@ours.network/fleet 1.2.0-nightly.6 → 1.2.0-nightly.60

package/dist/session/acp.d.ts

@@ -1,8 +1,11 @@
+import type { FileDeliveryInput, CopyChatFile, DeliveredFile } from '../file-delivery/types.js';
+import { type TaskNoticeBinding, type TaskCreatedNotice } from './task-notice.js';
 import * as acp from '@agentclientprotocol/sdk';
 import type { CommonPermissions } from '../config.js';
 import type { AcpMcpServer } from '../harness/types.js';
 import { ConversationEventStore } from './conversation-store.js';
 import type { ConversationSnapshot, PromptOrigin, PromptReceipt, SubmitPromptCommand } from './conversation-types.js';
+import { type PendingPrompt } from './prompt-batch.js';
 import type { ConversationHandlePage, ExitRecord, InterruptOutcome, QueuedPrompt, SessionEvent, AgentSession, RuntimeSelectorMetadata, SessionSnapshot, SubmitPromptOptions, TurnCancellationSource, TurnOutcome, TurnResult } from './types.js';
 /** Bound safe-boundary waiting without turning a hung tool into cancellation. */
 export declare const AFTER_TOOL_BOUNDARY_TIMEOUT_MS = 120000;
@@ -25,6 +28,17 @@ export declare const STEERING_OCCUPANCY_IDLE_MS = 150000;
 export declare const CODEX_DISABLE_INHERITED_MCP_ENV = "OURS_FLEET_CODEX_DISABLE_INHERITED_MCP";
 /** Server-generated typed provenance followed by the exact human-authored body. */
 export declare function promptContentBlocks(text: string, origin?: PromptOrigin): acp.ContentBlock[];
+/**
+ * One adapter turn that carries several admitted prompts.
+ *
+ * A single prompt's provenance block describes "the accompanying text", which
+ * is only unambiguous when there is one text. Here every member is one text
+ * block, unchanged, immediately preceded by its own server-generated block
+ * that names its route and binds its exact bytes — so a monitor wake next to
+ * an owner prompt is never read under the owner's authority, and text that
+ * imitates a marker stays text: it cannot produce a typed block.
+ */
+export declare function batchContentBlocks(members: ReadonlyArray<Pick<PendingPrompt, 'text' | 'origin'>>): acp.ContentBlock[];
 export declare function runtimeSelector(options: acp.SessionConfigOption[] | null | undefined, category: string): RuntimeSelectorMetadata | undefined;
 /** Fresh ACP response including the legacy model report still used by some adapters. */
 export type AcpStartupSessionResponse = acp.NewSessionResponse & {
@@ -49,6 +63,7 @@ export interface AcpSessionOptions {
     inheritEnvironment?: boolean;
     stateDir: string;
     mode: 'fresh' | 'resume';
+    requireResume?: boolean;
     permissions: CommonPermissions;
     /** Native permission-mode id to request via session/set_mode; undefined keeps the agent default. */
     modeId?: string;
@@ -136,6 +151,12 @@ export declare class AcpSession implements AgentSession {
     private lastUpdateAt?;
     private lastError?;
     private promptTail;
+    /** Admitted prompts not yet handed to the adapter, in admission order. */
+    private readonly pendingPrompts;
+    /** Admitted prompt → the adapter turn that carries it, while that turn is open. */
+    private readonly sharedTurns;
+    /** Commands the adapter currently advertises; only these are control operations. */
+    private advertisedCommands;
     private queueDepth;
     private exit;
     private steeringSupported;
@@ -175,6 +196,7 @@ export declare class AcpSession implements AgentSession {
     private stallTimer?;
     private stallAttempt?;
     private readonly toolBoundaryWaiters;
+    private fileExportBusy;
     private activeTurn?;
     private constructor();
     static start(options: AcpSessionOptions): Promise<AcpSession>;
@@ -232,6 +254,22 @@ export declare class AcpSession implements AgentSession {
      * for it is what turned a busy agent into a timeout and then into "dead".
      */
     queuePrompt(text: string, options?: SubmitPromptOptions): Promise<QueuedPrompt>;
+    /** The turn whose events and result answer this admitted prompt; itself unless a release shared it. */
+    sharedTurnId(promptId: string): string | undefined;
+    /**
+     * Queue an admitted prompt behind the current work. Each prompt keeps its
+     * own step in the chain, so its place in line is unchanged; what the step
+     * does when it is reached is release a whole snapshot, not one prompt.
+     */
+    private enqueue;
+    /**
+     * The turn boundary. The first waiting prompt to get here takes every
+     * pending prompt delivered with it, synchronously, and they share one adapter
+     * turn. A prompt admitted after that — while the turn runs, or while a
+     * cancellation settles — stays pending for the next boundary. A step whose
+     * prompt an earlier boundary already took just reports that turn's result.
+     */
+    private release;
     /**
      * Prepare the session for a prompt that asked to pre-empt current work.
      *
@@ -271,6 +309,8 @@ export declare class AcpSession implements AgentSession {
      * (`queuePrompt({ interrupt: true })`) needs the typed error, because only it
      * still owes an undelivered message a replay.
      */
+    readonly liveVoiceSupported = true;
+    interruptPrompt(generation: string, promptId: string): Promise<InterruptOutcome>;
     interrupt(source?: TurnCancellationSource): Promise<InterruptOutcome>;
     private cancelActive;
     /**
@@ -300,6 +340,8 @@ export declare class AcpSession implements AgentSession {
      */
     private settlePendingAutomatically;
     exitResult(): ExitRecord | null;
+    /** One attempt, tied to the managed live turn captured before any approval/read. */
+    sendFileToChat(input: FileDeliveryInput, signal: AbortSignal, copy: CopyChatFile, policy: CommonPermissions): Promise<DeliveredFile>;
     close(): Promise<void>;
     /** ACP requires the field. Bundled agents treat [] as no client-added servers. */
     private declaredMcpServers;
@@ -311,6 +353,11 @@ export declare class AcpSession implements AgentSession {
     private recoverStall;
     /** Keep the original queue slot (including startup) until recovery finishes. */
     private runPrompt;
+    /**
+     * One adapter turn. `members` are the admitted prompts it carries, the first
+     * being the turn's own id; each keeps its own started and completed records
+     * so none is left open and none is reported delivered that was not sent.
+     */
     private runSinglePrompt;
     private steerPrompt;
     private requestPermission;
@@ -338,8 +385,13 @@ export declare class AcpSession implements AgentSession {
      * signal. Never infer commentary from text, message order, or unknown meta.
      */
     private codexMessagePhase;
-    /** Normalize every ACP update losslessly into the durable ledger. */
+    /**
+     * Normalize every ACP update losslessly into the durable ledger. The ledger is the conversation the
+     * owner reads, so the agent's commentary between its tools is kept as written, like its final answer.
+     */
     private recordConversationUpdate;
+    taskNoticeBinding(): TaskNoticeBinding | undefined;
+    recordTaskCreated(binding: TaskNoticeBinding, notice: TaskCreatedNotice): void;
     conversationPage(request?: {
         after?: string;
         limit?: number;

package/dist/session/acp.js

@@ -1,3 +1,4 @@
+import { appendTaskCreated } from './task-notice.js';
 import { spawn } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, lstatSync, readFileSync, readlinkSync, realpathSync, writeFileSync, } from 'node:fs';
@@ -7,6 +8,8 @@ import * as acp from '@agentclientprotocol/sdk';
 import { normalizeSessionUpdate } from './conversation-normalizer.js';
 import { ConversationEventStore } from './conversation-store.js';
 import { SessionEvents } from './events.js';
+import { commandName, memberAuthority, memberBindings, pendingInventory, takeBatch, } from './prompt-batch.js';
+import { recordClaudeRateLimit } from '../subscriptions/observed.js';
 import { DEFAULT_STALL_TIMEOUT_MS, STALL_RECOVERY_PROMPT, StallWatchdog, StallToolHistory, hasStallRecoveryClaim } from './stall-watchdog.js';
 import { ACP_CANCEL_DEADLINE_EXCEEDED, SessionControlError, classifyChildExit, sessionBackendCapabilities, turnResult, } from './types.js';
 const CANCEL_SETTLE_GRACE_MS = 15_000;
@@ -36,7 +39,6 @@ const TERMINAL_TOOL_STATUSES = new Set(['completed', 'failed']);
 /** Consumed only by Fleet's authenticated bundled-Codex app-server proxy. */
 export const CODEX_DISABLE_INHERITED_MCP_ENV = 'OURS_FLEET_CODEX_DISABLE_INHERITED_MCP';
 const SCHEDULED_LOOP_REDACTION = '[scheduled-loop content redacted]';
-const OWNER_COMMENTARY_REDACTION = '[assistant commentary redacted]';
 const MAX_CANONICAL_SYMLINK_DEPTH = 40;
 const scheduledTurn = (turn) => turn?.origin?.kind === 'scheduled-loop';
 /**
@@ -181,6 +183,38 @@ export function promptContentBlocks(text, origin) {
             mimeType: 'application/vnd.ours-fleet.prompt-provenance+json',
         }, { type: 'text', text }];
 }
+/**
+ * One adapter turn that carries several admitted prompts.
+ *
+ * A single prompt's provenance block describes "the accompanying text", which
+ * is only unambiguous when there is one text. Here every member is one text
+ * block, unchanged, immediately preceded by its own server-generated block
+ * that names its route and binds its exact bytes — so a monitor wake next to
+ * an owner prompt is never read under the owner's authority, and text that
+ * imitates a marker stays text: it cannot produce a typed block.
+ */
+export function batchContentBlocks(members) {
+    if (members.length === 1)
+        return promptContentBlocks(members[0].text, members[0].origin);
+    const mimeType = 'application/vnd.ours-fleet.prompt-provenance+json';
+    return [{
+            type: 'resource_link',
+            uri: `ours-fleet://prompt-batch?members=${members.length}`,
+            name: 'Fleet queued prompt batch',
+            description: `Server-generated. This turn delivers ${members.length} separately admitted prompts in `
+                + 'submission order. Each prompt is one text block immediately preceded by its own '
+                + 'server-generated provenance block, which describes only that one text block.',
+            mimeType,
+        }, ...memberBindings(members, origin => conversationSource(origin).source).flatMap((binding, at) => [{
+                type: 'resource_link',
+                uri: `ours-fleet://prompt-provenance?source=${binding.source}&member=${binding.index}`
+                    + `&of=${binding.of}&bytes=${binding.bytes}&sha256=${binding.sha256}`,
+                name: binding.source === 'owner_admin_console' ? 'Direct owner admin console' : 'Fleet queued prompt',
+                description: `Server-generated provenance for prompt ${binding.index} of ${binding.of}: `
+                    + `${memberAuthority(binding.source)}. Applies only to the text block that immediately follows.`,
+                mimeType,
+            }, { type: 'text', text: members[at].text }])];
+}
 export function runtimeSelector(options, category) {
     const option = options?.find(candidate => candidate.category === category);
     if (!option || typeof option.currentValue !== 'string')
@@ -238,6 +272,12 @@ export class AcpSession {
     lastUpdateAt;
     lastError;
     promptTail = Promise.resolve();
+    /** Admitted prompts not yet handed to the adapter, in admission order. */
+    pendingPrompts = [];
+    /** Admitted prompt → the adapter turn that carries it, while that turn is open. */
+    sharedTurns = new Map();
+    /** Commands the adapter currently advertises; only these are control operations. */
+    advertisedCommands = new Set();
     queueDepth = 0;
     exit = null;
     steeringSupported = false;
@@ -277,6 +317,7 @@ export class AcpSession {
     stallTimer;
     stallAttempt;
     toolBoundaryWaiters = new Set();
+    fileExportBusy = false;
     activeTurn;
     constructor(options, child, connection) {
         this.options = options;
@@ -409,8 +450,7 @@ export class AcpSession {
             const text = open.text;
             const promptId = open.promptId;
             this.queueDepth++;
-            const run = this.promptTail.then(() => this.runPrompt(text, promptId));
-            this.promptTail = run.then(() => undefined, () => undefined);
+            const run = this.enqueue(promptId, text, undefined);
             void run.finally(() => { this.queueDepth = Math.max(0, this.queueDepth - 1); });
         }
     }
@@ -465,6 +505,9 @@ export class AcpSession {
             readiness: this.readiness === 'idle' && this.steeringOccupied
                 ? 'running' : this.readiness,
             sessionId: this.sessionId,
+            // A shared turn is a human console turn if any member is: inbox traffic must not cut it short.
+            ...(this.activeTurn?.origin ? { activePromptSource: this.activeTurn.console
+                    ? 'owner-admin-console' : this.activeTurn.origin.kind } : {}),
             lastError: this.lastError,
             pendingPermissionId: this.pendingPermissions.keys().next().value,
             runtimeModel: this.runtimeModel,
@@ -579,6 +622,11 @@ export class AcpSession {
      * steering response from becoming a tight replay loop.
      */
     async steerOrQueueWake(text, options) {
+        // A tool-boundary wait may outlive its original turn. Recheck the current
+        // typed source at delivery, since an Owner turn can begin during the wait.
+        // `console` covers a shared turn whose first member is not the console prompt.
+        if (options.origin?.kind === 'fleet-monitor' && this.activeTurn?.console)
+            return this.submitPrompt(text, { ...options, interrupt: false, steer: false });
         if (this.stallRecoveryClaimed)
             return this.submitPrompt(text, { ...options, interrupt: false, steer: false });
         const steered = await this.steerPrompt(text);
@@ -668,8 +716,7 @@ export class AcpSession {
         const queuedBehind = this.queueDepth;
         this.admitToLedger(promptId, text, queuedBehind, options);
         this.queueDepth++;
-        const run = this.promptTail.then(() => this.runPrompt(text, promptId, options.origin));
-        this.promptTail = run.then(() => undefined, () => undefined);
+        const run = this.enqueue(promptId, text, options.origin);
         const completion = run.then(result => { this.queueDepth = Math.max(0, this.queueDepth - 1); return result; }, error => {
             this.queueDepth = Math.max(0, this.queueDepth - 1);
             return turnResult(false, 'failed', error?.message ?? String(error));
@@ -679,6 +726,46 @@ export class AcpSession {
             delivery: delivery ?? (queuedBehind > 0 ? 'queued' : 'started'),
         };
     }
+    /** The turn whose events and result answer this admitted prompt; itself unless a release shared it. */
+    sharedTurnId(promptId) {
+        return this.sharedTurns.get(promptId);
+    }
+    /**
+     * Queue an admitted prompt behind the current work. Each prompt keeps its
+     * own step in the chain, so its place in line is unchanged; what the step
+     * does when it is reached is release a whole snapshot, not one prompt.
+     */
+    enqueue(promptId, text, origin) {
+        const entry = {
+            promptId, text, origin, ...conversationSource(origin), admittedAt: new Date().toISOString(),
+            command: this.advertisedCommands.has(commandName(text) ?? ''),
+        };
+        this.pendingPrompts.push(entry);
+        const run = this.promptTail.then(() => this.release(entry));
+        this.promptTail = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    /**
+     * The turn boundary. The first waiting prompt to get here takes every
+     * pending prompt delivered with it, synchronously, and they share one adapter
+     * turn. A prompt admitted after that — while the turn runs, or while a
+     * cancellation settles — stays pending for the next boundary. A step whose
+     * prompt an earlier boundary already took just reports that turn's result.
+     */
+    release(entry) {
+        if (entry.released)
+            return entry.released;
+        const members = takeBatch(this.pendingPrompts, entry);
+        for (const member of members)
+            this.sharedTurns.set(member.promptId, members[0].promptId);
+        const run = this.runPrompt(members).finally(() => {
+            for (const member of members)
+                this.sharedTurns.delete(member.promptId);
+        });
+        for (const member of members)
+            member.released = run;
+        return run;
+    }
     /**
      * Prepare the session for a prompt that asked to pre-empt current work.
      *
@@ -760,6 +847,10 @@ export class AcpSession {
         const existing = this.conversation.receiptFor(command.commandId, bodyDigest);
         if (existing)
             return existing;
+        if (command.expectedSessionGeneration !== undefined && command.expectedSessionGeneration !== this.conversationSnapshot().sessionGeneration)
+            throw new Error('session_changed: Agent session changed. Record a new voice message.');
+        if (command.requireIdle && (this.queueDepth > 0 || this.conversationSnapshot().readiness !== 'idle'))
+            throw new Error('voice_busy: Agent is already working. Wait for the current turn.');
         const queued = await this.queuePrompt(command.text, {
             origin: { kind: 'owner-admin-console', commandId: command.commandId },
             actor: { browserSession: command.actorBrowserSession },
@@ -792,6 +883,14 @@ export class AcpSession {
      * (`queuePrompt({ interrupt: true })`) needs the typed error, because only it
      * still owes an undelivered message a replay.
      */
+    liveVoiceSupported = true;
+    async interruptPrompt(generation, promptId) {
+        if (generation !== this.sessionGeneration)
+            throw new Error('session_changed: Agent session changed.');
+        if (!this.activeTurn?.promptIds.includes(promptId))
+            return { state: 'settled' };
+        return this.interrupt('local-console');
+    }
     async interrupt(source = 'local-console') {
         try {
             await this.cancelActive(source);
@@ -810,6 +909,8 @@ export class AcpSession {
         if (!this.sessionId)
             return;
         const active = this.activeTurn;
+        if (active)
+            active.fileDeliveryRevoked = true;
         const previousSource = active?.cancellationSource;
         if (active && (source === 'owner' || source === 'local-console' || !previousSource))
             active.cancellationSource = source;
@@ -1013,6 +1114,54 @@ export class AcpSession {
     exitResult() {
         return this.exit;
     }
+    /** One attempt, tied to the managed live turn captured before any approval/read. */
+    async sendFileToChat(input, signal, copy, policy) {
+        const active = this.activeTurn, sessionId = this.sessionId;
+        const check = () => {
+            signal.throwIfAborted();
+            if (!active || !sessionId || this.activeTurn !== active || this.sessionId !== sessionId || active.fileDeliveryRevoked
+                || active.cancellationSource || this.closing || !this.isAlive() || this.replaying || this.steeringOccupied
+                || active.origin?.kind === 'scheduled-loop' || policy.approval === 'deny')
+                throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE');
+        };
+        check();
+        if (this.fileExportBusy)
+            throw Error('FILE_DELIVERY_BUSY');
+        this.fileExportBusy = true;
+        const toolCallId = 'fleet-file-export-' + randomUUID();
+        try {
+            const onAbort = () => {
+                for (const [id, pending] of this.pendingPermissions)
+                    if (pending.toolCallId === toolCallId)
+                        this.settlePendingAutomatically(id, pending, 'cancelled', undefined, 'File send cancelled');
+            };
+            signal.addEventListener('abort', onAbort, { once: true });
+            let answer;
+            try {
+                answer = await this.requestPermission({ sessionId: sessionId, toolCall: {
+                        toolCallId, title: 'Send file to this ACP chat: ' + (input.filename ?? input.path), kind: 'read', status: 'pending',
+                        locations: [{ path: resolve(this.options.cwd, input.path) }],
+                    }, options: [{ optionId: 'send', name: 'Send file', kind: 'allow_once' }, { optionId: 'deny', name: 'Do not send', kind: 'reject_once' }] }, policy);
+            }
+            finally {
+                signal.removeEventListener('abort', onAbort);
+            }
+            check();
+            if (answer.outcome.outcome !== 'selected' || answer.outcome.optionId !== 'send')
+                throw Error('FILE_SEND_DENIED');
+            const attachment = await copy({ sessionGeneration: this.sessionGeneration, acpSessionId: sessionId, turnId: active.id });
+            // Synchronous check + durable append establishes order with cancellation/stop.
+            // No await, pending-send journal, replay or recovery exists after this point.
+            check();
+            this.conversation.append({ kind: 'file.attached', source: 'agent', sessionGeneration: this.sessionGeneration,
+                acpSessionId: sessionId, promptId: active.id, turnId: active.id, payload: { attachment } });
+            return attachment;
+        }
+        finally {
+            this.releaseTool(toolCallId);
+            this.fileExportBusy = false;
+        }
+    }
     async close() {
         this.closing = true;
         if (this.stallTimer)
@@ -1066,6 +1215,8 @@ export class AcpSession {
         const persisted = this.options.mode === 'resume' && existsSync(this.sessionFile)
             ? readFileSync(this.sessionFile, 'utf8').trim()
             : '';
+        if (this.options.requireResume && (!persisted || !(this.agentCapabilities?.sessionCapabilities?.resume != null || this.agentCapabilities?.loadSession)))
+            throw new Error('TASK_CONTEXT_RESUME_UNAVAILABLE');
         let advertisedConfigOptions;
         let advertisedModes;
         let advertisedModelId;
@@ -1283,8 +1434,9 @@ export class AcpSession {
         }
     }
     /** Keep the original queue slot (including startup) until recovery finishes. */
-    async runPrompt(text, turnId = randomUUID(), origin) {
-        const result = await this.runSinglePrompt(text, turnId, origin);
+    async runPrompt(members) {
+        const { text, promptId: turnId, origin } = members[0];
+        const result = await this.runSinglePrompt(text, turnId, origin, members);
         const attempt = this.stallAttempt;
         if (!attempt || attempt.turnId !== turnId)
             return result;
@@ -1319,7 +1471,21 @@ export class AcpSession {
             return turnResult(true, 'cancelled', 'diagnostic recovery requires operator attention', undefined, 'stall-watchdog');
         }
     }
-    async runSinglePrompt(text, turnId = randomUUID(), origin) {
+    /**
+     * One adapter turn. `members` are the admitted prompts it carries, the first
+     * being the turn's own id; each keeps its own started and completed records
+     * so none is left open and none is reported delivered that was not sent.
+     */
+    async runSinglePrompt(text, turnId = randomUUID(), origin, members = [{ promptId: turnId, text, origin }]) {
+        const closeMembers = (payload) => {
+            for (const member of members)
+                this.conversation.appendSafe({
+                    kind: 'turn.completed', sessionGeneration: this.sessionGeneration,
+                    acpSessionId: this.sessionId, promptId: member.promptId, turnId, payload,
+                });
+        };
+        // Not handed to the adapter and not closed: the members stay admitted, and
+        // the next session generation dispatches them again.
         if (!this.sessionId || !this.isAlive())
             return turnResult(false, 'failed', this.lastError ?? 'ACP session is offline');
         this.readiness = 'running';
@@ -1327,18 +1493,19 @@ export class AcpSession {
         this.retryNativeTurnId = undefined;
         let settle;
         const settled = new Promise(resolve => { settle = resolve; });
-        this.activeTurn = { toolEvidence: new Map(), startedAt: Date.now(), toolIds: new Set(), lastProgressAt: 0, progressCount: 0, transportFailures: 0, boundaryUnknown: false, id: turnId, output: '', origin, settled, settle };
+        this.activeTurn = { toolEvidence: new Map(), startedAt: Date.now(), toolIds: new Set(), lastProgressAt: 0, progressCount: 0, transportFailures: 0, boundaryUnknown: false, id: turnId, output: '', origin, settled, settle, promptIds: members.map(member => member.promptId), console: members.some(member => member.origin?.kind === 'owner-admin-console') };
         this.events.emit('state', { turnId, status: 'running', origin });
-        this.conversation.appendSafe({
+        members.forEach((member, index) => this.conversation.appendSafe({
             kind: 'prompt.started', sessionGeneration: this.sessionGeneration,
-            acpSessionId: this.sessionId, promptId: turnId, turnId,
-            source: conversationSource(origin).source, payload: {},
-        });
+            acpSessionId: this.sessionId, promptId: member.promptId, turnId,
+            source: conversationSource(member.origin).source,
+            payload: members.length > 1 ? { batch: { turnId, index, size: members.length } } : {},
+        }));
         try {
             const response = await Promise.race([
                 this.connection.agent.request(acp.methods.agent.session.prompt, {
                     sessionId: this.sessionId,
-                    prompt: promptContentBlocks(text, origin),
+                    prompt: batchContentBlocks(members),
                 }),
                 this.terminated,
             ]);
@@ -1349,14 +1516,10 @@ export class AcpSession {
                 turnId, stopReason: response.stopReason, origin, cancellationSource,
             });
             this.events.emit('state', { status: 'idle' });
-            this.conversation.appendSafe({
-                kind: 'turn.completed', sessionGeneration: this.sessionGeneration,
-                acpSessionId: this.sessionId, promptId: turnId, turnId,
-                payload: {
-                    outcome: classifyStopReason(response.stopReason),
-                    stopReason: response.stopReason,
-                    ...(cancellationSource ? { cancellationSource } : {}),
-                },
+            closeMembers({
+                outcome: classifyStopReason(response.stopReason),
+                stopReason: response.stopReason,
+                ...(cancellationSource ? { cancellationSource } : {}),
             });
             // The prompt was accepted either way — the agent answered. Whether the
             // turn SUCCEEDED is a separate question, and only `stopReason` answers it.
@@ -1377,11 +1540,7 @@ export class AcpSession {
             });
             if (this.isAlive())
                 this.events.emit('state', { status: 'idle' });
-            this.conversation.appendSafe({
-                kind: 'turn.completed', sessionGeneration: this.sessionGeneration,
-                acpSessionId: this.sessionId, promptId: turnId, turnId,
-                payload: { outcome: 'failed', stopReason: this.lastError },
-            });
+            closeMembers({ outcome: 'failed', stopReason: this.lastError });
             return turnResult(false, 'failed', this.lastError, this.activeTurn?.id === turnId ? this.activeTurn.output : undefined);
         }
         finally {
@@ -1401,6 +1560,8 @@ export class AcpSession {
     }
     async steerPrompt(text) {
         this.steeringWasUsed = true;
+        if (this.activeTurn)
+            this.activeTurn.fileDeliveryRevoked = true;
         if (!this.sessionId || !this.isAlive())
             return turnResult(false, 'failed', this.lastError ?? 'ACP session is offline');
         this.steeringRequests++;
@@ -1432,7 +1593,7 @@ export class AcpSession {
             this.steeringRequests--;
         }
     }
-    requestPermission(params) {
+    requestPermission(params, neutralPolicy) {
         // `kinds` is a PRIORITY order. Scanning the agent's option array instead
         // (`options.find(o => kinds.includes(o.kind))`) hands the choice to whatever
         // order the agent happened to list, which is exactly how an automatic denial
@@ -1450,7 +1611,7 @@ export class AcpSession {
         // Permission is part of the tool lifecycle. Reserve before any policy or
         // human decision so a monitor wake cannot slip between request and answer.
         this.reservePermission(toolCallId, permissionId);
-        if (this.isEffectiveCodexProtectedMcpApproval(params)) {
+        if (!neutralPolicy && this.isEffectiveCodexProtectedMcpApproval(params)) {
             // Protected MCP approval is already the tool's narrow gate. Never turn
             // this one decision into an adapter-wide standing grant.
             const option = choose(['allow_once']);
@@ -1461,9 +1622,9 @@ export class AcpSession {
                 this.releasePermission(toolCallId, permissionId);
             return Promise.resolve(response);
         }
-        if (this.options.permissions.approval === 'allow' && this.withinAutomaticBoundary(params)) {
+        if ((neutralPolicy ?? this.options.permissions).approval === 'allow' && this.withinAutomaticBoundary(params, neutralPolicy)) {
             const option = choose(['allow_always', 'allow_once']);
-            const response = this.settleAutomatically(params, option, 'allowed', 'permissions.approval=allow', `the request is inside the ${this.options.permissions.filesystem} boundary`);
+            const response = this.settleAutomatically(params, option, 'allowed', 'permissions.approval=allow', `the request is inside the ${(neutralPolicy ?? this.options.permissions).filesystem} boundary`);
             if (option)
                 this.allowPermission(toolCallId, permissionId);
             else
@@ -1473,8 +1634,8 @@ export class AcpSession {
         // A live grace window still counts as attended: the controller may be
         // mid-reconnect, and denying instantly is exactly what the grace prevents.
         const unattended = this.controllerCount === 0 && !this.controllerGrace
-            && this.options.permissions.unattended === 'deny';
-        if (this.options.permissions.approval === 'deny' || unattended) {
+            && (neutralPolicy ?? this.options.permissions).unattended === 'deny';
+        if ((neutralPolicy ?? this.options.permissions).approval === 'deny' || unattended) {
             // reject_once FIRST: `reject_always` teaches the agent a standing rule from
             // a decision no human made, so one unattended denial would silently disable
             // the tool for the rest of the session.
@@ -1575,8 +1736,8 @@ export class AcpSession {
             ? { outcome: { outcome: 'selected', optionId: option.optionId } }
             : { outcome: { outcome: 'cancelled' } };
     }
-    withinAutomaticBoundary(params) {
-        const filesystem = this.options.permissions.filesystem;
+    withinAutomaticBoundary(params, policy) {
+        const filesystem = (policy ?? this.options.permissions).filesystem;
         if (filesystem === 'unrestricted')
             return true;
         if (filesystem === 'read-only' && params.toolCall.kind !== 'read')
@@ -1707,9 +1868,17 @@ export class AcpSession {
         const scheduled = this.activeTurn?.origin?.kind === 'scheduled-loop';
         const messagePhase = update.sessionUpdate === 'agent_message_chunk'
             ? this.codexMessagePhase(update) : undefined;
-        this.recordConversationUpdate(update, scheduled, messagePhase === 'commentary');
+        this.recordConversationUpdate(update, scheduled);
         if (update.sessionUpdate === 'config_option_update')
             this.captureRuntimeMetadata(update.configOptions);
+        if (update.sessionUpdate === 'available_commands_update')
+            this.advertisedCommands = new Set((update.availableCommands ?? []).map(command => command.name));
+        if (update.sessionUpdate === 'usage_update') {
+            // Claude subscription rate-limit snapshot (claude-agent-acp forwards the SDK rate_limit_event).
+            const rateLimit = update._meta?.['_claude/rateLimit'];
+            if (rateLimit)
+                recordClaudeRateLimit(this.options.stateDir, rateLimit);
+        }
         switch (update.sessionUpdate) {
             case 'agent_message_chunk': {
                 const phase = messagePhase;
@@ -1785,13 +1954,15 @@ export class AcpSession {
             return undefined;
         return phase === 'commentary' || phase === 'final_answer' ? phase : 'ambiguous';
     }
-    /** Normalize every ACP update losslessly into the durable ledger. */
-    recordConversationUpdate(update, scheduled, commentary = false) {
+    /**
+     * Normalize every ACP update losslessly into the durable ledger. The ledger is the conversation the
+     * owner reads, so the agent's commentary between its tools is kept as written, like its final answer.
+     */
+    recordConversationUpdate(update, scheduled) {
         const normalized = normalizeSessionUpdate(update, scheduled ? {
             redactText: SCHEDULED_LOOP_REDACTION,
             redactToolCallId: 'scheduled-loop-tool',
-        }
-            : commentary ? { redactText: OWNER_COMMENTARY_REDACTION } : {});
+        } : {});
         this.conversation.appendSafe({
             kind: normalized.kind,
             sessionGeneration: this.sessionGeneration,
@@ -1805,6 +1976,10 @@ export class AcpSession {
         });
     }
     // ── conversation ledger access (AgentSession) ─────────────────────────────
+    taskNoticeBinding() {
+        return this.activeTurn && this.sessionId ? { sessionGeneration: this.sessionGeneration, acpSessionId: this.sessionId, promptId: this.activeTurn.id } : undefined;
+    }
+    recordTaskCreated(binding, notice) { appendTaskCreated(this.conversation, binding, notice); }
     conversationPage(request = {}) {
         const floor = Number(this.conversationStartCursor ?? 0);
         const requested = Number(request.after ?? 0);
@@ -1832,6 +2007,7 @@ export class AcpSession {
             readiness: this.isAlive() ? this.readiness : 'offline',
             queueDepth: this.queueDepth,
             pendingPermissionIds: [...this.pendingPermissions.keys()],
+            ...pendingInventory(this.pendingPrompts),
             ...(this.conversation.degraded ? { historyDegraded: true } : {}),
         };
     }

package/dist/session/arbiter.d.ts

@@ -23,6 +23,7 @@ export declare class RoleTurnArbiter implements AgentSession {
     private tail;
     private unsettled;
     private stopping;
+    private retiring;
     /** Bumped by `retireStalledAdmission`; every claim carries the one it was made under. */
     private generation;
     /** Resolves the instant the CURRENT generation is retired. */
@@ -53,6 +54,11 @@ export declare class RoleTurnArbiter implements AgentSession {
      */
     retireStalledAdmission(): void;
     queuePrompt(text: string, options?: SubmitPromptOptions): Promise<QueuedPrompt>;
+    /** Inbox traffic must not cancel or steer an active human console/voice turn.
+     * Queue it once; the monitor commits its cursor after that turn succeeds.
+     * Other origins retain their configured monitor policy.
+     */
+    private monitorAdmissionOptions;
     submitPrompt(text: string, options?: SubmitPromptOptions): Promise<TurnResult>;
     /**
      * Do not hold `exclusive` while ACP waits for a tool boundary: permission
@@ -62,6 +68,9 @@ export declare class RoleTurnArbiter implements AgentSession {
     tryScheduled(text: string, origin: Extract<PromptOrigin, {
         kind: 'scheduled-loop';
     }>, beforeQueue?: () => void | Promise<void>): Promise<ScheduledAttempt>;
+    /** Retire only at the same admission boundary used by all prompt producers. */
+    retireIfIdle(expired: (snapshot: SessionSnapshot, queueDepth: number) => boolean): Promise<boolean>;
+    sharedTurnId(promptId: string): string | undefined;
     stopScheduledAdmission(): void;
     isAlive(): boolean;
     snapshot(): SessionSnapshot;
@@ -72,6 +81,8 @@ export declare class RoleTurnArbiter implements AgentSession {
     conversationSnapshot(): ConversationSnapshot;
     subscribeConversation(listener: (event: ConversationEventV1) => void): () => void;
     submitPromptBrowser(command: SubmitPromptCommand): Promise<PromptReceipt>;
+    get liveVoiceSupported(): boolean;
+    interruptPrompt(generation: string, promptId: string): Promise<InterruptOutcome>;
     interrupt(source?: TurnCancellationSource): Promise<InterruptOutcome>;
     respondPermission(permissionId: string, optionId: string): boolean;
     respondPermissionV2(permissionId: string, optionId: string, sessionGeneration: string): 'accepted' | 'stale';