@turns/dev 0.0.3 → 0.0.5

package/README.md

@@ -44,6 +44,7 @@ invocations and daemon starts. On Linux the other persistent files are:
 
 - `~/.config/turns/machine-id`
 - `~/.local/state/turns/native-upload-state.json`
+- `~/.local/state/turns/letta-sessions/*.json` (Letta conversation-to-project associations)
 - `~/.config/systemd/user/turns.service`
 
 The credential file contains a seven-day access token and a signed refresh

package/dist/agent-anchor.js

@@ -2,12 +2,14 @@
 import { spawn } from 'node:child_process';
 import fs from 'node:fs';
 import net from 'node:net';
+import os from 'node:os';
 import path from 'node:path';
 import readline from 'node:readline';
 import { DatabaseSync } from 'node:sqlite';
 import { fileURLToPath } from 'node:url';
 import { WebSocket } from 'ws';
-import { ACP_PROFILES, PROCESS_HARNESSES, processEventSessionId, processInvocation, RPC_PROFILES, resolveHarnessCommand, rpcFrameSessionIdentity, rpcUiRequestIsInformational, } from "./harness-registry.js";
+import { ACP_PROFILES, lettaHeadlessEnvironment, lettaSessionIdentity, PROCESS_HARNESSES, parseLettaSessionIdentity, processEventSessionId, processInvocation, RPC_PROFILES, resolveHarnessCommand, rpcFrameSessionIdentity, rpcUiRequestIsInformational, } from "./harness-registry.js";
+import { recordLettaSessionContext } from "./letta-session-context.js";
 const socketIndex = process.argv.indexOf('--socket');
 const socketPath = socketIndex >= 0 ? path.resolve(process.argv[socketIndex + 1] || '') : '';
 if (!socketPath)
@@ -333,6 +335,165 @@ class ClaudeTransport extends LineTransport {
         }
     }
 }
+class LettaTransport extends LineTransport {
+    conversationId;
+    agentId;
+    permissionMode;
+    turnWaiter;
+    control;
+    initWaiter;
+    constructor(anchor, createSession) {
+        const existing = parseLettaSessionIdentity(anchor.agentSessionId);
+        const nativePermissionMode = anchor.permissionMode === 'bypassPermissions'
+            ? 'unrestricted'
+            : anchor.permissionMode === 'acceptEdits'
+                ? 'acceptEdits'
+                : 'standard';
+        const args = [
+            '-p',
+            '--input-format',
+            'stream-json',
+            '--output-format',
+            'stream-json',
+            '--include-partial-messages',
+            '--permission-mode',
+            nativePermissionMode,
+            '--reflection-trigger',
+            'off',
+            ...(anchor.model && anchor.model !== 'auto' ? ['--model', anchor.model] : []),
+            ...(createSession ? ['--new'] : ['--conversation', existing.conversationId]),
+        ];
+        super(anchor, 'letta', resolveHarnessCommand('letta', { command: 'letta' }), args, anchor.cwd, lettaHeadlessEnvironment());
+        this.conversationId = createSession ? '' : existing.conversationId;
+        this.agentId = createSession ? '' : existing.agentId;
+        this.permissionMode = anchor.permissionMode;
+        this.turnWaiter = null;
+        this.control = new Map();
+        this.initWaiter = deferred();
+    }
+    onFrame(frame) {
+        if (!frame || typeof frame !== 'object')
+            return;
+        if (frame.type === 'system' && frame.subtype === 'init') {
+            this.agentId = String(frame.agent_id || frame.session_id || '');
+            this.conversationId = String(frame.conversation_id || '');
+            if (this.conversationId) {
+                const identity = this.agentId ? lettaSessionIdentity(this.agentId, this.conversationId) : this.conversationId;
+                const transcriptPath = this.agentId
+                    ? path.join(os.homedir(), '.letta', 'transcripts', this.agentId, this.conversationId, 'transcript.jsonl')
+                    : '';
+                if (this.agentId && transcriptPath) {
+                    recordLettaSessionContext({
+                        agentId: this.agentId,
+                        conversationId: this.conversationId,
+                        workingDirectory: this.anchor.cwd,
+                        transcriptPath,
+                    });
+                }
+                if (identity !== this.anchor.agentSessionId ||
+                    (transcriptPath && path.resolve(transcriptPath) !== this.anchor.transcriptPath)) {
+                    this.anchor.updateIdentity(identity, transcriptPath);
+                }
+            }
+            this.initWaiter.resolve(frame);
+            return;
+        }
+        if (frame.type === 'result' && this.turnWaiter) {
+            const waiter = this.turnWaiter;
+            this.turnWaiter = null;
+            frame.subtype === 'error' || frame.stop_reason === 'error'
+                ? waiter.reject(new Error(frame.result || 'Letta turn failed.'))
+                : waiter.resolve(frame);
+            return;
+        }
+        if (frame.type === 'control_response') {
+            const requestId = frame.response?.request_id;
+            const waiter = this.control.get(requestId);
+            if (!waiter)
+                return;
+            this.control.delete(requestId);
+            frame.response?.subtype === 'error'
+                ? waiter.reject(new Error(frame.response.error || 'Letta control request failed.'))
+                : waiter.resolve(frame.response?.response ?? frame.response);
+            return;
+        }
+        if (frame.type === 'control_request')
+            void this.answerReverse(frame);
+    }
+    onClose(error) {
+        this.initWaiter.reject(error);
+        if (this.turnWaiter) {
+            this.turnWaiter.reject(error);
+            this.turnWaiter = null;
+        }
+        for (const waiter of this.control.values())
+            waiter.reject(error);
+        this.control.clear();
+    }
+    async open(timeoutMs = 90_000) {
+        const timer = setTimeout(() => this.initWaiter.reject(new Error('Letta init timed out.')), timeoutMs);
+        timer.unref?.();
+        try {
+            await this.initWaiter.promise;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    controlRequest(subtype, extra = {}, timeoutMs = 30_000) {
+        const requestId = `turns_letta_${subtype}_${crypto.randomUUID()}`;
+        const waiter = deferred();
+        this.control.set(requestId, waiter);
+        this.emit({ type: 'control_request', request_id: requestId, request: { subtype, ...extra } });
+        const timer = setTimeout(() => {
+            if (this.control.delete(requestId))
+                waiter.reject(new Error(`Letta control request timed out: ${subtype}`));
+        }, timeoutMs);
+        timer.unref?.();
+        return waiter.promise.finally(() => clearTimeout(timer));
+    }
+    async answerReverse(frame) {
+        let response;
+        try {
+            response = await this.anchor.askInteraction(frame);
+        }
+        catch {
+            return;
+        }
+        this.emit({ type: 'control_response', response: { subtype: 'success', request_id: frame.request_id, response } });
+    }
+    prompt(text, timeoutMs) {
+        if (this.turnWaiter)
+            throw new Error('Letta already has an active turn.');
+        const waiter = deferred();
+        this.turnWaiter = waiter;
+        this.emit({ type: 'user', message: { role: 'user', content: text } });
+        const timer = setTimeout(() => {
+            if (this.turnWaiter === waiter)
+                this.turnWaiter = null;
+            waiter.reject(new Error('Letta turn timed out.'));
+        }, timeoutMs);
+        timer.unref?.();
+        return waiter.promise.finally(() => clearTimeout(timer));
+    }
+    async interrupt() {
+        try {
+            return await this.controlRequest('interrupt');
+        }
+        catch (error) {
+            try {
+                process.kill(-this.child.pid, 'SIGINT');
+            }
+            catch {
+                try {
+                    this.child.kill('SIGINT');
+                }
+                catch { }
+            }
+            throw error;
+        }
+    }
+}
 class CodexAppServerTransport extends LineTransport {
     threadId;
     permissionMode;
@@ -1275,9 +1436,11 @@ class Anchor {
         // send_message crosses a local socket after the queue claim crosses a
         // WebSocket, so either acknowledgement can be lost after the agent has
         // already accepted the turn. A replacement claim for the same prompt must
-        // adopt a running/successful turn instead of executing it again. Failed or
-        // interrupted turns remain retryable when the server issues a new claim.
-        if (sameClaim || (sameMessage && ['running', 'completed'].includes(this.currentTurn?.status))) {
+        // adopt it regardless of outcome instead of repeating work or turning a
+        // persistent harness failure into an automatic retry loop. A deliberate
+        // user retry arrives with a new queue message ID.
+        if (sameClaim ||
+            (sameMessage && ['running', 'completed', 'interrupted', 'error'].includes(this.currentTurn?.status))) {
             if (claimToken && claimToken !== this.currentTurn.claimToken) {
                 this.currentTurn = { ...this.currentTurn, claimToken };
             }
@@ -1380,6 +1543,26 @@ class Anchor {
                 stopReason: result?.method || 'turn/completed',
             };
         }
+        if (this.source === 'letta') {
+            if (!(this.transport instanceof LettaTransport) ||
+                this.transport.child.exitCode !== null ||
+                lettaSessionIdentity(this.transport.agentId, this.transport.conversationId) !== this.agentSessionId ||
+                this.transport.permissionMode !== this.permissionMode) {
+                this.transport?.stop?.();
+                this.transport = new LettaTransport(this, createSession);
+                await this.transport.open();
+            }
+            if (interruptedBeforePrompt())
+                return interruptedBeforePrompt();
+            const result = await this.transport.prompt(this.currentTurn.prompt, timeoutMs);
+            return {
+                exitCode: 0,
+                signal: null,
+                timedOut: false,
+                error: null,
+                stopReason: result?.stop_reason || result?.subtype || 'completed',
+            };
+        }
         if (PROCESS_HARNESSES.has(this.source)) {
             const invocation = processInvocation({
                 harness: this.source,

package/dist/file-browsing.js

@@ -31,9 +31,11 @@ export const FILE_TYPE_SAMPLE_BYTES = 64 * 1024;
 /** Extensions carrying their own type, where guessing text would be wrong. */
 const BINARY_CONTENT_TYPES = new Map([
     ['.apng', 'image/apng'],
+    ['.aac', 'audio/aac'],
     ['.avif', 'image/avif'],
     ['.bmp', 'image/bmp'],
     ['.gif', 'image/gif'],
+    ['.flac', 'audio/flac'],
     ['.gz', 'application/gzip'],
     ['.heic', 'image/heic'],
     ['.ico', 'image/x-icon'],
@@ -41,12 +43,20 @@ const BINARY_CONTENT_TYPES = new Map([
     ['.jpg', 'image/jpeg'],
     ['.mp3', 'audio/mpeg'],
     ['.mp4', 'video/mp4'],
+    ['.m4a', 'audio/mp4'],
+    ['.m4v', 'video/mp4'],
+    ['.mov', 'video/quicktime'],
+    ['.oga', 'audio/ogg'],
+    ['.ogg', 'audio/ogg'],
+    ['.ogv', 'video/ogg'],
+    ['.opus', 'audio/ogg'],
     ['.pdf', 'application/pdf'],
     ['.png', 'image/png'],
     ['.svg', 'image/svg+xml'],
     ['.wasm', 'application/wasm'],
     ['.webm', 'video/webm'],
     ['.webp', 'image/webp'],
+    ['.wav', 'audio/wav'],
     ['.zip', 'application/zip'],
 ]);
 /**

package/dist/harness-registry.js

@@ -159,7 +159,36 @@ export const ACP_PROFILES = {
 // These harnesses keep one bidirectional process attached to the anchor. They
 // are listed separately from process harnesses so queued turns cannot
 // accidentally fall back to one-shot CLI invocations.
-export const RESIDENT_HARNESSES = new Set(['claude', 'codex']);
+export const RESIDENT_HARNESSES = new Set(['claude', 'codex', 'letta']);
+/** Letta's agent + conversation pair identifies one exact transcript. */
+export function lettaSessionIdentity(agentId, conversationId) {
+    return `letta:${String(agentId)}:${String(conversationId)}`;
+}
+export function parseLettaSessionIdentity(value) {
+    const match = /^letta:(agent-(?:local-)?[0-9a-f-]+):(.+)$/iu.exec(String(value || ''));
+    return match ? { agentId: match[1], conversationId: match[2] } : { agentId: '', conversationId: String(value || '') };
+}
+/**
+ * Letta's TUI stores cloud credentials in ~/.letta/settings.json, while its
+ * headless transport requires LETTA_API_KEY in the spawned process. Return a
+ * narrow child-only environment overlay; explicit daemon environment wins.
+ */
+export function lettaHeadlessEnvironment(home = HOME) {
+    if (process.env.LETTA_API_KEY)
+        return {};
+    try {
+        const settings = JSON.parse(fs.readFileSync(path.join(home, '.letta', 'settings.json'), 'utf8'));
+        const apiKey = typeof settings?.env?.LETTA_API_KEY === 'string' ? settings.env.LETTA_API_KEY.trim() : '';
+        const baseUrl = typeof settings?.env?.LETTA_BASE_URL === 'string' ? settings.env.LETTA_BASE_URL.trim() : '';
+        return {
+            ...(apiKey ? { LETTA_API_KEY: apiKey } : {}),
+            ...(!process.env.LETTA_BASE_URL && baseUrl ? { LETTA_BASE_URL: baseUrl } : {}),
+        };
+    }
+    catch {
+        return {};
+    }
+}
 export const RPC_PROFILES = {
     // Prime selects an existing session only at process launch. The transcript
     // path is authoritative (its header id can differ from its filename id), so

package/dist/letta-session-context.js

@@ -0,0 +1,70 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { applicationPaths } from "./auth.js";
+import { lettaSessionIdentity } from "./harness-registry.js";
+function contextDirectory(stateDirectory = applicationPaths().stateDirectory) {
+    return path.join(stateDirectory, 'letta-sessions');
+}
+function contextFile(identity, stateDirectory) {
+    const digest = crypto.createHash('sha256').update(identity).digest('hex');
+    return path.join(contextDirectory(stateDirectory), `${digest}.json`);
+}
+/** Letta transcripts identify an agent and conversation but do not persist the
+ * cwd. Keep Turns-owned launch context outside Letta's data directory so a
+ * later daemon scan can safely resume the conversation in the same project. */
+export function recordLettaSessionContext(context, stateDirectory) {
+    if (!context.agentId ||
+        !context.conversationId ||
+        !path.isAbsolute(context.workingDirectory) ||
+        !path.isAbsolute(context.transcriptPath))
+        return;
+    const identity = lettaSessionIdentity(context.agentId, context.conversationId);
+    const directory = contextDirectory(stateDirectory);
+    const file = contextFile(identity, stateDirectory);
+    const temporary = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    try {
+        fs.writeFileSync(temporary, `${JSON.stringify({ identity, ...context })}\n`, { mode: 0o600 });
+        try {
+            fs.renameSync(temporary, file);
+        }
+        catch (error) {
+            if (process.platform !== 'win32')
+                throw error;
+            try {
+                fs.unlinkSync(file);
+            }
+            catch { }
+            fs.renameSync(temporary, file);
+        }
+    }
+    finally {
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch { }
+    }
+}
+export function readLettaSessionContext(identity, stateDirectory) {
+    try {
+        const value = JSON.parse(fs.readFileSync(contextFile(identity, stateDirectory), 'utf8'));
+        if (value?.identity !== identity ||
+            !value.agentId ||
+            !value.conversationId ||
+            !path.isAbsolute(value.workingDirectory || '') ||
+            !path.isAbsolute(value.transcriptPath || ''))
+            return null;
+        if (lettaSessionIdentity(value.agentId, value.conversationId) !== identity)
+            return null;
+        return {
+            agentId: String(value.agentId),
+            conversationId: String(value.conversationId),
+            workingDirectory: String(value.workingDirectory),
+            transcriptPath: String(value.transcriptPath),
+        };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/local-session-sources.js

@@ -4,6 +4,8 @@ import os from 'node:os';
 import path from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
 import { readDeepseekTrajectoryHeader } from "./deepseek-trajectories.js";
+import { lettaSessionIdentity } from "./harness-registry.js";
+import { readLettaSessionContext } from "./letta-session-context.js";
 const HOME = os.homedir();
 const PROJECTION_ROOT = path.join(HOME, '.local', 'state', 'turns-dev', 'session-projections');
 const DEEPSEEK_SESSIONS_ROOT = path.join(path.resolve(process.env.DSH_HOME || path.join(HOME, '.dsh')), 'sessions');
@@ -91,6 +93,10 @@ const EXTRA_FILE_STORES = {
         root: path.join(HOME, '.fx', 'sessions'),
         include: (file) => path.basename(file) === 'events.jsonl',
     },
+    letta: {
+        root: path.join(HOME, '.letta', 'transcripts'),
+        include: (file) => path.basename(file) === 'transcript.jsonl',
+    },
 };
 function safeStat(file) {
     try {
@@ -253,6 +259,7 @@ function nativeSessionIdFromPath(harness, sourcePath) {
         cline: /\/([^/]+)\.messages\.json$/iu,
         poolside: /trajectory-(?:standalone_)?([0-9a-f-]{20,})\.ndjson$/iu,
         fx: /\/sessions\/([^/]+)\/events\.jsonl$/iu,
+        letta: /\/transcripts\/agent-(?:local-)?[0-9a-f-]+\/([^/]+)\/transcript\.jsonl$/iu,
     };
     return patterns[harness]?.exec(normalized)?.[1] || '';
 }
@@ -1097,6 +1104,13 @@ export function nativeDescriptorWorkingDirectory(descriptor) {
         cursor: cursorMetadataWorkingDirectory,
         gemini: geminiMetadataWorkingDirectory,
         kimi: kimiMetadataWorkingDirectory,
+        letta: (candidate) => {
+            const normalized = String(candidate.sourcePath || candidate.file || '').replaceAll('\\', '/');
+            const match = /\/transcripts\/(agent-(?:local-)?[0-9a-f-]+)\/([^/]+)\/transcript\.jsonl$/iu.exec(normalized);
+            if (!match)
+                return '';
+            return readLettaSessionContext(lettaSessionIdentity(match[1], match[2]))?.workingDirectory || '';
+        },
         fx: (candidate) => absolutePathCandidate([
             sidecarJson(candidate, 'session.json')?.workspace_root,
             sidecarJson(candidate, 'session.json')?.origin_workspace_root,
@@ -1176,6 +1190,12 @@ export async function nativeDescriptorAgentSessionId(descriptor) {
     // into work whose lifecycle and ownership belong to its parent agent.
     if (subagent)
         return '';
+    if (descriptor?.harness === 'letta') {
+        const normalized = String(descriptor?.sourcePath || descriptor?.file || '').replaceAll('\\', '/');
+        const match = /\/transcripts\/(agent-(?:local-)?[0-9a-f-]+)\/([^/]+)\/transcript\.jsonl$/iu.exec(normalized);
+        if (match)
+            return lettaSessionIdentity(match[1], match[2]);
+    }
     const structural = descriptorNativeSessionId(descriptor);
     if (structural) {
         // Kimi persists its ACP key as `session_<uuid>`. The path parser used to
@@ -1309,6 +1329,7 @@ const HARNESS_PROCESS_NAMES = {
     hermes: ['hermes'],
     kilo: ['kilo'],
     kimi: ['kimi', 'kimi-code'],
+    letta: ['letta'],
     muse: ['muse'],
     omp: ['omp'],
     openclaw: ['openclaw'],

package/dist/queue-worker.js

@@ -45,6 +45,70 @@ export async function reserveCreatingNativeSession(request, creating, sessionId,
         return;
     await request({ type: 'session.native.reserve', sessionId, agentSessionId });
 }
+function workingDirectoryFailure(message, directory, error) {
+    const detail = error instanceof Error ? error.message : String(error || 'Unknown filesystem error.');
+    return new Error(`${message}: ${directory}. ${detail}`, { cause: error });
+}
+/** Resolve the directory typed into a new-session draft on the machine that
+ * will run it. The browser cannot expand `~` because the daemon's home may be
+ * different from the viewer's, and a new project directory may not exist yet.
+ *
+ * Check the nearest existing ancestor against the daemon allowlist before
+ * creating anything. The final assertion repeats that check after mkdir so a
+ * symlinked ancestor cannot launch a session outside the allowlist.
+ */
+export function prepareNewSessionWorkingDirectory(requestedDirectory, allowedDirectories = [], homeDirectory = os.homedir()) {
+    const requested = String(requestedDirectory || '').trim();
+    if (!requested)
+        throw new Error('Choose a working directory.');
+    const expanded = requested === '~'
+        ? homeDirectory
+        : requested.startsWith('~/')
+            ? path.join(homeDirectory, requested.slice(2))
+            : requested;
+    if (!path.isAbsolute(expanded)) {
+        throw new Error(`Working directory must be an absolute path or start with ~/: ${requested}`);
+    }
+    const resolved = path.resolve(expanded);
+    let exists = true;
+    try {
+        fs.statSync(resolved);
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            exists = false;
+        else
+            throw workingDirectoryFailure('Working directory is inaccessible', resolved, error);
+    }
+    if (!exists) {
+        let ancestor = path.dirname(resolved);
+        while (!fs.existsSync(ancestor)) {
+            const parent = path.dirname(ancestor);
+            if (parent === ancestor)
+                break;
+            ancestor = parent;
+        }
+        if (allowedDirectories.length && !workingDirectoryIsAllowed(ancestor, allowedDirectories)) {
+            throw new Error(`Working directory is outside the daemon allowlist: ${resolved}`);
+        }
+        try {
+            fs.mkdirSync(resolved, { recursive: true });
+        }
+        catch (error) {
+            throw workingDirectoryFailure('Working directory could not be created', resolved, error);
+        }
+    }
+    try {
+        const canonical = assertAllowedWorkingDirectory(resolved, allowedDirectories);
+        fs.accessSync(canonical, fs.constants.X_OK);
+        return canonical;
+    }
+    catch (error) {
+        if (/outside the daemon allowlist/iu.test(String(error?.message || error)))
+            throw error;
+        throw workingDirectoryFailure('Working directory is inaccessible', resolved, error);
+    }
+}
 /** The origin serving the same deployment as a `wss://…/api/socket` endpoint. */
 export function httpBaseUrl(websocketUrl) {
     const url = new URL(websocketUrl);
@@ -244,7 +308,13 @@ export function resultError(result) {
 }
 export function dispatchErrorIsRetryable(error) {
     const message = String(error?.message || error || '');
-    return !(/(?:not supported|does not support|no resumable native session|session key.*unavailable|no local transcript descriptor|working directory is unavailable|outside the daemon allowlist|agent executable not found)/iu.test(message) || /attachment .* (?:size mismatch|download failed \(4\d\d\))/iu.test(message));
+    // OpenCode emits this only after its provider stream has exhausted its own
+    // backoff. Re-queueing the turn starts that entire retry sequence again and
+    // also persists another copy of the user's prompt in the native session.
+    return !(/(?:not supported|does not support|no resumable native session|session key.*unavailable|no local transcript descriptor|working directory (?:is (?:unavailable|not a directory|inaccessible)|must be|could not be created)|outside the daemon allowlist|agent executable not found|provider finish_reason:\s*network_error)/iu.test(message) || /attachment .* (?:size mismatch|download failed \(4\d\d\))/iu.test(message));
+}
+export function queueFailureIsRetryable(error, promptStarted) {
+    return !promptStarted && dispatchErrorIsRetryable(error);
 }
 export async function actualHarnessStatus(entry) {
     if (!entry || entry.connection.closed)
@@ -505,7 +575,10 @@ export async function watchQueuedPrompts({ rpc, options, machine, getDescriptors
                     promptId: claim.prompt.id,
                     claimToken: claim.claimToken,
                     error: redactor.redactText(error.message),
-                    retryable: dispatchErrorIsRetryable(error),
+                    // The anchor accepted and finished this prompt. Replaying it can
+                    // duplicate side effects and turns persistent harness failures (for
+                    // example, expired authentication) into an unbounded retry loop.
+                    retryable: queueFailureIsRetryable(error, true),
                 });
             }
             else {
@@ -572,11 +645,11 @@ export async function watchQueuedPrompts({ rpc, options, machine, getDescriptors
             const workingDirectory = pendingNativeSession
                 ? String(claim.session?.workingDirectory || '')
                 : await nativeDescriptorWorkingDirectory(descriptor);
-            const fallbackDirectory = path.dirname(descriptor.file);
-            const selectedDirectory = workingDirectory && path.isAbsolute(workingDirectory) && fs.existsSync(workingDirectory)
-                ? workingDirectory
-                : fallbackDirectory;
-            cwd = assertAllowedWorkingDirectory(selectedDirectory, options.allowedDirectories);
+            cwd = pendingNativeSession
+                ? prepareNewSessionWorkingDirectory(workingDirectory, options.allowedDirectories)
+                : assertAllowedWorkingDirectory(workingDirectory && path.isAbsolute(workingDirectory) && fs.existsSync(workingDirectory)
+                    ? workingDirectory
+                    : path.dirname(descriptor.file), options.allowedDirectories);
             if (!fs.statSync(cwd).isDirectory())
                 throw new Error(`Working directory is unavailable: ${cwd}`);
             entry = await usableAnchor(sessionId, descriptor.harness, agentSessionId);
@@ -587,6 +660,10 @@ export async function watchQueuedPrompts({ rpc, options, machine, getDescriptors
             ...claim,
             entry,
             renewTimer: null,
+            // Recovery only observes turns that an anchor already accepted. Treat
+            // an uncertain recovery failure conservatively for the same reason as a
+            // failed live turn: the prompt may already have produced side effects.
+            promptStarted: Boolean(recovery),
         };
         claims.set(sessionId, queued);
         const renewClaim = () => request({
@@ -645,6 +722,10 @@ export async function watchQueuedPrompts({ rpc, options, machine, getDescriptors
             // boundary before starting this attempt so an earlier turn_error with
             // that ID cannot immediately settle the new turn.
             const eventCursor = entry.connection.eventCursor();
+            // A local request can lose its response after the anchor has accepted
+            // the prompt, so crossing this boundary permanently disables automatic
+            // replay even when the exact delivery outcome is unknown.
+            queued.promptStarted = true;
             await entry.connection.request('send_message', {
                 source: descriptor.harness,
                 sessionId,
@@ -712,7 +793,7 @@ export async function watchQueuedPrompts({ rpc, options, machine, getDescriptors
                     promptId: claim.prompt.id,
                     claimToken: claim.claimToken,
                     error: redactor.redactText(error?.message || String(error)),
-                    retryable: dispatchErrorIsRetryable(error),
+                    retryable: queueFailureIsRetryable(error, Boolean(held?.promptStarted)),
                 }).catch(() => { });
             }
             claims.delete(sessionId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@turns/dev",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "description": "Upload local AI agent sessions to turns.dev",
   "license": "MIT",
   "type": "module",