@platless/axom-cli 0.5.9 → 0.6.52

package/dist/workstation/acp/processorSession.js

@@ -1,96 +1,6 @@
-/**
- * One live agent session driven by the deterministic ACP processor over a transport (Task 19, spec 2026-10-11 §5.3/§5.4/§5.7):
- * the daemon side of keeper-acp — or of the local fallback, which is the same session mechanism in this process.
- *
- * ## The record loop
- *
- * The transport's raw stream (`subscribeRaw`) is the only input. For each record, in order:
- * `step(record)` → every command it produced is executed through the transport (`executeDownCommandsVia`: idempotent by cause,
- * refused unless its spawn runs now, prompt blocks filled from this daemon's memory, `secretRef`s substituted from this daemon's
- * memory) → a prompt whose blocks are gone is failed with an `agent_prompt_failed` note → the record's frames go out.
- * Everything the server or this daemon decides reaches the processor as a note or a write first (`agent_prompt`, `agent_answer`,
- * `agent_interrupt`, …); nothing here changes processor state directly, and nothing here numbers a frame — the processor does —
- * with the one exception the poison contract names (below).
- *
- * ## What leaves
- *
- * Frames the manager sends (`onFrames`), unchanged, with `src`. The ones meant for the daemon itself stay here:
- * `processor.open_result` settles {@link openSession}; `processor.history_event`/`history_end` become the load's backfill
- * (never journaled: a daemon that dies inside the window loads again); an `agent_steered` / `agent_config_option_set` whose
- * request this object made settles that call (one with nobody waiting goes out as a frame).
- *
- * ## Secrets and blocks
- *
- * Prompt and steer blocks are held in memory under a `blocksRef` until their `down` is written; secrets (a delegation bearer)
- * under a `secretRef`, for the life of the session. Notes carry only the refs (spec §13).
- *
- * ## Poison (interface-contracts, "中毒恢复契约")
- *
- * A step that throws poisons the processor. The session is degraded: every turn still open ends with a failed `agent_turn_done`
- * this object numbers itself, after the processor's last seq; the adapter is terminated; `onDegraded` tells the manager, which
- * retires the session so the next `agent_open` starts a new spawn (`session/load`). Never retried from a checkpoint: replay is
- * deterministic and would poison again on the same record. A transport that fails under the loop (keeper gone, raw truncated) is
- * handled the same way: Task 19 has no re-attach (Task 21).
- *
- * ## Qoder side files (17c)
- *
- * When the repair is on, a 1 s timer asks the processor's **current** `sideDemand` — only once the processor has folded every
- * record this object appended — runs `BackgroundSideNotes.poll(demand)` and appends the notes it returns, in order. The reader
- * stops when the demand is `undefined` (no repair any more).
- *
- * ## Outbox, backpressure, checkpoints (Task 20, spec §5.5/§5.6)
- *
- * The manager records every journaled frame in {@link outbox} (the transport's outbox stream) before it sends it; the listener
- * {@link onFrames} registers returns that append, and the loop awaits it before folding the next record — so the outbox holding a
- * frame with `src.o = o` proves record `o`'s commands are in raw, and a checkpoint at `o` never precedes `o`'s frames. Before each
- * record the loop waits for {@link SessionOutbox.room}: a server that does not acknowledge stops the processor, and the backlog
- * stays in the raw log.
- *
- * Checkpoints (`acp.commit{checkpoint, rawThrough}`, raw truncated to the checkpoint): at the end of every turn; within a turn
- * every {@link CHECKPOINT_RAW_BYTES} of folded raw or {@link CHECKPOINT_INTERVAL_MS}; and on a `close('keep')` (graceful exit,
- * detach). Never while `boundaries.sideChunk` holds a half-read Qoder fact or a load's history window is open — deferred to the
- * next record where both are clear. Each carries `processorVersion` (`checkpointOf`).
- *
- * ## A session left under the same key
- *
- * An earlier life of this ref (a swept or degraded session, a previous daemon's, a local outbox) is reused, not released: the new
- * spawn continues the same raw log and outbox. Its unacknowledged frames are read back into {@link outbox} (resent when the server
- * reopens the ref) and the processor numbers after the highest seq the outbox ever held — `max(outbox.maxSeq, committedTail.seq,
- * resumeFromSeq)` (§5.5). An earlier life whose adapter still runs is never stopped here: the daemon adopts it at start
- * ({@link ProcessorSession.adopt}), and keeper-acp refuses a second spawn into a running session.
- *
- * ## Adoption (Task 21, spec §5.5)
- *
- * A keeper-acp session whose adapter outlived the daemon (restart, upgrade, crash) is adopted, not stopped:
- * `acp.attach` → the head checkpoint is restored → raw `(checkpoint.offset, replayEnd]` is replayed **updating state only** —
- * `replayEnd = max(outbox last.src.o, committedTail.src.o)`, everything whose frames were recorded — and the frames the replay
- * produces are compared byte for byte with the outbox entries that survive (daemon-numbered ones, `src.i ≥ DAEMON_FRAME_INDEX`,
- * skipped; differences are only counted when the checkpoint came from this very processor version) → the seq continues after
- * `max(replayed seq, outbox.maxSeq, committedTail.seq)` → the unacknowledged outbox entries are resent on the server's reopen →
- * the records after `replayEnd` are folded live (their commands are idempotent by cause). A session whose open never completed, or
- * that cannot be rebuilt (no readable checkpoint and no spawn record left), is refused ({@link AdoptionRefusedError}); the caller
- * stops its adapter and keeps its outbox. A checkpoint is cut right after the spawn and when the open completes, so every session
- * has one that says whether it is open.
- *
- * ## Detach (Task 21, spec §5.5.5)
- *
- * {@link detach} ends this daemon's hold on a keeper-hosted session without touching the adapter: the loop stops after the
- * record in hand, a head checkpoint is cut when the state is safe (never mid Qoder chunk or load history — then the next daemon
- * replays), the subscription is dropped. No `session/cancel`, no answer to a pending card, no `turn_done(failed)`: a detaching
- * session never degrades. The next daemon adopts it.
- *
- * ## Keeper connection loss (Task 21)
- *
- * keeper-acp unreachable under the loop (a request lost on a dropped connection, a stream that ended) is not a degradation: the
- * session re-attaches — `acp.attach` (which relaunches the current generation's keeper-acp if it died; an older generation is
- * only reconnected) and the same rebuild as an adoption, in place — with bounded retries. A note whose append failed is looked
- * for in raw before it is appended again. Only a keeper that is gone with the session (not found, or unreachable after the
- * retries) degrades it. When keeper-acp itself restarted, the session it recovered ends with `proc exit{reason:'keeper_lost'}`:
- * that tail is folded (a real `turn_done` in it is delivered) and the session reports its adapter dead.
- */
+/** Daemon-side keeper session: records notes before commands, awaits outbox persistence before advancing, and checkpoints only complete history boundaries. A poisoned processor degrades the session and ends pending turns; it never retries half-updated state. */
 import { PROTOCOL_VERSION, RequestError } from '@agentclientprotocol/sdk';
 import { ACCOUNT_LIMITS_READ_TIMEOUT_MS } from '../protocol/accountLimits.js';
-import { BackgroundSideNotes, nativeTerminalHistoryPath } from '../qoderAdapter/backgroundTerminal.js';
 import { AgentInitializeTimeoutError, AgentSpawnError, UnsupportedProtocolVersionError } from './acpClient.js';
 import { executeDownCommandsVia } from './processor/transport/types.js';
 import { createProcessor, ProcessorPoisonedError, restoreProcessor } from './processor/step.js';
@@ -98,21 +8,18 @@ import { checkpointOf, decodeCheckpoint, encodeCheckpoint, PROCESSOR_VERSION } f
 import { DAEMON_FRAME_INDEX, isOutboxTail, SessionOutbox, transportOutboxStore } from './outbox.js';
 import { initialState } from './processor/state.js';
 import { activityRaw, runtimeDiagnostics } from './processor/runtime.js';
-import { sideDemand } from './processor/sideChannel.js';
-import { unfinishedAsyncTasks } from './processor/updates.js';
+import { unfinishedAsyncTasks, unfinishedDraftSubagentCount } from './processor/updates.js';
 import { pendingRequestIds } from './processor/session.js';
 import { steeredIds } from './processor/control.js';
 import { RawTruncatedError } from './processor/transport/types.js';
-import { REPAIR_NOTE } from '../qoderAdapter/backgroundTerminalFold.js';
 import { AcpKeeperUnavailableError } from '../keepers/acp/client.js';
+import { RegistrationOwnershipError } from '../runtime/ownership.js';
 import { AcpErrorCode } from '../keepers/acp/protocol.js';
 import { KeeperClosedError, KeeperConnectionLostError, KeeperNotConnectedError, KeeperRequestError, KeeperRequestTimeoutError, } from '../keepers/kit/client.js';
 /** What the executor reports when a prompt's blocks are no longer in this daemon's memory (interface-contracts). */
 export const PROMPT_LOST = 'The prompt was lost before it reached the agent';
 /** The error a turn ends with when the session degrades under it (poison, or a transport that failed under the loop). */
 export const SESSION_DEGRADED = 'The agent session failed and was stopped; reopen it to continue';
-/** How often the Qoder side-file reader polls (the live repair's timer). */
-const SIDE_POLL_MS = 1_000;
 /** stderr kept for a startup failure's message (the `err` records the processor ignores). */
 const STDERR_TAIL_BYTES = 8_192;
 /** Within a turn, a checkpoint every this many bytes of folded raw (spec §5.5, §14). */
@@ -210,7 +117,6 @@ export class ProcessorSession {
     openResult;
     historyEnd;
     history = [];
-    side;
     /** The record loop's tail: notes it appends are serialised behind it. */
     chain = Promise.resolve();
     /** The loop is held at a record boundary for a switch ({@link suspend}); `release` lets it go on. */
@@ -252,7 +158,7 @@ export class ProcessorSession {
         }
         catch (error) {
             // keeper-acp unreachable is not a launch failure: the caller falls back to the local transport.
-            if (error instanceof AcpKeeperUnavailableError)
+            if (error instanceof AcpKeeperUnavailableError || error instanceof RegistrationOwnershipError)
                 throw error;
             throw spawnFailure(options.spawn.command, error);
         }
@@ -262,11 +168,12 @@ export class ProcessorSession {
             // resent when the server reopens the ref, and numbering continues after the highest seq the outbox ever held.
             const attached = await transport.attach(sessionKey);
             let leftovers = await readOutboxTail(transport, sessionKey, attached.outbox);
-            if (seed && seed.imports.length > 0) {
+            const imports = (seed?.imports ?? options.imports ?? []).filter((entry) => entry.seq > (attached.outbox?.lastSeq ?? 0));
+            if (imports.length > 0) {
                 // A switch's successor (Task 24): the predecessor's unacknowledged frames land here before anything this session numbers —
                 // the predecessor is released only after this append returned (never the other way round: the frames would be nowhere).
                 const at = Math.max(spawned.o - 1, 0);
-                const entries = seed.imports.map((entry, k) => ({ seq: entry.seq, src: { o: at, i: DAEMON_FRAME_INDEX + k }, frame: { ...entry.frame } }));
+                const entries = imports.map((entry, index) => ({ seq: entry.seq, src: { o: at, i: DAEMON_FRAME_INDEX + index }, frame: { ...entry.frame } }));
                 const { first } = await transport.appendOutbox(sessionKey, entries);
                 leftovers = [...leftovers, ...entries.map((entry, k) => ({ o: first + k, t: Date.now(), ...entry }))];
             }
@@ -552,14 +459,9 @@ export class ProcessorSession {
         if (this.checkpointDue && this.checkpointSafe())
             this.cutCheckpoint();
     }
-    /**
-     * A checkpoint must let a replay continue from it alone: not while a chunked Qoder fact is half-read (`sideChunk`, its first
-     * chunks would be truncated away) nor inside a load's history window (history is never journaled: a daemon that dies in the
-     * window loads again — interface-contracts, T19).
-     */
     checkpointSafe() {
         const state = this.processor.state;
-        return state.offset >= 0 && state.offset <= this.recordedThrough && state.boundaries.sideChunk === null && state.history === null &&
+        return state.offset >= 0 && state.offset <= this.recordedThrough && state.history === null &&
             this.processor.poisoned === undefined;
     }
     /** Snapshot now (a record boundary: the loop is between records) and commit it with raw truncated through it (not a marker's). */
@@ -644,7 +546,7 @@ export class ProcessorSession {
     /** Async tasks / background work the adapter still runs for this session (processor state): a switch would kill them. */
     get liveBackgroundWork() {
         const state = this.processor.state;
-        return unfinishedAsyncTasks(state).length + (sideDemand(state)?.active() ? 1 : 0);
+        return unfinishedAsyncTasks(state).length + unfinishedDraftSubagentCount(state);
     }
     /** The adapter's exit, once it has one: the spawn it ended and why (keeper-acp's `reason`, absent for an exit of its own). */
     get adapterExit() {
@@ -674,6 +576,9 @@ export class ProcessorSession {
                         this.history.push(event);
                     }
                     continue;
+                case 'processor.closed_replay_level':
+                    this.log(`[acp] session ${this.key}: ignored ${String(frame.sessionUpdate)} for ended replay scope ${JSON.stringify(frame.sessionId)}`);
+                    continue;
                 case 'processor.history_end': {
                     const droppedCount = typeof frame.droppedCount === 'number' ? frame.droppedCount : 0;
                     this.historyEnd = { ok: frame.ok === true, droppedCount };
@@ -945,7 +850,6 @@ export class ProcessorSession {
         for (const [, reply] of this.pendingReplies)
             reply({ ok: false, error: reason });
         this.pendingReplies.clear();
-        this.stopSide();
         void this.transport.terminate(this.key).catch(() => null);
         try {
             this.options.onDegrade?.(this.headSeq);
@@ -1010,20 +914,8 @@ export class ProcessorSession {
             ...(request.sessionId !== undefined ? { sessionId: request.sessionId } : {}),
             mcpServers: request.mcpServers,
             ...(request.redact && request.redact.length > 0 ? { redact: [...request.redact] } : {}),
-            ...(request.delegation ? { delegation: request.delegation } : {}),
         };
-        const repair = request.mode === 'load' ? request.repair : undefined;
-        if (repair) {
-            // The repair note must follow the open note before the loop folds the open note (and so writes the `session/load` line
-            // the history answers): the loop is held while both are appended.
-            await this.holdingLoop(async () => {
-                await this.send(note);
-                await this.enableRepair(request.sessionId, request.cwd, repair.historyHome);
-            });
-        }
-        else {
-            await this.send(note);
-        }
+        await this.send(note);
         return this.waitFor(() => this.openResult);
     }
     /** Runs `work` (appends only — never a wait on the loop) with the record loop held, so no record is folded meanwhile. */
@@ -1044,55 +936,6 @@ export class ProcessorSession {
             await this.send({ type: 'historyEnd' });
         return this.waitFor(() => this.historyEnd);
     }
-    /**
-     * Turn the Qoder background terminal repair on (17c): the `qoder_terminal_repair` note, then the side-file reader. Nothing for a
-     * runtime the repair does not certify (no history path).
-     */
-    async enableRepair(nativeSessionId, cwd, historyHome, restoreCalls = false) {
-        const path = nativeTerminalHistoryPath(this.agentInfo, nativeSessionId, cwd, historyHome);
-        if (!path || this.side?.nativeSessionId === nativeSessionId)
-            return;
-        // A load that failed and fell back to `session/new`: the processor closed the load's repair (`settleOpen`); its reader goes
-        // too, and the new session gets its own (the old path closed the attached session and opened a fresh one).
-        this.stopSide();
-        const from = await this.appendNote({ type: REPAIR_NOTE, nativeSessionId, ...(restoreCalls ? { restoreCalls: true } : {}) });
-        const reader = new BackgroundSideNotes({ path, nativeSessionId, cwd, restoreCalls });
-        const timer = setInterval(() => { void this.pollSide(); }, SIDE_POLL_MS);
-        timer.unref();
-        this.side = { reader, timer, from, polling: false, nativeSessionId };
-    }
-    async pollSide() {
-        const side = this.side;
-        if (!side || side.polling || this.degraded !== undefined || this.closing)
-            return;
-        // The demand is the processor's *current* state, so only once it has folded everything this object appended.
-        if (this.processor.state.offset < Math.max(side.from, this.appended))
-            return;
-        const demand = sideDemand(this.processor.state);
-        if (!demand) {
-            this.stopSide();
-            return;
-        }
-        side.polling = true;
-        try {
-            const notes = await side.reader.poll(demand);
-            for (const note of notes)
-                await this.appendNote(note);
-        }
-        catch (error) {
-            this.log(`[acp] session ${this.key}: background terminal read failed: ${error instanceof Error ? error.message : String(error)}`);
-        }
-        finally {
-            side.polling = false;
-        }
-    }
-    stopSide() {
-        if (!this.side)
-            return;
-        clearInterval(this.side.timer);
-        this.side.reader.close();
-        this.side = undefined;
-    }
     // ---- AcpAgentSession ----------------------------------------------------------------------------------------------------
     get facts() {
         const initialize = this.processor.state.initialize;
@@ -1108,7 +951,6 @@ export class ProcessorSession {
     get configOptions() { return this.processor.state.configOptions ?? []; }
     get runtimeDiagnostics() { return runtimeDiagnostics(this.processor.state); }
     get activityRaw() { return activityRaw(this.processor.state); }
-    get delegation() { return this.processor.state.delegation ?? null; }
     get nativeSessionId() {
         const root = this.processor.state.rootSessionId;
         return root !== null && root.length > 0 ? root : null;
@@ -1177,6 +1019,13 @@ export class ProcessorSession {
     async steer(blocks, priority, id) {
         if (this.pendingReplies.has(`agent_steered:${id}`))
             throw new Error(`A steer with id '${id}' is already in flight`);
+        // A full producing window stops the raw loop, including control notes. Appending here
+        // would leave a steer that can execute long after the server's RPC timed out. Refuse
+        // before recording anything: promptRequired proves this attempt cannot inject later.
+        if (!this.outbox.hasRoom()) {
+            this.log(`[acp] session ${this.key}: steer ${id} not admitted while awaiting event acknowledgements`);
+            return 'promptRequired';
+        }
         const answered = this.reply('agent_steered', id);
         await this.send({ type: 'agent_steer', id, blocksRef: this.holdBlocks(blocks), ...(priority !== undefined ? { priority } : {}) })
             .catch((error) => { this.pendingReplies.delete(`agent_steered:${id}`); throw error; });
@@ -1283,7 +1132,6 @@ export class ProcessorSession {
             this.resume();
             this.detached = true;
             this.unlisten();
-            this.stopSide();
             for (const waiter of [...this.waiters])
                 waiter.reject(new Error('The agent session was handed to the next daemon'));
             // A loop waiting for room stops (it sees `closing`); the head checkpoint is cut at the record boundary after it.
@@ -1307,7 +1155,6 @@ export class ProcessorSession {
         this.closing ??= (async () => {
             this.resume(); // a held loop drains (every fold sees `closing`)
             this.unlisten();
-            this.stopSide();
             for (const waiter of [...this.waiters])
                 waiter.reject(new Error('The agent session is closed'));
             for (const [, reply] of this.pendingReplies)

package/dist/workstation/acp/registry/catalog.js

@@ -44,10 +44,10 @@
  *
  * 这里写下的来源**整个替换** registry 的 `version` 与 `distribution`，id 与展示名仍是 registry 的，
  * 于是已有的配置条目、roster、安装、启动、更新都不用知道发生过替换（见 {@link withCatalogOverrides}）。
- * 本文件的 distribution 用于长期策略；Qoder 等临时的钉版本放在
+ * 本文件的 distribution 用于长期策略；临时的版本覆盖才放在
  * axom-patch/cli/runtime.json，按 registry 版本挑选（`when_registry_version` / `until_registry_version`，
  * 见 `patchAssets.ts`），registry 一到就自己让位。两者与上面的 `install` 是同一条安全边界：只能是
- * 随 CLI 发布、钉死版本、由真机验证过的可信配置。
+ * 随 CLI 发布、钉死版本、由补丁哈希和回归验证过的可信配置。
  *
  * ## `supplement` 与 `supersedes`：registry 缺的条目、registry 不肯撤的条目
  *
@@ -86,13 +86,13 @@ export const AXOM_AGENT_CATALOG = [
         defaultName: 'claude-agent',
         defaultLabel: 'Claude Agent',
         detect: { commands: ['claude'] },
-        // 钉版本的唯一理由是补丁：claude-account-limits 的配方只核验过 0.90.0（runtime.json 的
+        // 钉版本的唯一理由是补丁：账号配额与 replay lifecycle 配方只核验过 0.97.0（runtime.json 的
         // package_patches）。不钉的话 registry 一发新版，Install/Update 就装上一个配方不覆盖的包，
         // 账号配额扩展静默消失——2026-10-14 的 antigravity（registry 已到 1.4.0、native extension
         // 只认 1.3.0）就是这个缺口的实例。钉住后 scan 的 Update 比对（installedVersion vs 本清单的
         // version）只在落后于钉住版本时才成立，上游新版要等 nightly 核验移植配方后再 bump。
-        // 周期核验步骤见 axom-patch/cli/nightly-task.md。
-        distribution: { version: '0.90.0', npx: { package: '@agentclientprotocol/claude-agent-acp@0.90.0' } },
+        // 周期核验步骤见 axom-patch/DAILY_UPGRADE_CHECK.md。
+        distribution: { version: '0.97.0', npx: { package: '@agentclientprotocol/claude-agent-acp@0.97.0' } },
         launchEnv: {
             // Axom 拉起的 Claude Code——会话进程、配额读的 /usage、auth status 探针、terminalLogin 代跑的
             // `--cli auth login`——一律使用独立的 OAuth 凭据槽，与用户终端 `claude login` 写进默认槽
@@ -116,16 +116,18 @@ export const AXOM_AGENT_CATALOG = [
         defaultName: 'codex',
         defaultLabel: 'Codex',
         detect: { commands: ['codex'] },
-        // 与 claude-acp 同一条规则：codex-account-limits 只核验过 2.2.2，钉住直到配方随新版本移植。
-        distribution: { version: '2.2.2', npx: { package: '@agentclientprotocol/codex-acp@2.2.2' } },
+        // 与 claude-acp 同一条规则：codex-account-limits 只核验过 2.3.0（2026-10-27 nightly；2.3.0 的
+        // authStatus 锚点在两处 capabilities 里重复，已加长到 initialize 独有后缀消歧），钉住直到配方随新版本移植。
+        distribution: { version: '2.3.0', npx: { package: '@agentclientprotocol/codex-acp@2.3.0' } },
     },
     {
         registryAgent: 'qoder',
         defaultName: 'qoder',
         defaultLabel: 'Qoder',
         detect: { commands: ['qodercli'] },
-        // The temporary registry catch-up pin lives in axom-patch/cli/runtime.json so a newer
-        // upstream release can take over without another Axom release.
+        // Native ACP is the sole Qoder entry. The exact --acp argv is pinned here; the package
+        // patch layer verifies the 1.1.75 package and its qoder-native-acp recipe hashes.
+        distribution: { version: '1.1.75', npx: { package: '@qoder-ai/qodercli@1.1.75', args: ['--acp'] } },
     },
     // `gemini` was here and is deliberately gone. `@google/gemini-cli --acp` now refuses `session/new`
     // outright ("This client is no longer supported for Gemini Code Assist for individuals … migrate
@@ -144,7 +146,7 @@ export const AXOM_AGENT_CATALOG = [
         // 其余字段照 registry#458 的条目写。
         supplement: {
             name: 'Kimi Code',
-            version: '2.1.1',
+            version: '2.3.3',
             description: "Moonshot AI's next-gen coding agent",
             repository: 'https://github.com/MoonshotAI/kimi-code',
             website: 'https://moonshotai.github.io/kimi-code/',
@@ -152,13 +154,13 @@ export const AXOM_AGENT_CATALOG = [
             license: 'MIT',
             icon: 'https://cdn.agentclientprotocol.com/registry/v1/latest/kimi.svg',
             distribution: {
-                binary: kimiCodeBinary('2.1.1', {
-                    'darwin-aarch64': ['darwin-arm64', '8c3bad99571b16abd113ab5d511a98a36b852c0d5493991842a67b8c2bc4ecd0'],
-                    'darwin-x86_64': ['darwin-x64', 'f6dc0289112c24119d070f9203d44bcd53580e380819db25b58be65643b75bd4'],
-                    'linux-aarch64': ['linux-arm64', '5c68d74b139b47fb3457f3805a159cdfa942a6a98a159ab158a1baf93b024bbd'],
-                    'linux-x86_64': ['linux-x64', 'b66cc3787bc9dfa6a06761305dc8878f98e7a24f79fa4494c00714229a1486e8'],
-                    'windows-aarch64': ['win32-arm64', '72bb17fef0d165a5f61905ede7e57c552791905d605a778967d054fe702873d4'],
-                    'windows-x86_64': ['win32-x64', '87756a53a9bb0915842d884eaf43f69a06b2e404bcbb05d41c519c12d4b410cb'],
+                binary: kimiCodeBinary('2.3.3', {
+                    'darwin-aarch64': ['darwin-arm64', 'd097b397db785e9bde07e9d169870e315dd9a0d9d6542727ea4a50e4a630a280'],
+                    'darwin-x86_64': ['darwin-x64', '9c42127a60488add5cfb8ca60d35f4df9d881552eb3b05268c3a691f7b3c5406'],
+                    'linux-aarch64': ['linux-arm64', '4b12a13d64dbf9cde631e4c74965ccd1b72bfd93892b30d8272b4bc6448fe45f'],
+                    'linux-x86_64': ['linux-x64', '0e4a766d38e5202a2413b8517bd4b3a2c00486327a6e231c98f99a0bbf7422e1'],
+                    'windows-aarch64': ['win32-arm64', '655a4b0e57090fa414aec6c69e4801c12a28e7ca75dd627bfc64340b600079fd'],
+                    'windows-x86_64': ['win32-x64', '08bd5fcb7b0d6b3bcd70ef42e58b73c884149905b0044544a941ad795f587c4a'],
                 }),
             },
         },
@@ -173,21 +175,20 @@ export const AXOM_AGENT_CATALOG = [
         registryAgent: 'command-code',
         defaultName: 'command-code',
         defaultLabel: 'Command Code',
-        // registry 没有它。1.66.0 还没有 `acp` 子命令，1.74.3 起有、真机试跑通过；2026-10-14 nightly
-        // 升到 1.82.1：`acp` 子命令仍在（四个 bin 不变），commandcode-account-limits 配方已随
-        // generate.py 移植（handler map 换了名字 u/dn→m/hn，锚点已跟）。包里有 `cmd`、`cmdc`、
+        // registry 没有它。1.66.0 还没有 `acp` 子命令，1.74.3 起有、真机试跑通过；2026-10-27 已到 1.88.0（10-25）：`acp` 子命令仍在（四个 bin 不变），commandcode-account-limits 配方已随
+        // generate.py 移植（handler map 枚举每版改名 u/dn→m/hn→m/vn→m/bn，锚点已跟）。包里有 `cmd`、`cmdc`、
         // `commandcode`、`command-code` 四个 bin，npx 挑与包名同名的那个。没有 ACP 登录方法，只有一句
         // 说明（终端里跑 `cmd login`）；凭据在 `~/.commandcode`，与用户自己装的那份共用。npm 上的许可证
         // 写的是 UNLICENSED（专有）。
         supplement: {
             name: 'Command Code',
-            version: '1.82.1',
+            version: '1.88.0',
             description: 'Command Code, coding agent that continuously learns your coding taste.',
             website: 'https://commandcode.ai',
             authors: ['Command Code'],
             license: 'UNLICENSED',
             icon: 'https://commandcode.ai/favicon.ico',
-            distribution: { npx: { package: 'command-code@1.82.1', args: ['acp'] } },
+            distribution: { npx: { package: 'command-code@1.88.0', args: ['acp'] } },
         },
         detect: { commands: ['command-code', 'commandcode'] },
     },
@@ -203,19 +204,19 @@ export const AXOM_AGENT_CATALOG = [
         // 2026-10-13 真机验证（ZCode 桌面 3.14.5 + 0.69.3）：initialize → session/new → 首轮 prompt 通过，
         // 日志 "serving the coding-plan API key (config.json or store)"。0.63/0.64 那轮不兼容（模型只剩
         // 无授权的 builtin:bigmodel-coding-plan\GLM-5.3，首轮 CONFIGURATION_ERROR "Model creation failed"，
-        // 2026-10-06 两台机器复现）自 0.68.1 起修复。2026-10-14 nightly 升到 0.69.4：三份配方的目标文件
-        // 与 0.69.3 字节一致（配方 versions 同时覆盖两版），subagent 探针在 0.69.4 补丁副本上通过、
-        // pristine 证实上游仍未原生发出 subagent/async 变体。
+        // 2026-10-06 两台机器复现）自 0.68.1 起修复。2026-10-29 升到 0.80.0：迁移配额、模型兜底、
+        // subagent/async 补丁；env 账号包装复用上游 bridge-accounts（不写桌面配置）。
+        // ZCODE_PROVIDER + ZCODE_API_KEY 支持独立个人 Coding Plan，无需复用桌面 OAuth。
         supplement: {
             name: 'ZCode',
-            version: '0.69.4',
+            version: '0.80.0',
             description: 'Community bridge that drives the real ZCode app-server (GLM) over ACP.',
             repository: 'https://github.com/william0wang/zcode-acp',
             website: 'https://github.com/william0wang/zcode-acp',
             authors: ['William Wang'],
             license: 'Apache-2.0',
             icon: 'https://raw.githubusercontent.com/william0wang/zcode-acp/main/registry/zcode-acp/icon.svg',
-            distribution: { npx: { package: 'zcode-acp-server@0.69.4' } },
+            distribution: { npx: { package: 'zcode-acp-server@0.80.0' } },
         },
         prerequisite: {
             label: 'ZCode',
@@ -238,7 +239,7 @@ export const AXOM_AGENT_CATALOG = [
         recommended: true,
         // pi-steering 与 pi-subagent-subwork 两份配方只核验过 0.0.34。registry 今天也在 0.0.34，
         // 但那是巧合而不是保护：上游一发 0.0.35，未钉版本的 Install 就会装上一个 steering/子代理
-        // 归一都不生效的包。钉住后版本只随配方移植走（nightly-task.md）。
+        // 归一都不生效的包。钉住后版本只随配方移植走（DAILY_UPGRADE_CHECK.md）。
         distribution: { version: '0.0.34', npx: { package: 'pi-acp@0.0.34' } },
         prerequisite: {
             label: 'Pi',
@@ -287,27 +288,52 @@ export const AXOM_AGENT_CATALOG = [
     // registry 自己的条目（binary .par），我们只补名字与本机检测；`agy` 是 Antigravity 装好后放进 PATH 的命令。
     // distribution 钉住：antigravity 的账号配额靠 native extension（runtime.json
     // native_extensions，account-limits/antigravity-proxy.mjs），proxy 是 stdio sidecar，只在核验过的
-    // 版本上声明能力。2026-10-14 nightly 升到 1.4.0：真实 1.4.0 .par 经 proxy 拉起，initialize 透传无损、
-    // `axom/accountRateLimits` 能力注入成功（本地实测；配额 READ 属于用户凭据路径，留给真机冒烟）。
-    // 归档 URL 抄自 registry 的 1.4.0 条目；registry 本身不给这个条目发 sha256，这里同样不发，校验语义与
-    // registry 直装一致（binaryInstall：无 sha256 即不校验）。上游发新版时按 nightly-task.md 核验后同升。
+    // 版本上声明能力。2026-10-25 nightly 升到 1.4.3：真实 1.4.3 .par 经 proxy 拉起，initialize 透传无损、
+    // `axom/accountRateLimits`（v5）能力注入成功（本地实测；配额 READ 属于用户凭据路径，留给真机冒烟）。
+    // 归档 URL 抄自 registry 的 1.4.3 条目（六平台 HEAD 200）；registry 本身不给这个条目发 sha256，这里同样不发，校验语义与
+    // registry 直装一致（binaryInstall：无 sha256 即不校验）。上游发新版时按 axom-patch/DAILY_UPGRADE_CHECK.md 核验后同升。
     {
         registryAgent: 'antigravity-acp',
         defaultName: 'google-antigravity',
         defaultLabel: 'Google Antigravity',
         detect: { commands: ['agy'] },
         distribution: {
-            version: '1.4.0',
+            version: '1.4.3',
             binary: {
-                'darwin-aarch64': { archive: 'https://dl.google.com/agy-extensions/releases/macos/agy-acp-server-1.4.0-darwin-arm64.zip', cmd: './agy_acp_server.par' },
-                'darwin-x86_64': { archive: 'https://dl.google.com/agy-extensions/releases/macos/agy-acp-server-1.4.0-darwin-x86_64.zip', cmd: './agy_acp_server.par' },
-                'linux-x86_64': { archive: 'https://dl.google.com/agy-extensions/releases/linux/agy-acp-server-1.4.0-linux-x86_64.zip', cmd: './agy_acp_server.par', args: ['--uid='] },
-                'linux-aarch64': { archive: 'https://dl.google.com/agy-extensions/releases/linux/agy-acp-server-1.4.0-linux-arm64.zip', cmd: './agy_acp_server.par', args: ['--uid='] },
-                'windows-x86_64': { archive: 'https://dl.google.com/agy-extensions/releases/windows/agy-acp-server-1.4.0-windows-x86_64.zip', cmd: './agy_acp_server.exe' },
-                'windows-aarch64': { archive: 'https://dl.google.com/agy-extensions/releases/windows/agy-acp-server-1.4.0-windows-arm64.zip', cmd: './agy_acp_server.exe' },
+                'darwin-aarch64': { archive: 'https://dl.google.com/agy-extensions/releases/macos/agy-acp-server-1.4.3-darwin-arm64.zip', cmd: './agy_acp_server.par' },
+                'darwin-x86_64': { archive: 'https://dl.google.com/agy-extensions/releases/macos/agy-acp-server-1.4.3-darwin-x86_64.zip', cmd: './agy_acp_server.par' },
+                'linux-x86_64': { archive: 'https://dl.google.com/agy-extensions/releases/linux/agy-acp-server-1.4.3-linux-x86_64.zip', cmd: './agy_acp_server.par', args: ['--uid='] },
+                'linux-aarch64': { archive: 'https://dl.google.com/agy-extensions/releases/linux/agy-acp-server-1.4.3-linux-arm64.zip', cmd: './agy_acp_server.par', args: ['--uid='] },
+                'windows-x86_64': { archive: 'https://dl.google.com/agy-extensions/releases/windows/agy-acp-server-1.4.3-windows-x86_64.zip', cmd: './agy_acp_server.exe' },
+                'windows-aarch64': { archive: 'https://dl.google.com/agy-extensions/releases/windows/agy-acp-server-1.4.3-windows-arm64.zip', cmd: './agy_acp_server.exe' },
             },
         },
     },
+    // CodeBuddy（腾讯的编码 agent，npm 是它唯一的官方 CLI 分发）。registry 已收录 `codebuddy-code`
+    // （npx @tencent-ai/codebuddy-code --acp，包自带 @agentclientprotocol/sdk 依赖），于是这是最普通
+    // 的「registry 条目 + 本清单认证」形态：不 supplement（registry 有这个 id）、不 pathLaunch（有可装
+    // 产物，Axom 装自己托管的那份）、不钉版本（没有依赖版本的配方）、不配 launchEnv——本条就是
+    // CodeBuddy 本身，登录落在它的 copilot.tencent.com。
+    //
+    // 2026-10-19/21 真机实测（npm 2.169.0/2.171.0，ACP capture）：`--acp` 起 initialize 通过，能力
+    // image/embeddedContext/mcp http+sse/loadSession/delegateTools/multitask；authMethods 声明
+    // iOA、external（Google/Github）、internal（WeChat）、selfhosted；登录链接经 `_codebuddy.ai/authUrl`
+    // 扩展通知推送（acpClient 的处理器）。凭据在 CODEBUDDY_CONFIG_DIR（默认 ~/.codebuddy）的
+    // credentials.json，登录走 ACP 认证流（一次性，与终端 CLI 共用）。
+    //
+    // 同一引擎另有 App 产品形态（App 内 product.json 声明 productName/endpoint/计费，经其自设的
+    // ACC_PRODUCT_CONFIG_PATH 环境变量切换）——那是**另一个产品、另一套账号**，npm 包名、registry
+    // id、CLI bin 都不带它的名字；Axom 只策展 npm 的 CodeBuddy，不策展那个 App 形态，也不替用户
+    // 预设产品开关（真需要的用户可经 agentEnv 自行覆盖）。
+    //
+    // detect 认 npm 包的两个主 bin（codebuddy 与 cbc；codebuddy-code/codebuddy-lowmem 是同名
+    // 变体，不另列）。
+    {
+        registryAgent: 'codebuddy-code',
+        defaultName: 'codebuddy',
+        defaultLabel: 'CodeBuddy',
+        detect: { commands: ['codebuddy', 'cbc'] },
+    },
 ];
 /**
  * Kimi Code 的六个平台归档：GitHub release `@moonshot-ai/kimi-code@<version>` 下的

package/dist/workstation/acp/registry/launch.js

@@ -1,7 +1,9 @@
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import path from 'node:path';
+import semver from 'semver';
 import { fileURLToPath } from 'node:url';
+import { managedRuntimeFor, verifyManagedRuntime, verifyRecordedManagedRuntime } from '../managedRuntime.js';
 import { nativeExtensionFor } from '../patchAssets.js';
 import { verifyPatchedFiles } from '../managedPatches.js';
 import { AdapterNotInstalledError, inside, labelFor } from '../builds/model.js';
@@ -45,10 +47,23 @@ function expandHomeInEnv(env) {
     return Object.fromEntries(Object.entries(env).map(([key, value]) => [key, value === '~' ? home : value.startsWith('~/') ? path.join(home, value.slice(2)) : value]));
 }
 export async function launchForBuild(build, root, options) {
+    const policy = options.policy ?? managedRuntimeFor(build.agentId);
+    // Only a caller resolving an explicit recorded old binding/rollback may use legacy launch rules.
+    // Removing runtimeReleaseId from the strict target never changes its policy classification.
+    const legacy = options.allowLegacy && !build.runtimeReleaseId && policy && (build.package !== policy.package || (semver.valid(build.version) !== null && semver.lt(build.version, policy.version)));
+    if (policy && !legacy) {
+        const verify = options.allowLegacy && build.runtimeReleaseId ? verifyRecordedManagedRuntime : verifyManagedRuntime;
+        await verify({ ...options, policy, build, storeRoot: root, initialize: false });
+    }
+    // A build recorded under a strict policy this CLI no longer ships launches like any other build:
+    // its runtimeReleaseId is history, and the patched-file check below still applies.
     const dir = inside(root, build.dir);
     const entry = inside(dir, build.launch.entry);
     if (build.kind === 'npm-patched' && build.package && build.patchedFiles) {
-        await verifyPatchedFiles(inside(path.join(dir, 'node_modules'), build.package), build.patchedFiles);
+        if (build.patchedFilesBase !== undefined && build.patchedFilesBase !== 'node_modules')
+            throw new Error('Invalid Axom patched file base');
+        const modules = path.join(dir, 'node_modules');
+        await verifyPatchedFiles(build.patchedFilesBase === 'node_modules' ? modules : inside(modules, build.package), build.patchedFiles);
     }
     if (!existsSync(entry))
         throw new AdapterNotInstalledError(build.agentId, `build ${build.buildId} is missing its executable`);

package/dist/workstation/acp/switching.js

@@ -62,7 +62,6 @@ const PLAIN_BLOCKERS = {
     'a permission or elicitation is unanswered': 'it is waiting for an answer',
     'the agent reports it is active': 'the agent says it is still working',
     'an async task or background terminal is still running': 'it has a background task or terminal still running',
-    'a delegation refresh is pending': 'its delegated access is being renewed',
 };
 /** Why a session may not be switched now (spec §6.3 step 2); empty = strictly idle. */
 export function switchBlockers(input) {
@@ -83,8 +82,6 @@ export function switchBlockers(input) {
         blockers.push('the agent reports it is active');
     if ((session.liveBackgroundWork ?? 0) > 0)
         blockers.push('an async task or background terminal is still running');
-    if (session.delegation?.refreshPending)
-        blockers.push('a delegation refresh is pending');
     const quiet = input.quietMs ?? SWITCH_QUIET_MS;
     const last = Math.max(input.lastActivityAt, session.lastFoldAt ?? 0);
     if (input.now - last < quiet)

package/dist/workstation/acp/test/fakeAgent.js

@@ -113,6 +113,12 @@
 //                                               // with this message instead of succeeding — lets a
 //                                               // test prove a real agent-side rejection surfaces as
 //                                               // a rejected promise
+//     authenticateNotifications?: Array<{method: string, params: unknown}>,
+//                                              // sent as client notifications at the top of the
+//                                              // `authenticate` handler, before anything else —
+//                                              // models an agent that pushes a login URL as an
+//                                              // extension notification (`_codebuddy.ai/authUrl`)
+//                                              // rather than eliciting or printing it
 //     hangOnAuthenticate?: boolean,            // if true, `authenticate` never resolves — the shape
 //                                               // measured on a real agent that opens a browser and
 //                                               // waits for its callback (spec §6.2: antigravity's
@@ -348,6 +354,13 @@ async function main() {
             writeFileSync(config.authenticateSink, JSON.stringify(ctx.params));
         if (config.authenticateRejectsWith)
             throw new Error(config.authenticateRejectsWith);
+        // Extension notifications an agent pushes while answering `authenticate` (measured on the real
+        // CodeBuddy adapter: `_codebuddy.ai/authUrl` with `{authUrl, provider}` — a URL channel that
+        // is neither `elicitation/create` nor stderr). Sent before the reply, so a client that only
+        // listens from the reply onward still misses them, exactly like the real one.
+        for (const { method, params } of config.authenticateNotifications ?? []) {
+            await ctx.client.notify(method, params);
+        }
         if (config.createElicitationDuringAuthenticate) {
             // `requestId` is filled in here rather than in the config: a login elicitation is
             // request-scoped (ACP's `ElicitationRequestScope` — "tied to a specific JSON-RPC request