@zgeoff/atc 2.15.0 → 2.15.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/atc",
-  "version": "2.15.0",
+  "version": "2.15.2",
   "description": "Terminal control tower for coding-agent sessions",
   "homepage": "https://github.com/zgeoff/atc#readme",
   "bugs": "https://github.com/zgeoff/atc/issues",
@@ -24,6 +24,7 @@
     "build:atc-bridge": "bun scripts/build-atc-bridge.ts && oxfmt src/agents/atc-bridge-files.ts && format-codemod --quiet src/agents/atc-bridge-files.ts",
     "build:binaries": "bash scripts/build-binaries.sh",
     "audit": "bun audit",
+    "check:imports": "bun scripts/check-imports.ts",
     "deadcode": "knip",
     "lint": "oxlint --type-aware --type-check --report-unused-disable-directives-severity error",
     "lint:fix": "oxlint --type-aware --type-check --report-unused-disable-directives-severity error --fix",

package/src/agents/agent-adapter.ts

@@ -1,24 +1,9 @@
-import type { HookEvent } from '../daemon/hooks';
+import type { AdapterEvent } from '../protocol/adapter-event';
+import type { HookEvent } from '../protocol/hook-event';
+import type { AgentID } from '../shared/agent-id';
 import type { AgentSessionID } from '../shared/agent-session-id';
 import type { SessionID } from '../shared/session-id';
 
-/**
- * Which agent a session runs under: the key the adapter registry is looked
- * up by. Every agent CLI supplies one, and so does every configured backend
- * that drives a CLI it does not own, so two ids can share one kind.
- */
-export type AgentID = string;
-
-/**
- * Missing and empty values become Claude so a fleet written before the agent
- * column still restores as Claude. Any other string is returned as it stands,
- * registered or not: an id whose adapter is gone must reach the caller intact
- * so the session can be shown and refused, never quietly run as Claude.
- */
-export function toAgentID(raw: unknown): AgentID {
-  return typeof raw === 'string' && raw !== '' ? raw : 'claude';
-}
-
 export interface SpawnOptions {
   readonly prompt: string;
 
@@ -64,26 +49,6 @@ export interface GuestSpawnPlan extends SpawnPlan {
   readonly files: Readonly<Record<string, string>>;
 }
 
-export interface AdapterEvent {
-  kind: 'started' | 'needs-input' | 'turn-done' | 'prompt-submitted' | 'ended' | 'heartbeat';
-  agentSessionID?: AgentSessionID;
-  message?: string;
-
-  // Fuller activity text than message: what the agent last said or was
-  // asked, for briefing. Bounded by the adapter.
-  detail?: string;
-
-  // Opaque handle the adapter can later pull a session name from.
-  nameSource?: string;
-
-  // Claude resume-existence path. Distinct from nameSource: a naming
-  // handle is not a resume gate.
-  transcriptSource?: string;
-
-  // The agent's whole final message for a finished turn; detail holds a bounded preview of it.
-  result?: string;
-}
-
 export interface TranscriptToolUse {
   readonly name: string;
   readonly input: string;

package/src/agents/build-hook-settings.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import type { AgentID } from './agent-adapter';
+import type { AgentID } from '../shared/agent-id';
 import { buildCLICommand } from './build-cli-command';
 
 /**

package/src/agents/claude-adapter.ts

@@ -1,14 +1,15 @@
 import { existsSync } from 'node:fs';
 import { z } from 'zod';
-import type { HookEvent } from '../daemon/hooks';
+import type { AdapterEvent } from '../protocol/adapter-event';
+import type { HookEvent } from '../protocol/hook-event';
 import type { AgentSessionID } from '../shared/agent-session-id';
 import { buildOptionalString } from '../shared/build-optional-string';
 import type { Config } from '../shared/config';
 import { isRecord } from '../shared/report';
 import { toAgentSessionID } from '../shared/to-agent-session-id';
 import { toShellArg } from '../shared/to-shell-arg';
+import { truncateDetail } from '../shared/truncate-detail';
 import type {
-  AdapterEvent,
   AgentAdapter,
   AgentProfile,
   GuestPaths,
@@ -31,7 +32,6 @@ import type { ClaudeHeadlessRun } from './make-claude-headless-runner';
 import { parseClaudeTranscriptLine } from './parse-claude-transcript-line';
 import { planTypedLineInput } from './plan-typed-line-input';
 import { resolveClaudePermissionMode } from './resolve-claude-permission-mode';
-import { truncateDetail } from './truncate-detail';
 import { writeATCBridge } from './write-atc-bridge';
 import { writeHookSettings } from './write-hook-settings';
 

package/src/agents/codex-adapter.ts

@@ -1,15 +1,16 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { z } from 'zod';
-import type { HookEvent } from '../daemon/hooks';
+import type { AdapterEvent } from '../protocol/adapter-event';
+import type { HookEvent } from '../protocol/hook-event';
 import type { AgentSessionID } from '../shared/agent-session-id';
 import { buildOptionalString } from '../shared/build-optional-string';
 import type { Config } from '../shared/config';
 import { isRecord } from '../shared/report';
 import { toAgentSessionID } from '../shared/to-agent-session-id';
 import { toShellArg } from '../shared/to-shell-arg';
+import { truncateDetail } from '../shared/truncate-detail';
 import type {
-  AdapterEvent,
   AgentAdapter,
   AgentProfile,
   NameUpdate,
@@ -22,7 +23,6 @@ import { buildArgsWithoutFlags } from './build-args-without-flags';
 import { findFlagValue } from './find-flag-value';
 import { planPastedLineInput } from './plan-pasted-line-input';
 import { resolveAgentHome } from './resolve-agent-home';
-import { truncateDetail } from './truncate-detail';
 
 // Codex's hook payload keys, snake_case. An absent or wrong-typed field
 // parses to undefined rather than failing the payload, so a broken reporter

package/src/agents/gateway-adapter.ts

@@ -1,12 +1,12 @@
-import type { HookEvent } from '../daemon/hooks';
+import type { AdapterEvent } from '../protocol/adapter-event';
+import type { HookEvent } from '../protocol/hook-event';
+import type { AgentID } from '../shared/agent-id';
 import type { AgentSessionID } from '../shared/agent-session-id';
 import type { GatewayConfig } from '../shared/collect-gateways';
 import type { Config } from '../shared/config';
 import { toShellArg } from '../shared/to-shell-arg';
 import type {
-  AdapterEvent,
   AgentAdapter,
-  AgentID,
   AgentProfile,
   HeadlessRunner,
   NameUpdate,

package/src/agents/grok-adapter.ts

@@ -1,7 +1,8 @@
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { z } from 'zod';
-import type { HookEvent } from '../daemon/hooks';
+import type { AdapterEvent } from '../protocol/adapter-event';
+import type { HookEvent } from '../protocol/hook-event';
 import type { AgentSessionID } from '../shared/agent-session-id';
 import { buildOptionalString } from '../shared/build-optional-string';
 import type { Config } from '../shared/config';
@@ -9,8 +10,8 @@ import { isRecord } from '../shared/report';
 import type { SessionID } from '../shared/session-id';
 import { toAgentSessionID } from '../shared/to-agent-session-id';
 import { toShellArg } from '../shared/to-shell-arg';
+import { truncateDetail } from '../shared/truncate-detail';
 import type {
-  AdapterEvent,
   AgentAdapter,
   AgentProfile,
   NameUpdate,
@@ -22,7 +23,6 @@ import type {
 import { normalizeHookEventName } from './normalize-hook-event';
 import { planPastedLineInput } from './plan-pasted-line-input';
 import { resolveAgentHome } from './resolve-agent-home';
-import { truncateDetail } from './truncate-detail';
 
 interface GrokSessionHookState {
   latestPromptID?: string;

package/src/agents/start-claude-headless-run.ts

@@ -1,6 +1,6 @@
-import { truncateSummary } from '../daemon/truncate-summary';
 import { isCompiledBinary } from '../shared/is-compiled-binary';
 import { isRecord } from '../shared/report';
+import { truncateSummary } from '../shared/truncate-summary';
 import { buildClaudeQueryOptions } from './build-claude-query-options';
 import type { ClaudeHeadlessRunRequest } from './build-claude-query-options';
 

package/src/client/boot-daemon.ts

@@ -2,17 +2,17 @@ import { spawn as spawnChild } from 'node:child_process';
 import type { ChildProcess } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { toAgentID } from '../agents/agent-adapter';
-import type { AgentID } from '../agents/agent-adapter';
 import { DaemonError } from '../protocol/daemon-error';
 import type { DaemonFeature } from '../protocol/daemon-features';
 import { parseDaemonFeatures } from '../protocol/parse-daemon-features';
 import { PROTOCOL_V } from '../protocol/protocol';
+import type { AgentID } from '../shared/agent-id';
 import { daemonPidFile, daemonRecordFile, daemonSocketPath } from '../shared/config';
 import { findDaemonRecord } from '../shared/find-daemon-record';
 import { getBuild } from '../shared/get-build';
 import { isCompiledBinary } from '../shared/is-compiled-binary';
 import { makeSingleFlight } from '../shared/make-single-flight';
+import { toAgentID } from '../shared/to-agent-id';
 import { DaemonClient } from './daemon-client';
 import { formatProtocolMismatch } from './format-protocol-mismatch';
 import type { ProtocolMismatch } from './format-protocol-mismatch';

package/src/client/collect-agent-picks.ts

@@ -1,4 +1,4 @@
-import type { AgentID } from '../agents/agent-adapter';
+import type { AgentID } from '../shared/agent-id';
 import type { Config } from '../shared/config';
 
 export interface AgentPick {

package/src/client/daemon-client.ts

@@ -1,3 +1,4 @@
+import type { DaemonChannel } from '../protocol/daemon-channel';
 import { DaemonError } from '../protocol/daemon-error';
 import { LineDecoder } from '../protocol/line-decoder';
 import { OutboundQueue } from '../protocol/outbound-queue';
@@ -14,7 +15,7 @@ interface Pending {
  * event callback. `open` connects the socket; `sendHello` completes the
  * handshake and must come first.
  */
-export class DaemonClient {
+export class DaemonClient implements DaemonChannel {
   onEvent: (event: EventMsg) => void = () => {};
 
   onClose: () => void = () => {};

package/src/client/format-overlay-agent-mark.ts

@@ -1,4 +1,4 @@
-import type { AgentID } from '../agents/agent-adapter';
+import type { AgentID } from '../shared/agent-id';
 
 const BUILT_IN_MARKS: Readonly<Record<AgentID, string>> = { grok: 'g', codex: 'x' };
 

package/src/client/index.ts

@@ -1,9 +1,11 @@
 import { match } from 'ts-pattern';
 import { createActor } from 'xstate';
-import type { AgentID } from '../agents/agent-adapter';
-import { countSessionStates, sortGroupedSessionViews, sortSessionViews } from '../daemon/sessions';
+import { countSessionStates } from '../protocol/count-session-states';
 import { DaemonError } from '../protocol/daemon-error';
 import type { EventMsg } from '../protocol/protocol';
+import { sortGroupedSessionViews } from '../protocol/sort-grouped-session-views';
+import { sortSessionViews } from '../protocol/sort-session-views';
+import type { AgentID } from '../shared/agent-id';
 import { loadConfig } from '../shared/config';
 import { makeSingleFlight } from '../shared/make-single-flight';
 import { bootDaemonClient } from './boot-daemon';

package/src/client/pick-tab-target.ts

@@ -1,5 +1,5 @@
-import type { SessionState } from '../daemon/sessions';
-import { sortSessionViews } from '../daemon/sessions';
+import type { SessionState } from '../protocol/session-state';
+import { sortSessionViews } from '../protocol/sort-session-views';
 
 interface TabCandidate {
   readonly id: string;

package/src/client/spawn-picker.ts

@@ -1,6 +1,6 @@
 import { homedir } from 'node:os';
-import type { AgentID } from '../agents/agent-adapter';
 import { DaemonError } from '../protocol/daemon-error';
+import type { AgentID } from '../shared/agent-id';
 import { loadConfig } from '../shared/config';
 import { collectAgentPicks } from './collect-agent-picks';
 import type { AgentPick } from './collect-agent-picks';

package/src/client/to-mirror-session.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
-import { toAgentID } from '../agents/agent-adapter';
-import type { AgentID } from '../agents/agent-adapter';
-import type { SessionState } from '../daemon/sessions';
+import type { SessionState } from '../protocol/session-state';
+import type { AgentID } from '../shared/agent-id';
+import { toAgentID } from '../shared/to-agent-id';
 
 export interface MirrorSession {
   id: string;

package/src/client/ui.ts

@@ -1,6 +1,6 @@
-import type { AgentID } from '../agents/agent-adapter';
-import { PINNED_GROUP_KEY } from '../daemon/sessions';
-import type { SessionState } from '../daemon/sessions';
+import { PINNED_GROUP_KEY } from '../protocol/pinned-group-key';
+import type { SessionState } from '../protocol/session-state';
+import type { AgentID } from '../shared/agent-id';
 import { RESET_INPUT_MODES } from '../shared/reset-input-modes';
 import { formatDir } from './dirs';
 import { formatOverlayAgentMark } from './format-overlay-agent-mark';

package/src/daemon/build-fleet-events.ts

@@ -18,18 +18,24 @@ export interface FleetEvent {
   readonly label?: string;
 }
 
+/**
+ * Builds the events from the sessions that may name them. Rows written
+ * before atc session ids stayed stable across restores carry an earlier atc
+ * id, so a session of `aliases` that holds a row's agent session id names
+ * it when no session holds the atc id; every session that may name a row
+ * may alias it unless the caller gives fewer.
+ */
 export function buildFleetEvents(
   rows: readonly StoredEvent[],
   sessions: readonly SessionDescriptor[],
+  aliases: readonly SessionDescriptor[] = sessions,
 ): FleetEvent[] {
   return rows.map((row) => {
-    // Rows written before atc session ids stayed stable across restores
-    // carry an earlier atc id, so the agent session id links them.
     const live =
+      sessions.find((s) => s.id === row.atcID) ??
       (row.agentSessionID === null
         ? undefined
-        : sessions.find((s) => s.agentSessionID === row.agentSessionID)) ??
-      sessions.find((s) => s.id === row.atcID);
+        : aliases.find((s) => s.agentSessionID === row.agentSessionID));
 
     return {
       cursor: encodeCursor({ kind: 'events', id: row.id }),

package/src/daemon/build-grant-from-fleet-entry.ts

@@ -0,0 +1,14 @@
+import type { FleetEntry } from '../store/fleet-entry';
+import { buildTargetIdentity } from './build-target-identity';
+import type { TargetGrant } from './target-access';
+
+/**
+ * The target a fleet row's session is bound to. A row that stores no
+ * target ran on the implicit `local` target, under its identity.
+ */
+export function buildGrantFromFleetEntry(entry: FleetEntry): TargetGrant {
+  return {
+    target: entry.target ?? 'local',
+    targetIdentity: entry.targetIdentity ?? buildTargetIdentity('local-pty', {}),
+  };
+}

package/src/daemon/build-message-trail-entry.ts

@@ -1,6 +1,6 @@
-import { truncateDetail } from '../agents/truncate-detail';
 import type { AgentSessionID } from '../shared/agent-session-id';
 import type { SessionID } from '../shared/session-id';
+import { truncateDetail } from '../shared/truncate-detail';
 import type { MessageRecord, MessageStatus } from '../store/message-record';
 import type { TrailEntry } from '../store/trail-entry';
 

package/src/daemon/build-report-trail-entry.ts

@@ -1,6 +1,6 @@
-import { truncateDetail } from '../agents/truncate-detail';
 import type { AgentSessionID } from '../shared/agent-session-id';
 import type { SessionID } from '../shared/session-id';
+import { truncateDetail } from '../shared/truncate-detail';
 import type { TrailEntry } from '../store/trail-entry';
 import type { NoteReport } from './parse-report';
 

package/src/daemon/build-report-view.ts

@@ -17,17 +17,23 @@ export interface ReportView {
   readonly complete: boolean;
 }
 
+/**
+ * Builds the view from the sessions that may name it. A row written before
+ * atc session ids stayed stable across restores carries an earlier atc id,
+ * so a session of `aliases` that holds its agent session id names it when
+ * no session holds the atc id. The alias only names the report: whoever
+ * checks who may read it checks the row's own atc id.
+ */
 export function buildReportView(
   stored: StoredReport,
   sessions: readonly SessionDescriptor[],
+  aliases: readonly SessionDescriptor[],
 ): ReportView {
-  // A row written before atc session ids stayed stable across restores
-  // carries an earlier atc id, so the agent session id links it.
   const live =
+    sessions.find((s) => s.id === stored.atcID) ??
     (stored.agentSessionID === null
       ? undefined
-      : sessions.find((s) => s.agentSessionID === stored.agentSessionID)) ??
-    sessions.find((s) => s.id === stored.atcID);
+      : aliases.find((s) => s.agentSessionID === stored.agentSessionID));
 
   return {
     report: encodeCursor({ kind: 'events', id: stored.id }),

package/src/daemon/build-scoped-context.ts

@@ -1,23 +1,25 @@
 import { DaemonError } from '../protocol/daemon-error';
 import type { SessionID } from '../shared/session-id';
 import { toSessionID } from '../shared/to-session-id';
+import { buildGrantFromFleetEntry } from './build-grant-from-fleet-entry';
 import { buildTargetForbiddenError } from './build-target-forbidden-error';
-import { buildTargetIdentity } from './build-target-identity';
-import type { DaemonContext } from './daemon-connection';
+import type { DaemonContext } from './daemon-context';
 import type { KeyedRequest } from './idempotency-ledger';
 import type { TargetAccess, TargetGrant } from './target-access';
 
 /**
  * The daemon as a principal with the given access sees it. Its keyed
  * spawns and messages hold their keys in the given namespace, apart from
- * every other namespace's. A session on a target outside the access does
- * not exist here: every lookup of it answers as a lookup of an unknown
- * session does, so the request's own handling refuses it with the words
- * and data it gives a session that never existed. Lists leave such
- * sessions out, and a spawn may use only a target the access holds, a
- * spawn's replayed answer included. A kill, or a pin, of a session whose
- * sub-sessions reach past the access is refused whole, before anything
- * changes.
+ * every other namespace's. A session exists here only when the access
+ * reaches every session in its tree: its top-level session and each
+ * sub-session of that one. Every lookup of any other session answers as a
+ * lookup of an unknown session does, so the request's own handling refuses
+ * it with the words and data it gives a session that never existed. Lists
+ * leave such sessions out, the directory list leaves out directories
+ * spawned only on targets outside the access, and a spawn may use only a
+ * target the access holds, a spawn's replayed answer included. A kill, a
+ * forget, or a change checks the tree in the same synchronous step that
+ * starts it, so a sub-session added after the check is never part of it.
  */
 export function buildScopedContext(
   ctx: DaemonContext,
@@ -28,11 +30,11 @@ export function buildScopedContext(
   const buildPrincipalKey = (keyed: KeyedRequest | null): KeyedRequest | null =>
     keyed === null ? null : { ...keyed, principal: keyNamespace };
 
-  const canSee = (id: SessionID): boolean => {
-    const grant = ctx.findSessionGrant(id);
+  const canSee = (id: SessionID): boolean => ctx.canSeeSession(id, access);
 
-    return grant !== null && access.canUse(grant);
-  };
+  // A request's own access narrowed to this one.
+  const mergeAccess = (outer: TargetAccess | null): TargetAccess =>
+    outer === null ? access : outer.merge(access);
 
   const canUseTarget = (target: string): boolean => {
     const targetIdentity = ctx.findTargetIdentity(target);
@@ -57,10 +59,7 @@ export function buildScopedContext(
       return null;
     }
 
-    return {
-      target: entry.target ?? 'local',
-      targetIdentity: entry.targetIdentity ?? buildTargetIdentity('local-pty', {}),
-    };
+    return buildGrantFromFleetEntry(entry);
   };
 
   // Throws the refusal a fresh spawn to the session's target gets when a
@@ -73,24 +72,9 @@ export function buildScopedContext(
     }
   };
 
-  // Throws the refusal of a change to a session whose sub-sessions the
-  // change would reach too when any of them is out of reach. The refusal
-  // holds only the session the caller sent, never a sub-session's id or
-  // how many there are.
-  const requireTreeInReach = (id: SessionID, action: string): void => {
-    if (ctx.collectChildIDs(id).every((child) => canSee(child))) {
-      return;
-    }
-
-    throw new DaemonError(
-      'target_forbidden',
-      `this client may not ${action} session '${id}': it has a sub-session on a target this client may not use`,
-      { session: id },
-    );
-  };
-
   return {
     ...ctx,
+    isSessionVisible: canSee,
     collectSessions: () => ctx.collectSessions().filter((session) => canSee(session.id)),
     collectAgents: () => {
       const list = ctx.collectAgents();
@@ -115,11 +99,12 @@ export function buildScopedContext(
         }),
       };
     },
-    collectFleet: async () => {
-      const fleet = await ctx.collectFleet();
+    collectSpawnDirs: (outer) => {
+      const merged = outer === null ? access : outer.merge(access);
 
-      return fleet.filter((entry) => canSee(entry.sessionID));
+      return ctx.collectSpawnDirs(merged);
     },
+    resolveSpawnParent: (id) => (canSee(id) ? ctx.resolveSpawnParent(id) : 'missing'),
     resolveSpawnTarget: (requested) => {
       if (requested !== undefined) {
         requireTarget(canUseTarget, requested);
@@ -132,12 +117,10 @@ export function buildScopedContext(
       return target;
     },
     spawnSession: async (plan, keyed) => {
-      let answer: Readonly<Record<string, unknown>>;
-
       // A held key's replay is checked against the target its session was
       // bound to, inside the spawn, before its answer leaves the daemon.
       try {
-        answer = await ctx.spawnSession(plan, buildPrincipalKey(keyed), access);
+        return await ctx.spawnSession(plan, buildPrincipalKey(keyed), access);
       } catch (error) {
         // A held key's refusal may carry the session its spawn made.
         if (error instanceof DaemonError && typeof error.data?.['effectRef'] === 'string') {
@@ -146,29 +129,17 @@ export function buildScopedContext(
 
         throw error;
       }
-
-      return answer;
     },
-    killSession: (id) => {
-      if (!canSee(id)) {
-        return Promise.resolve(false);
-      }
 
-      requireTreeInReach(id, 'kill');
-
-      return ctx.killSession(id);
-    },
-    updateSession: (id, name, pinned) => {
-      if (!canSee(id)) {
-        return false;
-      }
+    // The daemon's kill takes the session's sub-sessions before its first
+    // await, so the set it kills is the set this check saw.
+    killSession: (id) => (canSee(id) ? ctx.killSession(id) : Promise.resolve(false)),
 
-      if (pinned !== undefined) {
-        requireTreeInReach(id, 'pin');
-      }
-
-      return ctx.updateSession(id, name, pinned);
-    },
+    // A session out of reach answers before any confirm token is handed
+    // out or taken, so its host is never touched.
+    forgetSession: (id, confirmToken) =>
+      canSee(id) ? ctx.forgetSession(id, confirmToken) : Promise.resolve('missing' as const),
+    updateSession: (id, name, pinned) => canSee(id) && ctx.updateSession(id, name, pinned),
     ackSession: (id) => canSee(id) && ctx.ackSession(id),
     buildResumeCommand: (id) => (canSee(id) ? ctx.buildResumeCommand(id) : null),
     readSessionScreen: (id) =>
@@ -190,12 +161,16 @@ export function buildScopedContext(
     writeSessionLine: (sessionID, text) =>
       canSee(sessionID) ? ctx.writeSessionLine(sessionID, text) : 'missing',
     ejectSession: (id, prompt) => (canSee(id) ? ctx.ejectSession(id, prompt) : 'missing'),
-    adoptSession: (id, cols, rows) =>
-      canSee(id) ? ctx.adoptSession(id, cols, rows) : Promise.resolve('missing' as const),
+    adoptSession: (id, cols, rows, outer) =>
+      canSee(id)
+        ? ctx.adoptSession(id, cols, rows, mergeAccess(outer))
+        : Promise.resolve('missing' as const),
     resizeSession: (client, sessionID, dims) =>
       canSee(sessionID) && ctx.resizeSession(client, sessionID, dims),
-    readSessionRecord: (id) =>
-      canSee(id) ? ctx.readSessionRecord(id) : Promise.resolve('missing' as const),
+    readSessionRecord: (id, outer) =>
+      canSee(id)
+        ? ctx.readSessionRecord(id, mergeAccess(outer))
+        : Promise.resolve('missing' as const),
     loadSessionTranscript: (id, from, limit) =>
       canSee(id) ? ctx.loadSessionTranscript(id, from, limit) : Promise.resolve('missing' as const),
     readEvents: (afterID, limit, waitMs, sessionID, outer) => {
@@ -203,31 +178,43 @@ export function buildScopedContext(
 
       return ctx.readEvents(afterID, limit, waitMs, sessionID, merged);
     },
-    readReport: (id, outer) => {
-      const merged = outer === null ? access : outer.merge(access);
-
-      return ctx.readReport(id, merged);
-    },
-    writeSessionMessage: (sessionID, from, text, keyed) =>
+    readReport: (id, outer) => ctx.readReport(id, mergeAccess(outer)),
+    writeSessionMessage: (sessionID, from, text, keyed, outer) =>
       canSee(sessionID)
-        ? ctx.writeSessionMessage(sessionID, from, text, buildPrincipalKey(keyed))
+        ? ctx.writeSessionMessage(
+            sessionID,
+            from,
+            text,
+            buildPrincipalKey(keyed),
+            mergeAccess(outer),
+          )
         : Promise.resolve('missing' as const),
     readMessage: async (messageID, waitMs) => {
       // The owner is checked before any wait, so a message outside the
       // access answers at once, as an unknown message does.
       const view = await ctx.readMessage(messageID, 0);
 
-      if (view === null || !canSee(view.session)) {
+      // Only the session the message was sent to owns it here, never one
+      // that shares its agent session id.
+      if (view === null || view.session !== view.record.atcID || !canSee(view.session)) {
         return null;
       }
 
-      return waitMs === 0 ? view : ctx.readMessage(messageID, waitMs);
+      if (waitMs === 0) {
+        return view;
+      }
+
+      // The message may move to another session that holds its agent
+      // session id while the read waits.
+      const waited = await ctx.readMessage(messageID, waitMs);
+
+      return waited !== null && waited.session === waited.record.atcID ? waited : null;
     },
-    attachTap: (client, sessionID) =>
-      canSee(sessionID) ? ctx.attachTap(client, sessionID) : 'missing',
-    ackMessage: (client, sessionID, messageID) =>
+    attachTap: (client, sessionID, outer) =>
+      canSee(sessionID) ? ctx.attachTap(client, sessionID, mergeAccess(outer)) : 'missing',
+    ackMessage: (client, sessionID, messageID, outer) =>
       canSee(sessionID)
-        ? ctx.ackMessage(client, sessionID, messageID)
+        ? ctx.ackMessage(client, sessionID, messageID, mergeAccess(outer))
         : Promise.resolve('unknown' as const),
   };
 }

package/src/daemon/build-session-message-event.ts

@@ -1,7 +1,7 @@
-import { truncateDetail } from '../agents/truncate-detail';
 import { PROTOCOL_V } from '../protocol/protocol';
 import type { EventMsg } from '../protocol/protocol';
 import type { SessionID } from '../shared/session-id';
+import { truncateDetail } from '../shared/truncate-detail';
 import type { MessageRecord } from '../store/message-record';
 
 /**