@ours.network/fleet 1.2.0-nightly.8 → 1.2.0-nightly.81

package/dist/session/acp.js

@@ -1,3 +1,5 @@
+import { ConversationObservation } from './conversation-observation.js';
+import { appendTaskCreated } from './task-notice.js';
 import { spawn } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, lstatSync, readFileSync, readlinkSync, realpathSync, writeFileSync, } from 'node:fs';
@@ -7,6 +9,8 @@ import * as acp from '@agentclientprotocol/sdk';
 import { normalizeSessionUpdate } from './conversation-normalizer.js';
 import { ConversationEventStore } from './conversation-store.js';
 import { SessionEvents } from './events.js';
+import { commandName, memberAuthority, memberBindings, pendingInventory, takeBatch, refuseAtRelease, RELEASE_GUARD_REFUSED, } from './prompt-batch.js';
+import { recordClaudeRateLimit } from '../subscriptions/observed.js';
 import { DEFAULT_STALL_TIMEOUT_MS, STALL_RECOVERY_PROMPT, StallWatchdog, StallToolHistory, hasStallRecoveryClaim } from './stall-watchdog.js';
 import { ACP_CANCEL_DEADLINE_EXCEEDED, SessionControlError, classifyChildExit, sessionBackendCapabilities, turnResult, } from './types.js';
 const CANCEL_SETTLE_GRACE_MS = 15_000;
@@ -36,7 +40,6 @@ const TERMINAL_TOOL_STATUSES = new Set(['completed', 'failed']);
 /** Consumed only by Fleet's authenticated bundled-Codex app-server proxy. */
 export const CODEX_DISABLE_INHERITED_MCP_ENV = 'OURS_FLEET_CODEX_DISABLE_INHERITED_MCP';
 const SCHEDULED_LOOP_REDACTION = '[scheduled-loop content redacted]';
-const OWNER_COMMENTARY_REDACTION = '[assistant commentary redacted]';
 const MAX_CANONICAL_SYMLINK_DEPTH = 40;
 const scheduledTurn = (turn) => turn?.origin?.kind === 'scheduled-loop';
 /**
@@ -164,6 +167,9 @@ function conversationSource(origin) {
         case 'owner': return { source: 'owner_channel', persistBody: false };
         case 'fleet-monitor': return { source: 'fleet_monitor', persistBody: false };
         case 'scheduled-loop': return { source: 'scheduled_loop', persistBody: false };
+        // A supervisor wake like a monitor notice; the body is never retained, so
+        // restart recovery can never replay a reminder past its dispatch fence.
+        case 'self-reminder': return { source: 'fleet_monitor', persistBody: false };
         case 'local-console':
         default:
             return { source: 'local_console', persistBody: true };
@@ -181,6 +187,38 @@ export function promptContentBlocks(text, origin) {
             mimeType: 'application/vnd.ours-fleet.prompt-provenance+json',
         }, { type: 'text', text }];
 }
+/**
+ * One adapter turn that carries several admitted prompts.
+ *
+ * A single prompt's provenance block describes "the accompanying text", which
+ * is only unambiguous when there is one text. Here every member is one text
+ * block, unchanged, immediately preceded by its own server-generated block
+ * that names its route and binds its exact bytes — so a monitor wake next to
+ * an owner prompt is never read under the owner's authority, and text that
+ * imitates a marker stays text: it cannot produce a typed block.
+ */
+export function batchContentBlocks(members) {
+    if (members.length === 1)
+        return promptContentBlocks(members[0].text, members[0].origin);
+    const mimeType = 'application/vnd.ours-fleet.prompt-provenance+json';
+    return [{
+            type: 'resource_link',
+            uri: `ours-fleet://prompt-batch?members=${members.length}`,
+            name: 'Fleet queued prompt batch',
+            description: `Server-generated. This turn delivers ${members.length} separately admitted prompts in `
+                + 'submission order. Each prompt is one text block immediately preceded by its own '
+                + 'server-generated provenance block, which describes only that one text block.',
+            mimeType,
+        }, ...memberBindings(members, origin => conversationSource(origin).source).flatMap((binding, at) => [{
+                type: 'resource_link',
+                uri: `ours-fleet://prompt-provenance?source=${binding.source}&member=${binding.index}`
+                    + `&of=${binding.of}&bytes=${binding.bytes}&sha256=${binding.sha256}`,
+                name: binding.source === 'owner_admin_console' ? 'Direct owner admin console' : 'Fleet queued prompt',
+                description: `Server-generated provenance for prompt ${binding.index} of ${binding.of}: `
+                    + `${memberAuthority(binding.source)}. Applies only to the text block that immediately follows.`,
+                mimeType,
+            }, { type: 'text', text: members[at].text }])];
+}
 export function runtimeSelector(options, category) {
     const option = options?.find(candidate => candidate.category === category);
     if (!option || typeof option.currentValue !== 'string')
@@ -238,7 +276,16 @@ export class AcpSession {
     lastUpdateAt;
     lastError;
     promptTail = Promise.resolve();
+    /** Admitted prompts not yet handed to the adapter, in admission order. */
+    pendingPrompts = [];
+    /** Admitted prompt → the adapter turn that carries it, while that turn is open. */
+    sharedTurns = new Map();
+    /** Commands the adapter currently advertises; only these are control operations. */
+    advertisedCommands = new Set();
+    presentedCommands = [];
     queueDepth = 0;
+    deferredRecovered = [];
+    observation = new ConversationObservation(() => this.captureObservation());
     exit = null;
     steeringSupported = false;
     agentCapabilities;
@@ -277,6 +324,7 @@ export class AcpSession {
     stallTimer;
     stallAttempt;
     toolBoundaryWaiters = new Set();
+    fileExportBusy = false;
     activeTurn;
     constructor(options, child, connection) {
         this.options = options;
@@ -289,6 +337,9 @@ export class AcpSession {
             roleId: options.name, log: line => options.log(`[${options.name}] ${line}`),
         });
         this.conversationStartCursor = this.conversation.lastCursor();
+        // A durable append can precede its inventory mutation. Capture only after
+        // the synchronous owner checkpoint, never the state at append notification.
+        this.conversation.subscribe(() => this.observation.scheduleCapture());
         this.sessionFile = join(options.stateDir, '.acp-session-id');
         this.terminated = new Promise((_resolve, reject) => { this.terminate = reject; });
         // Nothing awaits this promise until a request races it; an unobserved
@@ -322,6 +373,7 @@ export class AcpSession {
                 acpSessionId: this.sessionId,
                 payload: { status: 'failed', detail: this.lastError },
             });
+            this.observation.publish();
         });
     }
     static async start(options) {
@@ -406,14 +458,29 @@ export class AcpSession {
                 });
                 continue;
             }
-            const text = open.text;
-            const promptId = open.promptId;
-            this.queueDepth++;
-            const run = this.promptTail.then(() => this.runPrompt(text, promptId));
-            this.promptTail = run.then(() => undefined, () => undefined);
-            void run.finally(() => { this.queueDepth = Math.max(0, this.queueDepth - 1); });
+            const recovered = { promptId: open.promptId, text: open.text };
+            if (this.options.deferRecoveredPrompts)
+                this.deferredRecovered.push(recovered);
+            else
+                this.dispatchRecovered(recovered);
         }
     }
+    /**
+     * Dispatch recovered prompts held by deferRecoveredPrompts. A recovered turn
+     * can run tools at once, including the managed Fleet CLI, so it must not
+     * start before the supervisor's control socket accepts connections. Prompts
+     * never activated stay admitted-unstarted and recover again on next start.
+     */
+    activateRecoveredPrompts() {
+        for (const recovered of this.deferredRecovered.splice(0))
+            this.dispatchRecovered(recovered);
+    }
+    dispatchRecovered({ promptId, text }) {
+        this.queueDepth++;
+        const run = this.enqueue(promptId, text, undefined);
+        this.observation.publish();
+        void run.finally(() => { this.queueDepth = Math.max(0, this.queueDepth - 1); this.observation.publish(); });
+    }
     isAlive() {
         // child.killed only means kill() successfully SENT a signal. A process may
         // ignore SIGTERM and remain alive. exitCode or signalCode is the actual
@@ -430,6 +497,7 @@ export class AcpSession {
             return;
         this.steeringOccupied = true;
         this.refreshSteeringOccupancy();
+        this.observation.publish();
     }
     refreshSteeringOccupancy() {
         if (!this.steeringOccupied)
@@ -452,6 +520,7 @@ export class AcpSession {
         if (!this.steeringOccupied)
             return;
         this.steeringOccupied = false;
+        this.observation.publish();
         this.options.log(`[${this.options.name}] steering-started turn no longer holds the adapter (${reason})`);
     }
     snapshot() {
@@ -465,6 +534,9 @@ export class AcpSession {
             readiness: this.readiness === 'idle' && this.steeringOccupied
                 ? 'running' : this.readiness,
             sessionId: this.sessionId,
+            // A shared turn is a human console turn if any member is: inbox traffic must not cut it short.
+            ...(this.activeTurn?.origin ? { activePromptSource: this.activeTurn.console
+                    ? 'owner-admin-console' : this.activeTurn.origin.kind } : {}),
             lastError: this.lastError,
             pendingPermissionId: this.pendingPermissions.keys().next().value,
             runtimeModel: this.runtimeModel,
@@ -579,6 +651,11 @@ export class AcpSession {
      * steering response from becoming a tight replay loop.
      */
     async steerOrQueueWake(text, options) {
+        // A tool-boundary wait may outlive its original turn. Recheck the current
+        // typed source at delivery, since an Owner turn can begin during the wait.
+        // `console` covers a shared turn whose first member is not the console prompt.
+        if (options.origin?.kind === 'fleet-monitor' && this.activeTurn?.console)
+            return this.submitPrompt(text, { ...options, interrupt: false, steer: false });
         if (this.stallRecoveryClaimed)
             return this.submitPrompt(text, { ...options, interrupt: false, steer: false });
         const steered = await this.steerPrompt(text);
@@ -644,6 +721,9 @@ export class AcpSession {
      * for it is what turned a busy agent into a timeout and then into "dead".
      */
     async queuePrompt(text, options = {}) {
+        // A guarded prompt must reach the model only through the release fence.
+        if (options.releaseGuard)
+            options = { ...options, interrupt: false, steer: false };
         if (this.stallRecoveryClaimed && options.origin?.kind === 'fleet-monitor')
             options = { ...options, interrupt: false, steer: false };
         if (this.cancelRecoveryReason)
@@ -666,12 +746,18 @@ export class AcpSession {
         }
         const promptId = randomUUID();
         const queuedBehind = this.queueDepth;
-        this.admitToLedger(promptId, text, queuedBehind, options);
-        this.queueDepth++;
-        const run = this.promptTail.then(() => this.runPrompt(text, promptId, options.origin));
-        this.promptTail = run.then(() => undefined, () => undefined);
-        const completion = run.then(result => { this.queueDepth = Math.max(0, this.queueDepth - 1); return result; }, error => {
+        const run = this.observation.checkpoint(() => {
+            this.admitToLedger(promptId, text, queuedBehind, options);
+            this.queueDepth++;
+            return this.enqueue(promptId, text, options.origin, options.releaseGuard);
+        });
+        const completion = run.then(result => {
             this.queueDepth = Math.max(0, this.queueDepth - 1);
+            this.observation.publish();
+            return result;
+        }, error => {
+            this.queueDepth = Math.max(0, this.queueDepth - 1);
+            this.observation.publish();
             return turnResult(false, 'failed', error?.message ?? String(error));
         });
         return {
@@ -679,6 +765,57 @@ export class AcpSession {
             delivery: delivery ?? (queuedBehind > 0 ? 'queued' : 'started'),
         };
     }
+    /** The turn whose events and result answer this admitted prompt; itself unless a release shared it. */
+    sharedTurnId(promptId) {
+        return this.sharedTurns.get(promptId);
+    }
+    /**
+     * Queue an admitted prompt behind the current work. Each prompt keeps its
+     * own step in the chain, so its place in line is unchanged; what the step
+     * does when it is reached is release a whole snapshot, not one prompt.
+     */
+    enqueue(promptId, text, origin, releaseGuard) {
+        const entry = {
+            promptId, text, origin, ...conversationSource(origin), admittedAt: new Date().toISOString(),
+            command: this.advertisedCommands.has(commandName(text) ?? ''),
+            ...(releaseGuard ? { releaseGuard } : {}),
+        };
+        this.pendingPrompts.push(entry);
+        const run = this.promptTail.then(() => this.release(entry));
+        this.promptTail = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    /**
+     * The turn boundary. The first waiting prompt to get here takes every
+     * pending prompt delivered with it, synchronously, and they share one adapter
+     * turn. A prompt admitted after that — while the turn runs, or while a
+     * cancellation settles — stays pending for the next boundary. A step whose
+     * prompt an earlier boundary already took just reports that turn's result.
+     */
+    release(entry) {
+        if (entry.released)
+            return entry.released;
+        const refused = refuseAtRelease(this.pendingPrompts, entry, Boolean(this.sessionId && this.isAlive()));
+        if (refused) {
+            this.conversation.appendSafe({
+                kind: 'turn.completed', sessionGeneration: this.sessionGeneration, acpSessionId: this.sessionId,
+                promptId: entry.promptId, turnId: entry.promptId,
+                payload: { outcome: 'cancelled', stopReason: RELEASE_GUARD_REFUSED },
+            });
+            entry.released = Promise.resolve(refused);
+            return entry.released;
+        }
+        const members = takeBatch(this.pendingPrompts, entry);
+        for (const member of members)
+            this.sharedTurns.set(member.promptId, members[0].promptId);
+        const run = this.runPrompt(members).finally(() => {
+            for (const member of members)
+                this.sharedTurns.delete(member.promptId);
+        });
+        for (const member of members)
+            member.released = run;
+        return run;
+    }
     /**
      * Prepare the session for a prompt that asked to pre-empt current work.
      *
@@ -760,11 +897,16 @@ export class AcpSession {
         const existing = this.conversation.receiptFor(command.commandId, bodyDigest);
         if (existing)
             return existing;
+        if (command.expectedSessionGeneration !== undefined && command.expectedSessionGeneration !== this.conversationSnapshot().sessionGeneration)
+            throw new Error('session_changed: Agent session changed. Record a new voice message.');
+        if (command.requireIdle && (this.queueDepth > 0 || this.conversationSnapshot().readiness !== 'idle'))
+            throw new Error('voice_busy: Agent is already working. Wait for the current turn.');
         const queued = await this.queuePrompt(command.text, {
             origin: { kind: 'owner-admin-console', commandId: command.commandId },
             actor: { browserSession: command.actorBrowserSession },
         });
         const receipt = {
+            sessionGeneration: this.sessionGeneration,
             commandId: command.commandId,
             promptId: queued.promptId,
             state: queued.queuedBehind > 0 ? 'queued' : 'starting',
@@ -792,6 +934,14 @@ export class AcpSession {
      * (`queuePrompt({ interrupt: true })`) needs the typed error, because only it
      * still owes an undelivered message a replay.
      */
+    liveVoiceSupported = true;
+    async interruptPrompt(generation, promptId) {
+        if (generation !== this.sessionGeneration)
+            throw new Error('session_changed: Agent session changed.');
+        if (!this.activeTurn?.promptIds.includes(promptId))
+            return { state: 'settled' };
+        return this.interrupt('local-console');
+    }
     async interrupt(source = 'local-console') {
         try {
             await this.cancelActive(source);
@@ -810,6 +960,8 @@ export class AcpSession {
         if (!this.sessionId)
             return;
         const active = this.activeTurn;
+        if (active)
+            active.fileDeliveryRevoked = true;
         const previousSource = active?.cancellationSource;
         if (active && (source === 'owner' || source === 'local-console' || !previousSource))
             active.cancellationSource = source;
@@ -902,6 +1054,7 @@ export class AcpSession {
             this.allowPermission(pending.toolCallId, permissionId);
         else
             this.releasePermission(pending.toolCallId, permissionId);
+        this.readiness = this.pendingPermissions.size > 0 ? 'awaiting_permission' : 'running';
         this.events.emit('permission', {
             turnId: this.activeTurn?.id,
             origin: this.activeTurn?.origin,
@@ -918,7 +1071,7 @@ export class AcpSession {
             promptId: this.activeTurn?.id, turnId: this.activeTurn?.id,
             payload: { decision, decisionSource: 'manual', optionId },
         });
-        this.readiness = this.pendingPermissions.size > 0 ? 'awaiting_permission' : 'running';
+        this.observation.publish();
         return true;
     }
     /**
@@ -984,6 +1137,8 @@ export class AcpSession {
             : { outcome: { outcome: 'cancelled' } });
         const settled = decision === 'denied' && !rejectOption ? 'cancelled' : decision;
         this.releasePermission(pending.toolCallId, permissionId);
+        if (this.pendingPermissions.size === 0 && this.readiness === 'awaiting_permission')
+            this.readiness = 'running';
         this.events.emit('permission', {
             turnId: this.activeTurn?.id,
             origin: this.activeTurn?.origin,
@@ -1007,12 +1162,59 @@ export class AcpSession {
                 ...(rejectOption ? { optionId: rejectOption.optionId } : {}),
             },
         });
-        if (this.pendingPermissions.size === 0 && this.readiness === 'awaiting_permission')
-            this.readiness = 'running';
+        this.observation.publish();
     }
     exitResult() {
         return this.exit;
     }
+    /** One attempt, tied to the managed live turn captured before any approval/read. */
+    async sendFileToChat(input, signal, copy, policy) {
+        const active = this.activeTurn, sessionId = this.sessionId;
+        const check = () => {
+            signal.throwIfAborted();
+            if (!active || !sessionId || this.activeTurn !== active || this.sessionId !== sessionId || active.fileDeliveryRevoked
+                || active.cancellationSource || this.closing || !this.isAlive() || this.replaying || this.steeringOccupied
+                || active.origin?.kind === 'scheduled-loop' || policy.approval === 'deny')
+                throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE');
+        };
+        check();
+        if (this.fileExportBusy)
+            throw Error('FILE_DELIVERY_BUSY');
+        this.fileExportBusy = true;
+        const toolCallId = 'fleet-file-export-' + randomUUID();
+        try {
+            const onAbort = () => {
+                for (const [id, pending] of this.pendingPermissions)
+                    if (pending.toolCallId === toolCallId)
+                        this.settlePendingAutomatically(id, pending, 'cancelled', undefined, 'File send cancelled');
+            };
+            signal.addEventListener('abort', onAbort, { once: true });
+            let answer;
+            try {
+                answer = await this.requestPermission({ sessionId: sessionId, toolCall: {
+                        toolCallId, title: 'Send file to this ACP chat: ' + (input.filename ?? input.path), kind: 'read', status: 'pending',
+                        locations: [{ path: resolve(this.options.cwd, input.path) }],
+                    }, options: [{ optionId: 'send', name: 'Send file', kind: 'allow_once' }, { optionId: 'deny', name: 'Do not send', kind: 'reject_once' }] }, policy);
+            }
+            finally {
+                signal.removeEventListener('abort', onAbort);
+            }
+            check();
+            if (answer.outcome.outcome !== 'selected' || answer.outcome.optionId !== 'send')
+                throw Error('FILE_SEND_DENIED');
+            const attachment = await copy({ sessionGeneration: this.sessionGeneration, acpSessionId: sessionId, turnId: active.id });
+            // Synchronous check + durable append establishes order with cancellation/stop.
+            // No await, pending-send journal, replay or recovery exists after this point.
+            check();
+            this.conversation.append({ kind: 'file.attached', source: 'agent', sessionGeneration: this.sessionGeneration,
+                acpSessionId: sessionId, promptId: active.id, turnId: active.id, payload: { attachment } });
+            return attachment;
+        }
+        finally {
+            this.releaseTool(toolCallId);
+            this.fileExportBusy = false;
+        }
+    }
     async close() {
         this.closing = true;
         if (this.stallTimer)
@@ -1066,6 +1268,8 @@ export class AcpSession {
         const persisted = this.options.mode === 'resume' && existsSync(this.sessionFile)
             ? readFileSync(this.sessionFile, 'utf8').trim()
             : '';
+        if (this.options.requireResume && (!persisted || !(this.agentCapabilities?.sessionCapabilities?.resume != null || this.agentCapabilities?.loadSession)))
+            throw new Error('TASK_CONTEXT_RESUME_UNAVAILABLE');
         let advertisedConfigOptions;
         let advertisedModes;
         let advertisedModelId;
@@ -1171,6 +1375,7 @@ export class AcpSession {
             kind: 'session.state', sessionGeneration: this.sessionGeneration,
             acpSessionId: this.sessionId, payload: { status: 'idle' },
         });
+        this.observation.publish();
     }
     captureRuntimeMetadata(options, modelId) {
         this.runtimeModel = runtimeSelector(options, 'model');
@@ -1283,8 +1488,9 @@ export class AcpSession {
         }
     }
     /** Keep the original queue slot (including startup) until recovery finishes. */
-    async runPrompt(text, turnId = randomUUID(), origin) {
-        const result = await this.runSinglePrompt(text, turnId, origin);
+    async runPrompt(members) {
+        const { text, promptId: turnId, origin } = members[0];
+        const result = await this.runSinglePrompt(text, turnId, origin, members);
         const attempt = this.stallAttempt;
         if (!attempt || attempt.turnId !== turnId)
             return result;
@@ -1308,8 +1514,11 @@ export class AcpSession {
             attempt.recoveryStartedAt = Date.now();
             const recoveryOrigin = origin?.kind === 'scheduled-loop'
                 ? origin : { kind: 'stall-watchdog' };
-            this.admitToLedger(attempt.recoveryId, STALL_RECOVERY_PROMPT, 0, { origin: recoveryOrigin });
-            const recovered = await this.runSinglePrompt(STALL_RECOVERY_PROMPT, attempt.recoveryId, recoveryOrigin);
+            const recovery = this.observation.checkpoint(() => {
+                this.admitToLedger(attempt.recoveryId, STALL_RECOVERY_PROMPT, 0, { origin: recoveryOrigin });
+                return this.runSinglePrompt(STALL_RECOVERY_PROMPT, attempt.recoveryId, recoveryOrigin);
+            });
+            const recovered = await recovery;
             attempt.report(attempt.superseded ? 'superseded'
                 : recovered.succeeded && attempt.resumed ? 'recovery_completed' : 'blocked_recovery');
             // A failed diagnostic turn must not make startup tear down the session.
@@ -1319,7 +1528,22 @@ export class AcpSession {
             return turnResult(true, 'cancelled', 'diagnostic recovery requires operator attention', undefined, 'stall-watchdog');
         }
     }
-    async runSinglePrompt(text, turnId = randomUUID(), origin) {
+    /**
+     * One adapter turn. `members` are the admitted prompts it carries, the first
+     * being the turn's own id; each keeps its own started and completed records
+     * so none is left open and none is reported delivered that was not sent.
+     */
+    async runSinglePrompt(text, turnId = randomUUID(), origin, members = [{ promptId: turnId, text, origin }]) {
+        let completionPayload;
+        const closeMembers = (payload) => {
+            for (const member of members)
+                this.conversation.appendSafe({
+                    kind: 'turn.completed', sessionGeneration: this.sessionGeneration,
+                    acpSessionId: this.sessionId, promptId: member.promptId, turnId, payload,
+                });
+        };
+        // Not handed to the adapter and not closed: the members stay admitted, and
+        // the next session generation dispatches them again.
         if (!this.sessionId || !this.isAlive())
             return turnResult(false, 'failed', this.lastError ?? 'ACP session is offline');
         this.readiness = 'running';
@@ -1327,18 +1551,20 @@ export class AcpSession {
         this.retryNativeTurnId = undefined;
         let settle;
         const settled = new Promise(resolve => { settle = resolve; });
-        this.activeTurn = { toolEvidence: new Map(), startedAt: Date.now(), toolIds: new Set(), lastProgressAt: 0, progressCount: 0, transportFailures: 0, boundaryUnknown: false, id: turnId, output: '', origin, settled, settle };
+        this.activeTurn = { toolEvidence: new Map(), startedAt: Date.now(), toolIds: new Set(), lastProgressAt: 0, progressCount: 0, transportFailures: 0, boundaryUnknown: false, id: turnId, output: '', origin, settled, settle, promptIds: members.map(member => member.promptId), console: members.some(member => member.origin?.kind === 'owner-admin-console') };
+        this.observation.publish();
         this.events.emit('state', { turnId, status: 'running', origin });
-        this.conversation.appendSafe({
+        members.forEach((member, index) => this.conversation.appendSafe({
             kind: 'prompt.started', sessionGeneration: this.sessionGeneration,
-            acpSessionId: this.sessionId, promptId: turnId, turnId,
-            source: conversationSource(origin).source, payload: {},
-        });
+            acpSessionId: this.sessionId, promptId: member.promptId, turnId,
+            source: conversationSource(member.origin).source,
+            payload: members.length > 1 ? { batch: { turnId, index, size: members.length } } : {},
+        }));
         try {
             const response = await Promise.race([
                 this.connection.agent.request(acp.methods.agent.session.prompt, {
                     sessionId: this.sessionId,
-                    prompt: promptContentBlocks(text, origin),
+                    prompt: batchContentBlocks(members),
                 }),
                 this.terminated,
             ]);
@@ -1349,15 +1575,11 @@ export class AcpSession {
                 turnId, stopReason: response.stopReason, origin, cancellationSource,
             });
             this.events.emit('state', { status: 'idle' });
-            this.conversation.appendSafe({
-                kind: 'turn.completed', sessionGeneration: this.sessionGeneration,
-                acpSessionId: this.sessionId, promptId: turnId, turnId,
-                payload: {
-                    outcome: classifyStopReason(response.stopReason),
-                    stopReason: response.stopReason,
-                    ...(cancellationSource ? { cancellationSource } : {}),
-                },
-            });
+            completionPayload = {
+                outcome: classifyStopReason(response.stopReason),
+                stopReason: response.stopReason,
+                ...(cancellationSource ? { cancellationSource } : {}),
+            };
             // The prompt was accepted either way — the agent answered. Whether the
             // turn SUCCEEDED is a separate question, and only `stopReason` answers it.
             return turnResult(true, classifyStopReason(response.stopReason), response.stopReason, this.activeTurn?.id === turnId ? this.activeTurn.output : undefined, this.activeTurn?.id === turnId ? this.activeTurn.cancellationSource : undefined);
@@ -1377,11 +1599,7 @@ export class AcpSession {
             });
             if (this.isAlive())
                 this.events.emit('state', { status: 'idle' });
-            this.conversation.appendSafe({
-                kind: 'turn.completed', sessionGeneration: this.sessionGeneration,
-                acpSessionId: this.sessionId, promptId: turnId, turnId,
-                payload: { outcome: 'failed', stopReason: this.lastError },
-            });
+            completionPayload = { outcome: 'failed', stopReason: this.lastError };
             return turnResult(false, 'failed', this.lastError, this.activeTurn?.id === turnId ? this.activeTurn.output : undefined);
         }
         finally {
@@ -1397,10 +1615,15 @@ export class AcpSession {
                 this.cancelEscalation = undefined;
                 this.activeTurn = undefined;
             }
+            if (completionPayload)
+                closeMembers(completionPayload);
+            this.observation.publish();
         }
     }
     async steerPrompt(text) {
         this.steeringWasUsed = true;
+        if (this.activeTurn)
+            this.activeTurn.fileDeliveryRevoked = true;
         if (!this.sessionId || !this.isAlive())
             return turnResult(false, 'failed', this.lastError ?? 'ACP session is offline');
         this.steeringRequests++;
@@ -1432,7 +1655,7 @@ export class AcpSession {
             this.steeringRequests--;
         }
     }
-    requestPermission(params) {
+    requestPermission(params, neutralPolicy) {
         // `kinds` is a PRIORITY order. Scanning the agent's option array instead
         // (`options.find(o => kinds.includes(o.kind))`) hands the choice to whatever
         // order the agent happened to list, which is exactly how an automatic denial
@@ -1450,7 +1673,7 @@ export class AcpSession {
         // Permission is part of the tool lifecycle. Reserve before any policy or
         // human decision so a monitor wake cannot slip between request and answer.
         this.reservePermission(toolCallId, permissionId);
-        if (this.isEffectiveCodexProtectedMcpApproval(params)) {
+        if (!neutralPolicy && this.isEffectiveCodexProtectedMcpApproval(params)) {
             // Protected MCP approval is already the tool's narrow gate. Never turn
             // this one decision into an adapter-wide standing grant.
             const option = choose(['allow_once']);
@@ -1461,9 +1684,9 @@ export class AcpSession {
                 this.releasePermission(toolCallId, permissionId);
             return Promise.resolve(response);
         }
-        if (this.options.permissions.approval === 'allow' && this.withinAutomaticBoundary(params)) {
+        if ((neutralPolicy ?? this.options.permissions).approval === 'allow' && this.withinAutomaticBoundary(params, neutralPolicy)) {
             const option = choose(['allow_always', 'allow_once']);
-            const response = this.settleAutomatically(params, option, 'allowed', 'permissions.approval=allow', `the request is inside the ${this.options.permissions.filesystem} boundary`);
+            const response = this.settleAutomatically(params, option, 'allowed', 'permissions.approval=allow', `the request is inside the ${(neutralPolicy ?? this.options.permissions).filesystem} boundary`);
             if (option)
                 this.allowPermission(toolCallId, permissionId);
             else
@@ -1473,8 +1696,8 @@ export class AcpSession {
         // A live grace window still counts as attended: the controller may be
         // mid-reconnect, and denying instantly is exactly what the grace prevents.
         const unattended = this.controllerCount === 0 && !this.controllerGrace
-            && this.options.permissions.unattended === 'deny';
-        if (this.options.permissions.approval === 'deny' || unattended) {
+            && (neutralPolicy ?? this.options.permissions).unattended === 'deny';
+        if ((neutralPolicy ?? this.options.permissions).approval === 'deny' || unattended) {
             // reject_once FIRST: `reject_always` teaches the agent a standing rule from
             // a decision no human made, so one unattended denial would silently disable
             // the tool for the rest of the session.
@@ -1487,42 +1710,20 @@ export class AcpSession {
         }
         const timeoutMs = this.options.permissionTimeoutMs ?? PERMISSION_TIMEOUT_MS;
         const expiresAt = new Date(Date.now() + timeoutMs).toISOString();
-        this.readiness = 'awaiting_permission';
-        this.events.emit('permission', {
-            turnId: this.activeTurn?.id,
-            origin: this.activeTurn?.origin,
-            permissionId,
-            toolCallId: this.activeTurn?.origin?.kind === 'scheduled-loop'
-                ? 'scheduled-loop-tool' : params.toolCall.toolCallId,
-            title: this.activeTurn?.origin?.kind === 'scheduled-loop'
+        const presented = {
+            toolCallId: scheduledTurn(this.activeTurn) ? 'scheduled-loop-tool' : toolCallId,
+            title: scheduledTurn(this.activeTurn)
                 ? 'Scheduled-loop permission requested' : params.toolCall.title ?? 'Permission requested',
-            status: 'pending',
             options: params.options.map(option => ({
                 optionId: option.optionId,
-                name: this.activeTurn?.origin?.kind === 'scheduled-loop' ? option.kind : option.name,
+                name: scheduledTurn(this.activeTurn) ? option.kind : option.name,
                 kind: option.kind,
             })),
-        });
-        this.conversation.appendSafe({
-            kind: 'permission.requested', sessionGeneration: this.sessionGeneration,
-            acpSessionId: this.sessionId, permissionId,
-            promptId: this.activeTurn?.id, turnId: this.activeTurn?.id,
-            toolCallId: scheduledTurn(this.activeTurn) ? 'scheduled-loop-tool' : params.toolCall.toolCallId,
-            payload: {
-                toolCallId: scheduledTurn(this.activeTurn) ? 'scheduled-loop-tool' : params.toolCall.toolCallId,
-                title: scheduledTurn(this.activeTurn)
-                    ? 'Scheduled-loop permission requested' : params.toolCall.title ?? 'Permission requested',
-                options: params.options.map(option => ({
-                    optionId: option.optionId,
-                    name: scheduledTurn(this.activeTurn) ? option.kind : option.name,
-                    kind: option.kind,
-                })),
-                expiresAt,
-            },
-        });
+            expiresAt,
+        };
         return new Promise(resolve => {
             const pending = {
-                options: params.options, resolve,
+                options: params.options, resolve, presented,
                 toolCallId,
                 eventToolCallId: scheduledTurn(this.activeTurn) ? 'scheduled-loop-tool' : toolCallId,
             };
@@ -1531,6 +1732,18 @@ export class AcpSession {
             }, timeoutMs);
             pending.expiry.unref?.();
             this.pendingPermissions.set(permissionId, pending);
+            this.readiness = 'awaiting_permission';
+            this.events.emit('permission', {
+                turnId: this.activeTurn?.id, origin: this.activeTurn?.origin,
+                permissionId, ...presented, status: 'pending',
+            });
+            this.conversation.appendSafe({
+                kind: 'permission.requested', sessionGeneration: this.sessionGeneration,
+                acpSessionId: this.sessionId, permissionId,
+                promptId: this.activeTurn?.id, turnId: this.activeTurn?.id,
+                toolCallId: presented.toolCallId, payload: presented,
+            });
+            this.observation.publish();
         });
     }
     /**
@@ -1575,8 +1788,8 @@ export class AcpSession {
             ? { outcome: { outcome: 'selected', optionId: option.optionId } }
             : { outcome: { outcome: 'cancelled' } };
     }
-    withinAutomaticBoundary(params) {
-        const filesystem = this.options.permissions.filesystem;
+    withinAutomaticBoundary(params, policy) {
+        const filesystem = (policy ?? this.options.permissions).filesystem;
         if (filesystem === 'unrestricted')
             return true;
         if (filesystem === 'read-only' && params.toolCall.kind !== 'read')
@@ -1707,9 +1920,19 @@ export class AcpSession {
         const scheduled = this.activeTurn?.origin?.kind === 'scheduled-loop';
         const messagePhase = update.sessionUpdate === 'agent_message_chunk'
             ? this.codexMessagePhase(update) : undefined;
-        this.recordConversationUpdate(update, scheduled, messagePhase === 'commentary');
+        // Install live capability state before the durable append can synchronously
+        // notify a subscriber that reenters observation at the new ledger barrier.
         if (update.sessionUpdate === 'config_option_update')
             this.captureRuntimeMetadata(update.configOptions);
+        if (update.sessionUpdate === 'available_commands_update')
+            this.advertisedCommands = new Set((update.availableCommands ?? []).map(command => command.name));
+        this.recordConversationUpdate(update, scheduled);
+        if (update.sessionUpdate === 'usage_update') {
+            // Claude subscription rate-limit snapshot (claude-agent-acp forwards the SDK rate_limit_event).
+            const rateLimit = update._meta?.['_claude/rateLimit'];
+            if (rateLimit)
+                recordClaudeRateLimit(this.options.stateDir, rateLimit);
+        }
         switch (update.sessionUpdate) {
             case 'agent_message_chunk': {
                 const phase = messagePhase;
@@ -1768,6 +1991,7 @@ export class AcpSession {
             default:
                 break;
         }
+        this.observation.publish();
     }
     /**
      * Codex ACP's phase extension is the only currently supported visibility
@@ -1785,13 +2009,17 @@ export class AcpSession {
             return undefined;
         return phase === 'commentary' || phase === 'final_answer' ? phase : 'ambiguous';
     }
-    /** Normalize every ACP update losslessly into the durable ledger. */
-    recordConversationUpdate(update, scheduled, commentary = false) {
+    /**
+     * Normalize every ACP update losslessly into the durable ledger. The ledger is the conversation the
+     * owner reads, so the agent's commentary between its tools is kept as written, like its final answer.
+     */
+    recordConversationUpdate(update, scheduled) {
         const normalized = normalizeSessionUpdate(update, scheduled ? {
             redactText: SCHEDULED_LOOP_REDACTION,
             redactToolCallId: 'scheduled-loop-tool',
-        }
-            : commentary ? { redactText: OWNER_COMMENTARY_REDACTION } : {});
+        } : {});
+        if (normalized.kind === 'capabilities.updated' && 'commands' in normalized.payload)
+            this.presentedCommands = normalized.payload.commands ?? [];
         this.conversation.appendSafe({
             kind: normalized.kind,
             sessionGeneration: this.sessionGeneration,
@@ -1805,6 +2033,10 @@ export class AcpSession {
         });
     }
     // ── conversation ledger access (AgentSession) ─────────────────────────────
+    taskNoticeBinding() {
+        return this.activeTurn && this.sessionId ? { sessionGeneration: this.sessionGeneration, acpSessionId: this.sessionId, promptId: this.activeTurn.id } : undefined;
+    }
+    recordTaskCreated(binding, notice) { appendTaskCreated(this.conversation, binding, notice); }
     conversationPage(request = {}) {
         const floor = Number(this.conversationStartCursor ?? 0);
         const requested = Number(request.after ?? 0);
@@ -1826,12 +2058,43 @@ export class AcpSession {
             snapshot: this.conversationSnapshot(),
         };
     }
+    subscribeConversationFailure(listener) {
+        return this.conversation.subscribeFailure(listener);
+    }
+    conversationReplayAvailable(expectedGeneration) {
+        return expectedGeneration === this.sessionGeneration && this.conversation.generationDurable(expectedGeneration);
+    }
+    replayConversation(request) {
+        if (request.expectedGeneration !== this.sessionGeneration)
+            throw new Error('session generation changed');
+        return this.conversation.replay(request);
+    }
+    observeConversation(listener) {
+        return this.observation.observe(listener);
+    }
+    captureObservation() {
+        const snapshot = this.snapshot();
+        return {
+            ...this.conversationSnapshot(),
+            ...pendingInventory(this.pendingPrompts),
+            ledgerBarrier: Number(this.conversation.lastCursor() ?? 0),
+            alive: snapshot.alive,
+            readiness: snapshot.alive ? snapshot.readiness : 'offline',
+            activePromptIds: [...(this.activeTurn?.promptIds ?? [])],
+            pendingPermissions: [...this.pendingPermissions].flatMap(([permissionId, pending]) => pending.presented ? [{ permissionId, ...pending.presented }] : []),
+            commands: this.presentedCommands,
+            runtimeModel: snapshot.runtimeModel,
+            reasoningEffort: snapshot.reasoningEffort,
+            permissionMode: snapshot.permissionMode,
+        };
+    }
     conversationSnapshot() {
         return {
             sessionGeneration: this.sessionGeneration,
             readiness: this.isAlive() ? this.readiness : 'offline',
             queueDepth: this.queueDepth,
             pendingPermissionIds: [...this.pendingPermissions.keys()],
+            ...pendingInventory(this.pendingPrompts),
             ...(this.conversation.degraded ? { historyDegraded: true } : {}),
         };
     }