letagents 0.12.11 → 0.12.12

package/dist/mcp/server/runtime/tool-surface-policy.js

@@ -0,0 +1,26 @@
+const TOOL_SURFACE_BY_PROFILE = {
+    supervised_room_turn: {
+        agentSessionLifecycle: false,
+        deliveryLoop: false,
+        onboarding: false,
+        rental: false,
+        roomResume: false,
+    },
+    autonomous_mcp_worker: {
+        agentSessionLifecycle: true,
+        deliveryLoop: true,
+        onboarding: true,
+        rental: true,
+        roomResume: true,
+    },
+    interactive_desktop: {
+        agentSessionLifecycle: true,
+        deliveryLoop: true,
+        onboarding: true,
+        rental: true,
+        roomResume: true,
+    },
+};
+export function toolSurfaceForExecutionProfile(profile) {
+    return TOOL_SURFACE_BY_PROFILE[profile];
+}

package/dist/mcp/server/runtime/worker-bearer.js

@@ -1,4 +1,5 @@
 export const LETAGENTS_AGENT_SESSION_BEARER_ENV = "LETAGENTS_AGENT_SESSION_BEARER";
+export const LETAGENTS_SUPERVISED_BOUNDED_TURNS_ENV = "LETAGENTS_SUPERVISED_BOUNDED_TURNS";
 export class WorkerBearerRuntimeConfigurationError extends Error {
     constructor(message) {
         super(message);
@@ -7,8 +8,21 @@ export class WorkerBearerRuntimeConfigurationError extends Error {
 }
 export function getWorkerBearerRuntime() {
     const bearer = process.env.LETAGENTS_AGENT_SESSION_BEARER?.trim();
-    if (!bearer) {
+    const supervised = process.env.LETAGENTS_SUPERVISED_BOUNDED_TURNS?.trim() === "1";
+    const profile = process.env.LETAGENTS_EXECUTION_PROFILE?.trim();
+    if (supervised !== (profile === "supervised_room_turn")) {
+        return {
+            mode: "invalid",
+            error: "LETAGENTS_EXECUTION_PROFILE=supervised_room_turn and LETAGENTS_SUPERVISED_BOUNDED_TURNS=1 must be configured together.",
+        };
+    }
+    if (!bearer && !supervised)
         return { mode: "owner" };
+    if (bearer && supervised) {
+        return {
+            mode: "invalid",
+            error: "Daemon-supervised bounded turns refuse LETAGENTS_AGENT_SESSION_BEARER; credentials must be borrowed from the exact supervisor generation.",
+        };
     }
     const apiUrl = process.env.LETAGENTS_API_URL?.trim();
     if (!apiUrl) {
@@ -36,13 +50,13 @@ export function getWorkerBearerRuntime() {
             error: "Worker bearer mode requires LETAGENTS_API_URL to be a valid HTTP(S) URL.",
         };
     }
-    if (process.env.LETAGENTS_TOKEN?.trim()) {
+    if (bearer && process.env.LETAGENTS_TOKEN?.trim()) {
         return {
             mode: "invalid",
             error: "Worker bearer mode refuses LETAGENTS_TOKEN. Remove the owner token from this process before starting the worker.",
         };
     }
-    return { mode: "worker", bearer };
+    return bearer ? { mode: "worker", bearer } : { mode: "supervised" };
 }
 export function requireValidWorkerBearerRuntime() {
     const runtime = getWorkerBearerRuntime();
@@ -51,17 +65,37 @@ export function requireValidWorkerBearerRuntime() {
     }
     return runtime;
 }
+export function isSupervisedBoundedTurn() {
+    return requireValidWorkerBearerRuntime().mode === "supervised";
+}
 export function workerModeDisabledToolResult(toolDescription = "This owner-auth onboarding tool") {
     const runtime = getWorkerBearerRuntime();
     if (runtime.mode === "invalid") {
         return { success: false, error: "worker_bearer_configuration_invalid", message: runtime.error };
     }
-    if (runtime.mode === "worker") {
+    if (runtime.mode === "worker" || runtime.mode === "supervised") {
         return {
             success: false,
-            error: "worker_bearer_mode",
-            message: `${toolDescription} is disabled while LETAGENTS_AGENT_SESSION_BEARER is configured.`,
+            error: runtime.mode === "worker" ? "worker_bearer_mode" : "supervised_bounded_mode",
+            message: runtime.mode === "worker"
+                ? `${toolDescription} is disabled while LETAGENTS_AGENT_SESSION_BEARER is configured.`
+                : `${toolDescription} is disabled during a daemon-supervised bounded turn.`,
         };
     }
     return null;
 }
+/**
+ * Supervised room delivery belongs to the desktop daemon. A bounded provider
+ * turn must never recreate the permanent MCP polling loop, even if its prompt
+ * asks it to do so.
+ */
+export function supervisedBoundedDeliveryDisabledToolResult(toolName = "wait_for_messages") {
+    if (process.env.LETAGENTS_SUPERVISED_BOUNDED_TURNS?.trim() !== "1") {
+        return null;
+    }
+    return {
+        success: false,
+        error: "supervised_bounded_delivery",
+        message: `${toolName} is disabled because supervised room delivery is owned by the desktop daemon.`,
+    };
+}

package/dist/mcp/server/runtime-contract.js

@@ -0,0 +1,27 @@
+import { registerTools } from "./register-tools.js";
+export const LETAGENTS_RUNTIME_CONTRACT_ARG = "--letagents-runtime-contract";
+/**
+ * Discover through the production registration path rather than maintaining a
+ * second capability list that can drift from the MCP server.
+ */
+export function registeredToolNames(profile, supervisedProvider = null) {
+    const names = new Set();
+    const recorder = {
+        tool(name) {
+            names.add(name);
+            return {};
+        },
+    };
+    registerTools(recorder, profile, supervisedProvider);
+    return [...names].sort();
+}
+export function letAgentsRuntimeContract() {
+    return {
+        format: 1,
+        profiles: {
+            cursor_supervised_room_turn: {
+                tools: registeredToolNames("supervised_room_turn", "cursor"),
+            },
+        },
+    };
+}

package/dist/mcp/server/runtime.js

@@ -1,14 +1,25 @@
 // Compatibility facade for MCP server runtime helpers. The implementation lives
 // in src/mcp/server/runtime/* so tool modules can import focused responsibilities
 // without turning this file back into the runtime god module.
+import { isLocalRoomStorageEnabled as isStoredLocalRoomStorageEnabled, touchRoomSession as touchStoredRoomSession, } from "../local-state.js";
+import { isSupervisedBoundedTurn } from "./runtime/worker-bearer.js";
+/** A daemon-supervised turn must always use its exact cloud worker route. */
+export async function isLocalRoomStorageEnabled(roomId) {
+    return !isSupervisedBoundedTurn() && isStoredLocalRoomStorageEnabled(roomId);
+}
+export function touchRoomSession(roomId, lastMessageId) {
+    if (!isSupervisedBoundedTurn())
+        touchStoredRoomSession(roomId, lastMessageId);
+}
 export { API_URL, ApiError, apiCall, getAuthorizationHeader, getLetagentsToken, isMissingRouteError, parseApiErrorPayload, resolveApiPath, } from "./runtime/api.js";
 export { clearAuthenticatedAccountCache, getAuthenticatedAccountCache, setAuthenticatedAccountCache, } from "./runtime/auth-cache.js";
 export { RepoRoomAuthRequiredError, maybeHandleRepoRoomAuthRequired, startPendingDeviceAuth, toRepoRoomAuthRequiredResult, } from "./runtime/device-auth.js";
 export { AGENT_INSTANCE_UUID, currentAgentIdentity, currentAgentIdentityKey, detectAgentIdeLabel, detectAgentRuntimeLabel, ensureAgentIdentity, getConversationIdentity, getSessionLivenessRegistration, resolveOwnerContext, setConversationIdentity, storeCurrentAgentIdentity, toPublicAgentIdentity, withAgentIdentity, } from "./runtime/identity.js";
-export { agentSessionCredentials, buildAgentDeliveryHeaders, ensureLocalWorkerAgentSession, getAgentSessionRepoBranch, identityFromAgentSession, requireWorkerAgentSession, resolveAgentSession, resolveWorkerToolIdentity, toPublicAgentSession, WORKER_BEARER_AGENT_SESSION_ID, } from "./runtime/agent-sessions.js";
+export { agentSessionCredentials, buildAgentDeliveryHeaders, ensureLocalWorkerAgentSession, getAgentSessionRepoBranch, identityFromAgentSession, requireWorkerAgentSession, resolveAgentSession, resolveClientRequestedBase, resolveWorkerToolIdentity, toPublicAgentSession, WORKER_BEARER_AGENT_SESSION_ID, } from "./runtime/agent-sessions.js";
 export { appendIncludePromptOnly, getLastMessageId, normalizeOptionalToolString, toAgentReadableMessages, withJoinRoomAgentPrompt, } from "./runtime/messages.js";
-export { currentRoom, attachMcpServer, getFallbackProjectId, getTargetRoomId, rememberRoom, shutdownRuntime, toPublicRoomResponse, toPublicRoomState, toPublicStoredRoomSession, toRoomState, touchCurrentRoom, withCanonicalRoomLink, } from "./runtime/room-state.js";
+export { currentRoom, attachMcpServer, getCurrentSupervisedRoomAuthority, getFallbackProjectId, getTargetRoomId, rememberRoom, runWithCurrentSupervisedRoom, shutdownRuntime, toPublicRoomResponse, toPublicCurrentRoomState, toPublicRoomState, toPublicStoredRoomSession, toRoomState, touchCurrentRoom, withCanonicalRoomLink, } from "./runtime/room-state.js";
 export { getRememberedRoomPresence, heartbeatRoomPresence, syncRoomPresence, } from "./runtime/presence.js";
 export { roomScopedApiCall } from "./runtime/room-api.js";
+export { borrowSupervisedWorkerCredential, borrowCurrentSupervisedWorkerCredential, bindSupervisedWorkerSession, checkpointSupervisedWorkerCursor, isRetryableSupervisorBridgeError, scheduleSupervisedWorkerCursorCheckpoint, resolveCurrentSupervisedWorkerSession, } from "./runtime/supervisor-bridge.js";
 export { autoJoinFromContext, buildJoinResponse, createInviteRoom, getCurrentLiveSessionPayload, joinInviteCode, joinNamedRoom, joinRoomIdentifier, joinRoomIdentifierWithoutImplicitGitRefCreate, normalizeJoinSessionMode, } from "./runtime/rooms.js";
-export { clearPendingDeviceAuth, clearStoredAuth, clearStoredAuth as clearStoredAuthorization, endStoredAgentSession, getCurrentAgentSession, getLocalStatePath, getPendingDeviceAuth, getStoredAgentIdentity, getStoredAgentSession, getStoredAuth, getStoredCurrentRoom, getStoredRoomSession, listStoredCodexLiveSessions, saveAgentSession, setPendingDeviceAuth, setStoredAuth, setStoredAgentIdentity, touchRoomSession, addLocalChatMessage, addLocalTask, claimLocalTaskReviewLease, getLatestLocalChatMessages, getLocalChatMessages, getLocalTask, listLocalTasks, isLocalChatStorageEnabled, isLocalRoomStorageEnabled, resolveLocalRoomStorageIdentifiers, releaseLocalTaskReviewLease, updateLocalTask, waitForLocalChatMessages, } from "../local-state.js";
+export { clearPendingDeviceAuth, clearStoredAuth, clearStoredAuth as clearStoredAuthorization, endStoredAgentSession, getCurrentAgentSession, getLocalStatePath, getPendingDeviceAuth, getStoredAgentIdentity, getStoredAgentSession, getStoredAgentSessionsForRoomIdentity, getStoredAuth, getStoredCurrentRoom, getStoredRoomSession, listStoredCodexLiveSessions, saveAgentSession, setPendingDeviceAuth, setStoredAuth, setStoredAgentIdentity, addLocalChatMessage, addLocalTask, claimLocalTaskReviewLease, getLatestLocalChatMessages, getLocalChatMessages, getLocalTask, listLocalTasks, isLocalChatStorageEnabled, resolveLocalRoomStorageIdentifiers, releaseLocalTaskReviewLease, updateLocalTask, waitForLocalChatMessages, } from "../local-state.js";

package/dist/mcp/server/supervised-tool-facade.js

@@ -0,0 +1,105 @@
+import { runWithCurrentSupervisedRoom } from "./runtime/room-state.js";
+import { completeCurrentSupervisedEffect, prepareCurrentSupervisedEffect, } from "./runtime/supervisor-bridge.js";
+const READ_TOOLS = new Set([
+    "get_current_room",
+    "check_repo",
+    "check_repo_visibility",
+    "read_messages",
+    "wait_for_messages",
+    "get_board",
+    "get_board_settings",
+    "get_room_artifacts",
+    "get_room_events",
+    "list_board_intents",
+    "get_onboarding_status",
+    "status_local_codex_session",
+    "rental_list_requests",
+]);
+function instruction(text, data = {}) {
+    const payload = { ...data, instruction: text };
+    return {
+        content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
+        structuredContent: payload,
+    };
+}
+const productionDependencies = {
+    prepareEffect: prepareCurrentSupervisedEffect,
+    completeEffect: completeCurrentSupervisedEffect,
+    withRoom: runWithCurrentSupervisedRoom,
+};
+export function profileAwareToolServer(server, profile, dependencies = productionDependencies, supervisedProvider = process.env.LETAGENTS_SUPERVISOR_PROVIDER?.trim() || null) {
+    if (profile !== "supervised_room_turn")
+        return server;
+    return new Proxy(server, {
+        get(target, property, receiver) {
+            if (property !== "tool") {
+                const value = Reflect.get(target, property, receiver);
+                return typeof value === "function" ? value.bind(target) : value;
+            }
+            return (name, ...registration) => {
+                const callback = registration.at(-1);
+                if (typeof callback !== "function")
+                    throw new Error(`Tool ${name} has no callback.`);
+                const wrapped = async (...call) => {
+                    const extra = (call.at(-1) ?? {});
+                    const input = call.length > 1 ? call[0] : {};
+                    if (extra.requestId === undefined || extra.requestId === null || String(extra.requestId).trim() === "") {
+                        throw new Error(`Supervised tool ${name} is missing its MCP request id; refusing an effect that cannot be deduplicated safely.`);
+                    }
+                    const prepared = await dependencies.prepareEffect({
+                        toolName: name,
+                        input,
+                        mcpRequestId: String(extra.requestId),
+                        mutation: !READ_TOOLS.has(name),
+                    });
+                    return dependencies.withRoom(prepared.roomId, async () => {
+                        if (prepared.state === "completed")
+                            return prepared.result;
+                        if (prepared.state === "uncertain") {
+                            return instruction("This mutating tool may already have completed, but its result was not durably checkpointed. Verify the external state before issuing a new request; this exact request will not be repeated automatically.", {
+                                code: "SUPERVISED_EFFECT_OUTCOME_UNCERTAIN",
+                                effect_id: prepared.effectId,
+                                detail: prepared.error,
+                            });
+                        }
+                        if (prepared.action === "use_final_answer") {
+                            return instruction(supervisedProvider === "cursor"
+                                ? "Do not send the activating room reply with a message tool. Keep working, then record the one public answer with complete_room_turn; Cursor's aggregate final text is live evidence only."
+                                : "Do not send the activating room reply with a message tool. Return it as your final answer; the daemon will publish it exactly once.", {
+                                code: "USE_FINAL_ANSWER",
+                                source_message_id: prepared.sourceMessageId,
+                            });
+                        }
+                        if (prepared.action === "room_move_prepared") {
+                            return instruction(supervisedProvider === "cursor"
+                                ? "The room move is prepared. Finish the work, then call complete_room_turn with the public response; the daemon will publish that proposal and then move the agent."
+                                : "The room move is prepared. Finish this turn normally; the daemon will publish the activating response and then move the agent.", {
+                                code: "ROOM_MOVE_PREPARED",
+                                destination_room: prepared.destinationRoom,
+                            });
+                        }
+                        let result;
+                        try {
+                            result = await callback(...call);
+                        }
+                        catch (error) {
+                            try {
+                                await dependencies.completeEffect({ effectId: prepared.effectId, error: error instanceof Error ? error.message : String(error) });
+                            }
+                            catch {
+                                // Preserve the callback error. An unacknowledged journal entry
+                                // remains executing, which is safer than repeating the effect.
+                            }
+                            throw error;
+                        }
+                        // Completion transport is deliberately outside the callback catch.
+                        // A reporting failure must never relabel a successful action failed.
+                        await dependencies.completeEffect({ effectId: prepared.effectId, result });
+                        return result;
+                    });
+                };
+                return target.tool.call(target, name, ...registration.slice(0, -1), wrapped);
+            };
+        },
+    });
+}

package/dist/mcp/server/tools/agent-sessions.js

@@ -2,9 +2,9 @@ import { z } from "zod";
 import { scheduleCodexRuntimeStreamBridgeBind, } from "../../codex-session.js";
 import { getManagedAgentProvider, toManagedAgentStartResponse, } from "../../managed-agent-providers.js";
 import { encodeRoomIdPath, looksLikeInviteCode, normalizeInviteCode } from "../../room-id.js";
-import { AGENT_INSTANCE_UUID, RepoRoomAuthRequiredError, apiCall, agentSessionCredentials, currentRoom, detectAgentIdeLabel, detectAgentRuntimeLabel, endStoredAgentSession, ensureAgentIdentity, getSessionLivenessRegistration, getAgentSessionRepoBranch, getStoredAgentSession, getTargetRoomId, ensureLocalWorkerAgentSession, isLocalRoomStorageEnabled, joinRoomIdentifier, resolveLocalRoomStorageIdentifiers, saveAgentSession, toPublicAgentSession, toPublicRoomState, toRepoRoomAuthRequiredResult, withAgentIdentity, resolveWorkerToolIdentity, } from "../runtime.js";
+import { AGENT_INSTANCE_UUID, RepoRoomAuthRequiredError, apiCall, agentSessionCredentials, currentRoom, detectAgentIdeLabel, detectAgentRuntimeLabel, endStoredAgentSession, ensureAgentIdentity, getSessionLivenessRegistration, getAgentSessionRepoBranch, getStoredAgentSession, getStoredAgentSessionsForRoomIdentity, getTargetRoomId, ensureLocalWorkerAgentSession, isLocalRoomStorageEnabled, joinRoomIdentifier, resolveLocalRoomStorageIdentifiers, resolveClientRequestedBase, saveAgentSession, toPublicAgentSession, toPublicRoomState, toRepoRoomAuthRequiredResult, withAgentIdentity, resolveWorkerToolIdentity, } from "../runtime.js";
 import { requireValidWorkerBearerRuntime, workerModeDisabledToolResult, } from "../runtime/worker-bearer.js";
-import { bindSupervisedWorkerSession } from "../runtime/supervisor-bridge.js";
+import { bindSupervisedWorkerSessionWithContext } from "../runtime/supervisor-bridge.js";
 export function registerAgentSessionTools(server) {
     // -- register_agent_session -------------------------------------------------
     server.tool("register_agent_session", "Register this MCP client as an explicit room agent session. Unregistered MCP traffic is treated as controller traffic and stays out of the connected-agent roster.", {
@@ -27,8 +27,29 @@ export function registerAgentSessionTools(server) {
         cwd: z
             .string()
             .optional()
-            .describe("Working directory used to detect the worker's active git branch. Defaults to the MCP server's working directory."),
+            .describe("Worker working directory used for branch detection and exact supervised Codex binding. Defaults to the MCP server's working directory."),
     }, async ({ room_id, session_kind, runtime, display_name, cwd }) => {
+        const workerRuntime = requireValidWorkerBearerRuntime();
+        if (workerRuntime.mode === "supervised") {
+            // Resolve before currentRoom, config, branch, or local storage. The
+            // daemon context is the only authority for a bounded worker's room.
+            const { agentSession } = await resolveWorkerToolIdentity({ roomId: room_id?.trim() || null });
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify({
+                            success: true,
+                            worker_bearer_mode: false,
+                            supervised_bounded_mode: true,
+                            agent_session: toPublicAgentSession(agentSession),
+                            agent_session_id: agentSession.session_id,
+                            use_agent_session_id: "This exact daemon-supervised agent_session_id may be passed to room tools. The credential remains daemon-private.",
+                        }, null, 2),
+                    },
+                ],
+            };
+        }
         const targetRoomId = getTargetRoomId(room_id);
         if (!targetRoomId) {
             return {
@@ -70,7 +91,7 @@ export function registerAgentSessionTools(server) {
         }
         const { cloudRoomId } = await resolveLocalRoomStorageIdentifiers(targetRoomId);
         const apiRoomId = cloudRoomId || targetRoomId;
-        if (requireValidWorkerBearerRuntime().mode === "worker") {
+        if (workerRuntime.mode === "worker") {
             // The supplied bearer is issued for an existing server-side agent
             // session. Do not call the owner-only registration endpoint or write
             // any session credential to local storage.
@@ -81,7 +102,8 @@ export function registerAgentSessionTools(server) {
                         type: "text",
                         text: JSON.stringify({
                             success: true,
-                            worker_bearer_mode: true,
+                            worker_bearer_mode: workerRuntime.mode === "worker",
+                            supervised_bounded_mode: false,
                             agent_session: toPublicAgentSession(agentSession),
                             agent_session_id: agentSession.session_id,
                             use_agent_session_id: "This local worker-bearer session marker may be passed to room tools. The supplied bearer remains the only server credential.",
@@ -104,6 +126,22 @@ export function registerAgentSessionTools(server) {
                 ],
             };
         }
+        // Stable-base signal (task_66): declare the intent behind display_name
+        // so the server can converge a replayed decorated label without ever
+        // guessing from numeric shape.
+        const priorRoomSessions = getStoredAgentSessionsForRoomIdentity(apiRoomId, identity.canonical_key);
+        const requestedSessionKind = session_kind ?? "worker";
+        const requestedBaseDisplayName = resolveClientRequestedBase({
+            explicitDisplayName: display_name,
+            identityDisplayName: identity.display_name,
+            priorSessions: priorRoomSessions,
+        });
+        const replacementSession = requestedSessionKind === "worker"
+            ? priorRoomSessions.find((session) => !session.ended_at
+                && session.session_kind === "worker"
+                && session.agent_instance_id === AGENT_INSTANCE_UUID
+                && Boolean(session.session_token)) ?? null
+            : null;
         const created = await apiCall(`/rooms/${encodeRoomIdPath(apiRoomId)}/agent-sessions`, {
             method: "POST",
             body: JSON.stringify({
@@ -112,10 +150,13 @@ export function registerAgentSessionTools(server) {
                 ide_label: identity.ide_label ?? detectAgentIdeLabel(),
                 agent_instance_id: AGENT_INSTANCE_UUID,
                 display_name: display_name?.trim() || identity.display_name,
+                requested_base_display_name: requestedBaseDisplayName,
                 session_kind: session_kind ?? "worker",
                 runtime: requestedRuntime,
                 repo_branch: repoBranch,
                 registration_liveness: getSessionLivenessRegistration(requestedRuntime),
+                replace_agent_session_id: replacementSession?.session_id ?? null,
+                replace_agent_session_token: replacementSession?.session_token ?? null,
             }),
         });
         const sessionId = typeof created.session_id === "string" ? created.session_id : "";
@@ -123,7 +164,10 @@ export function registerAgentSessionTools(server) {
         if (!sessionId || !sessionToken) {
             throw new Error("Agent session registration response was missing session credentials.");
         }
-        const session = saveAgentSession({
+        if (replacementSession) {
+            endStoredAgentSession(replacementSession.session_id, typeof created.created_at === "string" ? created.created_at : new Date().toISOString());
+        }
+        let session = saveAgentSession({
             session_id: sessionId,
             session_token: sessionToken,
             room_id: typeof created.room_id === "string" ? created.room_id : apiRoomId,
@@ -138,6 +182,11 @@ export function registerAgentSessionTools(server) {
             agent_key: typeof created.agent_key === "string" ? created.agent_key : identity.canonical_key,
             agent_instance_id: typeof created.agent_instance_id === "string" ? created.agent_instance_id : AGENT_INSTANCE_UUID,
             display_name: typeof created.display_name === "string" ? created.display_name : identity.display_name,
+            // Prefer the server-recorded allocation base; fall back to the base we
+            // declared so a later resume still replays a stable signal.
+            requested_base_display_name: (typeof created.assigned_base_display_name === "string" && created.assigned_base_display_name.trim())
+                || requestedBaseDisplayName
+                || null,
             owner_label: typeof created.owner_label === "string" ? created.owner_label : identity.owner_label,
             ide_label: typeof created.ide_label === "string" ? created.ide_label : identity.ide_label ?? detectAgentIdeLabel(),
             repo_branch: typeof created.repo_branch === "string" ? created.repo_branch : repoBranch,
@@ -146,7 +195,13 @@ export function registerAgentSessionTools(server) {
             last_seen_at: typeof created.last_seen_at === "string" ? created.last_seen_at : new Date().toISOString(),
             ended_at: typeof created.ended_at === "string" ? created.ended_at : null,
         });
-        await bindSupervisedWorkerSession(session);
+        const supervisorBinding = await bindSupervisedWorkerSessionWithContext(session, process.env, { cwd: cwd?.trim() || process.cwd() });
+        if (supervisorBinding.supervisorContextCwd) {
+            session = saveAgentSession({
+                ...session,
+                supervisor_context_cwd: supervisorBinding.supervisorContextCwd,
+            });
+        }
         scheduleCodexRuntimeStreamBridgeBind(session);
         return {
             content: [
@@ -167,6 +222,18 @@ export function registerAgentSessionTools(server) {
         room_id: z.string().optional().describe("Canonical room ID. Defaults to the current room or the stored session room."),
         agent_session_id: z.string().optional().describe("Registered agent session to disconnect."),
     }, async ({ room_id, agent_session_id }) => {
+        if (requireValidWorkerBearerRuntime().mode === "supervised") {
+            return {
+                content: [{
+                        type: "text",
+                        text: JSON.stringify({
+                            success: false,
+                            error: "supervised_bounded_mode",
+                            message: "Agent-session disconnection is owned by the desktop supervisor during a bounded turn.",
+                        }, null, 2),
+                    }],
+            };
+        }
         let targetRoomId = getTargetRoomId(room_id);
         const localSession = agent_session_id
             ? getStoredAgentSession(agent_session_id)

package/dist/mcp/server/tools/messages/index.js

@@ -7,8 +7,9 @@ export function registerStatusTools(server) {
     registerPostStatusTool(server);
     registerPostReasoningTool(server);
 }
-export function registerMessageTools(server) {
+export function registerMessageTools(server, options = {}) {
     registerSendMessageTool(server);
     registerReadMessagesTool(server);
-    registerWaitForMessagesTool(server);
+    if (options.includeDeliveryLoop !== false)
+        registerWaitForMessagesTool(server);
 }

package/dist/mcp/server/tools/messages/send-tool.js

@@ -112,6 +112,9 @@ async function sendMessageFromTool(input) {
     });
     touchCurrentRoom(typeof message.id === "string" ? message.id : undefined);
     await syncRoomPresence(targetRoomId ?? currentRoom?.room_id ?? null, identity, getRememberedRoomPresence(targetRoomId ?? currentRoom?.room_id ?? null, identity), agentSession);
+    // The `replied` receipt transition is server-owned: message creation marks
+    // the publisher's receipt on the reply target atomically with the reply
+    // itself, for MCP workers and supervised daemon publications alike.
     return jsonToolResponse({
         ...message,
         agent_identity: toPublicAgentIdentity(identity),

package/dist/mcp/server/tools/messages/wait-tool.js

@@ -1,8 +1,8 @@
 import { z } from "zod";
 import { getPollTimeoutCapMs } from "../../../../shared/poll-timeout-cap.js";
 import { encodeRoomIdPath } from "../../../room-id.js";
-import { appendIncludePromptOnly, buildAgentDeliveryHeaders, currentRoom, ensureAgentIdentity, getFallbackProjectId, getLatestLocalChatMessages, getLocalChatMessages, getLastMessageId, getRememberedRoomPresence, getTargetRoomId, identityFromAgentSession, isLocalRoomStorageEnabled, listLocalTasks, resolveLocalRoomStorageIdentifiers, resolveAgentSession, roomScopedApiCall, syncRoomPresence, toAgentReadableMessages, touchRoomSession, WORKER_BEARER_AGENT_SESSION_ID, waitForLocalChatMessages, } from "../../runtime.js";
-import { requireValidWorkerBearerRuntime } from "../../runtime/worker-bearer.js";
+import { agentSessionCredentials, appendIncludePromptOnly, buildAgentDeliveryHeaders, bindSupervisedWorkerSession, scheduleSupervisedWorkerCursorCheckpoint, currentRoom, ensureAgentIdentity, getFallbackProjectId, getLatestLocalChatMessages, getLocalChatMessages, getLastMessageId, getRememberedRoomPresence, getTargetRoomId, identityFromAgentSession, isLocalRoomStorageEnabled, listLocalTasks, resolveLocalRoomStorageIdentifiers, resolveAgentSession, roomScopedApiCall, syncRoomPresence, toAgentReadableMessages, touchRoomSession, WORKER_BEARER_AGENT_SESSION_ID, waitForLocalChatMessages, } from "../../runtime.js";
+import { requireValidWorkerBearerRuntime, supervisedBoundedDeliveryDisabledToolResult, } from "../../runtime/worker-bearer.js";
 import { attachAgentMessageActivations } from "../../../../shared/activation-routing.js";
 import { findLocalMessageById, findRemoteMessageById } from "./message-lookup.js";
 import { fetchRecentRemoteMessages } from "./read-tool.js";
@@ -235,7 +235,7 @@ export async function collectThreadContextMessages(input) {
     return contextMessages;
 }
 export function registerWaitForMessagesTool(server) {
-    server.tool("wait_for_messages", "Wait for new messages in a Let Agents Chat room (HTTP long-poll). Messages labeled activation.for_current_agent.decision=\"silent\" are skipped for the current worker; when last_observed_message_id is present, use it as cursor progress even if messages is empty. Threaded replies include thread_parent_id/thread.root_message_id; use send_thread_message with that id to keep focused side discussion out of the main room. For multi-hour runs, call in a loop: always pass after_message_id from the last message you processed or last_observed_message_id so an empty result means 'nothing new yet', not 'stop working'. If someone posted a premature 'I will wait' closing line, use send_message with a brief continue instruction. Per-call wait is capped (default max 180s unless LETAGENTS_POLL_MAX_MS is set on API and MCP).", {
+    server.tool("wait_for_messages", "Wait for new messages in a Let Agents Chat room (HTTP long-poll). Messages labeled activation.for_current_agent.decision=\"silent\" are skipped for the current worker; when last_observed_message_id is present, use it as cursor progress even if messages is empty. Threaded replies include thread_parent_id/thread.root_message_id; use send_thread_message with that id to keep focused side discussion out of the main room. For multi-hour runs, call in a loop: always pass after_message_id from the last message you processed or last_observed_message_id so an empty result means 'nothing new yet', not 'stop working'. Legacy/manual room workers may send a brief continue instruction when another legacy/manual participant posts a premature 'I will wait' closing line. Never send that nudge to or about a daemon-supervised participant, and daemon-supervised workers must not emit it; their supervisor owns wake and retry. Per-call wait is capped (default max 180s unless LETAGENTS_POLL_MAX_MS is set on API and MCP).", {
         room_id: z.string().optional().describe("Canonical room ID. Defaults to the current room."),
         after_message_id: z
             .string()
@@ -250,12 +250,32 @@ export function registerWaitForMessagesTool(server) {
             .optional()
             .describe("Registered agent session to use. Without this, the MCP transport is treated as controller traffic and is hidden from connected-agent activity."),
     }, async ({ room_id, after_message_id, timeout, agent_session_id }) => {
+        // This guard intentionally runs before room resolution, identity setup,
+        // local SQLite reads, presence writes, or HTTP traffic. In supervised
+        // bounded-turn mode the daemon is the sole inbox owner.
+        const boundedDeliveryDisabled = supervisedBoundedDeliveryDisabledToolResult();
+        if (boundedDeliveryDisabled) {
+            return jsonToolResponse(boundedDeliveryDisabled);
+        }
         const targetRoomId = getTargetRoomId(room_id);
         const targetProjectId = getFallbackProjectId();
         const localRoomId = targetRoomId ?? currentRoom?.room_id ?? targetProjectId;
         const identity = await ensureAgentIdentity();
         const sessionRoomId = targetRoomId ?? currentRoom?.room_id ?? localRoomId ?? null;
         const agentSession = resolveWaitAgentSession(sessionRoomId, agent_session_id);
+        if (agentSession) {
+            // Registration (or a successor generation) must bind strictly once.
+            // Later waits use a read-only exact verification capped at 250ms, so a
+            // wedged daemon cannot consume the room-poll budget and an old worker
+            // cannot read after a successor generation takes ownership.
+            await bindSupervisedWorkerSession(agentSession, process.env, { allowConfirmedFastPath: true });
+            // A cursor is acknowledged only when the worker explicitly uses it to
+            // request the next page. Persisting a cursor from the response we are
+            // still constructing could skip a message if serialization, presence,
+            // or the provider turn fails afterward.
+            if (after_message_id)
+                scheduleSupervisedWorkerCursorCheckpoint(agentSession, after_message_id);
+        }
         const maxPollMs = getPollTimeoutCapMs();
         const serverTimeout = Math.min(Math.max(timeout || DEFAULT_POLL_TIMEOUT_MS, 1000), maxPollMs);
         if (localRoomId && await isLocalRoomStorageEnabled(localRoomId)) {
@@ -289,7 +309,8 @@ export function registerWaitForMessagesTool(server) {
                 includeTaskOwnerLeases: !replayingExistingMessages,
             });
             const routing = filterSilentActivationMessages(messages);
-            touchRoomSession(effectiveLocalRoomId, routing.last_observed_message_id ?? getLastMessageId(result));
+            const observedCursor = routing.last_observed_message_id ?? getLastMessageId(result);
+            touchRoomSession(effectiveLocalRoomId, observedCursor);
             const threadContext = await collectThreadContextMessages({
                 messages: routing.messages,
                 localRoomId: effectiveLocalRoomId,
@@ -395,7 +416,37 @@ export function registerWaitForMessagesTool(server) {
             output[targetRoomId ? "room_id" : "project_id"] = roomIdFromResponse;
         }
         if (targetRoomId) {
-            touchRoomSession(targetRoomId, routing.last_observed_message_id ?? getLastMessageId(output));
+            const observedCursor = routing.last_observed_message_id ?? getLastMessageId(output);
+            touchRoomSession(targetRoomId, observedCursor);
+            if (allMessages.length > 0 && agentSession) {
+                const firstMsg = allMessages[0];
+                const lastMsg = allMessages[allMessages.length - 1];
+                if (typeof firstMsg?.id === "string" && typeof lastMsg?.id === "string") {
+                    try {
+                        await roomScopedApiCall({
+                            room_id: targetRoomId,
+                            project_id: targetProjectId,
+                            room_path: (r) => `/rooms/${encodeRoomIdPath(r)}/agents/self/observation`,
+                            project_path: (p) => `/projects/${encodeURIComponent(p)}/agents/self/observation`,
+                            options: {
+                                method: "PUT",
+                                body: JSON.stringify({
+                                    first_message_id: firstMsg.id,
+                                    last_message_id: lastMsg.id,
+                                    ...agentSessionCredentials(agentSession),
+                                }),
+                            },
+                        });
+                    }
+                    catch {
+                        // Non-blocking telemetry
+                    }
+                }
+            }
+            // Delivery alone is observation evidence (the span above), never a
+            // "responding" receipt: an agent that ignores an activation must not
+            // present as responding. Receipts advance only on real transitions —
+            // send-tool marks "replied" when the agent actually publishes a reply.
         }
         await syncRoomPresence(targetRoomId ?? currentRoom?.room_id ?? null, identity, getRememberedRoomPresence(targetRoomId ?? currentRoom?.room_id ?? null, agentSession ? identityFromAgentSession(agentSession) : identity), agentSession);
         return jsonToolResponse(output);

package/dist/mcp/server/tools/onboarding/status-tool.js

@@ -56,16 +56,17 @@ export function registerGetOnboardingStatusTool(server) {
         if (workerRuntime.mode === "invalid") {
             return jsonTextResponse({ success: false, error: "worker_bearer_configuration_invalid", message: workerRuntime.error });
         }
-        if (workerRuntime.mode === "worker") {
+        if (workerRuntime.mode === "worker" || workerRuntime.mode === "supervised") {
             return jsonTextResponse({
                 api_url: API_URL,
-                worker_bearer_mode: true,
+                worker_bearer_mode: workerRuntime.mode === "worker",
+                supervised_bounded_mode: workerRuntime.mode === "supervised",
                 authenticated: true,
-                auth_source: "worker_bearer",
+                auth_source: workerRuntime.mode === "worker" ? "worker_bearer" : "daemon_supervised",
                 account: null,
                 pending_device_auth: null,
                 next_step: "join_room",
-                note: "Owner-auth onboarding and saved-auth state are disabled in worker bearer mode.",
+                note: "Owner-auth onboarding and saved-auth state are disabled in worker credential mode.",
             });
         }
         const workingDir = cwd || process.cwd();