@superjackfruitlabs/salaam 0.0.3 → 0.0.4

package/dist/src/task-verification.js

@@ -1,3 +1,4 @@
+import { requiredChecks } from './task-policy.js';
 import { StationTaskVerification } from './station-task-verification.js';
 import { randomUUID } from 'node:crypto';
 import { commandTerminal } from './coding.js';
@@ -39,7 +40,7 @@ export class TaskVerification {
         };
     }
     assertIdle(task, stationInspection) {
-        if (this.budget.active(task) > 0 ||
+        if (this.budget.active(task, { verification: true }) > 0 ||
             this.store.db
                 .prepare("SELECT 1 FROM compactions WHERE session_id=? AND state='running'")
                 .get(task.session_id))
@@ -105,7 +106,7 @@ export class TaskVerification {
             this.assertIdle(task);
             if (!this.station)
                 this.coding.assertSafe(task.session_id);
-            if (!task.acceptance.some((c) => c.key === key))
+            if (!requiredChecks(task).some((c) => c.key === key))
                 throw new ServiceError('invalid_check', 'Check is not in this task plan');
             if (step &&
                 !task.steps.some((s) => s.id === step && s.state === 'awaiting_review' && s.checks?.includes(key)))
@@ -147,7 +148,7 @@ export class TaskVerification {
             this.station.dispatch(id);
             return;
         }
-        const task = this.tasks.get(receipt.task_id), check = task.acceptance.find((c) => c.key === receipt.check_key);
+        const task = this.tasks.get(receipt.task_id), check = requiredChecks(task).find((c) => c.key === receipt.check_key);
         try {
             const existing = this.store.db
                 .prepare('SELECT id FROM command_runs WHERE session_id=? AND step_key=?')
@@ -383,6 +384,26 @@ export class TaskVerification {
             throw new ServiceError('verification_required', 'Protected station completion requires awaited verification');
         return this.finishRecorded(id, request, expected, exception, authorize);
     }
+    /** Item 8: the completion critic, when the service has one. */
+    critic;
+    /** The critic's verdict on the current fresh verified evidence, starting it the first time.
+     * Reads the evidence outside the finishing transaction, so starting the reviewer can never be
+     * rolled back with a refused finish; the finish itself re-checks the verdict against its own
+     * evidence. */
+    async criticGateAsync(task) {
+        if (!task.completion_gate?.critic)
+            return { state: 'pass' };
+        if (!this.critic || !this.station)
+            return { state: 'failed', reason: 'A critic needs the station verification boundary' };
+        const checks = requiredChecks(task).map((c) => this.latest(task, c.key, null));
+        if (checks.some((c) => !c || c.state !== 'passed'))
+            return { state: 'pending' };
+        const fresh = await this.station.withFreshMany(checks.map((c) => c.id), task.deliverables, (evidence, deliverables) => ({ evidence, deliverables }));
+        return this.critic.gate(task, digest(fresh.evidence), fresh.deliverables.map(({ path, content }) => ({
+            path,
+            content,
+        })));
+    }
     async finishAsync(id, request, expected, exception, authorize) {
         if (!this.station)
             return this.finish(id, request, expected, exception, authorize);
@@ -401,7 +422,7 @@ export class TaskVerification {
             throw new ServiceError('verification_required', 'Strict station work requires verified completion without exceptions');
         if (!task.acceptance.length || !task.deliverables.length)
             throw new ServiceError('verification_required', 'Configured checks and deliverables required');
-        const checks = task.acceptance.map((c) => this.latest(task, c.key, null));
+        const checks = requiredChecks(task).map((c) => this.latest(task, c.key, null));
         if (checks.some((c) => !c || c.state !== 'passed'))
             throw new ServiceError('verification_required', 'Passed configured checks required');
         return this.station.withFreshMany(checks.map((c) => c.id), task.deliverables, (evidence, deliverables) => this.finishRecorded(id, request, expected, null, authorize, { evidence, deliverables }));
@@ -415,7 +436,7 @@ export class TaskVerification {
         if (view.completion?.state === 'succeeded') {
             try {
                 const evidence = JSON.parse(this.artifacts.read(String(view.completion.artifact_id)));
-                const checks = task.acceptance.map((c) => this.latest(task, c.key, null));
+                const checks = requiredChecks(task).map((c) => this.latest(task, c.key, null));
                 if (checks.some((c) => !c || c.state !== 'passed' || !evidence.checks.includes(c.id)))
                     throw Error('Changed checks');
                 view.completion.fresh = await this.station.withFreshMany(checks.map((c) => c.id), task.deliverables, (fresh) => view.completion.plan_revision === this.tasks.get(task.id).plan_revision &&
@@ -441,7 +462,7 @@ export class TaskVerification {
             this.assertIdle(task);
             if (task.steps.some((s) => s.state !== 'completed'))
                 throw new ServiceError('verification_required', 'Every step must be reviewed or verified');
-            const checks = task.acceptance.map((c) => this.latest(task, c.key, null));
+            const checks = requiredChecks(task).map((c) => this.latest(task, c.key, null));
             const missing = [];
             if (!task.acceptance.length)
                 missing.push('No configured acceptance checks');
@@ -452,13 +473,21 @@ export class TaskVerification {
                     (protectedResult
                         ? !protectedResult.evidence.some((e) => e.check_id === checks[n].id)
                         : !this.fresh(checks[n])))
-                    missing.push('Fresh check required: ' + task.acceptance[n].key);
+                    missing.push('Fresh check required: ' + requiredChecks(task)[n].key);
             let workspace = null, deliverables = [], diff = null;
             try {
                 if (protectedResult) {
                     const e = protectedResult.evidence[0];
                     workspace = { id: 'station:' + e.root_digest, revision: 0, digest: e.tree_digest };
-                    deliverables = protectedResult.deliverables;
+                    // Keep each deliverable's verified bytes as a session artifact, committed with the
+                    // completion, so publication reads the verified revision and never the live workspace.
+                    deliverables = protectedResult.deliverables.map(({ path, sha256, content }) => {
+                        if (typeof content !== 'string')
+                            throw new ServiceError('verification_required', 'Deliverable bytes unavailable');
+                        const artifact = this.artifacts.prepare(task.session_id, content);
+                        artifact.commit();
+                        return { path, sha256, artifact_id: artifact.id };
+                    });
                     diff = {
                         backend: 'linux-systemd-station-v1',
                         root_digest: e.root_digest,
@@ -481,6 +510,10 @@ export class TaskVerification {
             catch (error) {
                 missing.push('Workspace verification unavailable: ' + error.message);
             }
+            // Item 8: a declared critic must have passed this exact verified evidence.
+            if (task.completion_gate?.critic &&
+                !(protectedResult && this.critic?.passed(task, digest(protectedResult.evidence))))
+                missing.push('Critic review required');
             if (missing.length && !exception)
                 throw new ServiceError('verification_required', missing.join('; '));
             if (exception) {
@@ -544,7 +577,7 @@ export class TaskVerification {
                     if (completion.state === 'succeeded')
                         fresh =
                             fresh &&
-                                task.acceptance.every((check) => {
+                                requiredChecks(task).every((check) => {
                                     const latest = this.latest(task, check.key, null);
                                     return !!latest && evidence.checks.includes(latest.id) && this.fresh(latest);
                                 });

package/dist/src/task-work.js

@@ -34,6 +34,52 @@ export class TaskWork {
             .prepare('UPDATE task_runtime SET remaining_steps=remaining_steps-1 WHERE task_id=?')
             .run(task.id);
     }
+    /** Item 8: re-run the last completed step with the critic's findings added to its instruction,
+     * under its own re-prepared progression grant and a request of its own. */
+    reopenForCritic(taskId, stepId, round, epoch, findings) {
+        const task = this.get(taskId);
+        const step = task.steps.find((s) => s.id === stepId);
+        const grant = this.store.db
+            .prepare("SELECT id FROM task_grants WHERE task_id=? AND step_id=? AND plan_revision=? AND epoch=? AND state='accepted'")
+            .get(task.id, stepId, task.plan_revision, epoch);
+        if (!grant || !step || step.state !== 'completed' || task.steps.at(-1)?.id !== stepId)
+            throw new ServiceError('task_authority', 'Only the completed last step can be reopened');
+        this.store.transaction(() => {
+            this.store.db.prepare("UPDATE task_steps SET state='pending' WHERE id=?").run(stepId);
+            this.store.db.prepare("UPDATE task_grants SET state='prepared' WHERE id=?").run(grant.id);
+            this.store.event(task.session_id, 'work_task.step_reopened', {
+                task_id: task.id,
+                step_id: stepId,
+                grant_id: grant.id,
+                round,
+                reason: 'Critic requested changes',
+            });
+        });
+        return this.run(task.id, stepId, 'task-grant:' + grant.id + ':critic-reopen:' + round, this.get(task.id).revision, step.instruction +
+            '\n\nBefore this work is accepted, a reviewer asked for these changes:\n' +
+            findings, null, null, grant.id);
+    }
+    /** Re-run a step the provider rate-limited, as a fresh attempt under its own progression grant
+     * (re-prepared, with a request of its own, so it is never a replay of the refused attempt). */
+    retryStep(taskId, stepId, n, epoch) {
+        const task = this.get(taskId);
+        const grant = this.store.db
+            .prepare("SELECT id FROM task_grants WHERE task_id=? AND step_id=? AND plan_revision=? AND epoch=? AND state='accepted'")
+            .get(task.id, stepId, task.plan_revision, epoch);
+        if (!grant || task.steps.find((s) => s.id === stepId)?.state !== 'failed')
+            throw new ServiceError('task_authority', 'No settled grant for this rate-limited step');
+        this.store.transaction(() => {
+            this.store.db.prepare("UPDATE task_grants SET state='prepared' WHERE id=?").run(grant.id);
+            this.store.event(task.session_id, 'work_task.step_retried', {
+                task_id: task.id,
+                step_id: stepId,
+                grant_id: grant.id,
+                retry: n,
+                reason: 'Provider rate limit',
+            });
+        });
+        return this.run(task.id, stepId, 'task-grant:' + grant.id + ':rate-limit-retry:' + n, task.revision, null, null, null, grant.id);
+    }
     advance(grantId) {
         const grant = this.store.db.prepare('SELECT * FROM task_grants WHERE id=?').get(grantId);
         if (!grant)
@@ -439,6 +485,7 @@ export class TaskWork {
                 objective: task.objective,
                 constraints: task.constraints,
                 acceptance: task.acceptance,
+                ...(task.completion_gate ? { completion_gate: task.completion_gate } : {}),
                 deliverables: task.deliverables,
                 limits: task.limits,
                 active_step_id: task.steps.find((s) => s.state === 'running')?.id ?? null,

package/dist/src/tool-identity.js

@@ -0,0 +1,69 @@
+import { spawnSync } from 'node:child_process';
+import { userInfo } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { existsSync } from 'node:fs';
+import { ServiceError } from './protocol.js';
+export const sharedUserWarning = (user) => `Tool execution runs as ${user}, the same OS user that holds the provider credential. Set --tools-user to separate them.`;
+export function serviceToolIdentity() {
+    const user = userInfo().username;
+    return {
+        mode: 'service-user',
+        user,
+        uid: process.getuid?.() ?? -1,
+        prefix: [],
+        warning: sharedUserWarning(user),
+    };
+}
+const run = (argv, input) => spawnSync(argv[0], argv.slice(1), {
+    env: { PATH: '/usr/local/bin:/usr/bin:/bin', LANG: 'C' },
+    input,
+    encoding: 'utf8',
+    timeout: 10000,
+    killSignal: 'SIGKILL',
+    maxBuffer: 1 << 20,
+});
+/** Fail closed unless the tools user exists, is reachable without a password, and cannot read state. */
+export function probeToolsUser(user, stateDir, prefix = ['sudo', '-n', '-u', user, '--']) {
+    if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(user))
+        throw new Error('--tools-user must be a plain Unix user name');
+    if (process.platform !== 'linux' && prefix[0] === 'sudo')
+        throw new Error('--tools-user is supported on Linux hosts only');
+    const id = run([...prefix, '/usr/bin/id', '-u']);
+    const uid = Number(String(id.stdout).trim());
+    if (id.status !== 0 || !Number.isSafeInteger(uid))
+        throw new Error(`Cannot run as tools user ${user} (sudo -n -u ${user} failed); see docs/security.md host setup`);
+    if (uid === 0 || uid === process.getuid?.())
+        throw new Error('The tools user must be an unprivileged user distinct from the service user');
+    if (run([...prefix, '/usr/bin/test', '-r', stateDir]).status === 0)
+        throw new Error(`Tools user ${user} can read the Salaam state directory; restrict it to 0700`);
+    return { mode: 'tools-user', user, uid, prefix, warning: null };
+}
+export function toolArgv(identity, argv) {
+    return [...identity.prefix, ...argv];
+}
+/** Kill a tool process group owned by the tools user; the daemon cannot signal another uid. */
+export function killToolGroup(identity, pgid) {
+    if (identity.mode !== 'tools-user' || !Number.isSafeInteger(pgid) || pgid < 2)
+        return;
+    run(toolArgv(identity, ['/bin/kill', '-KILL', '--', '-' + pgid]));
+}
+const here = fileURLToPath(import.meta.url);
+/** Source runs (tests) use the built helper; packages ship it beside this file. */
+export const EDIT_HELPER = here.endsWith('.ts')
+    ? join(dirname(here), '..', 'dist/src/local-edit-helper.js')
+    : join(dirname(here), 'local-edit-helper.js');
+/** Apply reviewed edits as the tools user. Reports each applied path; any failure throws. */
+export function applyEditsAsTools(identity, root, edits, applied) {
+    if (!existsSync(EDIT_HELPER))
+        throw new ServiceError('tool_identity', 'Edit helper is missing');
+    const result = run(toolArgv(identity, [process.execPath, EDIT_HELPER, root]), JSON.stringify(edits));
+    for (const line of String(result.stdout ?? '').split('\n')) {
+        if (line.startsWith('applied '))
+            applied(JSON.parse(line.slice(8)));
+    }
+    if (result.status !== 0)
+        throw new ServiceError('tool_identity', `Edit as ${identity.user} failed: ${String(result.stderr ?? '')
+            .trim()
+            .slice(0, 400)}`);
+}

package/dist/src/usage.js

@@ -25,7 +25,7 @@ export class UsageLedger {
                 this.store.execution.assert(session);
                 this.store.taskModelAdmission?.(session, attempt, bounds?.input ?? 0, bounds?.output ?? 0);
                 if (attempt) {
-                    this.budget(attempt);
+                    this.budget(attempt, this.store.taskAttemptRequestLimit?.(session) ?? 16);
                     const changed = this.store.db
                         .prepare('UPDATE attempt_budgets SET spent_requests=spent_requests+1 WHERE attempt_id=? AND spent_requests+reserved_requests<limit_requests')
                         .run(attempt);

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@superjackfruitlabs/salaam",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@superjackfruitlabs/salaam",
-      "version": "0.0.3",
+      "version": "0.0.4",
       "bundleDependencies": [
         "@earendil-works/pi-ai",
         "@earendil-works/pi-coding-agent",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superjackfruitlabs/salaam",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",

package/src/acp-outcome.ts

@@ -312,6 +312,123 @@ export function acpFailure(
     ...(kind === 'unknown' ? {} : { retryable: false }),
   };
 }
+/** ACP tool kind for an approval, so a client's modes can tell edits apart:
+ * AgentPod's accept-edits approves only kind "edit"; full-auto approves all; ask none. */
+export function permissionKind(operationKind: string): 'edit' | 'execute' | 'other' {
+  if (operationKind === 'workspace') return 'edit';
+  if (operationKind === 'harness') return 'execute';
+  return 'other';
+}
+/** An operator MCP catalog read is a read; a server's `fetch` tool is a fetch; others stay other. */
+function operatorMcpKind(action: string, tool: unknown): string {
+  if (action === 'catalog') return 'read';
+  return action === 'call' && tool === 'fetch' ? 'fetch' : 'other';
+}
+
+function toolArgs(input: unknown): Record<string, unknown> {
+  try {
+    const value = typeof input === 'string' ? JSON.parse(input) : input;
+    if (value && typeof value === 'object' && !Array.isArray(value))
+      return value as Record<string, unknown>;
+  } catch {}
+  return {};
+}
+
+const label = (v: unknown) => (typeof v === 'string' && /^[\w.-]{1,128}$/.test(v) ? v : undefined);
+
+/** One line of what a tool acted on, for a card title: no control characters, at most `max`. */
+function shown(v: unknown, max: number): string | undefined {
+  if (typeof v !== 'string') return undefined;
+  const t = v
+    .replace(/[\u0000-\u001f\u007f]+/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (!t) return undefined;
+  return t.length > max ? t.slice(0, max - 1) + '…' : t;
+}
+/** A URL as host and path only: never its login, query or fragment (they may carry a secret). */
+function shownUrl(v: unknown): string | undefined {
+  if (typeof v !== 'string') return undefined;
+  try {
+    const u = new URL(v);
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') return undefined;
+    return u.host + (u.pathname === '/' ? '' : u.pathname);
+  } catch {
+    return undefined;
+  }
+}
+const titled = (verb: string, what: string | undefined) => {
+  if (!what) return verb;
+  const t = `${verb}: ${what}`;
+  return t.length > 80 ? t.slice(0, 79) + '…' : t;
+};
+
+/**
+ * The ACP title for a tool call, the way a board agent's card reads: the tool and what it acted on
+ * ("fetch: host/path", "write: runs/r/answer.md"). Every operator MCP call goes through one wrapper
+ * tool, so it is titled by the MCP tool itself. Only plain identifiers, URL host and path, paths,
+ * queries and commands are echoed, clipped to one line of 80 characters.
+ */
+/** A clipped input no longer parses: read the leading plain string fields it still carries. */
+function clippedArgs(input: unknown): Record<string, unknown> {
+  if (typeof input !== 'string') return {};
+  const out: Record<string, unknown> = {};
+  for (const key of [
+    'action',
+    'path',
+    'query',
+    'pattern',
+    'command',
+    'server',
+    'tool',
+    'item_id',
+  ]) {
+    const m = new RegExp(`"${key}"\\s*:\\s*"((?:[^"\\\\]|\\\\.){0,512})"`).exec(input);
+    if (m) {
+      try {
+        out[key] = JSON.parse(`"${m[1]}"`);
+      } catch {}
+    }
+  }
+  // A clipped patch is a long one, so a write: a delete (content null) is short and never clipped.
+  return out;
+}
+
+export function toolTitle(name: string, input: unknown): string {
+  const parsed = toolArgs(input);
+  const args = Object.keys(parsed).length ? parsed : clippedArgs(input);
+  const action = typeof args.action === 'string' ? args.action : '';
+  if (name === 'salaam_operator_mcp') {
+    const server = label(args.server);
+    const tool = label(args.tool);
+    if (action === 'call' && server && tool) {
+      const a = toolArgs(args.arguments);
+      return titled(tool, shownUrl(a.url) ?? shown(a.query ?? a.path ?? a.pattern, 80));
+    }
+    if (action === 'catalog') return titled('MCP catalog', server);
+    if (action === 'call') return titled('MCP call', server ?? tool);
+    return action ? titled('MCP request', label(action)) : 'MCP request (no input)';
+  }
+  if (name === 'salaam_board') {
+    if (action === 'card') return 'read this card';
+    if (action === 'attempts') return 'read this card’s runs';
+    if (action === 'library_search') return titled('library_search', shown(args.query, 80));
+    if (action === 'library_get') return titled('library_get', shown(args.item_id, 32));
+    return name;
+  }
+  if (['salaam_station', 'salaam_files', 'salaam_repository'].includes(name)) {
+    if (action === 'patch')
+      return titled(args.content === null ? 'delete' : 'write', shown(args.path, 80));
+    if (action === 'inspect' && args.path === undefined) return 'inspect workspace';
+    if (action === 'check') return titled('check', shown(args.command, 80));
+    if (['read', 'list', 'inspect', 'diff'].includes(action))
+      return titled(action, shown(args.path, 80));
+    if (action === 'search') return titled('search', shown(args.query ?? args.pattern, 80));
+    if (action) return action;
+  }
+  return name;
+}
+
 export function toolMetadata(
   name: string,
   input: unknown,
@@ -324,27 +441,31 @@ export function toolMetadata(
   } catch {}
   const action = String(args.action ?? '');
   const kind =
-    name === 'salaam_command' || (name === 'salaam_station' && action === 'check')
-      ? ['start', 'cancel', 'check'].includes(action)
-        ? 'execute'
-        : ['status', 'logs'].includes(action)
-          ? 'read'
-          : 'other'
-      : ['salaam_files', 'salaam_station'].includes(name) && action === 'patch'
-        ? args.content === null
-          ? 'delete'
-          : 'edit'
-        : ['salaam_files', 'salaam_repository', 'salaam_station'].includes(name) &&
-            ['search', 'list'].includes(action)
-          ? 'search'
-          : ['salaam_files', 'salaam_repository', 'salaam_station'].includes(name) &&
-              ['read', 'inspect', ...(name === 'salaam_repository' ? ['diff'] : [])].includes(
-                action,
-              )
+    name === 'salaam_board'
+      ? 'read'
+      : name === 'salaam_command' || (name === 'salaam_station' && action === 'check')
+        ? ['start', 'cancel', 'check'].includes(action)
+          ? 'execute'
+          : ['status', 'logs'].includes(action)
             ? 'read'
-            : ['salaam_history', 'inspect_child', 'consume_child_result'].includes(name)
+            : 'other'
+        : ['salaam_files', 'salaam_station'].includes(name) && action === 'patch'
+          ? args.content === null
+            ? 'delete'
+            : 'edit'
+          : ['salaam_files', 'salaam_repository', 'salaam_station'].includes(name) &&
+              ['search', 'list'].includes(action)
+            ? 'search'
+            : ['salaam_files', 'salaam_repository', 'salaam_station'].includes(name) &&
+                ['read', 'inspect', ...(name === 'salaam_repository' ? ['diff'] : [])].includes(
+                  action,
+                )
               ? 'read'
-              : 'other';
+              : ['salaam_history', 'inspect_child', 'consume_child_result'].includes(name)
+                ? 'read'
+                : name === 'salaam_operator_mcp'
+                  ? operatorMcpKind(action, args.tool)
+                  : 'other';
   const locations: { path: string; line?: number }[] = [];
   if (
     ['salaam_files', 'salaam_station'].includes(name) &&
@@ -361,3 +482,32 @@ export function toolMetadata(
   }
   return { kind, locations };
 }
+
+/** A durable task's steps as the ACP `plan` session update: the whole list, replaced on every
+ * change (https://agentclientprotocol.com/protocol/agent-plan). ACP has only pending,
+ * in_progress and completed, so a step that stopped says so in its text instead. */
+export function planUpdate(
+  task: { steps: { title: string; state: string }[] } | null | undefined,
+): {
+  sessionUpdate: 'plan';
+  entries: { content: string; priority: 'medium'; status: string }[];
+} | null {
+  if (!task?.steps.length) return null;
+  return {
+    sessionUpdate: 'plan',
+    entries: task.steps.map((step) => {
+      const status =
+        step.state === 'completed'
+          ? 'completed'
+          : step.state === 'running' || step.state === 'awaiting_review'
+            ? 'in_progress'
+            : 'pending';
+      const stopped = ['cancelled', 'failed', 'interrupted'].includes(step.state);
+      return {
+        content: stopped ? `${step.title} (${step.state})` : step.title,
+        priority: 'medium' as const,
+        status,
+      };
+    }),
+  };
+}

package/src/acp.ts

@@ -1,12 +1,19 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { realpathSync } from 'node:fs';
+import { mkdirSync, realpathSync, statSync } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
 import { once } from 'node:events';
 import { call } from './transport.js';
 import { acquireControl, Outbox, subscribe, type Feed } from './attach.js';
 import { AcpJournal } from './acp-journal.js';
 import { VERSION } from './config.js';
-import { acpFailure, AcpFailureError, toolMetadata } from './acp-outcome.js';
+import {
+  acpFailure,
+  AcpFailureError,
+  permissionKind,
+  toolMetadata,
+  toolTitle,
+  planUpdate,
+} from './acp-outcome.js';
 import type { CancellationReceipt } from './turn-cancellations.js';
 import { validateManagedMcpDeclarations } from './mcp-acp.js';
 import {
@@ -40,11 +47,14 @@ interface Connection {
   dirty: boolean;
   decisions: Promise<void>;
   failed?: Error;
+  /** The last plan sent, so an unchanged task sends nothing. */
+  plan?: string;
 }
 /** ACP v1 newline-delimited stdio adapter. The daemon remains the only worker owner. */
 export async function acp(state: string, options: { coding?: boolean } = {}): Promise<void> {
   const socket = join(state, 'operator.sock');
-  const journal = new AcpJournal(state);
+  const client = acpClientState(state);
+  const journal = new AcpJournal(client);
   const admission = process.env.SALAAM_AGENTPOD_ADMISSION,
     admissionToken = process.env.SALAAM_AGENTPOD_TOKEN;
   delete process.env.SALAAM_AGENTPOD_ADMISSION;
@@ -102,6 +112,14 @@ export async function acp(state: string, options: { coding?: boolean } = {}): Pr
       params: { sessionId: id, update: out },
     });
   };
+  /** Send the session's durable task plan when it differs from the last one sent. */
+  const sendPlan = async (c: Connection, task?: SessionSnapshot['work_task']) => {
+    const plan = planUpdate(task === undefined ? (await snapshot(c.id)).work_task : task);
+    const key = plan ? JSON.stringify(plan) : undefined;
+    if (!plan || key === c.plan) return;
+    c.plan = key;
+    await update(c.id, plan as unknown as Json);
+  };
   const promptReceipt = async (session: string, request: string, attemptId: string) => {
     if (!bound || !wantsReceipts) return;
     const attempt = await call<Attempt>(socket, `/v1/attempts/${attemptId}`);
@@ -201,7 +219,7 @@ export async function acp(state: string, options: { coding?: boolean } = {}): Pr
                 await update(c.id, {
                   sessionUpdate: 'tool_call',
                   toolCallId: String(part.id),
-                  title: String(part.name),
+                  title: toolTitle(String(part.name), part.arguments),
                   ...(await toolDetails(c.id, String(part.id), String(part.name), part.arguments)),
                   status: 'in_progress',
                   rawInput: part.arguments,
@@ -267,7 +285,7 @@ export async function acp(state: string, options: { coding?: boolean } = {}): Pr
       const toolCall = {
         toolCallId: 'salaam-operation:' + op.id,
         title: op.kind + ': ' + op.target,
-        kind: 'other',
+        kind: permissionKind(op.kind),
         status: 'pending',
         rawInput: {
           target: op.target,
@@ -290,7 +308,7 @@ export async function acp(state: string, options: { coding?: boolean } = {}): Pr
         )
           throw new Error('Invalid permission outcome');
         const decide = async () => {
-          const outbox = new Outbox(state, c.id);
+          const outbox = new Outbox(client, c.id);
           outbox.enqueueDecision(
             approval.id,
             approval.operation_digest,
@@ -381,6 +399,7 @@ export async function acp(state: string, options: { coding?: boolean } = {}): Pr
           tool?: string;
           input?: string;
           failed?: boolean;
+          output?: string;
           kind?: string;
           locations?: unknown[];
         };
@@ -391,7 +410,7 @@ export async function acp(state: string, options: { coding?: boolean } = {}): Pr
           void update(c.id, {
             sessionUpdate: started && fresh ? 'tool_call' : 'tool_call_update',
             toolCallId: p.tool_call_id,
-            title: p.tool ?? 'Tool',
+            title: p.tool ? toolTitle(p.tool, p.input) : 'Tool',
             ...(started
               ? {
                   kind: p.kind ?? toolMetadata(p.tool ?? '', p.input).kind,
@@ -400,6 +419,9 @@ export async function acp(state: string, options: { coding?: boolean } = {}): Pr
               : {}),
             status: started ? 'in_progress' : p.failed ? 'failed' : 'completed',
             ...(started && p.input ? { rawInput: p.input } : {}),
+            ...(!started && p.output
+              ? { content: [{ type: 'content', content: { type: 'text', text: p.output } }] }
+              : {}),
             ...(p.parent_tool_call_id
               ? { _meta: { 'salaam.dev/parentToolCallId': p.parent_tool_call_id } }
               : {}),
@@ -408,6 +430,10 @@ export async function acp(state: string, options: { coding?: boolean } = {}): Pr
           });
         }
       }
+      if (event.kind.startsWith('work_task.'))
+        void sendPlan(c).catch((error) => {
+          c.failed = error;
+        });
       if (
         [
           'inbox.changed',
@@ -518,6 +544,8 @@ export async function acp(state: string, options: { coding?: boolean } = {}): Pr
         if (record.receipt) await promptReceipt(id, record.request_id, record.receipt.attempt_id);
       if (wantsCancellations) await cancellationReceipts(c);
       await approvals(c, view);
+      // The plan is visible before any step runs.
+      await sendPlan(c, view.work_task ?? null);
       watch(c);
     } catch (error) {
       sessions.delete(id);
@@ -878,3 +906,21 @@ export async function acp(state: string, options: { coding?: boolean } = {}): Pr
     }
   }
 }
+
+/** A launcher-profile daemon's state belongs to root; its ACP clients keep their own
+ * journal and outbox in the caller's state home, keyed by the daemon state path. */
+export function acpClientState(state: string, env: NodeJS.ProcessEnv = process.env): string {
+  let own = false;
+  try {
+    own = statSync(state).uid === process.getuid?.();
+  } catch {}
+  if (own) return state;
+  const home = env.XDG_STATE_HOME || join(env.HOME ?? '/nonexistent', '.local/state');
+  const dir = join(
+    home,
+    'salaam/acp-clients',
+    createHash('sha256').update(state).digest('hex').slice(0, 32),
+  );
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  return dir;
+}