@platless/axom-cli 0.3.13 → 0.5.9

package/dist/workstation/acp/acpClient.js

@@ -3,15 +3,13 @@ import { randomUUID } from 'node:crypto';
 import { Readable, Writable } from 'node:stream';
 import { client, ndJsonStream, PROTOCOL_VERSION, RequestError } from '@agentclientprotocol/sdk';
 import { sniffAuthUrl } from './authUrlSniffer.js';
-import { metaTerminalAuthArgs, terminalLoginSpecOf } from './terminalLogin.js';
-import { airCapabilityMeta, asSdkClientCapabilities, AIR_ASYNC_TASKS_CAPABILITY, AIR_NATIVE_SUBAGENT_SESSIONS_CAPABILITY, DRAFT_SUBAGENTS_CAPABILITY, } from './draftSubagents.js';
-import { interceptDraftUpdates } from './draftInterceptor.js';
-import { claudeActivityRaw } from './activityReporting.js';
-import { findOnPath, probeEnvironment } from './installProbe.js';
-import { parseQoderProfile, sameProfileIdentity } from '../qoderAdapter/profile.js';
-import { parseTaskObservation, taskEventMatchesHost } from '../qoderAdapter/taskEvent.js';
-export class UnsupportedNodeVersionError extends Error {
-}
+import { overlayEnvSecrets } from './envSecrets.js';
+import { secretForms } from '../keepers/acp/stderr.js';
+import { initializeRequestParams, jsonRpcErrorCodeOf, parseInitializeResult, } from './initializeResponse.js';
+import { withPathPrefix } from './registry/launch.js';
+// Moved to `initializeResponse.ts` (shared with the deterministic processor); re-exported so every
+// existing importer of these names is unchanged.
+export { STEER_TIMINGS, steeringAdvertised, steeringTimings, toAuthMethodSnapshot, } from './initializeResponse.js';
 /**
  * A subprocess failed to start, or died before it finished responding to `initialize`.
  *
@@ -19,8 +17,7 @@ export class UnsupportedNodeVersionError extends Error {
  * 上写的那几行 —— npx 的 `npm error code ETARGET`、adapter 的崩溃栈、代理的拒绝。这里以前是
  * `stdio: 'inherit'`,那几行只落进 daemon.log,调用方拿到的是一句
  * "exited before responding to initialize (code=1)",服务端那头再转手就成了一条内容为空的
- * "ACP connection closed" —— 排查的人手上什么都没有。见 {@link isMissingPackageVersion}:那条判定
- * 需要的是证据,不是从「管子断了」倒推出来的猜测。
+ * "ACP connection closed" —— 排查的人手上什么都没有。
  */
 export class AgentSpawnError extends Error {
     stderr;
@@ -50,156 +47,15 @@ export class AgentInitializeTimeoutError extends Error {
  */
 const NPM_ETARGET = /(?:^|[^A-Z])ETARGET(?![A-Z])/;
 /**
- * 判定规则本身,脱离 {@link AgentSpawnError}/{@link AgentInitializeTimeoutError} 单独导出 ——
- * `installNpxPackage`(`installProbe.ts`)是这条规则的第二个读者:它下载适配器失败时报的是一段
- * `InstallOutcome.error`/`stderr` 字符串,不是这两个类里的一个实例,没有 `.stderr` 字段可供
- * {@link isMissingPackageVersion} 去 `instanceof` 窄化。两个调用点都要认同一件事——npm 自己打在
- * stderr 上的 `ETARGET` 错误码——所以正则只在这一处,两个调用点都直接测字符串,而不是各自维护一份。
+ * 判定规则本身:npm 自己打在 stderr 上的 `ETARGET` 错误码。读者是安装期的回退
+ * (`AcpAgents.installPristineWithFallback`)——启动期不再有回退,启动从不解析版本(spec 2026-10-11 §6.2)。
  */
 export function stderrShowsMissingPackageVersion(stderr) {
     return NPM_ETARGET.test(stderr);
 }
-/**
- * 这次启动失败,是不是因为 registry 钉的版本 npm 根本没有。
- *
- * 只看 {@link AgentSpawnError.stderr} / {@link AgentInitializeTimeoutError.stderr} 里的原始文本 ——
- * 超时也算进来是因为实测过:npx 在一台慢机器上可以把 20s 的 initialize 预算耗光之后才让子进程死掉,
- * 那时候 ETARGET 早就写在 stderr 上了,只是赢下 race 的是计时器。
- */
-export function isMissingPackageVersion(error) {
-    if (!(error instanceof AgentSpawnError) && !(error instanceof AgentInitializeTimeoutError))
-        return false;
-    return stderrShowsMissingPackageVersion(error.stderr);
-}
 /** The agent negotiated a protocol version this client does not speak. */
 export class UnsupportedProtocolVersionError extends Error {
 }
-/**
- * Minimum Node.js major version a known agent package requires, keyed by its npx package name
- * (unversioned — matched against both a bare specifier and a version-pinned one; see
- * `argMatchesPackage`).
- *
- * The registry has no field for this — verified fact, not an oversight to fix here. The only place
- * a Node requirement is declared is the agent package's own `package.json#engines`, and `npx` does
- * not enforce it: it just runs the package under whatever `node` is already on PATH. Getting this
- * wrong means the user sees a subprocess crash stack instead of an actionable message (ruling R7),
- * so this table exists to catch the one adapter known, as of 2026-08-21, to need it.
- */
-const KNOWN_MIN_NODE_MAJOR = [
-    { packageName: '@agentclientprotocol/claude-agent-acp', minMajor: 22 },
-];
-/**
- * True when `arg` is exactly `packageName`, or `packageName` followed by an `@version` suffix.
- * `arg.startsWith(packageName)` alone would also match an unrelated package that merely shares a
- * prefix (e.g. `@agentclientprotocol/claude-agent-acp-extra`); anchoring on an exact match or an
- * `@` boundary rules that out while still matching ruling R3's user-supplied, unpinned
- * `command`/`args` override, which has no version suffix to key off at all.
- */
-function argMatchesPackage(arg, packageName) {
-    return arg === packageName || arg.startsWith(`${packageName}@`);
-}
-/** Exported for tests: derives the minimum Node major version a launch spec requires, if known. */
-export function requiredNodeMajorFor(spec) {
-    const match = KNOWN_MIN_NODE_MAJOR.find((entry) => spec.args.some((arg) => argMatchesPackage(arg, entry.packageName)));
-    return match?.minMajor;
-}
-/**
- * Throws a message a user can act on when this machine's Node is older than a known agent
- * requires. `nodeVersion` defaults to the real running Node; it takes an explicit override so tests
- * can exercise both sides of the gate without depending on the host's actual Node version —
- * `process.versions.node` is a frozen property and cannot be stubbed.
- */
-export function assertNodeVersionSupported(spec, nodeVersion = process.versions.node) {
-    const required = requiredNodeMajorFor(spec);
-    if (required === undefined)
-        return;
-    const currentMajor = Number.parseInt(nodeVersion.split('.')[0] ?? '', 10);
-    if (Number.isNaN(currentMajor) || currentMajor < required) {
-        throw new UnsupportedNodeVersionError(`This agent requires Node.js >= ${required}, but this machine is running Node.js ${nodeVersion}. ` +
-            'Install a newer Node.js and try again.');
-    }
-}
-/**
- * Whether an `InitializeResponse._meta` advertises the `_session/steering` extension.
- *
- * ## `_session/steering` is not ACP
- *
- * It is absent from the schema this client is pinned to (`grep steer
- * node_modules/@agentclientprotocol/sdk/dist/schema/types.gen.d.ts` returns nothing). It is an
- * extension `claude-agent-acp` implements: the method constant lives at its `acp-agent.js@0.76.0:164`
- * and its own comment calls it a *"Custom (extension) request method ... Named `_session/steering`
- * per the agreed ACP steering wire protocol"*. The leading underscore is ACP's extension namespace.
- *
- * ## Why the top-level `_meta` specifically
- *
- * The adapter advertises it at `InitializeResponse._meta.steering.supported`, a **sibling of
- * `agentCapabilities`** (`acp-agent.js@0.76.0:944-950`), not a key inside it. `_meta` is typed
- * `{[key: string]: unknown} | null` (`types.gen.d.ts:1498-1500`), so every hop down has to be
- * narrowed rather than indexed through a cast.
- *
- * Strictly `=== true`. An agent that sends `steering: {}` (the shape ACP uses for its *own*
- * capability markers) has not said `supported`, and this extension does not define that spelling —
- * reading it as a yes would be this client inventing a wire contract.
- */
-export function steeringAdvertised(meta) {
-    if (typeof meta !== 'object' || meta === null)
-        return false;
-    const steering = meta.steering;
-    if (typeof steering !== 'object' || steering === null)
-        return false;
-    return steering.supported === true;
-}
-/**
- * The delivery timings the `_session/steering` extension defines — when the agent hands an injected
- * message to the model. `next` is the only lossless one: `now` aborts the running generation and
- * discards whatever tool calls were still outstanding.
- */
-export const STEER_TIMINGS = ['now', 'next', 'later'];
-/**
- * Which delivery timings an `InitializeResponse._meta` says the agent accepts —
- * `_meta.steering.timings`, the sibling of the `supported` flag {@link steeringAdvertised} reads,
- * and read from the **top-level** `_meta` for exactly the same reason.
- *
- * ## Empty is the answer, not the absence of one
- *
- * An agent that declares no timings has told us we may not name one. That is not "assume the
- * default" — the extension ignores an unrecognised `priority` **silently** (the measurement behind
- * ruling N4: sending `next` to today's adapters lands as `now`, which throws away the user's
- * in-flight work). So an empty result must reach the caller as "do not specify a timing at all",
- * and today — before the upstream PR that makes adapters broadcast this — every agent in the wild
- * produces exactly that. Steady state, not a bug.
- *
- * ## Unknown values are dropped, never rejected
- *
- * A timing this build has never heard of is skipped and the known ones beside it survive. This
- * client is deployed on user machines and can be older than both the agent it launches and the
- * server it reports to; throwing (or discarding the whole array) on a value from a future version
- * of the extension would take steering away from an agent that does support it. Non-strings are
- * dropped the same way: `_meta` is typed `{[key: string]: unknown}`, so nothing here is guaranteed.
- *
- * Duplicates collapse — the wire shape is a JSON array but the fact is a set.
- */
-export function steeringTimings(meta) {
-    if (typeof meta !== 'object' || meta === null)
-        return [];
-    const steering = meta.steering;
-    if (typeof steering !== 'object' || steering === null)
-        return [];
-    const declared = steering.timings;
-    if (!Array.isArray(declared))
-        return [];
-    const known = [];
-    for (const entry of declared) {
-        if (typeof entry !== 'string')
-            continue;
-        if (!STEER_TIMINGS.includes(entry))
-            continue;
-        if (known.includes(entry))
-            continue;
-        known.push(entry);
-    }
-    return known;
-}
 /**
  * The JSON-RPC error code an agent answered with, or `undefined` when the failure was not one an
  * agent answered at all.
@@ -230,10 +86,7 @@ export function steeringTimings(meta) {
 export function jsonRpcErrorCode(error) {
     if (!(error instanceof RequestError))
         return undefined;
-    const { code } = error;
-    if (!Number.isInteger(code))
-        return undefined;
-    return code >= -2_147_483_648 && code <= 2_147_483_647 ? code : undefined;
+    return jsonRpcErrorCodeOf(error.code);
 }
 function translateSpawnError(command, error, stderr) {
     if (error.code === 'ENOENT') {
@@ -274,12 +127,19 @@ const STDERR_FLUSH_GRACE_MS = 250;
  */
 function captureChildStderr(stream, present) {
     if (!stream)
-        return { text: () => '', flushed: () => Promise.resolve(), redactSecret: () => { } };
+        return { text: () => '', flushed: () => Promise.resolve(), redactValue: () => { } };
     let tail = '';
     let lineBuffer = '';
     let protectedLine = '';
     let droppingLongLine = false;
-    const secrets = new Set();
+    /** {@link ChildStderr.redactValue}'s forms. */
+    const quiet = new Set();
+    const redactAll = (text) => {
+        let safe = text;
+        for (const secret of quiet)
+            safe = safe.replaceAll(secret, '[REDACTED]');
+        return safe;
+    };
     const forward = (value) => {
         tail = (tail + value).slice(-STDERR_TAIL_LIMIT);
         process.stderr.write(value);
@@ -292,10 +152,7 @@ function captureChildStderr(stream, present) {
                 droppingLongLine = false;
             }
             else {
-                let safe = protectedLine.slice(0, newline + 1);
-                for (const secret of secrets)
-                    safe = safe.replaceAll(secret, '[REDACTED]');
-                forward(safe);
+                forward(redactAll(protectedLine.slice(0, newline + 1)));
             }
             protectedLine = protectedLine.slice(newline + 1);
         }
@@ -348,8 +205,10 @@ function captureChildStderr(stream, present) {
     };
     stream.on('data', (chunk) => {
         const text = chunk.toString();
-        if (secrets.size > 0)
+        if (quiet.size > 0) {
             forwardProtected(text);
+            scanForAuthUrl(text);
+        }
         else {
             tail = (tail + text).slice(-STDERR_TAIL_LIMIT);
             process.stderr.write(chunk);
@@ -362,25 +221,19 @@ function captureChildStderr(stream, present) {
     // A final unterminated line (no trailing `\n` before the process exits) is still a real line —
     // scan whatever is left in the buffer once the stream itself says there is no more coming.
     void ended.then(() => {
-        if (protectedLine && !droppingLongLine) {
-            let safe = protectedLine;
-            for (const secret of secrets)
-                safe = safe.replaceAll(secret, '[REDACTED]');
-            forward(safe);
-        }
-        if (secrets.size === 0)
-            scanForAuthUrl('\n');
+        if (protectedLine && !droppingLongLine)
+            forward(redactAll(protectedLine));
+        scanForAuthUrl('\n');
     });
     return {
         text: () => tail,
         flushed: (ms) => settledWithin(ended, ms).then(() => undefined),
-        redactSecret: (secret) => {
-            if (!secret)
-                return;
-            lineBuffer = '';
-            secrets.add(secret);
-            if (secret.startsWith('Bearer '))
-                secrets.add(secret.slice('Bearer '.length));
+        redactValue: (value) => {
+            // Longest first, so a form containing another is removed whole (Set order is insertion order).
+            const all = [...quiet, ...secretForms(value)].sort((a, b) => b.length - a.length);
+            quiet.clear();
+            for (const form of all)
+                quiet.add(form);
         },
     };
 }
@@ -404,7 +257,7 @@ function rejectionWithin(failure, ms) {
         });
     });
 }
-/** 报错正文里只放最后几行;完整尾巴留在 `.stderr` 上给 {@link isMissingPackageVersion} 这类程序读。 */
+/** 报错正文里只放最后几行;完整尾巴留在 `.stderr` 上给程序读。 */
 function lastStderrLines(text, count) {
     return text.split('\n').map((line) => line.trim()).filter(Boolean).slice(-count).join(' | ');
 }
@@ -505,54 +358,20 @@ export async function closeAgentTransport(child, connection, graceMs = CHILD_EXI
     connection.close();
     await connection.closed.catch(() => { });
 }
-/**
- * One `initialize` auth method, or `null` when the agent did not advertise a usable one.
- *
- * `initResponse` is another process's JSON that arrived over a pipe; `AuthMethod` is what this
- * client *asked* for, not what it was handed. Both variants of that union make `id` and `name`
- * required (`@agentclientprotocol/sdk` `types.gen.d.ts:2241-2246` for `AuthMethodTerminal`,
- * `:2281-2286` for `AuthMethodAgent`), so an agent that omits them is off-spec -- but nothing
- * between its stdout and here checks, and the snapshot then carries `undefined` in two positions
- * its own type declares non-optional. That lie does not stay local: `JSON.stringify` erases an
- * `undefined` value entirely, so the object passes every `typeof x.id` check in this process and
- * still reaches a peer with the keys missing.
- *
- * `agoragentic-acp` advertises exactly `{type: 'terminal', description: '…'}`. Observing it once
- * put a malformed `AuthMethodInfo` in the roster, which rides in every subsequent
- * `management_hello`, which the server then cannot decode -- and a hello the server cannot decode
- * closes the socket with nothing said, so the workstation retried into a permanent OFFLINE.
- *
- * Dropping rather than repairing: `id` is the value `authenticate` is called with, so inventing
- * one would trade a missing sign-in method for a broken one.
- */
-export function toAuthMethodSnapshot(method) {
-    if (typeof method.id !== 'string' || typeof method.name !== 'string')
-        return null;
-    // Terminal by shape (spec 2026-09-24 D6): a top-level `type: "terminal"`, or a `_meta
-    // ["terminal-auth"]` object from an agent that advertises its terminal login only there.
-    const terminal = terminalLoginSpecOf(method) !== undefined;
-    const args = 'args' in method && Array.isArray(method.args) ? method.args : terminal ? metaTerminalAuthArgs(method) : undefined;
-    return {
-        id: method.id,
-        name: method.name,
-        ...(terminal ? { type: 'terminal' } : {}),
-        ...(method.description != null ? { description: method.description } : {}),
-        // `args` only exists on a terminal method — top-level, or under `_meta["terminal-auth"]` when
-        // that is the only place the agent put it. Never the `_meta` command: see `terminalLogins`.
-        ...(args ? { args } : {}),
-    };
-}
 const DEFAULT_INITIALIZE_TIMEOUT_MS = 30_000;
 /**
  * Spawns an ACP agent subprocess, connects to it over ndjson stdio, and negotiates capabilities
  * via `initialize`. `env` and `agentEnv` are overlay layers on top of the current process
  * environment, not full environments (existing contract carried over from the deleted bridge
  * transport): if `PATH` is present in either, it has already been resolved by the caller and must
- * not be prefixed with anything else here.
+ * not be prefixed with anything else here — except the spec's own `pathPrefix` (a build's
+ * `node_modules/.bin`), which the adapter needs whatever `PATH` it is given.
  */
 export async function connectAgent(spec, env, agentEnv, options = {}) {
-    assertNodeVersionSupported(spec, options.nodeVersion);
-    const processEnv = { ...process.env, ...spec.env, ...env, ...agentEnv };
+    // No Node gate here any more: a build's `engines.node` is checked against the Node that runs it when
+    // the spec is made (`launchForBuild`, `builds/nodeGate.ts`); a config `command` override is the user's own.
+    // A build's own PATH prefix (`node_modules/.bin`) must survive a server- or agent-supplied PATH.
+    const processEnv = withPathPrefix({ ...process.env, ...spec.env, ...env, ...agentEnv }, spec.pathPrefix);
     const child = spawn(spec.command, spec.args, {
         // stderr 是 `pipe` 而不是 `inherit`,而且**依然不接进协议流** —— 它被 `captureChildStderr`
         // 单独读走:原样转发到 daemon.log(`inherit` 以前免费提供的那件事),同时留一份尾巴给启动期的
@@ -561,131 +380,19 @@ export async function connectAgent(spec, env, agentEnv, options = {}) {
         env: processEnv,
     });
     const stderrTail = captureChildStderr(child.stderr, options.present);
-    for (const secret of options.stderrSecrets ?? [])
-        stderrTail.redactSecret(secret);
-    if (options.onProcessExit)
-        child.once('exit', options.onProcessExit);
+    for (const value of overlayEnvSecrets({ env, agentEnv }))
+        stderrTail.redactValue(value);
     const lifecycle = watchChildLifecycle(child, spec.command, stderrTail);
     // Argument order reads backwards from what the names suggest: argument 1 is the child's stdin
     // (we write to it), argument 2 is the child's stdout (we read from it). Swapping them still
     // compiles and still "connects" — the initialize request just never arrives, so the failure mode
     // is a hang, not an error.
-    // Filled in by `bindDraftUpdates` once a session exists. Held in closure variables rather than
-    // passed in, because the interceptor has to be in place before `initialize` — the agent may send
-    // its first update before anyone has had a chance to register anything.
-    let updateCapture = null;
-    let ownSessionId = null;
-    let diagnostics = {
-        generation: randomUUID(), revision: 0, available: true,
-        launch: { source: options.launchSource ?? 'direct',
-            executable: (findOnPath(spec.command, probeEnvironment(processEnv)) ?? spec.command).slice(0, 4096),
-            platform: process.platform, architecture: process.arch, transport: 'stdio' },
-    };
-    const diagnosticListeners = new Set();
-    const providerTaskListeners = new Set();
-    child.once('exit', () => {
-        diagnostics = { ...diagnostics, available: false, revision: diagnostics.revision + 1,
-            profile: diagnostics.profile ? { ...diagnostics.profile, observerHealthy: false, rootConfirmed: false } : undefined };
-        for (const listener of diagnosticListeners)
-            listener(diagnostics);
-    });
-    let adapterRevision = 0;
-    const pendingProfiles = new Map();
-    const applyProfile = (sessionId, revision, profile) => {
-        const previous = diagnostics.profile;
-        if (!previous || !diagnostics.available || sessionId !== ownSessionId || revision <= adapterRevision ||
-            !sameProfileIdentity(previous, profile) || profile.rootSessionId !== ownSessionId ||
-            (previous.runtimeGeneration !== undefined && profile.runtimeGeneration !== previous.runtimeGeneration) ||
-            (profile.rootConfirmed === true && !profile.runtimeGeneration))
-            return;
-        adapterRevision = revision;
-        diagnostics = { ...diagnostics, revision: diagnostics.revision + 1, profile };
-        for (const listener of diagnosticListeners)
-            listener(diagnostics);
-    };
-    let draftSink = null;
-    // Same "filled in later" shape as `draftSink`, for `bindActivity` — see that method's own doc
-    // comment on `AcpConnection`.
-    let activitySink = null;
-    // Sessions this connection handles by some route other than an `AcpSession` — today only
-    // adoption's replay. Kept beside `ownSessionId` rather than folded into it because they mean
-    // different things: one is "the session we drive", these are "sessions someone else on this
-    // connection is already reading".
-    const knownSessionIds = new Set();
-    // p3-fix7 N9: updates diverted before any session is bound. An agent may push its first `session/update` (Claude's
-    // `available_commands_update`) before this client has processed the `session/new` response that names the session,
-    // so it reads as a stranger's. Dropping it lost the command table of every first probe (run 4 and run 5 daemon
-    // logs); kept here, bounded, and replayed to the sink once the session binds.
-    const preBind = [];
-    const stream = ndJsonStream(Writable.toWeb(child.stdin), 
-    // The child's stdout, minus the notifications the pinned SDK cannot deliver. Everything else
-    // reaches it byte-for-byte; see `draftInterceptor.ts` for the measurements behind this.
-    interceptDraftUpdates(Readable.toWeb(child.stdout), {
-        // Unbound means unknown, and unknown must not be claimed as ours: treating a session we have
-        // not been told about as our own would send its frames to the SDK, which drops them silently.
-        // Diverting is the recoverable direction — the sink can decide, and it can log.
-        isOwnSession: (sessionId) => (ownSessionId !== null && sessionId === ownSessionId) || knownSessionIds.has(sessionId),
-        captureUpdate: (notification) => updateCapture?.(notification) ?? false,
-        onDiverted: (update) => {
-            if (draftSink) {
-                draftSink(update);
-                return;
-            }
-            // No sink yet: keep it until the session binds (bounded), then replay what is ours.
-            if (preBind.length >= PRE_BIND_MAX_UPDATES) {
-                const dropped = preBind.shift();
-                warnDroppedPreBind(dropped.update, 'too many updates arrived before the session was bound');
-            }
-            preBind.push({ update, at: Date.now() });
-        },
-    }));
+    const stream = ndJsonStream(Writable.toWeb(child.stdin), Readable.toWeb(child.stdout));
     const app = client({ name: 'axom' });
-    app.onNotification('_axom/qoder/profile', (params) => (params ?? {}), (ctx) => {
-        const params = ctx.params;
-        const profile = parseQoderProfile(params.profile);
-        if (!diagnostics.profile || !profile || typeof params.sessionId !== 'string' ||
-            profile.rootSessionId !== params.sessionId || !Number.isSafeInteger(params.revision) ||
-            params.revision <= 0 || !sameProfileIdentity(diagnostics.profile, profile))
-            return;
-        if (ownSessionId) {
-            applyProfile(params.sessionId, params.revision, profile);
-        }
-        else {
-            // ACP may notify before its new/load reply. Retain only bounded typed candidates;
-            // no candidate becomes evidence until the response binds this connection's exact root.
-            const previous = pendingProfiles.get(params.sessionId);
-            if (previous && (params.revision <= previous.revision ||
-                profile.runtimeGeneration !== previous.profile.runtimeGeneration))
-                return;
-            if (!previous && pendingProfiles.size >= 8)
-                return;
-            pendingProfiles.set(params.sessionId, { revision: params.revision, profile });
-        }
-    });
-    app.onNotification('_qoder/task_event', (params) => params, (ctx) => {
-        const event = parseTaskObservation(ctx.params);
-        if (!event || !taskEventMatchesHost(event, {
-            selected: options.providerTaskAdapterSelected === true, available: diagnostics.available,
-            confirmed: diagnostics.profile?.rootConfirmed === true, rootSessionId: ownSessionId,
-            runtimeGeneration: diagnostics.profile?.runtimeGeneration,
-        }))
-            return;
-        for (const listener of providerTaskListeners)
-            listener(event);
-    });
-    // claude-agent-acp's raw-SDK-message channel (design §5.1/§2.1): registered unconditionally on
-    // every connection, before `options.configure?.(app)` and before `initialize` — `_claude/sdkMessage`
-    // is not a built-in ACP method, so `ClientApp.onNotification` needs the custom-method overload (a
-    // parser plus a handler) rather than the typed-literal one `registerPermissionHandlers` uses. The
-    // method name is vendor-specific, so this handler simply never fires on a connection to any other
-    // agent — there is no need to gate the registration on `agentInfo`, which in any case is not yet
-    // known this early (`initialize` has not happened).
-    app.onNotification('_claude/sdkMessage', (params) => (params ?? {}), (ctx) => {
-        const raw = claudeActivityRaw(ctx.params);
-        if (raw)
-            activitySink?.(raw);
-    });
-    options.configure?.(app);
+    // This adapter process's generation: the scope `permission.ts`'s `permissionRequestId` derives card ids in (a sign-in's
+    // connection registers the permission handlers).
+    const generation = randomUUID();
+    options.configure?.(app, { generation });
     const connection = app.connect(stream);
     const timeoutMs = options.initializeTimeoutMs ?? DEFAULT_INITIALIZE_TIMEOUT_MS;
     let timeoutHandle;
@@ -702,60 +409,7 @@ export async function connectAgent(spec, env, agentEnv, options = {}) {
     let initResponse;
     try {
         initResponse = await Promise.race([
-            connection.agent.request('initialize', {
-                protocolVersion: PROTOCOL_VERSION,
-                // Three things are declared here, and they are not interchangeable — see
-                // `draftSubagents.ts` for the tier each one sits in.
-                //
-                // 1. `subagents: {}` is the **canonical** draft field from ACP RFD #1992. Both official
-                //    adapters gate native subagent sessions on it, and both answer with
-                //    `agentCapabilities.sessionCapabilities.subagents` (measured against each).
-                //
-                // 2. The AIR list is sent as well, for two separate reasons. It is the *only* channel for
-                //    `asyncTasks` — nothing canonical exists for background work — and it is the fallback
-                //    for `nativeSubagentSessions`, because a released SDK sitting between us and an agent
-                //    can strip a draft field it has no type for (upstream says so in #1017's compatibility
-                //    note). Declaring both is not belt-and-braces: they cover different failure modes.
-                //
-                // 3. `subagent-transcript: true` stays. It is claude-agent-acp's older vendor key
-                //    (`dist/acp-agent.js:155-158`), and it still governs the **fallback** path taken when
-                //    native subagent sessions are not negotiated — an older adapter, or a stripped
-                //    capability. Without it that path strips every subagent's text and thinking
-                //    (`stripSubagentTextAndThinking`, `:3926`), leaving nothing but tool-call wreckage.
-                //    Adapters that have never heard of any of these keys are required by the spec to
-                //    ignore them.
-                clientCapabilities: asSdkClientCapabilities({
-                    [DRAFT_SUBAGENTS_CAPABILITY]: {},
-                    // `ClientSessionCapabilities.configOptions` (`types.gen.d.ts:4306`), part of the schema
-                    // proper — unlike `subagents` above, this survives the pinned SDK's `zInitializeRequest`
-                    // stripping because it's a known field, not a draft one. `{}` for `boolean` tells the
-                    // agent it may send `type: "boolean"` entries in `SessionConfigOption` and that this
-                    // client will send `session/set_config_option` with a boolean `value`
-                    // (`SessionConfigOptionsCapabilities`, `types.gen.d.ts:4333-4353`); without it an agent
-                    // with a boolean toggle downgrades it to a two-value select.
-                    session: { configOptions: { boolean: {} } },
-                    // `ClientCapabilities.elicitation` (`types.gen.d.ts:4479`) is a known field of the schema
-                    // proper, not a draft one, so it survives `zInitializeRequest` stripping as-is. `{}` for
-                    // `url` (`ElicitationUrlCapabilities`, `:4616`) means the client can put a URL in front of
-                    // the user; this is the precondition for the whole device-code login shape to exist at all
-                    // — Codex's own `getCodexAuthMethods` gates its `chat-gpt-device-code` auth method on
-                    // `clientCapabilities?.elicitation?.url != null`. Without declaring it, Codex never offers
-                    // that method and `elicitation/create` with `mode: 'url'` never arrives to answer (see
-                    // `permission.ts`'s `handleCreateElicitation`).
-                    //
-                    // `form` (`ElicitationFormCapabilities`, `types.gen.d.ts:4455`) is what keeps Claude's
-                    // AskUserQuestion alive: without it the adapter puts the tool in `disallowedTools`
-                    // (`claude-agent-acp/dist/acp-agent.js:5959`), so the model never has it at all — the
-                    // symptom is prose questions, not an unrendered card. This is the trigger for the whole
-                    // elicitation-standardization plan: everything through Task 17 built the machinery to
-                    // answer `elicitation/create` once it arrives; this line is what makes it arrive at all.
-                    elicitation: { url: {}, form: {} },
-                    _meta: {
-                        'subagent-transcript': true,
-                        ...airCapabilityMeta(AIR_NATIVE_SUBAGENT_SESSIONS_CAPABILITY, AIR_ASYNC_TASKS_CAPABILITY),
-                    },
-                }),
-            }),
+            connection.agent.request('initialize', initializeRequestParams()),
             lifecycle.failure,
             timeout,
         ]);
@@ -776,130 +430,39 @@ export async function connectAgent(spec, env, agentEnv, options = {}) {
     }
     // Global Constraint 1 is v1-only; the schema calls for disconnecting when the agent didn't
     // accept the version this client sent.
-    if (initResponse.protocolVersion !== PROTOCOL_VERSION) {
+    const reading = parseInitializeResult(initResponse);
+    if (!reading.protocolSupported) {
         const error = new UnsupportedProtocolVersionError(`Agent '${spec.command}' negotiated protocol version ${initResponse.protocolVersion}, ` +
             `but this client only supports version ${PROTOCOL_VERSION}.`);
         connection.close(error);
         child.kill();
         throw error;
     }
-    const sessionCapabilities = initResponse.agentCapabilities?.sessionCapabilities;
-    diagnostics = { ...diagnostics, profile: parseQoderProfile(initResponse._meta?.qoderProfile) };
-    const capabilities = {
-        // Capability markers are empty objects (`{ _meta? }`); supplying `{}` means "supported", and
-        // omitting the field (or explicit `null`) means "not supported". A truthiness check reads `{}`
-        // correctly by accident but reads `null`/`undefined` correctly too, which hides the real bug:
-        // this must stay an explicit `!= null`, never `Boolean(...)` or a bare truthy test.
-        list: sessionCapabilities?.list != null,
-        delete: sessionCapabilities?.delete != null,
-        resume: sessionCapabilities?.resume != null,
-        loadSession: initResponse.agentCapabilities?.loadSession === true,
-        logout: initResponse.agentCapabilities?.auth?.logout != null,
-        /**
-         * ACP `PromptCapabilities.image` (`types.gen.d.ts:1601`): "Agent supports
-         * [`ContentBlock::Image`]". Every field of that type is optional, so an agent that says
-         * nothing supports text only -- `=== true` rather than `!== false`.
-         *
-         * Verified against codex-acp 1.7.0, which declares `{embeddedContext: true, image: true}`.
-         * `audio` is deliberately not read: no agent we target declares it, and an unread capability
-         * is a field nobody can act on.
-         */
-        promptImage: initResponse.agentCapabilities?.promptCapabilities?.image === true,
-        mcpHttp: initResponse.agentCapabilities?.mcpCapabilities?.http === true,
-    };
-    // Honour the advertised capability, not what the agent happens to route: some adapters (e.g.
-    // codex-acp routing `session/fork`) implement more than they declare in `agentCapabilities`.
-    // Reading `capabilities` above off `initResponse` — never probing the agent for what it accepts
-    // — is what keeps that distinction intact.
-    const advertisedAuthMethods = initResponse.authMethods ?? [];
-    const authMethods = advertisedAuthMethods
-        .map(toAuthMethodSnapshot)
-        .filter((method) => method !== null);
-    const terminalLogins = new Map();
-    for (const method of advertisedAuthMethods) {
-        const spec = terminalLoginSpecOf(method);
-        if (spec && typeof method.id === 'string')
-            terminalLogins.set(method.id, spec);
-    }
-    if (authMethods.length !== advertisedAuthMethods.length) {
+    // Capabilities, auth methods and steering are read in `initializeResponse.ts`, the one reading the
+    // deterministic processor shares — see that file for the rules.
+    const { capabilities, authMethods, droppedAuthMethods } = reading;
+    const terminalLogins = new Map(reading.terminalLogins);
+    if (droppedAuthMethods > 0) {
         // Named and counted rather than dropped in silence: the user loses a sign-in method they can
         // see advertised in the agent's own docs, and the only honest answer to "why" is which agent
         // sent what. `agentInfo.name` first because most agents launch through `npx`/`uvx` and
         // `spec.command` would then name the launcher, which identifies none of the ~40 registry
         // entries. See `toAuthMethodSnapshot` for what accepting these costs instead.
         console.warn(`[acp] agent '${initResponse.agentInfo?.name ?? spec.command}' advertised ` +
-            `${advertisedAuthMethods.length - authMethods.length} auth method(s) without the required ` +
+            `${droppedAuthMethods} auth method(s) without the required ` +
             'id/name; ignoring them');
     }
     return {
-        get runtimeDiagnostics() { return diagnostics; },
-        providerTaskAdapterSelected: options.providerTaskAdapterSelected === true,
-        publishCallbacks(snapshot) {
-            if (snapshot.rootSessionId !== ownSessionId)
-                return;
-            diagnostics = { ...diagnostics, revision: diagnostics.revision + 1, callbacks: snapshot };
-            for (const listener of diagnosticListeners)
-                listener(diagnostics);
-        },
-        onRuntimeDiagnostics(cb) { diagnosticListeners.add(cb); },
-        onProviderTaskEvent(cb) { providerTaskListeners.add(cb); },
         capabilities,
         authMethods,
         terminalLogins,
-        supportsSteering: steeringAdvertised(initResponse._meta),
-        steeringTimings: steeringTimings(initResponse._meta),
-        agentInfo: initResponse.agentInfo ?? undefined,
+        supportsAccountLimits: reading.supportsAccountLimits,
+        supportsSteering: reading.supportsSteering,
+        steeringTimings: reading.steeringTimings,
+        agentInfo: reading.agentInfo,
         connection,
-        redactStderrSecret: (secret) => stderrTail.redactSecret(secret),
-        agentProcessAlive: () => child.exitCode === null && child.signalCode === null,
-        captureSessionUpdates(sink) {
-            if (updateCapture)
-                throw new Error('A session replay is already active on this connection');
-            updateCapture = sink;
-            return () => { if (updateCapture === sink)
-                updateCapture = null; };
-        },
-        bindDraftUpdates(sessionId, sink) {
-            ownSessionId = sessionId;
-            draftSink = sink;
-            const current = diagnostics.profile;
-            if (current?.rootSessionId && current.rootSessionId !== sessionId) {
-                diagnostics = { ...diagnostics, profile: { ...current, rootSessionId: undefined,
-                        runtimeGeneration: undefined, rootConfirmed: false, initialized: false, observerHealthy: false } };
-            }
-            const pending = pendingProfiles.get(sessionId);
-            pendingProfiles.clear();
-            if (pending)
-                applyProfile(sessionId, pending.revision, pending.profile);
-            // p3-fix7 N9: replay what arrived before this moment. Our own session's updates go to the sink as `pre-bind`
-            // (they are ours, not a child's); anything else, or anything older than the window, is dropped with the
-            // warning it always had.
-            const now = Date.now();
-            for (const { update, at } of preBind.splice(0)) {
-                if (update.sessionId === sessionId && now - at <= PRE_BIND_MAX_AGE_MS) {
-                    sink(update.reason === 'foreign-session' ? { ...update, reason: 'pre-bind' } : update);
-                }
-                else {
-                    warnDroppedPreBind(update, 'no session is bound to this connection yet');
-                }
-            }
-        },
-        bindActivity(sink) {
-            activitySink = sink;
-        },
-        markSessionKnown(sessionId) {
-            knownSessionIds.add(sessionId);
-            return () => knownSessionIds.delete(sessionId);
-        },
         // Child first, streams second — see `closeAgentTransport` for why that order is the fix and not
         // an incidental detail.
         close: () => closeAgentTransport(child, connection),
     };
 }
-/** p3-fix7 N9: how many updates, and for how long, a connection keeps before its session is bound. */
-const PRE_BIND_MAX_UPDATES = 32;
-const PRE_BIND_MAX_AGE_MS = 5_000;
-/** Says so once per update rather than dropping in silence; it should stay rare, and if it stops being rare it is worth seeing. */
-function warnDroppedPreBind(update, why) {
-    console.warn(`[acp] dropped a ${update.reason} session/update for '${update.sessionId}': ${why}`);
-}