@platless/axom-cli 0.1.0 → 0.3.13

package/dist/workstation/acp/activityBusy.js

@@ -0,0 +1,43 @@
+/**
+ * 「这条会话的 agent 自己说它在忙吗」——一个**弱**判据，不是归一化器。
+ *
+ * 真正的 vendor 原文 → 规范三态只发生在服务端 `axom-core` 的 `agentActivityOf`
+ * （前序 spec 裁决 L1：归一化只在一处）。这里要回答的问题窄得多，答案只有两种，
+ * 而且两边对「读不懂」的处置是同一条推理：服务端答 `null`（保留上一个已知状态，不写库），
+ * 这里答 `false`（本来源不主张忙碌，判据退回 `liveness.turnRunning`）。两边都不把未知
+ * 伪装成已知——答 `true` 会造出一个永不消失的假忙碌，正是本轮要消灭的东西。
+ *
+ * 两个键分属两套词汇表（claude 的 `state`、codex 的 `type`），**不做或运算**：
+ * `state` 在就只看 `state`。混读等于承认一份原文可以同时是两种方言。
+ */
+export function activityIsBusy(raw) {
+    if (!raw)
+        return false;
+    if (typeof raw.state === 'string')
+        return raw.state === 'running' || raw.state === 'requires_action';
+    if (typeof raw.type === 'string')
+        return raw.type === 'active' && !codexBlockedOnHumanOnly(raw);
+    return false;
+}
+/**
+ * codex 的 `activeFlags` 里表示「agent 正被人挡住、没有在算」的标记。
+ *
+ * **和会话状态问的不是同一个问题。** 服务端的 `agentActivityOf` 要答「vendor 说它在干什么」，
+ * 这里要答「排干时有没有在途工作会被重启破坏」。一条停在审批卡或提问上的会话，两个答案不同：
+ * 它确实处在 vendor 说的 `active`，但**没有任何在途工作**，重启它不损失什么。把这种会话算成忙，
+ * 会让一次优雅更新白等满 30 分钟排干再报 BUSY —— 正是本分支要消灭的那个形状，只是换了个入口。
+ * 2026-09-21 在真机上抓到的第一条 codex 原文就是这一种：
+ * `{"type":"active","activeFlags":["waitingOnUserInput"]}`。
+ *
+ * 值域的取证、证据等级，以及「不认识的标记为什么保持忙」的理由，见 `axom-core` 的
+ * `AgentActivityMapping.kt` 里 `CODEX_BLOCKED_ON_HUMAN_FLAGS` 的 KDoc —— 那里是权威说明，
+ * 这两处必须同时改，所以判据故意写成同一个形状（非空 + 每一项都认得）。
+ */
+const CODEX_BLOCKED_ON_HUMAN_FLAGS = new Set(['waitingOnApproval', 'waitingOnUserInput']);
+/** `activeFlags` 非空**且每一项**都在 {@link CODEX_BLOCKED_ON_HUMAN_FLAGS} 里。 */
+function codexBlockedOnHumanOnly(raw) {
+    const flags = raw.activeFlags;
+    if (!Array.isArray(flags) || flags.length === 0)
+        return false;
+    return flags.every((flag) => typeof flag === 'string' && CODEX_BLOCKED_ON_HUMAN_FLAGS.has(flag));
+}

package/dist/workstation/acp/activityReporting.js

@@ -0,0 +1,54 @@
+/**
+ * 两条厂商特定的活动状态采集路径。**只做搬运，不做归一化**——vendor→规范三态的映射
+ * 只发生在服务端 ingest 一处（裁决 L1：normalise in one place, server ingest）。
+ *
+ * 判 agent 用 `InitializeResponse.agentInfo.name`：ACP 的 `Implementation.name` 文档自述
+ * "intended for programmatic or logical use"，而且用户改不了它（`agentName` 是工作站配置里的
+ * 条目名，随时可以改）。
+ */
+const CLAUDE_AGENT = '@agentclientprotocol/claude-agent-acp';
+const CODEX_AGENT = '@agentclientprotocol/codex-acp';
+/** 这个 agent 有没有配套的活动状态采集器；按 InitializeResponse.agentInfo.name 判。 */
+export function reportsActivity(agentName) {
+    return agentName === CLAUDE_AGENT || agentName === CODEX_AGENT;
+}
+/** Certified AIR task-stop compatibility, independent of activity collection. These adapters
+ * implement `_session/async_task/stop`; this is NOT a native child-session cancel declaration.
+ * Keep this separate even while the certified provider sets happen to coincide.
+ */
+export function supportsAsyncTaskStop(agentName) {
+    return agentName === CLAUDE_AGENT || agentName === CODEX_AGENT;
+}
+/**
+ * claude-agent-acp 的 `emitRawSDKMessages`（`acp-agent.d.ts:645`，0.75.1 起存在）：
+ * 命中过滤器的原始 SDK 消息会以 `extNotification("_claude/sdkMessage", …)` 推回来。
+ * 只要状态那一种——过滤器是 `SDKMessageFilter { type, subtype? }`（`:609`）。
+ */
+export function newSessionMetaFor(agentName) {
+    if (agentName !== CLAUDE_AGENT)
+        return undefined;
+    return { claudeCode: { emitRawSDKMessages: [{ type: 'system', subtype: 'session_state_changed' }] } };
+}
+function asObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+/** claude：把 _claude/sdkMessage 的 params 提成 vendor 原文，非状态消息返回 null。 */
+export function claudeActivityRaw(params) {
+    const message = asObject(params?.message);
+    if (!message)
+        return null;
+    if (message.type !== 'system' || message.subtype !== 'session_state_changed')
+        return null;
+    // 整条消息原样带走，不挑字段：服务端要的是证据，而将来 SDK 给这条消息加字段时
+    // 这里不该是需要改的地方。
+    return message;
+}
+/** codex：把 session_info_update 的 _meta 提成 vendor 原文，没有状态返回 null。 */
+export function codexActivityRaw(meta) {
+    const codex = asObject(meta?.codex);
+    if (!codex)
+        return null;
+    return asObject(codex.threadStatus);
+}

package/dist/workstation/acp/adoption.js

@@ -82,9 +82,13 @@
  * `user_message_chunk` now passes through here untouched, and `ExternalAgentEventApplier`'s
  * `onBackfillDone` is what closes the last buffered message.
  */
+import { randomUUID } from 'node:crypto';
 import { methods } from '@agentclientprotocol/sdk';
 import { validateWireEvent } from './validate.js';
-import { mapSessionUpdate, SessionMapperState } from './sessionUpdateMapper.js';
+import { SessionMapperScopes, scopeKey } from './sessionScope.js';
+import { mapSessionUpdate } from './sessionUpdateMapper.js';
+import { newSessionMetaFor } from './activityReporting.js';
+import { buildSessionMcpServers } from './delegationMcp.js';
 /** `NativeSessionInfo.title` is truncated to this many characters — mirrors the deleted `claudeCode/adoption.ts`'s display-safety guard (`TITLE_MAX_LENGTH`). */
 const TITLE_MAX_LENGTH = 80;
 /** `SessionInfo.updatedAt` is an ISO 8601 string or `null`/absent; missing or unparseable sorts as oldest (0) rather than throwing. */
@@ -94,6 +98,24 @@ function parseUpdatedAt(value) {
     const parsed = Date.parse(value);
     return Number.isNaN(parsed) ? 0 : parsed;
 }
+/**
+ * `session/delete` per id. Only when the agent advertised `sessionCapabilities.delete` — ACP forbids calling an unadvertised method. Codex's delete is an archive (`thread/archive`); that is still "gone from session/list", which is all the caller needs.
+ */
+export async function deleteNativeSessions(connection, ids) {
+    if (!connection.capabilities.delete)
+        return ids.map((nativeSessionId) => ({ nativeSessionId, outcome: 'unsupported' }));
+    const results = [];
+    for (const nativeSessionId of ids) {
+        try {
+            await connection.connection.agent.request(methods.agent.session.delete, { sessionId: nativeSessionId });
+            results.push({ nativeSessionId, outcome: 'deleted' });
+        }
+        catch (error) {
+            results.push({ nativeSessionId, outcome: 'failed', error: error instanceof Error ? error.message : String(error) });
+        }
+    }
+    return results;
+}
 /**
  * List an agent's native sessions scoped to `query.cwd`, newest first.
  *
@@ -126,17 +148,29 @@ export function createReplayCapture() {
     const armed = new Set();
     const buffered = new Map();
     const listeners = new Map();
+    const takeScoped = (sessionId) => {
+        armed.delete(sessionId);
+        const list = buffered.get(sessionId) ?? [];
+        buffered.delete(sessionId);
+        return list;
+    };
+    const capture = (sessionId, notification) => {
+        if (!armed.has(sessionId))
+            return false;
+        const list = buffered.get(sessionId) ?? [];
+        list.push(notification);
+        buffered.set(sessionId, list);
+        return true;
+    };
     return {
+        capture,
+        takeScoped,
         register(app) {
             app.onNotification(methods.client.session.update, (ctx) => {
                 // Armed wins over listening: while a session/load replay is in flight, its history must land
                 // in the buffer rather than in a live session's read loop — see `listen`'s doc comment.
-                if (armed.has(ctx.params.sessionId)) {
-                    const list = buffered.get(ctx.params.sessionId) ?? [];
-                    list.push(ctx.params.update);
-                    buffered.set(ctx.params.sessionId, list);
+                if (capture(ctx.params.sessionId, ctx.params))
                     return;
-                }
                 // Neither armed nor listened to: dropped, so this handler cannot accumulate every session
                 // the connection has ever seen an update for (see the file doc comment).
                 listeners.get(ctx.params.sessionId)?.(ctx.params.update);
@@ -146,10 +180,7 @@ export function createReplayCapture() {
             armed.add(sessionId);
         },
         take(sessionId) {
-            armed.delete(sessionId);
-            const list = buffered.get(sessionId) ?? [];
-            buffered.delete(sessionId);
-            return list;
+            return takeScoped(sessionId).map(({ update }) => update);
         },
         count(sessionId) {
             return buffered.get(sessionId)?.length ?? 0;
@@ -191,45 +222,43 @@ function stringField(payload, key) {
  * against the real `session/load` response).
  */
 export function foldReplayEvents(updates) {
+    return foldScopedReplayEvents(updates.map((update) => ({ sessionId: 'root', update })), 'root');
+}
+/** Fold each origin independently, without reordering interleaved native notifications. */
+export function foldScopedReplayEvents(updates, rootNativeSessionId) {
     const events = [];
-    // Fresh per replay, not shared with the live session that may follow: this call reconstructs one
-    // adopted session's history from its own `tool_call`s, and a registry carried in from elsewhere
-    // could name a call this history never created.
-    const mapperState = new SessionMapperState();
-    let sawMessageContent = false;
-    let currentMessageId = null;
-    function flushMessageCompleted() {
-        if (!sawMessageContent)
+    const scopes = new SessionMapperScopes();
+    const rootRuntimeId = randomUUID();
+    const messages = new Map();
+    const emit = (event, nativeSessionId) => {
+        events.push(nativeSessionId === rootNativeSessionId ? event : { ...event, acpSessionId: nativeSessionId });
+    };
+    const flush = (key) => {
+        const message = messages.get(key);
+        if (!message)
             return;
-        events.push({ eventName: 'agent_message', payload: { messageId: currentMessageId ?? 'replay' } });
-        sawMessageContent = false;
-        currentMessageId = null;
-    }
-    for (const update of updates) {
-        for (const event of mapSessionUpdate(update, mapperState)) {
-            if (event.eventName === 'user_message_chunk') {
-                // A user turn beginning means whatever the assistant was streaming has necessarily already
-                // ended — flush it first, mirroring AcpSession.finishTurn's ordering at a live turn
-                // boundary (just the mirror image here, since replay sees the *next* user turn rather than
-                // an explicit turn-end signal). The chunk itself then goes through verbatim: the fold that
-                // used to live here is the server's now.
-                flushMessageCompleted();
-                events.push(event);
-                continue;
-            }
+        emit({ eventName: 'agent_message', payload: { messageId: message.messageId ?? 'replay' } }, message.nativeSessionId);
+        messages.delete(key);
+    };
+    for (const { sessionId: nativeSessionId, update } of updates) {
+        const origin = { rootRuntimeId, nativeSessionId };
+        const key = scopeKey(origin);
+        for (const event of mapSessionUpdate(update, scopes.get(origin))) {
+            if (event.eventName === 'user_message_chunk')
+                flush(key);
             if (event.eventName === 'agent_message_chunk' || event.eventName === 'agent_thought_chunk') {
                 const messageId = stringField(event.payload, 'messageId');
-                if (sawMessageContent && messageId !== null && currentMessageId !== null && messageId !== currentMessageId) {
-                    flushMessageCompleted();
-                }
-                sawMessageContent = true;
-                if (messageId !== null)
-                    currentMessageId = messageId;
+                const previous = messages.get(key);
+                if (previous && messageId !== null && previous.messageId !== null && messageId !== previous.messageId)
+                    flush(key);
+                messages.set(key, { nativeSessionId, messageId: messageId ?? messages.get(key)?.messageId ?? null });
             }
-            events.push(event);
+            emit(event, nativeSessionId);
         }
     }
-    flushMessageCompleted();
+    for (const key of messages.keys())
+        flush(key);
+    scopes.clear();
     return events;
 }
 /**
@@ -330,7 +359,7 @@ export async function settleUpdates(sessionId, count, maxRounds = 10) {
  *
  * ## `session/load` also activates the session, not just replays it — and Task 8 relies on that
  *
- * The `session/load` request below sends `mcpServers: []`. That is not incidental — `session/load`
+ * The `session/load` request below sends the current MCP list. That is not incidental — `session/load`
  * is not a read-only "give me the history" call: per its own spec, the agent restores this
  * `sessionId` as its **current** session, the same way `session/new` would, just with history
  * attached instead of starting empty.
@@ -346,13 +375,32 @@ export async function settleUpdates(sessionId, count, maxRounds = 10) {
  * driving an already-loaded `sessionId` means hand-building the same small `DrivenSession` surface
  * around raw `session/prompt` / `session/cancel` requests and {@link ReplayCapture.listen}.
  *
- * `mcpServers: []` is consistent with the other path rather than a shortfall of this one:
- * `AcpSession.open`'s `buildSession(cwd).start()` attaches no MCP servers either (`OpenSessionOptions`
- * carries only `cwd`), because Axom does not configure MCP servers for external agents at all.
+ * Both paths use `buildSessionMcpServers`, so an adopted or reconnected session receives the same
+ * user servers and a freshly issued delegation lease when managed delegation is enabled.
+ *
+ * ## Also opts claude into activity reporting, the same as `session/new` — closing a real gap, not a cosmetic one
+ *
+ * `AcpSession.open`'s `session/new` request carries `_meta.claudeCode.emitRawSDKMessages`
+ * (`newSessionMetaFor`, `activityReporting.ts`) so claude's collector pushes
+ * `extNotification("_claude/sdkMessage", …)` back on the connection. `session/load` used to send no
+ * `_meta` at all, so every session reached through this function — every adoption, and every
+ * reconnect after a daemon restart, since a fresh child process's session table is always empty and
+ * therefore always takes the `createSession` branch of `getOrCreateSession` — permanently lost
+ * activity reporting the moment it was (re)loaded, while `agent_opened.reportsActivity` kept
+ * claiming `true`. Verified directly against the installed `claude-agent-acp@0.79.0` adapter
+ * (`dist/acp-agent.js`): `loadSession` → `getOrCreateSession` → (no matching in-process session, the
+ * case that always applies to a freshly spawned agent) → `createSession({ …, _meta: params._meta },
+ * { resume: params.sessionId })`, and `createSession` reads
+ * `sessionMeta?.claudeCode?.emitRawSDKMessages` off that same `_meta` exactly as `session/new` does.
+ * `newSessionMetaFor` is reused verbatim rather than re-implementing the same agent-name check here,
+ * so there is exactly one place that decides which agents opt in.
  */
 export async function* replayNativeSession(connection, capture, params) {
     if (!connection.capabilities.loadSession)
         return;
+    // Exclusive ownership must precede every mutation of the shared capture/known-session state.
+    // A rejected concurrent load must not consume or disarm the active owner's buffer.
+    const releaseCapture = connection.captureSessionUpdates((notification) => capture.capture(params.nativeSessionId, notification));
     // Arm before requesting — the agent may start sending session/update notifications for this
     // sessionId as soon as it receives the request, and the capture's handler drops anything for a
     // sessionId that isn't armed yet (see ReplayCapture.arm's doc comment).
@@ -361,12 +409,21 @@ export async function* replayNativeSession(connection, capture, params) {
     // router would otherwise drop them on the floor. During a replay this capture *is* the handler,
     // so the claim has to be made explicitly — and withdrawn in the same `finally` that disarms.
     const unmarkSession = connection.markSessionKnown(params.nativeSessionId);
+    // Same opt-in `session/new` sends, on the request that actually reaches the agent for every
+    // adoption/reconnect — see the doc comment above. `undefined` for every non-claude agent, in which
+    // case the spread below adds nothing, so a non-claude `session/load` is byte-for-byte the request
+    // it always sent.
+    const meta = newSessionMetaFor(connection.agentInfo?.name);
     let updates;
     try {
+        const mcpServers = buildSessionMcpServers(params.mcpServers, params.delegationMcp);
+        if (params.delegationMcp)
+            connection.redactStderrSecret(Object.values(params.delegationMcp.headers)[0]);
         const response = await connection.connection.agent.request(methods.agent.session.load, {
             sessionId: params.nativeSessionId,
             cwd: params.cwd,
-            mcpServers: [],
+            mcpServers,
+            ...(meta ? { _meta: meta } : {}),
         });
         params.onLoaded?.(response);
         // The response resolving is NOT the end of the replay — see {@link settleUpdates} for the SDK
@@ -374,6 +431,7 @@ export async function* replayNativeSession(connection, capture, params) {
         await settleUpdates(params.nativeSessionId, () => capture.count(params.nativeSessionId));
     }
     finally {
+        releaseCapture();
         unmarkSession();
         // In a `finally` because `arm()` has no other exit. A rejected `session/load` — a stale id the
         // agent has since deleted, the case `AcpAgents.startSession` catches and falls back from — used
@@ -383,9 +441,9 @@ export async function* replayNativeSession(connection, capture, params) {
         // session id, so nothing would ever come back to take this one. `take()` is both halves at once
         // (release the buffer, disarm), which is why the failure path calls the same function the
         // success path does rather than a disarm of its own.
-        updates = capture.take(params.nativeSessionId);
+        updates = capture.takeScoped(params.nativeSessionId);
     }
-    for (const event of foldReplayEvents(updates)) {
+    for (const event of foldScopedReplayEvents(updates, params.nativeSessionId)) {
         const rejection = validateWireEvent(event);
         if (rejection) {
             console.error(`[acp] dropping a replayed event that fails validateWireEvent: ${rejection.reason} (session ${params.nativeSessionId})`);

package/dist/workstation/acp/authUrlSniffer.js

@@ -50,3 +50,39 @@ export function sniffAuthUrl(line) {
         return undefined;
     return match[0].replace(TRAILING_DECORATION, '');
 }
+/** How many lines after an invitation a URL may still arrive on. Two covers the measured shape with one spare. */
+const INVITATION_REACH = 2;
+/**
+ * {@link sniffAuthUrl} with one line of memory, for a login process's own output.
+ *
+ * A device-code login measured on a real machine prints the invitation and the URL on **adjacent**
+ * lines (`Please visit the following URL…` / `Verification URL: https://…`), which the single-line
+ * rule misses entirely. This remembers an invitation for {@link INVITATION_REACH} lines.
+ *
+ * Deliberately **not** used by the stderr sniffer on login connections: that one covers an `npx`
+ * install's output too, where widening the match would pick up documentation links. This one is only
+ * ever pointed at a process whose whole job is to sign in.
+ */
+export function createAuthUrlScanner() {
+    let reach = 0;
+    return (line) => {
+        const direct = sniffAuthUrl(line);
+        if (direct) {
+            reach = 0;
+            return direct;
+        }
+        const clean = stripAnsi(line);
+        if (INVITATION_WORDS.test(clean)) {
+            reach = INVITATION_REACH;
+            return undefined;
+        }
+        if (reach === 0)
+            return undefined;
+        reach -= 1;
+        const match = ABSOLUTE_URL.exec(clean);
+        if (!match)
+            return undefined;
+        reach = 0;
+        return match[0].replace(TRAILING_DECORATION, '');
+    };
+}

package/dist/workstation/acp/contract.js

@@ -355,12 +355,17 @@ export const acpContractChecks = [
             // `AcpSession.prompt`'s own doc comment lists an overlapping call as an expected case, and
             // ACP itself allows it — the SDK's `ActiveSession.prompt` enqueues a `stop` message per call,
             // so two prompts really do produce two completions on the read queue. Everything downstream
-            // is built on one result per prompt: `agentSessions.ts` answers each `agent_prompt` frame's
-            // `agentTurnStarted` with the `agentTurnFinished` inside `onAgentTurnDone`, the server's run
-            // stays parked until a `turn_done` arrives, and `agent_message` — the event that flushes
-            // the server's delta buffer and attaches the turn's usage figures — is synthesized only as a
-            // turn ends. A dropped second result therefore does not merely lose a status line: it strands
-            // the second turn's text and parks the run indefinitely.
+            // is built on one result per prompt: each `prompt()` call pushes its own entry onto
+            // `AcpSession.inFlightTurns`, `finishTurn` pops exactly one entry per completion it sees (not
+            // "the" entry, "an" entry — see its own doc), and `agentSessions.ts`'s `onAgentTurnDone`
+            // fires once per `finishTurn` call and emits one `agent_turn_done` frame each time (2026-09-21
+            // rewrite; there is no longer a `tasks.agentTurnStarted`/`agentTurnFinished` bracket in the
+            // middle of that path, but the one-result-per-prompt pairing itself is unchanged — it was
+            // always `inFlightTurns`' push/pop symmetry, not the bracket, that guaranteed it). The
+            // server's run stays parked until a `turn_done` arrives, and `agent_message` — the event that
+            // flushes the server's delta buffer and attaches the turn's usage figures — is synthesized
+            // only as a turn ends. A dropped second result therefore does not merely lose a status line:
+            // it strands the second turn's text and parks the run indefinitely.
             //
             // Driven through `driveOneTurn` twice concurrently rather than two bare `prompt()` calls so a
             // real adapter's hook (which may need to say something specific to get output) is what decides

package/dist/workstation/acp/delegationMcp.js

@@ -0,0 +1,24 @@
+export function buildSessionMcpServers(userServers = [], lease) {
+    if (!lease)
+        return [...userServers];
+    const fail = () => { throw new Error('Delegation MCP configuration is unavailable'); };
+    let url;
+    try {
+        url = new URL(lease.url);
+    }
+    catch {
+        return fail();
+    }
+    if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash ||
+        url.pathname !== '/mcp/delegation' || !Number.isSafeInteger(lease.expiresAtEpochMs) ||
+        lease.expiresAtEpochMs <= Date.now() || userServers.some((server) => server.name === 'axom-delegation'))
+        return fail();
+    const headers = Object.entries(lease.headers);
+    if (headers.length !== 1 || headers[0][0].toLowerCase() !== 'authorization' ||
+        !/^Bearer [A-Za-z0-9_-]+$/.test(headers[0][1]))
+        return fail();
+    return [...userServers, {
+            type: 'http', name: 'axom-delegation', url: url.toString(),
+            headers: headers.map(([name, value]) => ({ name, value })),
+        }];
+}

package/dist/workstation/acp/draftInterceptor.js

@@ -104,6 +104,15 @@ export function interceptDraftUpdates(source, options) {
             enqueue(encoder.encode(`${line}\n`));
             return;
         }
+        if (options.captureUpdate && typeof parsed === 'object' && parsed !== null) {
+            const message = parsed;
+            const params = message.params;
+            if (message.method === SESSION_UPDATE_METHOD && !('id' in message) &&
+                params && typeof params.sessionId === 'string' && params.sessionId.length > 0 &&
+                typeof params.update === 'object' && params.update !== null &&
+                options.captureUpdate(params))
+                return;
+        }
         const diverted = diversionReasonFor(parsed, options.isOwnSession);
         if (!diverted) {
             // The original text, not a re-serialisation of the parse — see the doc comment.