@quantiya/codevibe-antigravity-plugin 2.0.61 → 2.0.62

package/dist/server.js

@@ -49,7 +49,7 @@ var fs5 = __toESM(require("fs"));
 var os5 = __toESM(require("os"));
 var import_child_process3 = require("child_process");
 var import_util3 = require("util");
-var import_codevibe_core5 = require("@quantiya/codevibe-core");
+var import_codevibe_core6 = require("@quantiya/codevibe-core");
 
 // src/logger.ts
 var import_os = __toESM(require("os"));
@@ -205,23 +205,20 @@ var HttpApi = class {
       this.sendJson(res, 400, { success: false, error: "invalid JSON" });
       return;
     }
-    if (!payload.sessionId || !payload.type || !payload.source || typeof payload.content !== "string") {
-      this.sendJson(res, 400, {
-        success: false,
-        error: "missing required fields: sessionId, type, source, content"
-      });
-      return;
-    }
-    if (!isValidEventType(payload.type) || !isValidEventSource(payload.source)) {
+    if (!isHttpEventPayload(payload)) {
       this.sendJson(res, 400, {
         success: false,
-        error: "invalid type or source enum value"
+        error: "invalid ordinary desktop event payload"
       });
       return;
     }
     try {
-      const { eventId } = await this.handlers.pushEvent(payload);
-      this.sendJson(res, 200, { success: true, data: { eventId } });
+      const result = await this.handlers.pushEvent(payload);
+      if (result.status === "DROPPED") {
+        this.sendJson(res, 503, { success: false, error: "event was not admitted", data: result });
+      } else {
+        this.sendJson(res, result.status === "PENDING" ? 202 : 200, { success: true, data: result });
+      }
     } catch (err) {
       logger.error("pushEvent failed in /event handler", { error: String(err) });
       const code = err?.code;
@@ -229,6 +226,10 @@ var HttpApi = class {
         this.sendJson(res, 404, { success: false, error: "session not found" });
         return;
       }
+      if (code === "INVALID_SYNC_INPUT") {
+        this.sendJson(res, 400, { success: false, error: "unsupported event payload; use its dedicated producer" });
+        return;
+      }
       this.sendJson(res, 500, { success: false, error: "event push failed" });
     }
   }
@@ -263,9 +264,10 @@ function isValidEventType(value) {
   if (typeof value !== "string") return false;
   return Object.values(import_codevibe_core2.EventType).includes(value);
 }
-function isValidEventSource(value) {
-  if (typeof value !== "string") return false;
-  return Object.values(import_codevibe_core2.EventSource).includes(value);
+function isHttpEventPayload(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const row = value;
+  return !Object.keys(row).some((key) => !["sessionId", "type", "source", "content", "metadata"].includes(key)) && typeof row.sessionId === "string" && /^[A-Za-z0-9_-]{1,256}$/.test(row.sessionId) && isValidEventType(row.type) && row.source === import_codevibe_core2.EventSource.DESKTOP && typeof row.content === "string";
 }
 async function readBody(req, maxBytes) {
   return new Promise((resolve2, reject) => {
@@ -346,6 +348,29 @@ function armShutdownWatchdog(exit, onFire, ms = SHUTDOWN_WATCHDOG_MS, durableObl
   return () => clearTimeout(timer);
 }
 
+// src/durable-transcript-reader.ts
+var import_codevibe_core3 = require("@quantiya/codevibe-core");
+function readAdmittedTranscript(options) {
+  const stream = (value) => Object.freeze({ ...value, conversationId: options.conversationId });
+  return (0, import_codevibe_core3.readDesktopSyncFile)({
+    ...options,
+    parse: (line) => {
+      const parsed = JSON.parse(line);
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) && Number.isFinite(parsed.step_index) && typeof parsed.type === "string" ? parsed : null;
+    },
+    admission: {
+      restore: (source, initial) => options.admission.restore(stream(source), initial),
+      skip: (gap, source) => options.admission.skip(gap, stream(source)),
+      admit: (event, source) => options.admission.admit({
+        conversationId: options.conversationId,
+        filePath: source.filePath,
+        byteOffset: source.startOffset,
+        event
+      }, stream(source))
+    }
+  });
+}
+
 // src/transcript-tailer.ts
 var OFFSET_FLUSH_INTERVAL_MS = 3e4;
 var ERROR_LOG_MIN_INTERVAL_MS = 1e4;
@@ -391,6 +416,8 @@ var TranscriptTailer = class extends import_events.EventEmitter {
     super();
     this.isWatching = false;
     this.isShuttingDown = false;
+    this.ownedReads = /* @__PURE__ */ new Set();
+    this.retryTimers = /* @__PURE__ */ new Map();
     /** Transcripts currently followed (stat-polled), keyed by conversation. */
     this.followed = /* @__PURE__ */ new Map();
     /** Conversations released by the follow cap during this lifetime. Their
@@ -448,6 +475,8 @@ var TranscriptTailer = class extends import_events.EventEmitter {
     const defaults = defaultPaths();
     this.brainRoot = options.brainRoot ?? defaults.brainRoot;
     this.offsetFilePath = options.offsetFilePath ?? defaults.offsetFilePath;
+    this.admission = options.admission;
+    if (this.admission && (typeof this.admission.restore !== "function" || typeof this.admission.admit !== "function" || typeof this.admission.skip !== "function")) throw new TypeError("Durable transcript admission requires restore, admit and skip");
   }
   /**
    * Start following transcripts. Loads persisted offsets, prunes orphans,
@@ -461,6 +490,8 @@ var TranscriptTailer = class extends import_events.EventEmitter {
     }
     this.startTime = Date.now();
     this.readGeneration++;
+    for (const timer of this.retryTimers.values()) clearTimeout(timer);
+    this.retryTimers.clear();
     this.loadPersistedOffsets();
     this.pruneOrphanedOffsets();
     if (!fs2.existsSync(this.brainRoot)) {
@@ -542,6 +573,8 @@ var TranscriptTailer = class extends import_events.EventEmitter {
     if (!this.isWatching) return;
     this.isShuttingDown = true;
     this.readGeneration++;
+    for (const timer of this.retryTimers.values()) clearTimeout(timer);
+    this.retryTimers.clear();
     if (this.flushTimer) {
       clearInterval(this.flushTimer);
       this.flushTimer = null;
@@ -584,6 +617,10 @@ var TranscriptTailer = class extends import_events.EventEmitter {
     this.lastErrorSignature = null;
     this.suppressedErrorCount = 0;
   }
+  /** Server shutdown joins reads it admitted before retiring the session. */
+  async waitForReads() {
+    await Promise.allSettled([...this.ownedReads]);
+  }
   /**
    * Best-effort sync flush. Safe to call from a process EXIT trap.
    * (The async stop() above is preferred when a regular shutdown is feasible.)
@@ -1052,9 +1089,19 @@ var TranscriptTailer = class extends import_events.EventEmitter {
         conversationId,
         error: String(error)
       });
+      if (this.admission && this.isWatching && generation === this.readGeneration && !this.retryTimers.has(filePath)) {
+        const timer = setTimeout(() => {
+          this.retryTimers.delete(filePath);
+          if (this.isWatching && generation === this.readGeneration) void this.scheduleReadNewLines(filePath, conversationId);
+        }, 5e3);
+        timer.unref();
+        this.retryTimers.set(filePath, timer);
+      }
     });
     this.activeReads.set(filePath, read);
+    this.ownedReads.add(read);
     void read.finally(() => {
+      this.ownedReads.delete(read);
       if (this.activeReads.get(filePath) === read) {
         this.activeReads.delete(filePath);
         this.pendingReads.delete(filePath);
@@ -1076,6 +1123,23 @@ var TranscriptTailer = class extends import_events.EventEmitter {
       logger.warn("No offset entry \u2014 skipping read", { filePath });
       return;
     }
+    if (this.admission) {
+      const result = await readAdmittedTranscript({
+        filePath,
+        conversationId,
+        initialOffset: entry.byteOffset,
+        admission: this.admission,
+        isCurrent: () => generation === this.readGeneration && !this.isShuttingDown
+      });
+      if (result) {
+        if (generation !== this.readGeneration) return;
+        entry.byteOffset = result.position.byteOffset;
+        entry.carryover = "";
+        entry.lastKnownSize = result.size;
+        entry.lastModifiedMs = result.mtimeMs;
+        return;
+      }
+    }
     let stat;
     try {
       stat = fs2.statSync(filePath);
@@ -3152,7 +3216,7 @@ var PromptResponder = class {
       };
     }
   }
-  async sendFreeFormWhenNoApprovalActive(text) {
+  async sendFreeFormWhenNoApprovalActive(text, beforeType) {
     const target = this.resolveTmuxTarget();
     if (!target) return { ok: false, reason: "no-tmux-target" };
     if (!this.paneObserver) {
@@ -3172,9 +3236,20 @@ var PromptResponder = class {
       }
       return null;
     };
+    let preparationFailed = false;
     try {
       const beforeText = await chooserIsAbsent();
       if (beforeText) return beforeText;
+      if (beforeType) {
+        try {
+          await beforeType();
+        } catch (error) {
+          preparationFailed = true;
+          throw error;
+        }
+        const afterPreparation = await chooserIsAbsent();
+        if (afterPreparation) return afterPreparation;
+      }
       await this.typeLiteral(target, text);
       await delay(ENTER_DELAY_MS);
       const beforeEnter = await chooserIsAbsent();
@@ -3182,6 +3257,7 @@ var PromptResponder = class {
       await this.sendKey(target, "Enter");
       return { ok: true };
     } catch (error) {
+      if (preparationFailed) throw error;
       return {
         ok: false,
         reason: "tmux-failed",
@@ -3314,6 +3390,16 @@ var MobilePromptDeduper = class {
     this.replaceEntries(sessionId, entries);
     return match;
   }
+  /** Inspect without spending the token before durable native admission. */
+  peekIfDuplicate(sessionId, echo) {
+    const normalized = this.normalize(echo);
+    if (!normalized) return null;
+    for (const entry of this.validEntries(sessionId)) {
+      const matchType = this.matchType(entry.normalized, normalized);
+      if (matchType) return { matchType, originalLength: entry.normalized.length, echoLength: normalized.length };
+    }
+    return null;
+  }
   // ─── Internals ──────────────────────────────────────────────────────────
   sweep() {
     const cutoff = this.now() - this.expiryMs;
@@ -3470,7 +3556,7 @@ function fireDaemonBeacon(name, params) {
 
 // src/event-mapper.ts
 var import_uuid2 = require("uuid");
-var import_codevibe_core3 = require("@quantiya/codevibe-core");
+var import_codevibe_core4 = require("@quantiya/codevibe-core");
 var CONTENT_MAX = 150 * 1024;
 var TOOL_OUTPUT_MAX = 50 * 1024;
 var TOOL_DIFF_MAX = 100 * 1024;
@@ -3478,10 +3564,10 @@ function mapTranscriptEvent(emit, sessionId, notBeforeMs) {
   const { event } = emit;
   const base = {
     sessionId,
-    source: import_codevibe_core3.EventSource.DESKTOP
+    source: import_codevibe_core4.EventSource.DESKTOP
   };
   const orderingKey = `${sessionId}:${emit.conversationId}`;
-  const nextTimestamp = () => (0, import_codevibe_core3.prepareEventTimestamp)({ orderingKey, agentClock: event.created_at, notBeforeMs });
+  const nextTimestamp = () => (0, import_codevibe_core4.prepareEventTimestamp)({ orderingKey, agentClock: event.created_at, notBeforeMs });
   const baseMetadata = {
     step_index: event.step_index,
     agy_source: event.source,
@@ -3521,7 +3607,7 @@ function mapTranscriptEvent(emit, sessionId, notBeforeMs) {
         {
           ...base,
           timestamp: nextTimestamp(),
-          type: import_codevibe_core3.EventType.USER_PROMPT,
+          type: import_codevibe_core4.EventType.USER_PROMPT,
           content: truncate(cleaned, CONTENT_MAX),
           metadata: { ...baseMetadata }
         }
@@ -3536,7 +3622,7 @@ function mapTranscriptEvent(emit, sessionId, notBeforeMs) {
       events.push({
         ...base,
         timestamp: nextTimestamp(),
-        type: import_codevibe_core3.EventType.REASONING,
+        type: import_codevibe_core4.EventType.REASONING,
         content: truncate(event.thinking, CONTENT_MAX),
         metadata: { ...baseMetadata }
       });
@@ -3545,7 +3631,7 @@ function mapTranscriptEvent(emit, sessionId, notBeforeMs) {
       events.push({
         ...base,
         timestamp: nextTimestamp(),
-        type: import_codevibe_core3.EventType.ASSISTANT_RESPONSE,
+        type: import_codevibe_core4.EventType.ASSISTANT_RESPONSE,
         content: truncate(event.content, CONTENT_MAX),
         metadata: { ...baseMetadata }
       });
@@ -3582,7 +3668,7 @@ function mapTranscriptEvent(emit, sessionId, notBeforeMs) {
         {
           ...base,
           timestamp: nextTimestamp(),
-          type: import_codevibe_core3.EventType.NOTIFICATION,
+          type: import_codevibe_core4.EventType.NOTIFICATION,
           content: truncate(content, CONTENT_MAX),
           metadata: {
             ...baseMetadata,
@@ -3602,7 +3688,7 @@ function mapTranscriptEvent(emit, sessionId, notBeforeMs) {
       {
         ...base,
         timestamp: nextTimestamp(),
-        type: import_codevibe_core3.EventType.TOOL_USE,
+        type: import_codevibe_core4.EventType.TOOL_USE,
         content: formatToolResultContent(event.type, toolName, truncatedContent, isErrorStatus),
         metadata: {
           ...baseMetadata,
@@ -3760,7 +3846,7 @@ function truncate(s, maxBytes) {
 }
 
 // src/tool-activity-integration.ts
-var import_codevibe_core4 = require("@quantiya/codevibe-core");
+var import_codevibe_core5 = require("@quantiya/codevibe-core");
 var TOOL_ACTIVITY_CONTENT = "tool_activity";
 var DEFAULT_WINDOW_MS = 1e4;
 var DEFAULT_MAX_OCCURRENCES = 50;
@@ -3827,9 +3913,9 @@ function agyOccurrenceId(emit, matchedCall) {
     createdAt: emit.event.created_at,
     stepIndex: emit.event.step_index,
     type: emit.event.type,
-    contentDigest: (0, import_codevibe_core4.digestOf)(emit.event.content ?? "")
+    contentDigest: (0, import_codevibe_core5.digestOf)(emit.event.content ?? "")
   };
-  return `agy:${(0, import_codevibe_core4.digestOf)(identity).slice("sha256:".length)}`;
+  return `agy:${(0, import_codevibe_core5.digestOf)(identity).slice("sha256:".length)}`;
 }
 var AgyToolActivityIntegration = class {
   constructor(deps) {
@@ -3838,31 +3924,34 @@ var AgyToolActivityIntegration = class {
     this.sessionsToRehome = /* @__PURE__ */ new Set();
     this.deps = deps;
   }
-  isActive() {
-    return this.consolidator !== null;
+  isActive(sessionId) {
+    return this.consolidator !== null && (sessionId === void 0 || this.backendSessionId === sessionId);
   }
   async start(sessionId) {
     if (this.consolidator && this.backendSessionId === sessionId) return;
     if (this.consolidator) await this.stop();
-    const outbox = new import_codevibe_core4.ToolActivityOutbox({
+    const outbox = new import_codevibe_core5.ToolActivityOutbox({
       agent: "agy",
       logger: this.deps.logger,
       root: this.deps.root
     });
-    await this.rehomePendingWindows(outbox, sessionId);
-    const ledger = new import_codevibe_core4.ToolActivityLedger({
+    const ledger = new import_codevibe_core5.ToolActivityLedger({
       agent: "agy",
       sessionId,
       logger: this.deps.logger,
       root: this.deps.root
     });
-    const consolidator = new import_codevibe_core4.ToolActivityConsolidator({
+    await this.deps.recoverPending?.(sessionId, outbox, ledger);
+    const legacyTransport = this.buildTransport();
+    const transport = this.deps.selectTransport ? await this.deps.selectTransport(sessionId, legacyTransport) : legacyTransport;
+    if (transport.protocol !== "SYNC_V2") await this.rehomePendingWindows(outbox, sessionId);
+    const consolidator = new import_codevibe_core5.ToolActivityConsolidator({
       agent: "agy",
       sessionId,
       logger: this.deps.logger,
       outbox,
       ledger,
-      transport: this.buildTransport(),
+      transport,
       windowMs: this.deps.windowMs ?? DEFAULT_WINDOW_MS,
       maxOccurrences: DEFAULT_MAX_OCCURRENCES
     });
@@ -3894,7 +3983,7 @@ var AgyToolActivityIntegration = class {
       ...target ? { normalizedTarget: target } : {},
       ts: emit.event.created_at,
       byteOffset: emit.byteOffset,
-      ...inputIdentity ? { digest: (0, import_codevibe_core4.digestOf)(inputIdentity) } : {}
+      ...inputIdentity ? { digest: (0, import_codevibe_core5.digestOf)(inputIdentity) } : {}
     });
   }
   async flush() {
@@ -3944,7 +4033,8 @@ var AgyToolActivityIntegration = class {
         }
       }
       if (!eligible) continue;
-      for (const envelope of pending.valid) {
+      const legacyWindows = pending.valid.filter((envelope) => envelope.syncSessionGenerationId === void 0);
+      for (const envelope of legacyWindows) {
         const rehomed = { ...envelope, backendSessionId: replacementSessionId };
         await outbox.persist(replacementSessionId, rehomed);
         await outbox.prune(oldSessionId, envelope.clientEventId);
@@ -3953,7 +4043,7 @@ var AgyToolActivityIntegration = class {
       this.deps.logger.info("[tool-activity] Rehomed durable Agy windows", {
         oldSessionId,
         replacementSessionId,
-        count: pending.valid.length
+        count: legacyWindows.length
       });
     }
   }
@@ -3963,7 +4053,7 @@ var AgyToolActivityIntegration = class {
       if (!session || session.sessionId !== sessionId) {
         throw terminalSessionError(sessionId);
       }
-      const encrypted = (0, import_codevibe_core4.encryptForEmit)(
+      const encrypted = (0, import_codevibe_core5.encryptForEmit)(
         override?.sessionKey ?? session.sessionKey ?? null,
         session.sessionIsEncrypted ?? false,
         TOOL_ACTIVITY_CONTENT,
@@ -3975,8 +4065,8 @@ var AgyToolActivityIntegration = class {
       const sessionKeyGen = override?.sessionKeyGen ?? session.sessionKeyGen;
       const input = {
         sessionId,
-        type: import_codevibe_core4.EventType.TOOL_ACTIVITY,
-        source: import_codevibe_core4.EventSource.DESKTOP,
+        type: import_codevibe_core5.EventType.TOOL_ACTIVITY,
+        source: import_codevibe_core5.EventSource.DESKTOP,
         content: encrypted.content,
         metadata: encrypted.metadata,
         timestamp: envelope.windowStart,
@@ -3991,10 +4081,10 @@ var AgyToolActivityIntegration = class {
         try {
           await sendOnce(sessionId, envelope);
         } catch (error) {
-          if ((0, import_codevibe_core4.isTerminalSessionError)(error)) {
+          if ((0, import_codevibe_core5.isTerminalSessionError)(error)) {
             throw new Error(`[tool-activity] Agy session ${sessionId} retired; awaiting replacement`);
           }
-          if ((0, import_codevibe_core4.isSessionKeyStaleError)(error) && this.deps.refreshSessionKey) {
+          if ((0, import_codevibe_core5.isSessionKeyStaleError)(error) && this.deps.refreshSessionKey) {
             const refreshed = await this.deps.refreshSessionKey(sessionId);
             if (refreshed) {
               await sendOnce(sessionId, envelope, refreshed);
@@ -4056,8 +4146,12 @@ var McpServer = class _McpServer {
      *  under this single sessionId. /resume does NOT create a new
      *  session — same row. */
     this.session = null;
-    this.promptPublications = new import_codevibe_core5.PromptPublicationTracker();
+    this.promptPublications = new import_codevibe_core6.PromptPublicationTracker();
     this.transcriptHandlers = /* @__PURE__ */ new Set();
+    this.nativeSourceSelection = null;
+    this.nativeSources = /* @__PURE__ */ new Map();
+    this.nativeToolStart = null;
+    this.nativeAdmissionChain = Promise.resolve();
     this.toolActivityKeyRefresh = null;
     // E1 (§4/§6a-4) — per-promptId durable raise entries for the agy producer.
     // Keyed by the E1 promptId (= derive(ownerToken)); each holds the SECRET
@@ -4210,9 +4304,23 @@ var McpServer = class _McpServer {
     this.wrapperPid = options.wrapperPid ?? null;
     this.cliLogPath = options.cliLogPath ?? null;
     this.launchSettleTimeoutMs = options.launchSettleTimeoutMs ?? LAUNCH_SETTLE_TIMEOUT_MS;
-    this.appSyncClient = options.appSyncClient ?? new import_codevibe_core5.AppSyncClient();
+    this.appSyncClient = options.appSyncClient ?? new import_codevibe_core6.AppSyncClient();
     this.toolActivity = options.toolActivityIntegration === void 0 ? new AgyToolActivityIntegration({
       logger,
+      selectTransport: async (sessionId, legacyTransport) => {
+        const session = this.session;
+        if (!session || session.sessionId !== sessionId) throw Error("SYNC_SOURCE_OWNER_CHANGED");
+        const selection = await this.selectNativeSource(session);
+        if (this.session !== session || !this.started) throw Error("SYNC_SOURCE_OWNER_CHANGED");
+        return selection.protocol === "LEGACY" ? legacyTransport : this.appSyncClient.toolActivitySyncTransport({
+          sessionScope: selection.sessionScope,
+          getEncryptionContext: selection.getEncryptionContext
+        });
+      },
+      recoverPending: async (sessionId, outbox, ledger) => {
+        await this.appSyncClient.recoverCompanionSyncSources({ sessionId });
+        await this.appSyncClient.recoverToolActivityWindows({ sessionId, outbox, ledger });
+      },
       createEvent: (input) => this.appSyncClient.createEvent(input),
       getSession: () => this.session,
       refreshSessionKey: (sessionId) => this.refreshToolActivitySessionKey(sessionId),
@@ -4228,7 +4336,11 @@ var McpServer = class _McpServer {
     this.workingDirectory = process.cwd();
     this.approvalDetector = options.approvalDetector ?? new ApprovalDetector(options.detectorOptions);
     this.paneObserver = options.paneObserver ?? new TmuxPaneObserver();
-    this.transcriptTailer = options.transcriptTailer ?? new TranscriptTailer();
+    this.transcriptTailer = options.transcriptTailer ?? new TranscriptTailer({ admission: {
+      restore: (source, initial) => this.restoreNativeSource(source, initial),
+      admit: (emit, source) => this.admitNativeSource(emit, source),
+      skip: (gap, source) => this.skipNativeSource(gap, source)
+    } });
     this.mobileDeduper = options.mobileDeduper ?? new MobilePromptDeduper();
     this.promptResponder = options.promptResponder ?? new PromptResponder({
       tmuxTarget: this.tmuxTarget ?? void 0,
@@ -4263,7 +4375,7 @@ var McpServer = class _McpServer {
     const authed = await this.appSyncClient.authenticateWithStoredTokens();
     if (!authed) {
       const kind = this.appSyncClient.getLastAuthFailureKind();
-      const failure = (0, import_codevibe_core5.describeStoredAuthFailure)(
+      const failure = (0, import_codevibe_core6.describeStoredAuthFailure)(
         kind,
         this.appSyncClient.getLastAuthFailureDetail()
       );
@@ -4282,9 +4394,32 @@ var McpServer = class _McpServer {
     this.stopRequestedDuringCreate = false;
     this.registerSignalHandlers();
     this.startTmuxLifecycleMonitor();
-    await (0, import_codevibe_core5.registerDeviceEncryptionKey)(this.appSyncClient, logger);
+    try {
+      const statusUserId = this.appSyncClient.getCurrentUserId();
+      const signal = AbortSignal.timeout(5e3);
+      const timeout = new Promise((_, reject) => signal.addEventListener(
+        "abort",
+        () => reject(new Error("status read timed out")),
+        { once: true }
+      ));
+      const subscription = await Promise.race([this.appSyncClient.getSubscriptionStatus(signal), timeout]);
+      if (this.appSyncClient.getCurrentUserId() !== statusUserId) throw new Error("account changed during read");
+      const sync = await Promise.race([this.appSyncClient.getCompanionSyncState(signal), timeout]);
+      if (this.appSyncClient.getCurrentUserId() !== statusUserId) throw new Error("account changed during read");
+      if (subscription.tier !== sync.tier) throw new Error("tier changed during read");
+      logger.info("Standalone Companion sync status", {
+        tier: sync.tier,
+        protocol: sync.protocol,
+        syncState: sync.usage?.syncState ?? null,
+        resetAtEpochMs: sync.resetAtEpochMs
+      });
+    } catch {
+      logger.warn("Standalone Companion sync status unavailable; cloud admission remains authoritative");
+    }
+    if (!this.started) return { httpPort: 0 };
+    await (0, import_codevibe_core6.registerDeviceEncryptionKey)(this.appSyncClient, logger);
     if (!this.started) return { httpPort: 0 };
-    (0, import_codevibe_core5.startDeviceKeyWatcher)(this.appSyncClient, logger);
+    (0, import_codevibe_core6.startDeviceKeyWatcher)(this.appSyncClient, logger);
     try {
       const swept = await this.appSyncClient.sweepOrphanSessions({
         agentType: "ANTIGRAVITY",
@@ -4424,6 +4559,9 @@ var McpServer = class _McpServer {
     }
     this.listenerHandles = [];
     await Promise.allSettled([...this.transcriptHandlers]);
+    await this.transcriptTailer.waitForReads();
+    await this.nativeAdmissionChain;
+    await this.stopNativeSources();
     if (this.session) {
       try {
         this.appSyncClient.stopHeartbeat(this.session.sessionId);
@@ -4434,7 +4572,7 @@ var McpServer = class _McpServer {
       } catch (err) {
         logger.warn("[tool-activity] Agy shutdown drain failed", { error: String(err) });
       }
-      const retired = await this.deactivateLaunchRow(this.session.sessionId);
+      const retired = await this.deactivateLaunchRow(this.session.sessionId, this.session);
       if (retired) this.durableObligationOpen = false;
       if (!retired) {
         hostedRetirementError = new Error(
@@ -4516,7 +4654,7 @@ var McpServer = class _McpServer {
    * their settlement marker/obligation alive on `false` instead of treating the
    * attempt as completion. The log stays inside so no failure is ever silent.
    */
-  async deactivateLaunchRow(sessionId) {
+  async deactivateLaunchRow(sessionId, quiescentSession) {
     try {
       this.appSyncClient.stopHeartbeat(sessionId);
     } catch (error) {
@@ -4527,7 +4665,14 @@ var McpServer = class _McpServer {
     }
     for (let attempt = 1; attempt <= SESSION_RETIRE_MAX_ATTEMPTS; attempt += 1) {
       try {
-        await this.appSyncClient.updateSession({ sessionId, status: "INACTIVE" });
+        const retired = await this.appSyncClient.updateSession({ sessionId, status: "INACTIVE" });
+        if (quiescentSession && retired?.sessionGenerationId) {
+          await this.appSyncClient.completeDesktopSyncRetirement({ sessionId }, retired, async () => {
+            await Promise.allSettled([...this.transcriptHandlers]);
+            await this.nativeAdmissionChain;
+            await this.stopNativeSources(quiescentSession);
+          });
+        }
         logger.info("Marked superseded/interrupted launch session INACTIVE", { sessionId });
         return true;
       } catch (err) {
@@ -4571,7 +4716,7 @@ var McpServer = class _McpServer {
     let sessionKey = null;
     let sessionKeyGen = null;
     try {
-      const result = await (0, import_codevibe_core5.resumeOrCreateSession)(
+      const result = await (0, import_codevibe_core6.resumeOrCreateSession)(
         {
           sessionId,
           userId,
@@ -4657,8 +4802,9 @@ var McpServer = class _McpServer {
       const stop = this.appSyncClient.subscribeToEvents(
         sessionId,
         (evt) => {
-          void this.handleMobileEvent(evt).catch((err) => {
+          return this.handleMobileEvent(evt).catch((err) => {
             logger.error("handleMobileEvent failed", { error: String(err) });
+            if ((0, import_codevibe_core6.requiresSyncInputDeliveryReceipt)(evt)) throw err;
           });
         },
         (err) => logger.warn("AppSync subscription error", { error: String(err) }),
@@ -4740,7 +4886,7 @@ var McpServer = class _McpServer {
     return activeId === conversationId;
   }
   // ─── Transcript flow ────────────────────────────────────────────────────
-  async handleTranscriptEmit(emit) {
+  async handleTranscriptEmit(emit, admission) {
     if (!this.started) return;
     const { conversationId, byteOffset, event } = emit;
     if (this.sessionDisabled) {
@@ -4766,14 +4912,18 @@ var McpServer = class _McpServer {
       }
     }
     const mapped = mapTranscriptEvent(emit, session.sessionId, notBeforeMs);
+    if (admission && (mapped.events.length > 2 || mapped.events.some((input) => !["USER_PROMPT", "ASSISTANT_RESPONSE", "REASONING", "TOOL_USE", "NOTIFICATION"].includes(input.type)))) {
+      throw Error("SYNC_NATIVE_SPECIALIZED_PRODUCER_REQUIRED");
+    }
     for (const reg of mapped.pendingCallRegistrations) {
       this.approvalDetector.registerPendingCall(reg);
     }
-    for (const input of mapped.events) {
-      if (input.type === import_codevibe_core5.EventType.USER_PROMPT || input.type === import_codevibe_core5.EventType.ASSISTANT_RESPONSE || input.type === import_codevibe_core5.EventType.NOTIFICATION) {
-        await this.flushToolActivityAtBoundary(input.type);
+    for (const [index, input] of mapped.events.entries()) {
+      if (input.type === import_codevibe_core6.EventType.USER_PROMPT || input.type === import_codevibe_core6.EventType.ASSISTANT_RESPONSE || input.type === import_codevibe_core6.EventType.NOTIFICATION) {
+        if (admission) await this.toolActivity.flush();
+        else await this.flushToolActivityAtBoundary(input.type);
       }
-      if (input.type === import_codevibe_core5.EventType.TOOL_USE && typeof input.metadata === "object" && input.metadata) {
+      if (input.type === import_codevibe_core6.EventType.TOOL_USE && typeof input.metadata === "object" && input.metadata) {
         const meta = input.metadata;
         const resultStep = typeof meta.step_index === "number" ? meta.step_index : void 0;
         const agyType = typeof meta.agy_type === "string" ? meta.agy_type : void 0;
@@ -4790,6 +4940,7 @@ var McpServer = class _McpServer {
               continue;
             }
           } catch (error) {
+            if (admission) throw error;
             logger.warn("[tool-activity] Agy result observation failed; emitting raw TOOL_USE fallback", {
               sessionId: session.sessionId,
               conversationId,
@@ -4799,11 +4950,12 @@ var McpServer = class _McpServer {
           }
         }
       }
-      if (input.type === import_codevibe_core5.EventType.USER_PROMPT && input.source === import_codevibe_core5.EventSource.DESKTOP) {
+      if (input.type === import_codevibe_core6.EventType.USER_PROMPT && input.source === import_codevibe_core6.EventSource.DESKTOP) {
         const clearedPromptIds = this.approvalDetector.onPanePromptCleared();
         await this.resolveAcceptedInputPrompts(session, clearedPromptIds);
-        const dedupe = this.mobileDeduper.consumeIfDuplicate(session.sessionId, input.content);
+        const dedupe = admission ? null : this.mobileDeduper.consumeIfDuplicate(session.sessionId, input.content);
         if (dedupe) {
+          if (admission) admission.echoContent = input.content;
           logger.info("Suppressed desktop echo of mobile prompt", {
             sessionId: session.sessionId,
             matchType: dedupe.matchType
@@ -4811,6 +4963,10 @@ var McpServer = class _McpServer {
           continue;
         }
       }
+      if (admission) {
+        admission.outputs[index] = input;
+        continue;
+      }
       try {
         if (!await this.createEncryptedEvent(session, input)) continue;
       } catch (err) {
@@ -4822,6 +4978,161 @@ var McpServer = class _McpServer {
       }
     }
   }
+  selectNativeSource(session) {
+    if (!this.started || this.session !== session) return Promise.reject(Error("SYNC_SOURCE_OWNER_CHANGED"));
+    if (this.nativeSourceSelection?.session === session) return this.nativeSourceSelection.pending;
+    const pending = this.appSyncClient.selectCompanionSourceTransport({ sessionId: session.sessionId });
+    const selected = { session, pending };
+    this.nativeSourceSelection = selected;
+    void pending.catch(() => {
+      if (this.nativeSourceSelection === selected) this.nativeSourceSelection = null;
+    });
+    return pending;
+  }
+  assertNativeOwner(owner) {
+    if (!this.started || this.sessionDisabled || this.session !== owner.session || owner.controller.signal.aborted) {
+      throw Error("SYNC_SOURCE_OWNER_CHANGED");
+    }
+  }
+  async nativeOwner(source) {
+    if (!this.started || this.sessionDisabled) throw Error("SYNC_SOURCE_STOPPED");
+    await this.ensureLaunchSession();
+    const session = this.session;
+    if (!session || !this.isMainConversation(source.conversationId)) throw Error("SYNC_SOURCE_OWNERSHIP_UNAVAILABLE");
+    const selection = await this.selectNativeSource(session);
+    if (!this.started || this.session !== session) throw Error("SYNC_SOURCE_OWNER_CHANGED");
+    if (selection.protocol === "LEGACY") return null;
+    if (!this.toolActivity?.isActive(session.sessionId)) {
+      if (this.nativeToolStart && this.nativeToolStart.session !== session) throw Error("SYNC_SOURCE_OWNER_CHANGED");
+      if (!this.nativeToolStart) {
+        const start = this.toolActivity ? this.toolActivity.start(session.sessionId) : Promise.reject(Error("SYNC_SOURCE_OWNERSHIP_UNAVAILABLE"));
+        const attempt = { session, pending: start };
+        this.nativeToolStart = attempt;
+        void start.finally(() => {
+          if (this.nativeToolStart === attempt) this.nativeToolStart = null;
+        }).catch(() => void 0);
+      }
+      await this.nativeToolStart.pending;
+    }
+    if (!this.toolActivity?.isActive(session.sessionId) || this.session !== session || !this.started) throw Error("SYNC_SOURCE_OWNERSHIP_UNAVAILABLE");
+    const streamSha256 = crypto3.createHash("sha256").update(JSON.stringify([source.filePath, source.conversationId])).digest("hex");
+    const key = `${selection.sessionScope.sessionId}:${selection.sessionScope.sessionGenerationId}:${streamSha256}`;
+    const existing = this.nativeSources.get(key);
+    if (existing) {
+      this.assertNativeOwner(existing);
+      return existing;
+    }
+    const owner = {
+      session,
+      selection,
+      streamSha256,
+      cursor: selection.writer.sourcePair({ provider: "agy", streamSha256 }),
+      controller: new AbortController(),
+      drain: null,
+      drainRequested: false,
+      timer: null,
+      retryMs: 5e3
+    };
+    this.nativeSources.set(key, owner);
+    return owner;
+  }
+  async restoreNativeSource(source, initial) {
+    const owner = await this.nativeOwner(source);
+    if (!owner) return null;
+    const position = await owner.cursor.open(initial);
+    this.assertNativeOwner(owner);
+    await owner.selection.writer.mobileEchoes("agy").reconcile(owner.streamSha256, position.byteOffset);
+    this.drainNativeSource(owner);
+    return position;
+  }
+  async skipNativeSource(gap, source) {
+    const owner = await this.nativeOwner(source);
+    if (!owner) throw Error("SYNC_SOURCE_PROTOCOL_CHANGED");
+    await owner.cursor.skip(gap);
+    this.assertNativeOwner(owner);
+  }
+  async admitNativeSource(emit, source) {
+    const owner = await this.nativeOwner(source);
+    if (!owner) throw Error("SYNC_SOURCE_PROTOCOL_CHANGED");
+    const run = this.nativeAdmissionChain.then(async () => {
+      this.assertNativeOwner(owner);
+      if ((await owner.cursor.open(0)).byteOffset >= source.endOffset) return;
+      const admission = { outputs: [null, null] };
+      await this.handleTranscriptEmit(emit, admission);
+      this.assertNativeOwner(owner);
+      const echoFrame = {
+        streamSha256: owner.streamSha256,
+        occurrence: `${source.startOffset}:${source.endOffset}`,
+        sourceSha256: source.sha256,
+        startOffset: source.startOffset,
+        endOffset: source.endOffset
+      };
+      const echoes = owner.selection.writer.mobileEchoes("agy");
+      for (let index = 0; index < admission.outputs.length; index++) {
+        const input = admission.outputs[index];
+        if (input?.type === import_codevibe_core6.EventType.USER_PROMPT && await echoes.claim(echoFrame, input.content, emit.event.created_at)) admission.outputs[index] = null;
+      }
+      const factory = (index) => {
+        const input = admission.outputs[index];
+        return input ? (id) => owner.selection.prepareEvent(input, id) : null;
+      };
+      await owner.cursor.admit({
+        provider: "agy",
+        streamSha256: owner.streamSha256,
+        occurrence: `${source.startOffset}:${source.endOffset}`,
+        sourceSha256: source.sha256,
+        startOffset: source.startOffset,
+        endOffset: source.endOffset,
+        anchor: source.anchor
+      }, [factory(0), factory(1)]);
+      this.assertNativeOwner(owner);
+      await echoes.reconcile(owner.streamSha256, source.endOffset);
+      this.drainNativeSource(owner);
+    });
+    this.nativeAdmissionChain = run.catch((error) => {
+      logger.warn("[sync-source] Agy admission retained", { error: String(error) });
+    });
+    await run;
+  }
+  drainNativeSource(owner) {
+    if (!this.started || this.session !== owner.session || owner.controller.signal.aborted) return;
+    owner.drainRequested = true;
+    if (owner.drain || owner.timer) return;
+    owner.drainRequested = false;
+    const run = (async () => {
+      let failed = false;
+      try {
+        if (await owner.cursor.drain(64, owner.controller.signal) >= 64) owner.drainRequested = true;
+        owner.retryMs = 5e3;
+      } catch (error) {
+        failed = true;
+        owner.retryMs = Math.min(owner.retryMs * 2, 6e4);
+        if (!owner.controller.signal.aborted) logger.warn("[sync-source] Agy delivery retained", { error: String(error) });
+      }
+      owner.drain = null;
+      if (!this.started || this.session !== owner.session || owner.controller.signal.aborted) return;
+      if (failed) {
+        owner.timer = setTimeout(() => {
+          owner.timer = null;
+          this.drainNativeSource(owner);
+        }, owner.retryMs);
+        owner.timer.unref();
+      } else if (owner.drainRequested) this.drainNativeSource(owner);
+    })();
+    owner.drain = run;
+    void run.catch((error) => logger.error("[sync-source] unexpected Agy drain failure", { error: String(error) }));
+  }
+  async stopNativeSources(session) {
+    const owned = [...this.nativeSources].filter(([, owner]) => !session || owner.session === session);
+    for (const [, owner] of owned) {
+      if (owner.timer) clearTimeout(owner.timer);
+      owner.timer = null;
+      owner.controller.abort(Error("SYNC_SOURCE_STOPPED"));
+    }
+    await Promise.all(owned.map(([, owner]) => owner.drain?.catch(() => void 0)));
+    for (const [key] of owned) this.nativeSources.delete(key);
+    if (!session || this.nativeSourceSelection?.session === session) this.nativeSourceSelection = null;
+  }
   async flushToolActivityAtBoundary(boundary) {
     try {
       await this.toolActivity?.flush();
@@ -4851,18 +5162,18 @@ var McpServer = class _McpServer {
     const expectedSession = this.session;
     try {
       const session = await this.appSyncClient.getSession(sessionId);
-      if (session?.status === import_codevibe_core5.SessionStatus.INACTIVE) {
+      if (session?.status === import_codevibe_core6.SessionStatus.INACTIVE) {
         const terminal = new Error(`Antigravity session is no longer active: ${sessionId}`);
         terminal.errorType = "SessionTerminal";
         throw terminal;
       }
-      if (!session || session.status !== import_codevibe_core5.SessionStatus.ACTIVE || !session.isEncrypted) {
+      if (!session || session.status !== import_codevibe_core6.SessionStatus.ACTIVE || !session.isEncrypted) {
         return null;
       }
       const sessionKeyGen = session.sessionKeyGen ?? null;
       const encryptedKeys = session.encryptedKeys ?? [];
       if (encryptedKeys.length === 0) return null;
-      const sessionKey = await import_codevibe_core5.keychainManager.getSessionKey(
+      const sessionKey = await import_codevibe_core6.keychainManager.getSessionKey(
         sessionId,
         encryptedKeys,
         sessionKeyGen
@@ -4875,7 +5186,7 @@ var McpServer = class _McpServer {
       liveSession.sessionIsEncrypted = true;
       return { sessionKey, sessionKeyGen };
     } catch (error) {
-      if ((0, import_codevibe_core5.isTerminalSessionError)(error)) throw error;
+      if ((0, import_codevibe_core6.isTerminalSessionError)(error)) throw error;
       logger.warn("[tool-activity] Agy session-key refresh failed; window remains retryable", {
         sessionId,
         error: String(error)
@@ -4895,7 +5206,7 @@ var McpServer = class _McpServer {
    * an encrypted keyless one (drop).
    */
   encryptOutbound(session, input) {
-    const enc = (0, import_codevibe_core5.encryptForEmit)(
+    const enc = (0, import_codevibe_core6.encryptForEmit)(
       session.sessionKey ?? null,
       session.sessionIsEncrypted ?? false,
       input.content,
@@ -4925,7 +5236,7 @@ var McpServer = class _McpServer {
     const promptId = input.producerKind === "PLUGIN_APPROVAL" ? input.promptId : void 0;
     const promptEntry = promptId ? this.e1PromptRaises.get(promptId) : void 0;
     const sendOnce = async () => {
-      if (promptId && !(0, import_codevibe_core5.isOpenPromptRaise)(
+      if (promptId && !(0, import_codevibe_core6.isOpenPromptRaise)(
         promptEntry,
         this.e1PromptRaises.get(promptId),
         this.e1NeedsResolution.has(promptId)
@@ -4938,7 +5249,7 @@ var McpServer = class _McpServer {
     try {
       return await sendOnce();
     } catch (error) {
-      if (!(0, import_codevibe_core5.isSessionKeyStaleError)(error)) throw error;
+      if (!(0, import_codevibe_core6.isSessionKeyStaleError)(error)) throw error;
       const refreshed = await this.refreshToolActivitySessionKey(session.sessionId);
       if (!refreshed) throw error;
       return sendOnce();
@@ -4959,7 +5270,7 @@ var McpServer = class _McpServer {
    * NOTIFICATION carrier, no fabricated options).
    */
   newE1Raise(sessionId, mobileActionable, title) {
-    const { record } = (0, import_codevibe_core5.newPromptRaise)({
+    const { record } = (0, import_codevibe_core6.newPromptRaise)({
       sessionId,
       producerKind: "PLUGIN_APPROVAL",
       mobileActionable,
@@ -4995,14 +5306,12 @@ var McpServer = class _McpServer {
     const operation = (async () => {
       try {
         if (this.promptPublications.isPublishing(promptId)) await this.promptPublications.waitFor(promptId);
-        const ack = await this.appSyncClient.createEvent({
+        const acknowledged = await this.appSyncClient.resolveCompanionPrompt({
           sessionId: entry.record.sessionId || sessionId,
-          type: import_codevibe_core5.EventType.NOTIFICATION,
-          source: import_codevibe_core5.EventSource.DESKTOP,
-          resolvedPromptId: promptId,
+          promptId,
           ownerToken: entry.record.ownerToken
         });
-        if (ack?.promptId !== promptId) return false;
+        if (!acknowledged) return false;
         this.e1NeedsResolution.delete(promptId);
         this.e1NeedsReRaise.delete(promptId);
         this.e1PromptRaises.delete(promptId);
@@ -5055,27 +5364,43 @@ var McpServer = class _McpServer {
    * Content is E2E-encrypted; the raise identity rides plaintext top-level.
    * Fail-closed on a missing session key — never cleartext.
    */
-  async emitSuppressedPromptCarrier(session, record, customBannerText) {
+  async emitSuppressedPromptCarrier(session, record, reRaiseToken, customBannerText) {
     const bannerText = customBannerText || "\u26A0\uFE0F A prompt is waiting in your desktop terminal, but its options could not be shown here. Please answer it on your desktop.";
     const input = {
       sessionId: session.sessionId,
-      type: import_codevibe_core5.EventType.NOTIFICATION,
-      source: import_codevibe_core5.EventSource.DESKTOP,
+      type: import_codevibe_core6.EventType.NOTIFICATION,
+      source: import_codevibe_core6.EventSource.DESKTOP,
       content: bannerText,
       metadata: {
         e1SuppressedPrompt: true
       },
-      ...(0, import_codevibe_core5.raiseFieldsFromRecord)(record),
+      ...(0, import_codevibe_core6.raiseFieldsFromRecord)(record),
       notificationText: bannerText,
-      timestamp: (0, import_codevibe_core5.prepareEventTimestamp)({ orderingKey: session.sessionId })
+      timestamp: (0, import_codevibe_core6.prepareEventTimestamp)({ orderingKey: session.sessionId })
     };
-    await this.flushToolActivityAtBoundary(import_codevibe_core5.EventType.NOTIFICATION);
-    if (!await this.createEncryptedEvent(session, input)) return false;
-    logger.info("E1: emitted suppressed-prompt badge carrier (mobileActionable=false)", {
-      sessionId: session.sessionId,
-      promptId: record.promptId
-    });
-    return true;
+    await this.flushToolActivityAtBoundary(import_codevibe_core6.EventType.NOTIFICATION);
+    return this.publishE1Prompt(session, input, reRaiseToken);
+  }
+  async publishE1Prompt(session, input, reRaiseToken) {
+    const promptId = input.promptId, entry = promptId ? this.e1PromptRaises.get(promptId) : void 0;
+    if (!promptId || !(0, import_codevibe_core6.isOpenPromptRaise)(entry, this.e1PromptRaises.get(promptId), this.e1NeedsResolution.has(promptId))) return "CLOSED";
+    if (!this.started || this.session !== session || input.sessionId !== session.sessionId) return "RETRY";
+    const { notificationText: _legacyHint, ...plain } = input;
+    const settle = (disposition) => {
+      if ((0, import_codevibe_core6.isOpenPromptRaise)(entry, this.e1PromptRaises.get(promptId), this.e1NeedsResolution.has(promptId))) {
+        if (disposition === "RETRY") this.e1NeedsReRaise.add(promptId);
+        else if (disposition === "RERAISED" || disposition === "OMITTED") this.e1NeedsReRaise.delete(promptId);
+      }
+      return disposition;
+    };
+    return this.promptPublications.run(promptId, () => this.appSyncClient.publishCompanionPrompt(
+      plain,
+      async () => !!await this.createEncryptedEvent(session, input),
+      { reRaiseToken }
+    ).then(settle, (error) => {
+      settle("RETRY");
+      throw error;
+    }));
   }
   /**
    * E1 (§6a-2b) — badge-only raise for a SUPPRESSED prompt, applying the content-key
@@ -5100,7 +5425,7 @@ var McpServer = class _McpServer {
         entry.contentPlain = customBannerText;
       }
     }
-    this.emitSuppressedPromptCarrier(session, record, customBannerText).catch((e) => {
+    this.emitSuppressedPromptCarrier(session, record, void 0, customBannerText).catch((e) => {
       logger.error("E1: failed to emit suppressed-prompt badge carrier", {
         sessionId: session.sessionId,
         promptId: record.promptId,
@@ -5137,8 +5462,8 @@ var McpServer = class _McpServer {
         ...snap.metadataPlain !== void 0 && { metadataPlain: snap.metadataPlain }
       };
       this.e1PromptRaises.set(entry.record.promptId, entry);
-      const acked = await this.reRaiseOneE1(replacementSession, entry, opts);
-      if (!acked && !entry.resolutionStarted) unacked.push(snap);
+      const disposition = await this.reRaiseOneE1(replacementSession, entry, opts);
+      if (disposition !== "RERAISED" && disposition !== "OMITTED" && !entry.resolutionStarted) unacked.push(snap);
     }
     if (!this.e1TtlRefreshTimer) this.startE1TtlRefresh();
     return unacked;
@@ -5226,57 +5551,65 @@ var McpServer = class _McpServer {
    */
   async reRaiseOneE1(session, entry, opts) {
     const rec = entry.record;
-    if (this.e1NeedsResolution.has(rec.promptId)) return false;
-    if (!(0, import_codevibe_core5.canRecoverPromptRaise)(entry, this.promptPublications.isPublishing(rec.promptId))) {
-      return false;
+    if (this.e1NeedsResolution.has(rec.promptId)) return "CLOSED";
+    if (!(0, import_codevibe_core6.canRecoverPromptRaise)(entry, this.promptPublications.isPublishing(rec.promptId))) {
+      return "RETRY";
     }
     const actionable = rec.mobileActionable && entry.contentPlain !== void 0;
     const retryUntilAck = opts?.retryUntilAck === true;
     const gen = opts?.gen;
     const MAX_ATTEMPTS = 4;
     for (let attempt = 1; ; attempt++) {
-      if (!(0, import_codevibe_core5.isOpenPromptRaise)(
+      if (!(0, import_codevibe_core6.isOpenPromptRaise)(
         entry,
         this.e1PromptRaises.get(rec.promptId),
         this.e1NeedsResolution.has(rec.promptId)
-      )) return false;
+      )) return "CLOSED";
       if (retryUntilAck && this.reRaiseSuperseded(gen)) {
         this.e1NeedsReRaise.add(rec.promptId);
         logger.warn("E1: block-until-ack re-raise aborted (lifecycle superseded/stopping) \u2014 flagged for retry-until-ack (entry retained)", {
           sessionId: session.sessionId,
           promptId: rec.promptId
         });
-        return false;
+        return "RETRY";
       }
       try {
+        let disposition;
         if (actionable) {
           const input = {
             sessionId: session.sessionId,
-            type: import_codevibe_core5.EventType.INTERACTIVE_PROMPT,
-            source: import_codevibe_core5.EventSource.DESKTOP,
+            type: import_codevibe_core6.EventType.INTERACTIVE_PROMPT,
+            source: import_codevibe_core6.EventSource.DESKTOP,
             content: entry.contentPlain,
             metadata: entry.metadataPlain ?? {},
-            ...(0, import_codevibe_core5.raiseFieldsFromRecord)(rec),
-            timestamp: (0, import_codevibe_core5.prepareEventTimestamp)({ orderingKey: session.sessionId })
+            ...(0, import_codevibe_core6.raiseFieldsFromRecord)(rec),
+            timestamp: (0, import_codevibe_core6.prepareEventTimestamp)({ orderingKey: session.sessionId })
           };
-          await this.flushToolActivityAtBoundary(import_codevibe_core5.EventType.INTERACTIVE_PROMPT);
-          if (!(0, import_codevibe_core5.isOpenPromptRaise)(
+          await this.flushToolActivityAtBoundary(import_codevibe_core6.EventType.INTERACTIVE_PROMPT);
+          if (!(0, import_codevibe_core6.isOpenPromptRaise)(
             entry,
             this.e1PromptRaises.get(rec.promptId),
             this.e1NeedsResolution.has(rec.promptId)
-          )) return false;
-          if (!await this.createEncryptedEvent(session, input)) return false;
+          )) return "CLOSED";
+          disposition = await this.publishE1Prompt(session, input, opts?.reRaiseToken);
         } else {
           rec.mobileActionable = false;
-          if (!await this.emitSuppressedPromptCarrier(session, rec, entry.contentPlain)) return false;
+          disposition = await this.emitSuppressedPromptCarrier(
+            session,
+            rec,
+            opts?.reRaiseToken,
+            entry.contentPlain
+          );
         }
+        if (disposition === "CLOSED" || disposition === "RETRY") return disposition;
         this.e1NeedsReRaise.delete(rec.promptId);
-        logger.info("E1: re-raised prompt onto replacement session", {
+        logger.info("E1: prompt publication settled", {
           sessionId: session.sessionId,
           promptId: rec.promptId,
-          actionable
+          actionable,
+          disposition
         });
-        return true;
+        return disposition;
       } catch (e) {
         if (!retryUntilAck && attempt >= MAX_ATTEMPTS) {
           this.e1NeedsReRaise.add(rec.promptId);
@@ -5285,7 +5618,7 @@ var McpServer = class _McpServer {
             promptId: rec.promptId,
             error: e instanceof Error ? e.message : String(e)
           });
-          return false;
+          return "RETRY";
         }
         if (retryUntilAck) {
           const delay2 = Math.min(
@@ -5333,16 +5666,14 @@ var McpServer = class _McpServer {
     const session = this.session;
     if (!session) return;
     const sid = session.sessionId;
-    const promptIds = [...this.e1PromptRaises.values()].filter((e) => e.record.sessionId === sid && !this.e1NeedsResolution.has(e.record.promptId) && (0, import_codevibe_core5.canRecoverPromptRaise)(e, this.promptPublications.isPublishing(e.record.promptId))).map((e) => e.record.promptId);
+    const promptIds = [...this.e1PromptRaises.values()].filter((e) => e.record.sessionId === sid && !this.e1NeedsResolution.has(e.record.promptId) && (0, import_codevibe_core6.canRecoverPromptRaise)(e, this.promptPublications.isPublishing(e.record.promptId))).map((e) => e.record.promptId);
     if (promptIds.length === 0) return;
     try {
-      const agedOut = await this.appSyncClient.refreshOpenPromptTtl(promptIds);
-      for (const promptId of agedOut) {
+      await this.appSyncClient.refreshSessionOpenPromptTtl({ sessionId: sid, promptIds }, async (promptId, reRaiseToken) => {
         const entry = this.e1PromptRaises.get(promptId);
-        if (entry && this.session && entry.record.sessionId === this.session.sessionId) {
-          await this.reRaiseOneE1(this.session, entry);
-        }
-      }
+        if (!entry || this.session !== session || entry.record.sessionId !== sid || this.e1NeedsResolution.has(promptId)) return "CLOSED";
+        return this.reRaiseOneE1(session, entry, { reRaiseToken });
+      });
     } catch (e) {
       logger.warn("E1: TTL-refresh tick failed (non-fatal, retries next tick)", {
         error: e instanceof Error ? e.message : String(e)
@@ -5403,6 +5734,7 @@ var McpServer = class _McpServer {
         }
         this.subscription = null;
       }
+      await this.stopNativeSources(old);
       try {
         await this.toolActivity?.prepareForReplacement();
       } catch (error) {
@@ -5445,10 +5777,10 @@ var McpServer = class _McpServer {
     }
     const result = { ...evt };
     try {
-      result.content = import_codevibe_core5.cryptoService.decryptContent(evt.content, session.sessionKey);
+      result.content = import_codevibe_core6.cryptoService.decryptContent(evt.content, session.sessionKey);
       const rawMeta = parseMaybeJson(evt.metadata);
       if (rawMeta && typeof rawMeta === "object" && typeof rawMeta.encrypted === "string") {
-        const decryptedMeta = import_codevibe_core5.cryptoService.decryptMetadata(
+        const decryptedMeta = import_codevibe_core6.cryptoService.decryptMetadata(
           rawMeta.encrypted,
           session.sessionKey
         );
@@ -5572,35 +5904,35 @@ var McpServer = class _McpServer {
     const content = state.paneDisplayHeader || state.matchedPaneHeader || state.pendingCall?.command || state.pendingCall?.filePath || "approval requested";
     const input = {
       sessionId: session.sessionId,
-      type: import_codevibe_core5.EventType.INTERACTIVE_PROMPT,
-      source: import_codevibe_core5.EventSource.DESKTOP,
+      type: import_codevibe_core6.EventType.INTERACTIVE_PROMPT,
+      source: import_codevibe_core6.EventSource.DESKTOP,
       content,
       metadata: optionsForMobile,
       // E1 (§4) — raise identity top-level: promptId + ownerToken/producerKind/
       // mobileActionable (the backend's classifyRaise upserts the open-prompt row).
-      ...(0, import_codevibe_core5.raiseFieldsFromRecord)(e1rec),
+      ...(0, import_codevibe_core6.raiseFieldsFromRecord)(e1rec),
       // Per-conversation monotonic timestamp (event-timestamp-ordering fix
       // v5.4, 2026-05-24). orderingKey scopes the counter to this conv so
       // INTERACTIVE_PROMPT can't be forced to lastMs+1 by a newer event
       // from a sibling conversation under v9's multi-conv-per-session
       // model.
-      timestamp: (0, import_codevibe_core5.prepareEventTimestamp)({
+      timestamp: (0, import_codevibe_core6.prepareEventTimestamp)({
         orderingKey: `${session.sessionId}:${state.conversationId}`
       })
     };
     try {
       this.stashE1RaiseContent(e1rec.promptId, content, optionsForMobile);
-      await this.flushToolActivityAtBoundary(import_codevibe_core5.EventType.INTERACTIVE_PROMPT);
+      await this.flushToolActivityAtBoundary(import_codevibe_core6.EventType.INTERACTIVE_PROMPT);
       if (this.e1NeedsResolution.has(e1rec.promptId) || this.e1PromptRaises.get(e1rec.promptId)?.record !== e1rec) return;
-      if (!await this.createEncryptedEvent(session, input)) return;
+      await this.publishE1Prompt(session, input);
     } catch (err) {
       logger.error("createEvent INTERACTIVE_PROMPT failed", {
         promptId: state.promptId,
         error: String(err)
       });
-      this.approvalDetector.rollbackPrompt(state.promptId);
-      if (state.paneHash) this.paneObserver.resetPromptHash(state.paneHash);
-      this.e1PromptRaises.delete(state.promptId);
+      if (this.e1PromptRaises.get(e1rec.promptId)?.record === e1rec && !this.e1NeedsResolution.has(e1rec.promptId)) {
+        this.e1NeedsReRaise.add(e1rec.promptId);
+      }
     }
   }
   // ─── Mobile → desktop flow ──────────────────────────────────────────────
@@ -5638,7 +5970,7 @@ var McpServer = class _McpServer {
       if (shouldDecrypt && sessionKey) {
         try {
           logger.info("Decrypting attachment", { id: attachment.id });
-          buffer = import_codevibe_core5.cryptoService.decryptData(buffer, sessionKey);
+          buffer = import_codevibe_core6.cryptoService.decryptData(buffer, sessionKey);
           logger.info("Attachment decrypted successfully", {
             id: attachment.id,
             decryptedSize: buffer.length
@@ -5693,7 +6025,7 @@ var McpServer = class _McpServer {
     await this.ensureLaunchSession();
     if (!this.session) return;
     const session = this.session;
-    if (evt.source !== import_codevibe_core5.EventSource.MOBILE) return;
+    if (evt.source !== import_codevibe_core6.EventSource.MOBILE) return;
     if (evt.sessionId !== session.sessionId) {
       logger.warn("Dropping mobile event with mismatched sessionId", {
         expected: session.sessionId,
@@ -5704,19 +6036,20 @@ var McpServer = class _McpServer {
     let decrypted;
     try {
       decrypted = this.decryptInbound(session, evt);
-    } catch {
+    } catch (error) {
+      if ((0, import_codevibe_core6.requiresSyncInputDeliveryReceipt)(evt)) throw error;
       return;
     }
     evt = decrypted;
-    await this.markDelivered(evt);
-    if (evt.type === import_codevibe_core5.EventType.USER_PROMPT || evt.type === import_codevibe_core5.EventType.PROMPT_RESPONSE) {
+    if (!await this.markDelivered(evt)) return;
+    if (evt.type === import_codevibe_core6.EventType.USER_PROMPT || evt.type === import_codevibe_core6.EventType.PROMPT_RESPONSE) {
       const mobileFloorMs = Date.parse(evt.timestamp);
       this.mobilePromptFloorBySession.set(session.sessionId, {
         floorMs: Number.isNaN(mobileFloorMs) ? Date.now() : mobileFloorMs,
         setAtWallMs: Date.now()
       });
     }
-    if (evt.type === import_codevibe_core5.EventType.USER_PROMPT || evt.type === import_codevibe_core5.EventType.PROMPT_RESPONSE) {
+    if (evt.type === import_codevibe_core6.EventType.USER_PROMPT || evt.type === import_codevibe_core6.EventType.PROMPT_RESPONSE) {
       let promptContent = evt.content;
       const attachments = evt.attachments ?? [];
       if (attachments.length > 0) {
@@ -5755,16 +6088,16 @@ var McpServer = class _McpServer {
       const rawMeta = parseMaybeJson(evt.metadata);
       const meta = rawMeta && typeof rawMeta === "object" ? rawMeta : {};
       const evtAny = evt;
-      const responsePromptId = evt.type === import_codevibe_core5.EventType.PROMPT_RESPONSE ? typeof meta.promptId === "string" && meta.promptId || typeof meta.prompt_id === "string" && meta.prompt_id || typeof evtAny.promptId === "string" && evtAny.promptId || typeof evtAny.prompt_id === "string" && evtAny.prompt_id || null : null;
+      const responsePromptId = evt.type === import_codevibe_core6.EventType.PROMPT_RESPONSE ? typeof meta.promptId === "string" && meta.promptId || typeof meta.prompt_id === "string" && meta.prompt_id || typeof evtAny.promptId === "string" && evtAny.promptId || typeof evtAny.prompt_id === "string" && evtAny.prompt_id || null : null;
       const advertisedOptionNumbers = Array.from(new Set(
         pendingPrompts.flatMap((prompt) => Object.keys(prompt.submitMap))
       ));
-      const intent = (0, import_codevibe_core5.classifyMobilePromptInput)(
+      const intent = (0, import_codevibe_core6.classifyMobilePromptInput)(
         promptContent,
         advertisedOptionNumbers
       );
       if (intent.kind === "option") {
-        const activePrompt = evt.type === import_codevibe_core5.EventType.PROMPT_RESPONSE ? pendingPrompts.find((prompt) => prompt.promptId === responsePromptId) ?? null : pendingPrompts.length === 1 ? pendingPrompts[0] : null;
+        const activePrompt = evt.type === import_codevibe_core6.EventType.PROMPT_RESPONSE ? pendingPrompts.find((prompt) => prompt.promptId === responsePromptId) ?? null : pendingPrompts.length === 1 ? pendingPrompts[0] : null;
         if (!activePrompt || !Object.prototype.hasOwnProperty.call(activePrompt.submitMap, intent.option)) {
           logger.warn("Numeric input does not identify one current advertised prompt; dropping", {
             sessionId: session.sessionId,
@@ -5774,7 +6107,7 @@ var McpServer = class _McpServer {
           });
           return;
         }
-        if (evt.type === import_codevibe_core5.EventType.PROMPT_RESPONSE) {
+        if (evt.type === import_codevibe_core6.EventType.PROMPT_RESPONSE) {
           if (responsePromptId !== activePrompt.promptId) {
             logger.warn("PROMPT_RESPONSE does not identify the current advertised prompt; dropping", {
               sessionId: session.sessionId,
@@ -5784,13 +6117,13 @@ var McpServer = class _McpServer {
             return;
           }
         }
-        this.mobileDeduper.track(session.sessionId, intent.option);
+        await this.trackDurableMobileEcho(session, evt, intent.option, "primary");
         const optionResult = await this.promptResponder.sendApprovalReply(
           activePrompt.promptId,
           intent.option
         );
         if (!optionResult.ok) {
-          this.mobileDeduper.forget(session.sessionId, intent.option);
+          if (!(0, import_codevibe_core6.requiresSyncInputDeliveryReceipt)(evt)) this.mobileDeduper.forget(session.sessionId, intent.option);
           return;
         }
         await this.resolveE1PluginApproval(session.sessionId, activePrompt.promptId);
@@ -5812,10 +6145,12 @@ var McpServer = class _McpServer {
         const clearedPromptIds = this.approvalDetector.onPanePromptCleared();
         await this.resolveAcceptedInputPrompts(session, clearedPromptIds);
       }
-      this.mobileDeduper.track(session.sessionId, promptContent);
-      const result = await this.promptResponder.sendFreeFormWhenNoApprovalActive(promptContent);
+      const result = await this.promptResponder.sendFreeFormWhenNoApprovalActive(
+        promptContent,
+        () => this.trackDurableMobileEcho(session, evt, promptContent, "free_form")
+      );
       if (!result.ok) {
-        this.mobileDeduper.forget(session.sessionId, promptContent);
+        if (!(0, import_codevibe_core6.requiresSyncInputDeliveryReceipt)(evt)) this.mobileDeduper.forget(session.sessionId, promptContent);
         logger.warn("sendFreeForm failed", { reason: result.reason, details: result.details });
         return;
       }
@@ -5823,18 +6158,37 @@ var McpServer = class _McpServer {
       return;
     }
   }
+  async trackDurableMobileEcho(session, event, content, lane) {
+    if (!(0, import_codevibe_core6.requiresSyncInputDeliveryReceipt)(event)) {
+      this.mobileDeduper.track(session.sessionId, content);
+      return;
+    }
+    const selected = await this.selectNativeSource(session);
+    if (selected.protocol !== "SYNC_V2" || !this.started || this.sessionDisabled || this.session !== session || event.sessionId !== selected.sessionScope.sessionId || event.sessionGenerationId !== selected.sessionScope.sessionGenerationId) throw Error("SYNC_ECHO_OWNER_CHANGED");
+    if (content.trim()) await selected.writer.mobileEchoes("agy").arm(
+      { eventId: event.eventId, timestamp: event.timestamp, type: event.type, lane },
+      content,
+      { nowMs: Date.now(), windowMs: 15e3, clockPrecisionMs: 1e3, allowSuffix: true, normalization: "whitespace" }
+    );
+    if (!this.started || this.sessionDisabled || this.session !== session) throw Error("SYNC_ECHO_OWNER_CHANGED");
+  }
   async emitPromptSafetyNotification(session, content) {
     const input = {
       sessionId: session.sessionId,
-      type: import_codevibe_core5.EventType.NOTIFICATION,
-      source: import_codevibe_core5.EventSource.DESKTOP,
+      type: import_codevibe_core6.EventType.NOTIFICATION,
+      source: import_codevibe_core6.EventSource.DESKTOP,
       content,
       metadata: { promptSafetyBlocked: true },
-      timestamp: (0, import_codevibe_core5.prepareEventTimestamp)({ orderingKey: session.sessionId })
+      timestamp: (0, import_codevibe_core6.prepareEventTimestamp)({ orderingKey: session.sessionId })
     };
-    await this.flushToolActivityAtBoundary(import_codevibe_core5.EventType.NOTIFICATION);
+    await this.flushToolActivityAtBoundary(import_codevibe_core6.EventType.NOTIFICATION);
     try {
-      await this.createEncryptedEvent(session, input);
+      if (!this.started || this.sessionDisabled || this.session !== session) return;
+      const result = await this.appSyncClient.publishCompanionNotice(
+        input,
+        async () => !!await this.createEncryptedEvent(session, input)
+      );
+      logger.debug("Prompt-safety notification publication outcome", { sessionId: session.sessionId, result });
     } catch (error) {
       logger.warn("Failed to emit prompt-safety notification", { error: String(error) });
     }
@@ -5844,23 +6198,20 @@ var McpServer = class _McpServer {
    * soon as the plugin receives + decrypts the event and BEFORE the
    * tmux send is attempted, mirroring codex/claude plugin semantics:
    * "delivered" means the desktop daemon has the message in hand, not
-   * that it has acted on it yet. Errors are swallowed (logged) since
-   * a status-write failure must not block the actual prompt routing.
+   * that it has acted on it yet. Legacy checkmarks remain best-effort;
+   * R2 requires exact cloud authority before terminal routing.
    */
   async markDelivered(evt) {
     try {
-      await this.appSyncClient.updateEventStatus({
-        eventId: evt.eventId,
-        sessionId: evt.sessionId,
-        timestamp: evt.timestamp,
-        deliveryStatus: import_codevibe_core5.DeliveryStatus.DELIVERED
-      });
+      return await (0, import_codevibe_core6.acknowledgeMobileInputDelivery)(this.appSyncClient.updateEventStatus.bind(this.appSyncClient), evt);
     } catch (err) {
       logger.warn("updateEventStatus(DELIVERED) failed", {
         eventId: evt.eventId,
         sessionId: evt.sessionId,
         error: String(err)
       });
+      if ((0, import_codevibe_core6.requiresSyncInputDeliveryReceipt)(evt)) throw err;
+      return true;
     }
   }
   /**
@@ -5873,12 +6224,7 @@ var McpServer = class _McpServer {
    */
   async markExecuted(evt) {
     try {
-      await this.appSyncClient.updateEventStatus({
-        eventId: evt.eventId,
-        sessionId: evt.sessionId,
-        timestamp: evt.timestamp,
-        deliveryStatus: import_codevibe_core5.DeliveryStatus.EXECUTED
-      });
+      await (0, import_codevibe_core6.acknowledgeMobileInputExecution)(this.appSyncClient.updateEventStatus.bind(this.appSyncClient), evt);
     } catch (err) {
       logger.warn("updateEventStatus(EXECUTED) failed", {
         eventId: evt.eventId,
@@ -5889,10 +6235,14 @@ var McpServer = class _McpServer {
   }
   // ─── HTTP API push hook (internal/programmatic) ────────────────────────
   async handleHttpPushEvent(payload) {
+    if (!isHttpEventPayload(payload)) throw Object.assign(Error("invalid HTTP event payload"), { code: "INVALID_SYNC_INPUT" });
     const session = this.findSessionByBackendId(payload.sessionId);
-    if (!session) {
+    if (!session || !this.started || this.sessionDisabled) {
       throw new SessionNotFoundError(payload.sessionId);
     }
+    const assertOwner = () => {
+      if (!this.started || this.sessionDisabled || this.session !== session) throw new SessionNotFoundError(payload.sessionId);
+    };
     const normalizedMeta = parseMaybeJson(payload.metadata);
     const metadata = normalizedMeta && typeof normalizedMeta === "object" ? normalizedMeta : {};
     const input = {
@@ -5905,15 +6255,12 @@ var McpServer = class _McpServer {
       // orderingKey is session-scoped. Slightly coarser than the
       // per-conv key used by transcript emits, but acceptable because
       // hook-script pushes are off the hot transcript path.
-      timestamp: (0, import_codevibe_core5.prepareEventTimestamp)({ orderingKey: payload.sessionId })
+      timestamp: (0, import_codevibe_core6.prepareEventTimestamp)({ orderingKey: payload.sessionId })
     };
-    const created = await this.createEncryptedEvent(session, input);
-    if (!created) {
-      throw new Error(
-        `fail-closed: encrypted session ${payload.sessionId} has no session key \u2014 event dropped (#638)`
-      );
-    }
-    return { eventId: created.eventId };
+    return this.appSyncClient.publishCompanionEvent(input, async () => {
+      assertOwner();
+      return this.createEncryptedEvent(session, input);
+    }, { assertOwner });
   }
   findSessionByBackendId(backendSessionId) {
     if (!this.session) return null;
@@ -6282,7 +6629,7 @@ async function main() {
     tmuxTarget: process.env.CODEVIBE_AGY_TMUX_TARGET ?? void 0,
     wrapperPid: process.env.CODEVIBE_AGY_WRAPPER_PID ? parseInt(process.env.CODEVIBE_AGY_WRAPPER_PID, 10) : void 0
   });
-  (0, import_codevibe_core5.installDaemonProcessGuards)(logger, {
+  (0, import_codevibe_core6.installDaemonProcessGuards)(logger, {
     onFatal: () => {
       void server.stop().finally(() => process.exit(1));
     }