@platless/axom-cli 0.5.9 → 0.6.52

package/dist/workstation/acp/processor/control.js

@@ -1,42 +1,13 @@
-/**
- * The open session and its controls, as notes and their responses (Task 17b): `session/new|load|resume`,
- * `historyEnd`, `session/set_config_option`/`set_mode`, `_session/steering`, `_session/async_task/stop`,
- * delegation's non-secret fields and the runtime `launch` (spec 2026-10-11 §5.4).
- *
- * ## Opening, and binding from the response
- *
- * `agent_session_open{mode, cwd, sessionId?, mcpServers?, redact?, delegation?}` sends one request —
- * the params `AcpSession.open` (`buildSession`), `replayNativeSession` (`session/load`) and the Qoder
- * resume path build, `_meta` included (`newSessionMetaFor`, decided from the initialize reading). The
- * MCP server list arrives finished: the daemon validated the delegation lease (`buildSessionMcpServers`,
- * which reads the clock) before it wrote the note, and the bearer in it is a `secretRef` token the
- * executor substitutes into stdin only (`redact`, spec §13). The **response** binds the root
- * (`bindRootSession`) and sets the config snapshot — no pre-bind buffer, no window. A failed open is
- * reported (`processor.open_result`) and never retried as `session/new` here.
- *
- * ## Replies
- *
- * `agent_config_option_set` and `agent_steered` are RPC replies: unnumbered frames carrying the
- * server's frame `id` from the note, built as `agentSessions.ts` builds them. A steer's blocks travel
- * like a prompt's (`fill: {blocksRef}`); if the executor lost them, the same `agent_prompt_failed` note
- * fails the steer.
- *
- * ## `steeredIds` (spec §5.5.4)
- *
- * {@link steeredIds}: steers whose line reached the agent and that are unanswered, plus the last
- * {@link STEERED_HISTORY_LIMIT} the agent answered `injected`. A `promptRequired`, a refusal, or a
- * line that never reached the agent is not steered: the server delivers that message the ordinary way.
- */
+/** Open-session binding, configuration, steering and launch notes. A response binds the native root; a failed load never silently creates another session here. The daemon supplies the finished MCP list with secrets replaced by references. */
 import { newSessionMetaFor } from '../activityReporting.js';
 import { flatChoicesOf, modesAlreadyRepresented, modelsAlreadyRepresented, normalizeConfigOptions, SYNTHESIZED_MODES_CONFIG_ID, SYNTHESIZED_MODEL_CONFIG_ID } from '../configOptions.js';
 import { ASYNC_TASK_STOP_METHOD, mapSteerOutcome, STEER_METHOD } from '../steering.js';
 import { emitEvent, isRecord } from './emit.js';
-import { settlementErrorCode } from './jsonrpc.js';
+import { jsonRpcErrorText, settlementErrorCode } from './jsonrpc.js';
 import { sameCause } from './record.js';
-import { onLaunchNote, onRootBound } from './runtime.js';
+import { onLaunchNote } from './runtime.js';
 import { bindRootSession, closeErrorText, connected } from './session.js';
 import { getOwn, putOwn, STEERED_HISTORY_LIMIT, } from './state.js';
-import { closeRepair } from './sideChannel.js';
 import { endHistory } from './updates.js';
 const OPEN_METHODS = { new: 'session/new', load: 'session/load', resume: 'session/resume' };
 export const NOT_INITIALIZED = 'The ACP connection has not finished initialize';
@@ -51,30 +22,12 @@ function request(state, out, method, params, kind, ctx, extras = {}) {
 function isStringArray(value) {
     return Array.isArray(value) && value.every((item) => typeof item === 'string');
 }
-function delegationOf(value) {
-    if (value === undefined)
-        return null;
-    if (!isRecord(value))
-        return undefined;
-    const { expiresAtEpochMs, leaseId, bindingId, instanceId } = value;
-    if (!Number.isSafeInteger(expiresAtEpochMs) || typeof leaseId !== 'string' || leaseId === ''
-        || (bindingId !== undefined && typeof bindingId !== 'string') || (instanceId !== undefined && typeof instanceId !== 'string')
-        || (bindingId !== undefined) !== (instanceId !== undefined))
-        return undefined;
-    return {
-        expiresAtEpochMs: expiresAtEpochMs, leaseId,
-        ...(bindingId !== undefined ? { bindingId, instanceId: instanceId, renewalRevision: 0 } : {}),
-    };
-}
 // ---- open ---------------------------------------------------------------------------------------
-/** `agent_session_open{mode, cwd, sessionId?, mcpServers?, redact?, delegation?}`. */
 export function onOpenNote(state, note, out) {
     const { mode, cwd, sessionId, mcpServers, redact } = note;
-    const delegation = delegationOf(note.delegation);
     if ((mode !== 'new' && mode !== 'load' && mode !== 'resume') || typeof cwd !== 'string' || cwd === ''
         || (mode === 'new' ? sessionId !== undefined : typeof sessionId !== 'string' || sessionId === '')
-        || (mcpServers !== undefined && !Array.isArray(mcpServers)) || (redact !== undefined && !isStringArray(redact))
-        || delegation === undefined) {
+        || (mcpServers !== undefined && !Array.isArray(mcpServers)) || (redact !== undefined && !isStringArray(redact))) {
         state.diagnostics.droppedNotes += 1;
         return;
     }
@@ -92,7 +45,7 @@ export function onOpenNote(state, note, out) {
         : mode === 'load'
             ? { sessionId, cwd, mcpServers: servers, ...(meta ? { _meta: meta } : {}) }
             : { sessionId, cwd, mcpServers: servers };
-    const pending = request(state, out, OPEN_METHODS[mode], params, 'open', { mode, ...(sessionId !== undefined ? { sessionId } : {}), ...(delegation ? { delegation } : {}) }, redact !== undefined && redact.length > 0 ? { redact } : {});
+    const pending = request(state, out, OPEN_METHODS[mode], params, 'open', { mode, ...(sessionId !== undefined ? { sessionId } : {}) }, redact !== undefined && redact.length > 0 ? { redact } : {});
     state.open = { status: 'pending', requestId: pending.id, mode };
     if (mode === 'load')
         state.history = { rootSessionId: sessionId, scopes: {}, messages: [], droppedCount: 0 };
@@ -105,11 +58,10 @@ export function settleOpen(state, entry, settlement, out) {
     const { mode } = ctx;
     if (settlement.outcome !== 'result') {
         const code = settlementErrorCode(settlement);
-        const error = settlement.outcome === 'error' ? settlement.error.message : closeErrorText(state);
+        const error = settlement.outcome === 'error' ? jsonRpcErrorText(settlement.error) : closeErrorText(state);
         state.open = { status: 'failed', mode, error, ...(code !== undefined ? { code } : {}) };
         endHistory(state, out, false);
         // A failed open closes the attached session, and its repair with it (`AcpSession.close`).
-        closeRepair(state);
         out.unjournaled({ t: 'processor.open_result', ok: false, mode, error, ...(code !== undefined ? { code } : {}) });
         return;
     }
@@ -117,10 +69,8 @@ export function settleOpen(state, entry, settlement, out) {
     const nativeSessionId = mode === 'new' ? (typeof result.sessionId === 'string' ? result.sessionId : '') : ctx.sessionId;
     if (nativeSessionId.length > 0) {
         bindRootSession(state, nativeSessionId);
-        onRootBound(state, out, nativeSessionId);
     }
     state.configOptions = normalizeConfigOptions(result.configOptions, result.modes, result.models);
-    state.delegation = ctx.delegation ?? null;
     state.open = { status: 'open', mode };
     out.unjournaled({
         t: 'processor.open_result', ok: true, mode,
@@ -280,7 +230,7 @@ export function steeredIds(state) {
     const inFlight = Object.entries(state.steers).filter(([, steer]) => steer.sent).map(([id]) => id);
     return [...state.steered, ...inFlight];
 }
-// ---- background tasks, delegation, launch -------------------------------------------------------
+// ---- background tasks, launch -------------------------------------------------------
 /** `agent_async_task_stop{asyncTaskId}` — `asyncTaskStopRequest`; its answer is diagnostics only. */
 export function onAsyncTaskStopNote(state, note, out) {
     const { asyncTaskId } = note;
@@ -290,29 +240,6 @@ export function onAsyncTaskStopNote(state, note, out) {
     }
     request(state, out, ASYNC_TASK_STOP_METHOD, { sessionId: state.rootSessionId, asyncTaskId }, 'rpc', undefined);
 }
-/**
- * `agent_delegation_renewed{expiresAtEpochMs, renewalRevision}` — a renewal the daemon accepted
- * (`agent_delegation_renew`'s checks read the clock, so the decision is the daemon's; the note is
- * its record).
- */
-export function onDelegationRenewedNote(state, note) {
-    const { expiresAtEpochMs, renewalRevision } = note;
-    const delegation = state.delegation;
-    if (!delegation || delegation.bindingId === undefined || !Number.isSafeInteger(expiresAtEpochMs) || !Number.isSafeInteger(renewalRevision)) {
-        state.diagnostics.droppedNotes += 1;
-        return;
-    }
-    delegation.expiresAtEpochMs = expiresAtEpochMs;
-    delegation.renewalRevision = renewalRevision;
-}
-/** `agent_delegation_refresh_pending{}` — a refreshed lease waits for the session to go idle. */
-export function onDelegationRefreshPendingNote(state) {
-    if (!state.delegation) {
-        state.diagnostics.droppedNotes += 1;
-        return;
-    }
-    state.delegation.refreshPending = true;
-}
 /** `agent_launch{launch}` (see `runtime.ts`). */
 export function onLaunch(state, note) {
     if (!onLaunchNote(state, note.launch))

package/dist/workstation/acp/processor/jsonrpc.js

@@ -132,6 +132,14 @@ export function settlementOf(response) {
     const { code, message, data } = response.error;
     return { outcome: 'error', error: { code, message, data } };
 }
+/**
+ * The text an agent's error is shown as. The ACP SDK's `RequestError.internalError(details)` puts the
+ * real cause only in `data.details` behind a generic "Internal error", so a string detail is kept.
+ */
+export function jsonRpcErrorText(error) {
+    const details = isRecord(error.data) && typeof error.data.details === 'string' ? error.data.details.trim().slice(0, 2000) : '';
+    return details && !error.message.includes(details) ? `${error.message}: ${details}` : error.message;
+}
 /** `jsonRpcErrorCode(err)` for a settlement: the code an agent answered with, if a frame may carry it. */
 export function settlementErrorCode(settlement) {
     return settlement.outcome === 'error' ? jsonRpcErrorCodeOf(settlement.error.code) : undefined;

package/dist/workstation/acp/processor/runtime.js

@@ -1,25 +1,7 @@
-/**
- * The two level signals (spec §5.4: "电平类帧从状态现算"): the agent's self-reported activity
- * (`agent_session_state`) and the runtime diagnostics (`agent_runtime_profile`). Neither is numbered
- * or journaled (analysis B §5); both are folded into state from the log, so after a restart they are
- * recomputed by replay and re-sent with `agent_opened` ({@link activityRaw}, {@link runtimeDiagnostics}).
- *
- * - **Activity** — `connectAgent`'s `_claude/sdkMessage` handler (`claudeActivityRaw`) and the mapper's
- *   `codexActivityRaw` on the root session's `session_info_update`, as `AcpSession.reportActivity`
- *   joins them. Both sinks are bound only once the session is open, so earlier pushes are dropped,
- *   as today.
- * - **Diagnostics** — `generation` is the keeper's `spawnId` (analysis B B2: no `randomUUID`), and
- *   `revision` is a fold: +1 on process exit and on every applied Qoder profile (the `connectAgent`
- *   closure, `acpClient.ts`). `launch` arrives in an `agent_launch` note the daemon writes after the
- *   spawn (analysis B D5: computed once, at spawn). Task 17c: the permission callback snapshot
- *   (`callbacks`, {@link callbackSnapshot}) — published, and the revision bumped, on every change to the
- *   session's pending/settled permission cards, as `AcpSession.publishCallbacks` does for every agent.
- */
+const connectionGeneration = (spawnId) => `session:${spawnId}`;
 import { claudeActivityRaw } from '../activityReporting.js';
-import { parseQoderProfile, sameProfileIdentity } from '../../qoderAdapter/profile.js';
-import { connectionGenerationOf } from '../../qoderAdapter/callbackContext.js';
 import { isRecord } from './emit.js';
-import { getOwn, initialRuntime, PENDING_PROFILE_LIMIT, putOwn } from './state.js';
+import { initialRuntime } from './state.js';
 function opened(state) {
     return state.open.status === 'open';
 }
@@ -60,7 +42,7 @@ export function callbackSnapshot(state) {
     if (rootSessionId === null || spawnId === undefined)
         return undefined;
     return {
-        rootSessionId, connectionGeneration: connectionGenerationOf(spawnId), complete,
+        rootSessionId, connectionGeneration: connectionGeneration(spawnId), complete,
         pending: complete ? Object.values(state.permissions).map((card) => ({
             requestId: card.requestId, originNativeSessionId: card.origin, rpcRequestId: card.rpcRequestId,
         })) : [],
@@ -70,11 +52,11 @@ export function callbackSnapshot(state) {
 /** The diagnostics as `agent_runtime_profile`/`agent_opened.runtimeDiagnostics` carry them, or `undefined` before a spawn and its `agent_launch` note. */
 export function runtimeDiagnostics(state) {
     const spawnId = currentSpawnId(state);
-    const { revision, available, launch, profile } = state.runtime;
+    const { revision, available, launch } = state.runtime;
     if (spawnId === undefined || launch === undefined)
         return undefined;
     const callbacks = callbackSnapshot(state);
-    return { generation: spawnId, revision, available, launch, ...(profile !== undefined ? { profile } : {}),
+    return { generation: spawnId, revision, available, launch,
         ...(callbacks !== undefined ? { callbacks } : {}) };
 }
 /**
@@ -113,69 +95,11 @@ export function onLaunchNote(state, launch) {
     state.runtime.launch = { source: source, executable: executable.slice(0, 4096), platform, architecture, transport };
     return true;
 }
-/** The `initialize` result's `_meta.qoderProfile` (`connectAgent`, right after the handshake). */
-export function onInitialized(state, result) {
-    const meta = isRecord(result) && isRecord(result._meta) ? result._meta : undefined;
-    const profile = parseQoderProfile(meta?.qoderProfile);
-    if (profile)
-        state.runtime.profile = profile;
-    else
-        delete state.runtime.profile;
-}
 /** The child exited: unavailable, profile no longer observed (`child.once('exit')` in `connectAgent`). */
 export function onProcessExit(state, out) {
     const runtime = state.runtime;
     runtime.revision += 1;
     runtime.available = false;
-    if (runtime.profile)
-        runtime.profile = { ...runtime.profile, observerHealthy: false, rootConfirmed: false };
-    changed(state, out);
-}
-function applyProfile(state, out, sessionId, revision, profile) {
-    const runtime = state.runtime;
-    const previous = runtime.profile;
-    if (!previous || !runtime.available || sessionId !== state.rootSessionId || revision <= runtime.adapterRevision
-        || !sameProfileIdentity(previous, profile) || profile.rootSessionId !== state.rootSessionId
-        || (previous.runtimeGeneration !== undefined && profile.runtimeGeneration !== previous.runtimeGeneration)
-        || (profile.rootConfirmed === true && !profile.runtimeGeneration))
-        return;
-    runtime.adapterRevision = revision;
-    runtime.revision += 1;
-    runtime.profile = profile;
     changed(state, out);
 }
-/** `_axom/qoder/profile{sessionId, revision, profile}` — the `connectAgent` handler, over state. */
-export function onProfileNotification(state, out, params) {
-    if (!isRecord(params))
-        return;
-    const profile = parseQoderProfile(params.profile);
-    const { sessionId, revision } = params;
-    if (!state.runtime.profile || !profile || typeof sessionId !== 'string' || profile.rootSessionId !== sessionId
-        || !Number.isSafeInteger(revision) || revision <= 0 || !sameProfileIdentity(state.runtime.profile, profile))
-        return;
-    if (state.rootSessionId !== null) {
-        applyProfile(state, out, sessionId, revision, profile);
-        return;
-    }
-    // ACP may notify before its new/load reply: bounded candidates, evidence only once the reply binds.
-    const pending = state.runtime.pendingProfiles;
-    const previous = getOwn(pending, sessionId);
-    if (previous && (revision <= previous.revision || profile.runtimeGeneration !== previous.profile.runtimeGeneration))
-        return;
-    if (!previous && Object.keys(pending).length >= PENDING_PROFILE_LIMIT)
-        return;
-    putOwn(pending, sessionId, { revision: revision, profile });
-}
 /** The root just bound (`bindDraftUpdates`' diagnostics half): drop a profile for another root, apply a pending one. */
-export function onRootBound(state, out, sessionId) {
-    const runtime = state.runtime;
-    const current = runtime.profile;
-    if (current?.rootSessionId && current.rootSessionId !== sessionId) {
-        const { rootSessionId: _root, runtimeGeneration: _generation, ...rest } = current;
-        runtime.profile = { ...rest, rootConfirmed: false, initialized: false, observerHealthy: false };
-    }
-    const pending = getOwn(runtime.pendingProfiles, sessionId);
-    runtime.pendingProfiles = {};
-    if (pending)
-        applyProfile(state, out, sessionId, pending.revision, pending.profile);
-}

package/dist/workstation/acp/processor/session.js

@@ -1,67 +1,16 @@
-/**
- * The session layer of the ACP processor (Task 17a): turns, interrupt, permission and elicitation
- * cards, and the permission-origin graph — `AcpSession` + `permission.ts` + the turn half of
- * `agentSessions.ts`, re-expressed as a synchronous fold over the raw log (spec 2026-10-11 §5.4).
- *
- * ## Turns
- *
- * - An `agent_prompt` note asks for a turn. Admission (`TaskRegistry.tryAdmitTurn`, a daemon-wide
- *   decision) arrives **in** the note (`admitted: false`), so a refusal lands on the note's offset and
- *   replays identically; so do the processor's own refusals (no connection, an overlapping exact
- *   turn). Those are the three daemon-initiated `turn_done`s of `agentSessions.ts`'s `agent_prompt`
- *   branch, with the same two frame shapes (see {@link refuseTurn} / {@link finishTurn}).
- * - An admitted prompt becomes one `session/prompt` command. The note carries no blocks — only a
- *   `blocksRef` the executor resolves (`DownCommand.fill`), so the blocks appear once in the log, in
- *   that `down` record (§5.4). `platformTurnId` rides in the command's annotation and is **read back
- *   from the `down` record** when the processor folds it: that record is what started the turn on the
- *   agent.
- * - A turn ends exactly on the record that settles its request — the agent's response line, a
- *   `proc exit`, or an `agent_prompt_failed` note (the executor could not write the line). There is no
- *   `settleUpdates` heuristic: log order is the truth (analysis B A4). One consequence, recorded
- *   rather than hidden: an update the agent writes **after** its `session/prompt` response belongs to
- *   whatever follows, not to the finished turn (analysis B §1.5).
- * - Turns are matched to their response by request id, not FIFO: two overlapping prompts the agent
- *   answers out of order keep their own results (`AcpSession.inFlightTurns` documents the swap the
- *   FIFO rule had).
- *
- * ## Cards
- *
- * `session/request_permission` and `'form'` `elicitation/create` follow `permission.ts` step for step
- * (the same builders and `validateWireEvent`), with ids derived from the log: a permission card is
- * `perm:<spawnId>:<JSON agent id>` ({@link permissionRequestId}, shared with the live path), an
- * elicitation card keeps the agent's id. A card the user has not answered stays in state with the
- * JSON-RPC id it came on, so after a restore it is still pending under the same id
- * ({@link pendingRequestIds}, spec §5.5.3/4) and the answer is written back on the original id.
- *
- * ## Task 17b
- *
- * `session/update` mapping and `agent_message` synthesis live in `updates.ts` (a turn's end flushes
- * the streaming message before its own frame, and a turn's start closes a message that began
- * outside any turn); the open session, config, steering and delegation in `control.ts`.
- *
- * ## Task 17c: callbacks and the adapter boundaries
- *
- * Every change to the pending/settled permission cards publishes the callback snapshot
- * (`runtime.ts` `publishCallbacks`), at the points `AcpSession` does: a registration (accepted, or
- * refused for its fields/capacity/a reused id — which also makes the snapshot incomplete), a
- * settlement (`answered` by a note, `canceled` by the agent or for want of a callback context), a
- * drain (interrupt, an interrupted turn, the connection closing — incomplete from then on). A Qoder
- * SDK adapter's root card carries its `callbackContext` (`qoderAdapter/callbackContext.ts`, the
- * function `AcpSession.emitEvent` uses), computed from that snapshot and the runtime profile — log
- * data only; without one the card is settled `canceled` and answered `cancelled`, as today. Cards are
- * emitted through the same boundaries as any other event (`updates.ts` `emitSessionEvent`).
- */
+/** Session turns, permission and elicitation cards, and callback snapshots over checkpointed state. Root and child permission origins are verified before a card is emitted; callback generations derive from the process spawn ID. */
 import { buildElicitationRequestedEvent, buildPermissionRequestedEvent, elicitationFieldKeys, isBlank, permissionRequestId, } from '../permission.js';
 import { validateWireEvent } from '../validate.js';
-import { isSdkCallbackCard, permissionCallbackContext } from '../../qoderAdapter/callbackContext.js';
 import { isRecord, nextSeq } from './emit.js';
-import { inboundKey, settlementErrorCode } from './jsonrpc.js';
+import { inboundKey, jsonRpcErrorText, settlementErrorCode } from './jsonrpc.js';
 import { sameCause } from './record.js';
-import { callbackSnapshot, publishCallbacks, resetRuntime } from './runtime.js';
-import { getOwn, initialBoundaries, initialCallbacks, initialMessage, PENDING_PERMISSION_LIMIT, SETTLED_PERMISSION_LIMIT, } from './state.js';
-import { emitSessionEvent, endForegroundTurn, endHistory, flushMessage, flushOutOfTurnMessage } from './updates.js';
+import { publishCallbacks, resetRuntime } from './runtime.js';
+import { getOwn, initialCallbacks, initialMessage, PENDING_PERMISSION_LIMIT, SETTLED_PERMISSION_LIMIT, } from './state.js';
+import { emitSessionEvent, endHistory, flushMessage, flushOutOfTurnMessage } from './updates.js';
 /** `agentSessions.ts`'s admission refusal text, verbatim. */
 export const ADMISSION_REFUSED = 'Workstation is not accepting new work';
+/** The agent answered `session/prompt` with `stopReason: 'refusal'` and no words of its own. */
+export const PROMPT_REFUSED = 'The agent refused this prompt.';
 /** `AcpSession.prompt`'s overlap refusal text, verbatim. */
 export const OVERLAPPING_TURN = 'An exact platform turn is still running; overlapping prompts are unavailable';
 /** What the SDK rejects pending requests with when the adapter's stdout ends (`jsonrpc.js` `close()`). */
@@ -95,13 +44,14 @@ export function resetForSpawn(state) {
     state.rootSessionId = null;
     state.open = { status: 'idle' };
     state.configOptions = null;
-    state.delegation = null;
     state.history = null;
     state.mapperScopes = {};
     state.message = initialMessage();
     state.steers = {};
     state.steered = [];
     state.asyncTasks = {};
+    state.draftSubagents = { children: {}, overflow: false };
+    state.closedReplayScopes = {};
     resetRuntime(state);
     state.turns = [];
     state.exactExecutionUnconfirmed = false;
@@ -111,7 +61,6 @@ export function resetForSpawn(state) {
     state.elicitations = {};
     state.settledPermissions = [];
     state.callbacks = initialCallbacks();
-    state.boundaries = initialBoundaries();
     state.permissionOrigins = {};
     state.permissionParents = {};
     state.unresolvedPermissionOrigins = {};
@@ -147,7 +96,8 @@ const STOP_REASONS = {
     end_turn: 'end_turn',
     max_tokens: 'max_tokens',
     max_turn_requests: 'max_turns',
-    refusal: 'refusal',
+    // No `refusal`: a refusal result settles 'failed' (see `settlePrompt`), and a completed turn
+    // never carries it.
 };
 /**
  * End turn `index` — `AcpSession.finishTurn` + `agentSessions.ts`'s `onAgentTurnDone` frame, in one.
@@ -158,8 +108,6 @@ function finishTurn(state, out, index, status, finish) {
     const [turn] = state.turns.splice(index, 1);
     if (!turn)
         return;
-    if (state.turns.length === 0)
-        endForegroundTurn(state);
     // Before the turn's own frame, on every path that ends a turn (`flushMessageCompleted`).
     flushMessage(state, out);
     const resolved = turn.interrupted ? 'interrupted' : status;
@@ -243,6 +191,28 @@ export function onDown(state, record) {
     else
         delete turn.platformTurnId;
 }
+/**
+ * The measured `_meta` key a refusal *result* carries its would-be error response under: a JSON
+ * string of the JSON-RPC error the agent chose not to send (`codebuddy-code` 2.171.0; shape-read,
+ * same rule as `acpClient`'s `_codebuddy.ai/authUrl`).
+ */
+const REFUSAL_ERROR_META_KEY = 'codebuddy.ai/errorMessage';
+function refusalErrorDetail(result) {
+    if (!isRecord(result) || !isRecord(result._meta))
+        return undefined;
+    const raw = result._meta[REFUSAL_ERROR_META_KEY];
+    if (typeof raw !== 'string')
+        return undefined;
+    try {
+        const parsed = JSON.parse(raw);
+        if (!isRecord(parsed) || typeof parsed.message !== 'string')
+            return undefined;
+        return { ...(typeof parsed.code === 'number' ? { code: parsed.code } : {}), message: parsed.message };
+    }
+    catch {
+        return undefined;
+    }
+}
 /** A `session/prompt` request settled: its turn ends on this record. */
 export function settlePrompt(state, entry, settlement, out) {
     const index = state.turns.findIndex((turn) => turn.requestId === entry.id);
@@ -252,14 +222,32 @@ export function settlePrompt(state, entry, settlement, out) {
         case 'result': {
             const stopReason = isRecord(settlement.result) ? settlement.result.stopReason : undefined;
             // ACP's own `cancelled` forces `interrupted` even when no interrupt was sent (a backstop).
-            finishTurn(state, out, index, stopReason === 'cancelled' ? 'interrupted' : 'completed', { stopReason, executionEnded: true });
+            if (stopReason === 'cancelled') {
+                finishTurn(state, out, index, 'interrupted', { stopReason, executionEnded: true });
+                return;
+            }
+            // Measured (codebuddy-code 2.171.0): an agent that needs credentials answers `session/prompt`
+            // with a *result* `stopReason: 'refusal'` — zero content, no JSON-RPC error — which used to
+            // settle 'completed' and render as nothing at all. A refusal result settles exactly like the
+            // agent's own refusal below ('failed' + `agentRefused`), with the agent's detail read out of
+            // the measured `_meta` key; a code-less detail stays an ordinary failure card server-side,
+            // while `-32000` beside the observed auth methods is what turns it into the sign-in card.
+            if (stopReason === 'refusal') {
+                const detail = refusalErrorDetail(settlement.result);
+                finishTurn(state, out, index, 'failed', {
+                    agentRefused: true, executionEnded: true,
+                    error: detail?.message ?? PROMPT_REFUSED, ...(detail?.code !== undefined ? { errorCode: detail.code } : {}),
+                });
+                return;
+            }
+            finishTurn(state, out, index, 'completed', { stopReason, executionEnded: true });
             return;
         }
         case 'error': {
             // The one exit where the agent itself answered (`TurnResult.agentRefused`).
             const errorCode = settlementErrorCode(settlement);
             finishTurn(state, out, index, 'failed', {
-                error: settlement.error.message, agentRefused: true, errorCode, executionEnded: errorCode !== undefined,
+                error: jsonRpcErrorText(settlement.error), agentRefused: true, errorCode, executionEnded: errorCode !== undefined,
             });
             return;
         }
@@ -405,23 +393,7 @@ export function onPermissionRequest(state, id, params, out) {
     const rpcKey = inboundKey(id);
     state.permissions[requestId] = { requestId, rpcKey, origin, rpcRequestId, optionIds: options.map((option) => option.optionId) };
     publishCallbacks(state, out);
-    let payload = event.payload;
-    const toolCall = payload.toolCall;
-    if (isSdkCallbackCard(toolCall)) {
-        // `AcpSession.emitEvent`: an SDK callback card is shown only with the evidence the server needs
-        // to route its answer back (`callbackContext`); without it, it is cancelled.
-        const spawnId = state.process.spawn.spawnId;
-        const callbackContext = root === null ? undefined : permissionCallbackContext({
-            rootSessionId: root, origin, requestId, toolCall, pendingRpcRequestId: rpcRequestId,
-            diagnostics: { generation: spawnId, available: state.runtime.available, profile: state.runtime.profile, callbacks: callbackSnapshot(state) },
-        });
-        if (!callbackContext) {
-            settlePermission(state, out, requestId, PERMISSION_CANCELLED, 'canceled');
-            state.diagnostics.refusedRequests += 1;
-            return undefined;
-        }
-        payload = { ...payload, callbackContext };
-    }
+    const payload = event.payload;
     emitSessionEvent(state, out, { eventName: event.eventName, payload, acpSessionId: origin });
     return requestId;
 }

package/dist/workstation/acp/processor/state.js

@@ -1,22 +1,16 @@
-/**
- * 2: Task 17b's open-session layer. 3: Task 17c (`boundaries`, `callbacks`, settled permissions with
- * their reason, `rpcRequestId` on a pending permission). 4: the repair's `polledProcesses`. An older
- * checkpoint is refused, never half-read.
- */
-export const PROCESSOR_STATE_SCHEMA = 4;
+/** State history: 2 — open-session layer; 3 — callback snapshots and adapter fold data;
+ * 4 — polled process state; 5 — adapter fold data and retired optional state removed.
+ * Schemas before 4 remain unreadable; schema 4 is upgraded by checkpoint.ts. */
+export const PROCESSOR_STATE_SCHEMA = 5;
 export const SETTLED_HISTORY_LIMIT = 16;
 export const SETTLED_PERMISSION_LIMIT = 64;
 export const PENDING_PERMISSION_LIMIT = 64;
 export const UNRESOLVED_ORIGIN_LIMIT = 1024;
-export const PENDING_PROFILE_LIMIT = 8;
 export const STEERED_HISTORY_LIMIT = 64;
 /** Unfinished async tasks tracked per connection, all sessions together. */
 export const ASYNC_TASK_LIMIT = 1024;
 export function initialRuntime() {
-    return { revision: 0, available: true, adapterRevision: 0, pendingProfiles: {} };
-}
-export function initialBoundaries() {
-    return { foreground: { pending: {} }, subwork: { calls: {}, count: 0 }, repair: null, sideChunk: null };
+    return { revision: 0, available: true };
 }
 export function initialCallbacks() {
     return { complete: true, rootSessionId: null };
@@ -48,16 +42,16 @@ export function initialState() {
         unresolvedPermissionOrigins: {},
         open: { status: 'idle' },
         configOptions: null,
-        delegation: null,
         history: null,
+        closedReplayScopes: {},
         mapperScopes: {},
         message: initialMessage(),
         steers: {},
         steered: [],
+        draftSubagents: { children: {}, overflow: false },
         asyncTasks: {},
         activity: null,
         runtime: initialRuntime(),
-        boundaries: initialBoundaries(),
         diagnostics: {
             orphanResponses: 0, protocolErrors: 0, ignoredLines: 0, unknownNotes: 0, droppedNotes: 0, refusedRequests: 0,
             rejectedRelations: 0, droppedUpdates: 0, invalidEvents: 0, untrackedAsyncTasks: 0, settled: [],

package/dist/workstation/acp/processor/step.js

@@ -1,15 +1,14 @@
+/** The ACP processor folds records synchronously in log order. No clock, randomness, environment, file I/O or timers: identical records and state produce byte-identical outputs. Commands execute before frames are recorded; IDs derive from log offsets. A failed fold poisons the state; unknown notes are counted for forward compatibility. */
 import { accountLimitsSchema, ACCOUNT_LIMITS_READ, ACCOUNT_LIMITS_UPDATED } from '../../protocol/accountLimits.js';
 import { initializeRequestParams, parseInitializeResult } from '../initializeResponse.js';
 import { STEER_METHOD } from '../steering.js';
 import { checkpointOf } from './checkpoint.js';
-import { failUnsentSteer, onAsyncTaskStopNote, onDelegationRefreshPendingNote, onDelegationRenewedNote, onHistoryEndNote, onInstallOutcomeNote, onOutputGapNote, onLaunch, onOpenNote, onSetConfigOptionNote, onSteerDown, onSteerNote, settleConfig, settleOpen, settleSteer, } from './control.js';
+import { failUnsentSteer, onAsyncTaskStopNote, onHistoryEndNote, onInstallOutcomeNote, onOutputGapNote, onLaunch, onOpenNote, onSetConfigOptionNote, onSteerDown, onSteerNote, settleConfig, settleOpen, settleSteer, } from './control.js';
 import { CANCEL_REQUEST_METHOD, classifyLine, inboundKey, invalidParams, invalidRequest, isJsonRpcId, methodNotFound, outboundKey, parseError, settlementErrorCode, settlementOf, } from './jsonrpc.js';
 import { RecordOutput } from './output.js';
 import { INBOUND_REQUEST_SCHEMAS } from './sdkSchemas.js';
 import { BATCH_CLOSE_REASON, connected, dropCards, finishAllTurns, forgetCard, onAnswerNote, onDown, onElicitationAnswerNote, onElicitationRequest, onInboundCancelled, onInterruptNote, onPermissionRequest, onPromptFailedNote, onPromptNote, onUndeliverableNote, resetForSpawn, settlePrompt, } from './session.js';
-import { onClaudeSdkMessage, onInitialized, onProcessExit, onProfileNotification } from './runtime.js';
-import { closeRepair, onRepairNote, onSideNote } from './sideChannel.js';
-import { REPAIR_NOTE, SIDE_NOTE } from '../../qoderAdapter/backgroundTerminalFold.js';
+import { onClaudeSdkMessage, onProcessExit } from './runtime.js';
 import { endHistory, onSessionUpdate } from './updates.js';
 import { initialState, SETTLED_HISTORY_LIMIT, } from './state.js';
 /** Serialized size above which a note is dropped (`droppedNotes`). */
@@ -73,7 +72,6 @@ function closeConnection(state, reason, out) {
     state.outbound = {};
     state.inbound = {};
     dropCards(state, out);
-    closeRepair(state);
     state.closed = reason;
     for (const entry of pending)
         settle(state, entry, { outcome: 'closed', reason }, out);
@@ -151,8 +149,6 @@ function onUp(state, line, o, t, out) {
                 onSessionUpdate(state, message.params, out, t);
             else if (message.method === '_claude/sdkMessage')
                 onClaudeSdkMessage(state, out, message.params, t);
-            else if (message.method === '_axom/qoder/profile')
-                onProfileNotification(state, out, message.params);
             return;
         case 'request':
             onInboundRequest(state, message.id, message.method, message.params, o, out);
@@ -265,7 +261,6 @@ function settleInitialize(state, entry, settlement, out) {
     }
     const { protocolSupported: _supported, ...facts } = reading;
     state.initialize = { status: 'ready', facts: JSON.parse(JSON.stringify(facts)) };
-    onInitialized(state, settlement.result);
     const capability = settlement.result.agentCapabilities?._meta?.['axom/accountRateLimits'];
     if (capability && typeof capability === 'object' && capability.read === true) {
         const quotaCapability = capability;
@@ -339,12 +334,6 @@ function onNote(state, note, out) {
         case 'agent_async_task_stop':
             onAsyncTaskStopNote(state, note, out);
             return;
-        case 'agent_delegation_renewed':
-            onDelegationRenewedNote(state, note);
-            return;
-        case 'agent_delegation_refresh_pending':
-            onDelegationRefreshPendingNote(state);
-            return;
         case 'agent_launch':
             onLaunch(state, note);
             return;
@@ -354,12 +343,6 @@ function onNote(state, note, out) {
         case 'agent_output_gap':
             onOutputGapNote(state, note, out);
             return;
-        case REPAIR_NOTE:
-            onRepairNote(state, note);
-            return;
-        case SIDE_NOTE:
-            onSideNote(state, note, out);
-            return;
         case 'agent_account_read': {
             if (!connected(state)) {
                 out.unjournaled({ t: 'agent_account_read_result', id: note.id, ok: false, error: 'Agent is offline' });