery.observeClientLine(rewritten);
-        if (!inventory || inventory.observeClientLine(rewritten))
-            writeToChild(rewritten);
+        writeToChild(rewritten);
     });
     output.on('line', line => {
-        if (!finished && (!inventory || inventory.observeServerLine(line)) && recovery.observeServerLine(line))
+        if (!finished && recovery.observeServerLine(line))
             writeToClient(line);
     });
     input.once('close', () => {

package/dist/harness/codex.js

@@ -262,7 +262,6 @@ function codexAcpEnvironment(role, dirs) {
     if (!source)
         throw new Error('Codex app-server proxy is missing; rebuild ours-fleet');
     writeFileSync(proxyModule, readFileSync(source, 'utf8'), { mode: 0o600 });
-    writeFileSync(join(runtimeDir, 'codex-file-inventory.js'), readFileSync(join(dirname(source), 'codex-file-inventory.js'), 'utf8'), { mode: 0o600 });
     const windows = process.platform === 'win32';
     const command = join(runtimeDir, windows ? 'codex-app-server-proxy.cmd' : 'codex-app-server-proxy');
     const script = windows
@@ -483,7 +482,7 @@ export function makeCodexAdapter(exec = realExec, transport, nativeTransport) {
                     catch (error) {
                         throw new Error(`Codex ACP runtime check failed: ${error.message}; check CODEX_PATH or reinstall Fleet with optional dependencies`);
                     }
-                    const minimum = role.file_delivery?.enabled ? '0.159.0' : role.model === 'gpt-6-astra' || resolution.version === '1.10.0'
+                    const minimum = role.model === 'gpt-6-astra' || resolution.version === '1.10.0'
                         ? '0.153.3' : '0.145.0';
                     if (!codexVersionAtLeast(runtime.version, minimum))
                         throw new Error(`${role.model ?? 'Codex ACP'} requires a newer Codex (>=${minimum}): ACP selects ${runtime.executable} (${runtime.version}); upgrade Fleet or set CODEX_PATH to a supported executable in the agent/service environment`);

package/dist/owner-channel/channel.js

@@ -1985,6 +1985,9 @@ export class OwnerChannel {
         const progressMs = this.options.config.progress_interval_ms;
         let lastSeq = activityCursor;
         let startedAt;
+        // When one turn delivers several waiting prompts, its events carry the turn's
+        // id, not this request's: follow the turn that actually carries this request.
+        const inTurn = (turnId) => turnId === (this.options.session.sharedTurnId?.(queued.promptId) ?? queued.promptId);
         let phase = 'starting request';
         let timer;
         const flushCommentary = () => {
@@ -2041,7 +2044,7 @@ export class OwnerChannel {
         };
         const acceptCommentary = (event) => {
             if (!this.commentsEnabled
-                || active.commentaryDisabled || active.finalizing || event.turnId !== queued.promptId
+                || active.commentaryDisabled || active.finalizing || !inTurn(event.turnId)
                 || event.kind !== 'agent_text' || event.messagePhase !== 'commentary'
                 || event.replayed || event.origin?.kind !== 'owner'
                 || event.origin.requestId !== active.requestId
@@ -2082,7 +2085,7 @@ export class OwnerChannel {
         const reportProgress = () => {
             const events = this.options.session.eventsSince(lastSeq);
             lastSeq = Math.max(lastSeq, this.latestEventSeq(events));
-            const activity = events.filter(event => event.turnId === queued.promptId);
+            const activity = events.filter(event => inTurn(event.turnId));
             if (!activity.length)
                 return;
             startedAt ??= Date.parse(activity[0].at) || Date.now();
@@ -2107,10 +2110,10 @@ export class OwnerChannel {
         const startProgress = (event) => {
             if (timer || progressMs <= 0)
                 return;
-            if (event && event.turnId !== queued.promptId)
+            if (event && !inTurn(event.turnId))
                 return;
             const observed = event ? [event] : this.options.session.eventsSince(activityCursor)
-                .filter(item => item.turnId === queued.promptId);
+                .filter(item => inTurn(item.turnId));
             if (!observed.length)
                 return;
             startedAt = Date.parse(observed[0].at) || Date.now();

package/dist/session/acp.d.ts

@@ -5,6 +5,7 @@ import type { CommonPermissions } from '../config.js';
 import type { AcpMcpServer } from '../harness/types.js';
 import { ConversationEventStore } from './conversation-store.js';
 import type { ConversationSnapshot, PromptOrigin, PromptReceipt, SubmitPromptCommand } from './conversation-types.js';
+import { type PendingPrompt } from './prompt-batch.js';
 import type { ConversationHandlePage, ExitRecord, InterruptOutcome, QueuedPrompt, SessionEvent, AgentSession, RuntimeSelectorMetadata, SessionSnapshot, SubmitPromptOptions, TurnCancellationSource, TurnOutcome, TurnResult } from './types.js';
 /** Bound safe-boundary waiting without turning a hung tool into cancellation. */
 export declare const AFTER_TOOL_BOUNDARY_TIMEOUT_MS = 120000;
@@ -27,6 +28,17 @@ export declare const STEERING_OCCUPANCY_IDLE_MS = 150000;
 export declare const CODEX_DISABLE_INHERITED_MCP_ENV = "OURS_FLEET_CODEX_DISABLE_INHERITED_MCP";
 /** Server-generated typed provenance followed by the exact human-authored body. */
 export declare function promptContentBlocks(text: string, origin?: PromptOrigin): acp.ContentBlock[];
+/**
+ * One adapter turn that carries several admitted prompts.
+ *
+ * A single prompt's provenance block describes "the accompanying text", which
+ * is only unambiguous when there is one text. Here every member is one text
+ * block, unchanged, immediately preceded by its own server-generated block
+ * that names its route and binds its exact bytes — so a monitor wake next to
+ * an owner prompt is never read under the owner's authority, and text that
+ * imitates a marker stays text: it cannot produce a typed block.
+ */
+export declare function batchContentBlocks(members: ReadonlyArray<Pick<PendingPrompt, 'text' | 'origin'>>): acp.ContentBlock[];
 export declare function runtimeSelector(options: acp.SessionConfigOption[] | null | undefined, category: string): RuntimeSelectorMetadata | undefined;
 /** Fresh ACP response including the legacy model report still used by some adapters. */
 export type AcpStartupSessionResponse = acp.NewSessionResponse & {
@@ -139,6 +151,12 @@ export declare class AcpSession implements AgentSession {
     private lastUpdateAt?;
     private lastError?;
     private promptTail;
+    /** Admitted prompts not yet handed to the adapter, in admission order. */
+    private readonly pendingPrompts;
+    /** Admitted prompt → the adapter turn that carries it, while that turn is open. */
+    private readonly sharedTurns;
+    /** Commands the adapter currently advertises; only these are control operations. */
+    private advertisedCommands;
     private queueDepth;
     private exit;
     private steeringSupported;
@@ -236,6 +254,22 @@ export declare class AcpSession implements AgentSession {
      * for it is what turned a busy agent into a timeout and then into "dead".
      */
     queuePrompt(text: string, options?: SubmitPromptOptions): Promise<QueuedPrompt>;
+    /** The turn whose events and result answer this admitted prompt; itself unless a release shared it. */
+    sharedTurnId(promptId: string): string | undefined;
+    /**
+     * Queue an admitted prompt behind the current work. Each prompt keeps its
+     * own step in the chain, so its place in line is unchanged; what the step
+     * does when it is reached is release a whole snapshot, not one prompt.
+     */
+    private enqueue;
+    /**
+     * The turn boundary. The first waiting prompt to get here takes every
+     * pending prompt delivered with it, synchronously, and they share one adapter
+     * turn. A prompt admitted after that — while the turn runs, or while a
+     * cancellation settles — stays pending for the next boundary. A step whose
+     * prompt an earlier boundary already took just reports that turn's result.
+     */
+    private release;
     /**
      * Prepare the session for a prompt that asked to pre-empt current work.
      *
@@ -319,6 +353,11 @@ export declare class AcpSession implements AgentSession {
     private recoverStall;
     /** Keep the original queue slot (including startup) until recovery finishes. */
     private runPrompt;
+    /**
+     * One adapter turn. `members` are the admitted prompts it carries, the first
+     * being the turn's own id; each keeps its own started and completed records
+     * so none is left open and none is reported delivered that was not sent.
+     */
     private runSinglePrompt;
     private steerPrompt;
     private requestPermission;

package/dist/session/acp.js

@@ -8,6 +8,7 @@ import * as acp from '@agentclientprotocol/sdk';
 import { normalizeSessionUpdate } from './conversation-normalizer.js';
 import { ConversationEventStore } from './conversation-store.js';
 import { SessionEvents } from './events.js';
+import { commandName, memberAuthority, memberBindings, pendingInventory, takeBatch, } from './prompt-batch.js';
 import { recordClaudeRateLimit } from '../subscriptions/observed.js';
 import { DEFAULT_STALL_TIMEOUT_MS, STALL_RECOVERY_PROMPT, StallWatchdog, StallToolHistory, hasStallRecoveryClaim } from './stall-watchdog.js';
 import { ACP_CANCEL_DEADLINE_EXCEEDED, SessionControlError, classifyChildExit, sessionBackendCapabilities, turnResult, } from './types.js';
@@ -182,6 +183,38 @@ export function promptContentBlocks(text, origin) {
             mimeType: 'application/vnd.ours-fleet.prompt-provenance+json',
         }, { type: 'text', text }];
 }
+/**
+ * One adapter turn that carries several admitted prompts.
+ *
+ * A single prompt's provenance block describes "the accompanying text", which
+ * is only unambiguous when there is one text. Here every member is one text
+ * block, unchanged, immediately preceded by its own server-generated block
+ * that names its route and binds its exact bytes — so a monitor wake next to
+ * an owner prompt is never read under the owner's authority, and text that
+ * imitates a marker stays text: it cannot produce a typed block.
+ */
+export function batchContentBlocks(members) {
+    if (members.length === 1)
+        return promptContentBlocks(members[0].text, members[0].origin);
+    const mimeType = 'application/vnd.ours-fleet.prompt-provenance+json';
+    return [{
+            type: 'resource_link',
+            uri: `ours-fleet://prompt-batch?members=${members.length}`,
+            name: 'Fleet queued prompt batch',
+            description: `Server-generated. This turn delivers ${members.length} separately admitted prompts in `
+                + 'submission order. Each prompt is one text block immediately preceded by its own '
+                + 'server-generated provenance block, which describes only that one text block.',
+            mimeType,
+        }, ...memberBindings(members, origin => conversationSource(origin).source).flatMap((binding, at) => [{
+                type: 'resource_link',
+                uri: `ours-fleet://prompt-provenance?source=${binding.source}&member=${binding.index}`
+                    + `&of=${binding.of}&bytes=${binding.bytes}&sha256=${binding.sha256}`,
+                name: binding.source === 'owner_admin_console' ? 'Direct owner admin console' : 'Fleet queued prompt',
+                description: `Server-generated provenance for prompt ${binding.index} of ${binding.of}: `
+                    + `${memberAuthority(binding.source)}. Applies only to the text block that immediately follows.`,
+                mimeType,
+            }, { type: 'text', text: members[at].text }])];
+}
 export function runtimeSelector(options, category) {
     const option = options?.find(candidate => candidate.category === category);
     if (!option || typeof option.currentValue !== 'string')
@@ -239,6 +272,12 @@ export class AcpSession {
     lastUpdateAt;
     lastError;
     promptTail = Promise.resolve();
+    /** Admitted prompts not yet handed to the adapter, in admission order. */
+    pendingPrompts = [];
+    /** Admitted prompt → the adapter turn that carries it, while that turn is open. */
+    sharedTurns = new Map();
+    /** Commands the adapter currently advertises; only these are control operations. */
+    advertisedCommands = new Set();
     queueDepth = 0;
     exit = null;
     steeringSupported = false;
@@ -411,8 +450,7 @@ export class AcpSession {
             const text = open.text;
             const promptId = open.promptId;
             this.queueDepth++;
-            const run = this.promptTail.then(() => this.runPrompt(text, promptId));
-            this.promptTail = run.then(() => undefined, () => undefined);
+            const run = this.enqueue(promptId, text, undefined);
             void run.finally(() => { this.queueDepth = Math.max(0, this.queueDepth - 1); });
         }
     }
@@ -467,7 +505,9 @@ export class AcpSession {
             readiness: this.readiness === 'idle' && this.steeringOccupied
                 ? 'running' : this.readiness,
             sessionId: this.sessionId,
-            ...(this.activeTurn?.origin ? { activePromptSource: this.activeTurn.origin.kind } : {}),
+            // A shared turn is a human console turn if any member is: inbox traffic must not cut it short.
+            ...(this.activeTurn?.origin ? { activePromptSource: this.activeTurn.console
+                    ? 'owner-admin-console' : this.activeTurn.origin.kind } : {}),
             lastError: this.lastError,
             pendingPermissionId: this.pendingPermissions.keys().next().value,
             runtimeModel: this.runtimeModel,
@@ -584,7 +624,8 @@ export class AcpSession {
     async steerOrQueueWake(text, options) {
         // A tool-boundary wait may outlive its original turn. Recheck the current
         // typed source at delivery, since an Owner turn can begin during the wait.
-        if (options.origin?.kind === 'fleet-monitor' && this.activeTurn?.origin?.kind === 'owner-admin-console')
+        // `console` covers a shared turn whose first member is not the console prompt.
+        if (options.origin?.kind === 'fleet-monitor' && this.activeTurn?.console)
             return this.submitPrompt(text, { ...options, interrupt: false, steer: false });
         if (this.stallRecoveryClaimed)
             return this.submitPrompt(text, { ...options, interrupt: false, steer: false });
@@ -675,8 +716,7 @@ export class AcpSession {
         const queuedBehind = this.queueDepth;
         this.admitToLedger(promptId, text, queuedBehind, options);
         this.queueDepth++;
-        const run = this.promptTail.then(() => this.runPrompt(text, promptId, options.origin));
-        this.promptTail = run.then(() => undefined, () => undefined);
+        const run = this.enqueue(promptId, text, options.origin);
         const completion = run.then(result => { this.queueDepth = Math.max(0, this.queueDepth - 1); return result; }, error => {
             this.queueDepth = Math.max(0, this.queueDepth - 1);
             return turnResult(false, 'failed', error?.message ?? String(error));
@@ -686,6 +726,46 @@ export class AcpSession {
             delivery: delivery ?? (queuedBehind > 0 ? 'queued' : 'started'),
         };
     }
+    /** The turn whose events and result answer this admitted prompt; itself unless a release shared it. */
+    sharedTurnId(promptId) {
+        return this.sharedTurns.get(promptId);
+    }
+    /**
+     * Queue an admitted prompt behind the current work. Each prompt keeps its
+     * own step in the chain, so its place in line is unchanged; what the step
+     * does when it is reached is release a whole snapshot, not one prompt.
+     */
+    enqueue(promptId, text, origin) {
+        const entry = {
+            promptId, text, origin, ...conversationSource(origin), admittedAt: new Date().toISOString(),
+            command: this.advertisedCommands.has(commandName(text) ?? ''),
+        };
+        this.pendingPrompts.push(entry);
+        const run = this.promptTail.then(() => this.release(entry));
+        this.promptTail = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    /**
+     * The turn boundary. The first waiting prompt to get here takes every
+     * pending prompt delivered with it, synchronously, and they share one adapter
+     * turn. A prompt admitted after that — while the turn runs, or while a
+     * cancellation settles — stays pending for the next boundary. A step whose
+     * prompt an earlier boundary already took just reports that turn's result.
+     */
+    release(entry) {
+        if (entry.released)
+            return entry.released;
+        const members = takeBatch(this.pendingPrompts, entry);
+        for (const member of members)
+            this.sharedTurns.set(member.promptId, members[0].promptId);
+        const run = this.runPrompt(members).finally(() => {
+            for (const member of members)
+                this.sharedTurns.delete(member.promptId);
+        });
+        for (const member of members)
+            member.released = run;
+        return run;
+    }
     /**
      * Prepare the session for a prompt that asked to pre-empt current work.
      *
@@ -807,7 +887,7 @@ export class AcpSession {
     async interruptPrompt(generation, promptId) {
         if (generation !== this.sessionGeneration)
             throw new Error('session_changed: Agent session changed.');
-        if (this.activeTurn?.id !== promptId)
+        if (!this.activeTurn?.promptIds.includes(promptId))
             return { state: 'settled' };
         return this.interrupt('local-console');
     }
@@ -1354,8 +1434,9 @@ export class AcpSession {
         }
     }
     /** Keep the original queue slot (including startup) until recovery finishes. */
-    async runPrompt(text, turnId = randomUUID(), origin) {
-        const result = await this.runSinglePrompt(text, turnId, origin);
+    async runPrompt(members) {
+        const { text, promptId: turnId, origin } = members[0];
+        const result = await this.runSinglePrompt(text, turnId, origin, members);
         const attempt = this.stallAttempt;
         if (!attempt || attempt.turnId !== turnId)
             return result;
@@ -1390,7 +1471,21 @@ export class AcpSession {
             return turnResult(true, 'cancelled', 'diagnostic recovery requires operator attention', undefined, 'stall-watchdog');
         }
     }
-    async runSinglePrompt(text, turnId = randomUUID(), origin) {
+    /**
+     * One adapter turn. `members` are the admitted prompts it carries, the first
+     * being the turn's own id; each keeps its own started and completed records
+     * so none is left open and none is reported delivered that was not sent.
+     */
+    async runSinglePrompt(text, turnId = randomUUID(), origin, members = [{ promptId: turnId, text, origin }]) {
+        const closeMembers = (payload) => {
+            for (const member of members)
+                this.conversation.appendSafe({
+                    kind: 'turn.completed', sessionGeneration: this.sessionGeneration,
+                    acpSessionId: this.sessionId, promptId: member.promptId, turnId, payload,
+                });
+        };
+        // Not handed to the adapter and not closed: the members stay admitted, and
+        // the next session generation dispatches them again.
         if (!this.sessionId || !this.isAlive())
             return turnResult(false, 'failed', this.lastError ?? 'ACP session is offline');
         this.readiness = 'running';
@@ -1398,18 +1493,19 @@ export class AcpSession {
         this.retryNativeTurnId = undefined;
         let settle;
         const settled = new Promise(resolve => { settle = resolve; });
-        this.activeTurn = { toolEvidence: new Map(), startedAt: Date.now(), toolIds: new Set(), lastProgressAt: 0, progressCount: 0, transportFailures: 0, boundaryUnknown: false, id: turnId, output: '', origin, settled, settle };
+        this.activeTurn = { toolEvidence: new Map(), startedAt: Date.now(), toolIds: new Set(), lastProgressAt: 0, progressCount: 0, transportFailures: 0, boundaryUnknown: false, id: turnId, output: '', origin, settled, settle, promptIds: members.map(member => member.promptId), console: members.some(member => member.origin?.kind === 'owner-admin-console') };
         this.events.emit('state', { turnId, status: 'running', origin });
-        this.conversation.appendSafe({
+        members.forEach((member, index) => this.conversation.appendSafe({
             kind: 'prompt.started', sessionGeneration: this.sessionGeneration,
-            acpSessionId: this.sessionId, promptId: turnId, turnId,
-            source: conversationSource(origin).source, payload: {},
-        });
+            acpSessionId: this.sessionId, promptId: member.promptId, turnId,
+            source: conversationSource(member.origin).source,
+            payload: members.length > 1 ? { batch: { turnId, index, size: members.length } } : {},
+        }));
         try {
             const response = await Promise.race([
                 this.connection.agent.request(acp.methods.agent.session.prompt, {
                     sessionId: this.sessionId,
-                    prompt: promptContentBlocks(text, origin),
+                    prompt: batchContentBlocks(members),
                 }),
                 this.terminated,
             ]);
@@ -1420,14 +1516,10 @@ export class AcpSession {
                 turnId, stopReason: response.stopReason, origin, cancellationSource,
             });
             this.events.emit('state', { status: 'idle' });
-            this.conversation.appendSafe({
-                kind: 'turn.completed', sessionGeneration: this.sessionGeneration,
-                acpSessionId: this.sessionId, promptId: turnId, turnId,
-                payload: {
-                    outcome: classifyStopReason(response.stopReason),
-                    stopReason: response.stopReason,
-                    ...(cancellationSource ? { cancellationSource } : {}),
-                },
+            closeMembers({
+                outcome: classifyStopReason(response.stopReason),
+                stopReason: response.stopReason,
+                ...(cancellationSource ? { cancellationSource } : {}),
             });
             // The prompt was accepted either way — the agent answered. Whether the
             // turn SUCCEEDED is a separate question, and only `stopReason` answers it.
@@ -1448,11 +1540,7 @@ export class AcpSession {
             });
             if (this.isAlive())
                 this.events.emit('state', { status: 'idle' });
-            this.conversation.appendSafe({
-                kind: 'turn.completed', sessionGeneration: this.sessionGeneration,
-                acpSessionId: this.sessionId, promptId: turnId, turnId,
-                payload: { outcome: 'failed', stopReason: this.lastError },
-            });
+            closeMembers({ outcome: 'failed', stopReason: this.lastError });
             return turnResult(false, 'failed', this.lastError, this.activeTurn?.id === turnId ? this.activeTurn.output : undefined);
         }
         finally {
@@ -1783,6 +1871,8 @@ export class AcpSession {
         this.recordConversationUpdate(update, scheduled);
         if (update.sessionUpdate === 'config_option_update')
             this.captureRuntimeMetadata(update.configOptions);
+        if (update.sessionUpdate === 'available_commands_update')
+            this.advertisedCommands = new Set((update.availableCommands ?? []).map(command => command.name));
         if (update.sessionUpdate === 'usage_update') {
             // Claude subscription rate-limit snapshot (claude-agent-acp forwards the SDK rate_limit_event).
             const rateLimit = update._meta?.['_claude/rateLimit'];
@@ -1917,6 +2007,7 @@ export class AcpSession {
             readiness: this.isAlive() ? this.readiness : 'offline',
             queueDepth: this.queueDepth,
             pendingPermissionIds: [...this.pendingPermissions.keys()],
+            ...pendingInventory(this.pendingPrompts),
             ...(this.conversation.degraded ? { historyDegraded: true } : {}),
         };
     }

package/dist/session/arbiter.d.ts

@@ -70,6 +70,7 @@ export declare class RoleTurnArbiter implements AgentSession {
     }>, beforeQueue?: () => void | Promise<void>): Promise<ScheduledAttempt>;
     /** Retire only at the same admission boundary used by all prompt producers. */
     retireIfIdle(expired: (snapshot: SessionSnapshot, queueDepth: number) => boolean): Promise<boolean>;
+    sharedTurnId(promptId: string): string | undefined;
     stopScheduledAdmission(): void;
     isAlive(): boolean;
     snapshot(): SessionSnapshot;

package/dist/session/arbiter.js

@@ -167,6 +167,7 @@ export class RoleTurnArbiter {
             return true;
         });
     }
+    sharedTurnId(promptId) { return this.session.sharedTurnId?.(promptId); }
     stopScheduledAdmission() { this.stopping = true; }
     isAlive() { return this.session.isAlive(); }
     snapshot() { return this.session.snapshot(); }

package/dist/session/codex-app-server.d.ts

@@ -1,6 +1,7 @@
 import { type TaskNoticeBinding, type TaskCreatedNotice } from './task-notice.js';
 import type { CommonPermissions } from '../config.js';
 import type { ConversationEventV1, ConversationSnapshot, PromptOrigin, PromptReceipt, SubmitPromptCommand } from './conversation-types.js';
+import { type PendingPrompt } from './prompt-batch.js';
 import type { CodexAppServerTransportFactory } from './codex-app-server-transport.js';
 import type { AgentSession, ConversationHandlePage, ExitRecord, InterruptOutcome, QueuedPrompt, SessionEvent, SessionSnapshot, SubmitPromptOptions, TurnCancellationSource, TurnResult } from './types.js';
 type JsonObject = Record<string, unknown>;
@@ -30,6 +31,16 @@ export interface CodexAppServerSessionOptions {
 }
 /** Server-generated application provenance for authenticated browser prompts only. */
 export declare function nativePromptAdditionalContext(origin: PromptOrigin | undefined): JsonObject | undefined;
+/**
+ * Application context for a turn that carries several admitted prompts.
+ *
+ * The single-prompt context says "the accompanying user text", which would
+ * cover every member. A shared turn therefore carries this one entry instead:
+ * each member is its own user text item, in order, and its route and exact
+ * bytes are stated here by the server. Text imitating this wording is still
+ * only user text; it cannot add an application-context entry.
+ */
+export declare function nativeBatchAdditionalContext(members: ReadonlyArray<Pick<PendingPrompt, 'text' | 'origin'>>): JsonObject | undefined;
 /** Native Codex session implementing Fleet's provider-neutral live-session contract. */
 export declare class CodexAppServerSession implements AgentSession {
     private readonly options;
@@ -56,6 +67,10 @@ export declare class CodexAppServerSession implements AgentSession {
     private exit;
     private queueDepth;
     private promptTail;
+    /** Admitted prompts not yet handed to the app-server, in admission order. */
+    private readonly pendingPrompts;
+    /** Admitted prompt → the turn that carries it, while that turn is open. */
+    private readonly sharedTurns;
     private activeTurn?;
     private controllerCount;
     private controllerGrace?;
@@ -69,6 +84,17 @@ export declare class CodexAppServerSession implements AgentSession {
     isAlive(): boolean;
     snapshot(): SessionSnapshot;
     queuePrompt(text: string, options?: SubmitPromptOptions): Promise<QueuedPrompt>;
+    /** The turn whose events and result answer this admitted prompt; itself unless a release shared it. */
+    sharedTurnId(promptId: string): string | undefined;
+    /** Each prompt keeps its own step in the chain; the step it reaches releases a whole snapshot. */
+    private enqueue;
+    /**
+     * The turn boundary: the first waiting prompt to get here synchronously
+     * takes every pending prompt delivered with it into one turn. A prompt
+     * admitted afterwards stays pending for the next boundary, and a step whose
+     * prompt was already taken reports that turn's result.
+     */
+    private release;
     submitPrompt(text: string, options?: SubmitPromptOptions): Promise<TurnResult>;
     readonly liveVoiceSupported = true;
     interruptPrompt(generation: string, promptId: string): Promise<InterruptOutcome>;