openmausbot 0.1.85 → 0.1.86

package/dist-server/server/decision-log.js

@@ -15,44 +15,88 @@
 // credentials included), and fire-and-forget — an audit log must never
 // take down the decision it is auditing.
 //
+// Layout and retention follow the usage ledger: one file per UTC month under
+// <data>/decisions/YYYY-MM.ndjson, and a month file is deleted only once the
+// whole month is older than the retention window (default 180 days, config
+// `decisions.retentionDays` or OMB_DECISION_RETENTION_DAYS), so at least that
+// much history is always kept. Older servers wrote one decisions.ndjson that
+// rotated to .1 at 4 MB; both are still read, never written, and removed by
+// the same window once their last row is older than it.
+//
 // Deliberately NOT covered: ask_bot peer-approval cards. They never cross
 // the runtime bus (peer-approval.ts appends its cards straight to the
 // store), so wiring them here would mean a second, parallel tap — a
 // separate change if it earns its keep.
-import { readFileSync } from "node:fs";
-import { appendFile, rename, stat } from "node:fs/promises";
-import { join } from "node:path";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { readdirSync, readFileSync } from "node:fs";
+import { appendFile, mkdir, readdir, stat, unlink } from "node:fs/promises";
+import { basename, join } from "node:path";
 import { redactSecrets } from "./redact.js";
-const FILE_NAME = "decisions.ndjson";
-// Rotation is logrotate at its simplest: when the live file crosses the cap
-// it becomes `.1` (clobbering the previous `.1`) and a fresh file starts.
-// Total disk is bounded at ~2× the cap; at a few hundred bytes per row that
-// is years of human-scale approvals, and anything fancier — dated segments,
-// compression — is more machinery than an audit trail this size warrants.
-const MAX_BYTES = 4 * 1024 * 1024;
+import { csvCell } from "./usage-ledger.js";
+const DIR = "decisions";
+const LEGACY_FILE = "decisions.ndjson";
+const MONTH_FILE = /^(\d{4})-(\d{2})\.ndjson$/;
+const DAY_MS = 24 * 60 * 60_000;
+const PRUNE_EVERY_MS = 60 * 60_000;
+export const DEFAULT_DECISION_RETENTION_DAYS = 180;
+export const MAX_DECISION_RETENTION_DAYS = 3650;
 const writeQueues = new Map();
-async function writeDecision(dataDir, row, maxBytes) {
-    const file = join(dataDir, FILE_NAME);
-    try {
-        if ((await stat(file)).size >= maxBytes)
-            await rename(file, `${file}.1`);
-    }
-    catch {
-        /* no live file yet — nothing to rotate */
+const lastPrune = new Map();
+let retentionDays = () => DEFAULT_DECISION_RETENTION_DAYS;
+/** The server binds its configured window once; see decisionRetentionDays. */
+export function bindDecisionRetention(provider) {
+    retentionDays = provider;
+}
+/** The window in force now. The admin activity log (admin-activity.ts)
+ * keeps its months for the same time, so one setting covers both. */
+export function boundRetentionDays() {
+    return retentionDays();
+}
+/** The retention window in days: OMB_DECISION_RETENTION_DAYS when it is a
+ * whole number in range, else the configured value, else 180. */
+export function decisionRetentionDays(configured, env = process.env) {
+    const fromEnv = env.OMB_DECISION_RETENTION_DAYS?.trim();
+    const parsed = fromEnv ? Number(fromEnv) : NaN;
+    if (Number.isInteger(parsed) && parsed >= 1 && parsed <= MAX_DECISION_RETENTION_DAYS)
+        return parsed;
+    if (typeof configured === "number" && Number.isInteger(configured) && configured >= 1 && configured <= MAX_DECISION_RETENTION_DAYS)
+        return configured;
+    return DEFAULT_DECISION_RETENTION_DAYS;
+}
+const actorScope = new AsyncLocalStorage();
+/** Run `work` as a person's card answer: every `source: "user"` row it
+ * writes names `actor`, without each resolver having to thread it through. */
+export function withDecisionActor(actor, work) {
+    return actorScope.run(actor, work);
+}
+function monthKey(at) {
+    return `${at.getUTCFullYear()}-${String(at.getUTCMonth() + 1).padStart(2, "0")}`;
+}
+export function decisionFileFor(dataDir, at) {
+    return join(dataDir, DIR, `${monthKey(at)}.ndjson`);
+}
+async function writeDecision(dataDir, record) {
+    const at = new Date(record.at);
+    await mkdir(join(dataDir, DIR), { recursive: true, mode: 0o700 });
+    await appendFile(decisionFileFor(dataDir, at), JSON.stringify(record) + "\n", { mode: 0o600 });
+    if (at.getTime() - (lastPrune.get(dataDir) ?? 0) >= PRUNE_EVERY_MS) {
+        lastPrune.set(dataDir, at.getTime());
+        await pruneDecisions(dataDir, retentionDays(), at);
     }
-    const record = redactSecrets({ at: new Date().toISOString(), ...row });
-    await appendFile(file, JSON.stringify(record) + "\n", { mode: 0o600 });
 }
 /** Append one decision row. Fire-and-forget, mirroring the event bus tee:
  * the fold that calls this is delivering approvals and cards, and a full
  * disk must not turn into denied tools. */
-export function appendDecision(dataDir, row, opts) {
+export function appendDecision(dataDir, row) {
+    const actor = row.actor ?? (row.source === "user" ? actorScope.getStore() : undefined);
+    // Redact now, not when the queue drains: the row is what was true at the
+    // moment of the decision.
+    const record = redactSecrets({ at: new Date().toISOString(), ...row, ...(actor ? { actor } : {}) });
     const previous = writeQueues.get(dataDir) ?? Promise.resolve();
-    // Serialize stat → optional rotate → append for each directory. Without
-    // this queue two simultaneous approvals can both rotate, overwrite .1,
-    // or append out of decision order.
+    // Serialize appends (and the occasional prune) per directory, so two
+    // simultaneous approvals keep their decision order.
     const queued = previous
-        .then(() => writeDecision(dataDir, row, opts?.maxBytes ?? MAX_BYTES))
+        .then(() => writeDecision(dataDir, record))
         .catch(() => {
         /* logging must never take down the fold */
     });
@@ -67,40 +111,157 @@ export function appendDecision(dataDir, row, opts) {
 export async function flushDecisionLog(dataDir) {
     await writeQueues.get(dataDir);
 }
+/** Delete what the window no longer covers: a month file once the first
+ * instant after its month is at or before `now - days`, a legacy file once
+ * its last write is. Returns the names removed. Never throws. */
+export async function pruneDecisions(dataDir, days, now = new Date()) {
+    const cutoff = now.getTime() - days * DAY_MS;
+    const removed = await pruneMonthFiles(join(dataDir, DIR), days, now);
+    for (const name of [`${LEGACY_FILE}.1`, LEGACY_FILE]) {
+        try {
+            if ((await stat(join(dataDir, name))).mtimeMs > cutoff)
+                continue;
+            await unlink(join(dataDir, name));
+            removed.push(name);
+        }
+        catch {
+            /* absent */
+        }
+    }
+    return removed;
+}
+/** Delete the `YYYY-MM.ndjson` files in `dir` whose whole month is at or
+ * before `now - days`. Returns the names removed. Never throws. Shared with
+ * the admin activity log. */
+export async function pruneMonthFiles(dir, days, now = new Date()) {
+    const cutoff = now.getTime() - days * DAY_MS;
+    const removed = [];
+    let names = [];
+    try {
+        names = await readdir(dir);
+    }
+    catch {
+        /* nothing written in the new layout yet */
+    }
+    for (const name of names) {
+        const match = MONTH_FILE.exec(name);
+        if (!match || Date.UTC(Number(match[1]), Number(match[2]), 1) > cutoff)
+            continue;
+        try {
+            await unlink(join(dir, name));
+            removed.push(name);
+        }
+        catch {
+            /* already gone, or not ours to remove */
+        }
+    }
+    return removed;
+}
 const isDecisionRow = (value) => typeof value === "object" &&
     value !== null &&
     typeof value.at === "string" &&
     typeof value.threadId === "string" &&
     typeof value.decision === "string" &&
     typeof value.source === "string";
-/** The newest `limit` rows, oldest first — the same order the inspector
- * uses for thread events. Reads `.1` before the live file so a request
- * right after a rotation still sees history instead of a nearly empty
- * log; whole-file reads are fine here because rotation caps both files,
- * unlike the unbounded per-thread event logs that need a tail walk. */
-export function readDecisions(dataDir, limit) {
-    const file = join(dataDir, FILE_NAME);
+function readRows(path) {
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch {
+        return [];
+    }
     const rows = [];
-    for (const path of [`${file}.1`, file]) {
-        let text;
+    for (const line of text.split("\n")) {
+        if (!line)
+            continue;
         try {
-            text = readFileSync(path, "utf8");
+            const value = JSON.parse(line);
+            if (isDecisionRow(value))
+                rows.push(value);
         }
         catch {
-            continue;
+            /* a line torn mid-write — skip the fragment, keep the rest */
         }
-        for (const line of text.split("\n")) {
-            if (!line)
-                continue;
-            try {
-                const value = JSON.parse(line);
-                if (isDecisionRow(value))
-                    rows.push(value);
-            }
-            catch {
-                /* a line torn mid-write — skip the fragment, keep the rest */
-            }
+    }
+    return rows;
+}
+/** Every file that may hold rows, oldest first: the legacy pair (which only
+ * ever holds rows older than any month file), then the months in order. */
+function sources(dataDir) {
+    let months = [];
+    try {
+        months = readdirSync(join(dataDir, DIR)).filter((name) => MONTH_FILE.test(name)).sort();
+    }
+    catch {
+        /* no month files yet */
+    }
+    return [join(dataDir, `${LEGACY_FILE}.1`), join(dataDir, LEGACY_FILE), ...months.map((name) => join(dataDir, DIR, name))];
+}
+/** The newest `limit` rows, oldest first — the same order the inspector
+ * uses for thread events. Reads month files newest first and stops once it
+ * has enough, so a long history costs no more than the page asked for. */
+export function readDecisions(dataDir, limit) {
+    const files = sources(dataDir);
+    const chunks = [];
+    let count = 0;
+    for (let index = files.length - 1; index >= 0 && count < limit; index -= 1) {
+        const rows = readRows(files[index]);
+        chunks.unshift(rows);
+        count += rows.length;
+    }
+    return chunks.flat().slice(-limit);
+}
+/** Every row whose time falls inside the range, oldest first. */
+export function readDecisionRange(dataDir, range) {
+    const from = range.from.getTime();
+    const to = range.to.getTime();
+    const first = monthKey(range.from);
+    const last = monthKey(range.to);
+    const rows = [];
+    for (const file of sources(dataDir)) {
+        // Month files outside the range are skipped unread; legacy files have no month.
+        const month = MONTH_FILE.exec(basename(file));
+        if (month && (`${month[1]}-${month[2]}` < first || `${month[1]}-${month[2]}` > last))
+            continue;
+        for (const row of readRows(file)) {
+            const at = Date.parse(row.at);
+            if (at >= from && at <= to)
+                rows.push(row);
         }
     }
-    return rows.slice(-limit);
+    return rows;
+}
+export function actorLabel(actor) {
+    if (!actor)
+        return "";
+    if (actor.kind === "loopback")
+        return "This computer";
+    if (actor.kind === "worker")
+        return "Local service";
+    return actor.email ?? actor.label;
+}
+/** One line per decision, spreadsheet-ready. Cells go through the usage
+ * CSV's formula neutralising, and every row through redaction again, so an
+ * export never carries more than the log itself may. */
+export function decisionsCsv(rows) {
+    const header = ["time", "decision", "source", "bot", "tool", "summary", "rule", "unattended", "answered_by", "thread", "request"];
+    const lines = [header.join(",")];
+    for (const raw of rows) {
+        const row = redactSecrets(raw);
+        lines.push([
+            row.at,
+            row.decision,
+            row.source,
+            row.botName || row.botId || "",
+            row.tool ?? "",
+            row.summary ?? "",
+            row.rule ?? "",
+            row.unattended ? "yes" : "",
+            actorLabel(row.actor),
+            row.threadId,
+            row.requestId ?? "",
+        ].map(csvCell).join(","));
+    }
+    return lines.join("\n") + "\n";
 }

package/dist-server/server/default-model-selection.js

@@ -1,10 +1,14 @@
+const claudeFirst = (instances) => instances.find((instance) => instance.driverKind === "claudeAgent") ?? instances[0];
 /** A saved choice is intentional: an unavailable provider or removed model
  * sends new bots to setup instead of silently changing their provider. */
-export function selectDefaultModelSelection(instances, preferred) {
+export function selectDefaultModelSelection(instances, preferred, context = {}) {
     if (preferred) {
         const instance = instances.find((candidate) => candidate.instanceId === preferred.instanceId);
         if (instance?.snapshot.state !== "available" ||
             instance.snapshot.authenticated === false ||
+            // An organisation that disallows the saved engine makes it unusable,
+            // exactly like an unavailable one: setup, never another provider.
+            context.refusal?.(instance) !== undefined ||
             (preferred.variant !== undefined && !instance.capabilities?.modelVariants) ||
             !(instance.models.default === preferred.model || instance.models.options.some((model) => model.id === preferred.model))) {
             return { instanceId: "", model: "" };
@@ -16,7 +20,20 @@ export function selectDefaultModelSelection(instances, preferred) {
             delete selection.effort;
         return selection;
     }
-    const available = instances.filter((instance) => instance.snapshot.state === "available");
-    const pick = available.find((instance) => instance.driverKind === "claudeAgent") ?? available[0];
+    // The organisation's policy is inert (no refusal) unless this desktop is enrolled.
+    const available = instances.filter((instance) => instance.snapshot.state === "available" && context.refusal?.(instance) === undefined);
+    const company = context.company;
+    let pick;
+    if (company && instances.some((instance) => company(instance.instanceId))) {
+        // Enrolled: an installed but signed-out personal Claude would send every
+        // new bot to setup although a Company model can run. Prefer instances that
+        // can run a turn now; a working personal engine still wins, so billing
+        // stays the person's explicit choice.
+        const ready = available.filter((instance) => instance.access === "custom" || instance.snapshot.authenticated !== false);
+        pick = claudeFirst(ready.filter((instance) => !company(instance.instanceId))) ?? claudeFirst(ready) ?? claudeFirst(available);
+    }
+    else {
+        pick = claudeFirst(available);
+    }
     return { instanceId: pick?.instanceId ?? "", model: pick?.models.default ?? "" };
 }

package/dist-server/server/delegations.js

@@ -642,17 +642,19 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
     await runTarget(item.toBotId, prefixed, item.depth + 1, sourceThreadId, channel, item.id, sender.id, item.targetThreadId);
     return "dispatched";
 }
-/** "Is the target free to take this handoff right now?" What "busy" means
- * depends on where the turn will run: a classic delegation lands in the
- * target's active thread, so it needs the bot to be idle; a fresh-thread
- * handoff needs only a free slot. This is the single free/busy test shared
- * by the expiry decision in `processOne` and the hold decision below, so
- * the two can never disagree about whether a handoff could have been
- * delivered right now. */
+/** "Is the target free to take this handoff right now?" Both shapes ask for
+ * a free capacity slot, never whole-bot idleness: a classic delegation lands
+ * in the target's standing thread and applies the same admission startTurn
+ * uses for a direct turn there, while a fresh-thread handoff needs any free
+ * slot. This is the single free/busy test shared by the expiry decision in
+ * `processOne` and the hold decision below, so the two can never disagree
+ * about whether a handoff could have been delivered right now. */
 function targetCanTakeTurn(bus, target, item) {
     return item.targetThreadId
         ? (bus.threadSlotFree ? bus.threadSlotFree(target.id) : !target.busy)
-        : !target.busy;
+        : bus.canAdmitDirectTurn
+            ? bus.canAdmitDirectTurn(target.id, target.threadId)
+            : !target.busy;
 }
 /** A busy target holds the handoff. Neither counts busy periods — the only
  * bound is DELEGATION_TTL_MS, checked in processOne before this runs (using
@@ -724,7 +726,7 @@ function sourceThreadBelongsToBot(store, botId, threadId) {
  * have moved either bot, or narrowed the sender's peers, in between. */
 function dropIfUnreachable(bus, sender, target, sourceThreadId, item) {
     const sectionsDiffer = !canAccessTeam(sender, target.section);
-    if (!sectionsDiffer && !target.hidden && peerAllowed(sender, target.id))
+    if (!sectionsDiffer && !target.hidden && peerAllowed(sender, target))
         return false;
     const reason = sectionsDiffer
         ? "bots now belong to different sections"

package/dist-server/server/drivers/acp/core.js

@@ -29,7 +29,7 @@ import { homedir } from "node:os";
 import { lstat, mkdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 import { createHash } from "node:crypto";
-import { PROVIDER_CREDENTIAL_ENV, WORKSPACE_CREDENTIAL_ENV } from "../../config.js";
+import { PROVIDER_CREDENTIAL_ENV, stripControlPlaneEnv, WORKSPACE_CREDENTIAL_ENV } from "../../config.js";
 import { decodeInjectId } from "../local-inject.js";
 import { describeSpawnFailure, execCli, killCliTree, spawnCli } from "../../procs.js";
 /**
@@ -45,6 +45,33 @@ import { supportsApprovalMode } from "../../../shared/approval-mode.js";
 import { appendNative } from "../native.js";
 import { commandSummary, toolDetailPreview } from "../../tool-summary.js";
 import { extractMcpImages } from "../../mcp-tool-images.js";
+import { redactSecretsInText } from "../../redact.js";
+import { recoveryPromptFor } from "../../resume-recovery.js";
+/** ACP vendors put the actionable cause in error.data while keeping the
+ * JSON-RPC message generic. Only surface known text fields, never a response
+ * body/config dump, and redact before bounding the displayed diagnostic. */
+function acpRpcError(value, method) {
+    const message = typeof value?.message === "string" ? value.message : "ACP request failed";
+    const data = value?.data;
+    const detail = typeof data === "string" ? data
+        : typeof data?.details === "string" ? data.details
+            : typeof data?.message === "string" ? data.message
+                : typeof data?.error?.message === "string" ? data.error.message
+                    : "";
+    const context = [
+        method,
+        typeof data?.service === "string" ? `service: ${data.service}` : "",
+        typeof data?.errorName === "string" ? data.errorName : "",
+    ].filter(Boolean).join(", ");
+    const diagnostic = `${detail && detail !== message ? `${message}: ${detail}` : message} (${context})`;
+    const error = new Error(redactSecretsInText(diagnostic).slice(0, 1500));
+    return Object.assign(error, { code: value?.code, data,
+        // -32603 is JSON-RPC's internal error. Invalid params, unsupported
+        // methods and auth refusals are user/configuration issues, not evidence
+        // of a broken process. Preserve their session instead of retrying them.
+        acpSessionFailure: value?.code === -32603,
+    });
+}
 const envOr = (key, fallback) => Number(process.env[key] ?? fallback);
 const INIT_TIMEOUT = envOr("OPENMAUS_ACP_INIT_TIMEOUT_MS", 300_000);
 const SESSION_CONFIG_TIMEOUT = envOr("OPENMAUS_ACP_SESSION_CONFIG_TIMEOUT_MS", 300_000); // configureSession's per-request default
@@ -171,6 +198,17 @@ function sessionOperationKey(toolCall) {
         locations: toolCall?.locations,
     }));
 }
+/** The banner an ACP CLI prints for `--version`. Hermes writes its whole banner
+ *  to stderr with an empty stdout, so an stdout-only read reports a perfectly
+ *  good install as "CLI not found". Prefer stdout; fall back to the first
+ *  stderr line; null when both are empty. */
+export function versionFromProbe(stdout, stderr) {
+    const out = (stdout ?? "").trim();
+    if (out)
+        return out;
+    const err = (stderr ?? "").trim().split(/\r\n|\n|\r/, 1)[0]?.trim() ?? "";
+    return err || null;
+}
 export function createAcpDriver(support) {
     const DRIVER_KIND = support.driverKind;
     const SOURCE = support.nativeSource;
@@ -205,6 +243,8 @@ export function createAcpDriver(support) {
                     if (!allowedCredentials.has(key))
                         delete env[key];
                 }
+                // The operator's own secrets are outside any driver's allowlist.
+                stripControlPlaneEnv(env);
                 support.transformEnv?.(env, activeConfig, instanceId);
                 return env;
             };
@@ -385,7 +425,25 @@ export function createAcpDriver(support) {
                 session.current = null;
                 active.delete(threadId);
                 current.flushAssistantText();
-                emit({ ...base(threadId, current.turnId), type: "turn.completed", ok, stopReason, cost: null });
+                // `end_turn` with nothing to show for it — no reply, no image, no
+                // tool result — is a lost turn, not a success. An engine can report
+                // exactly that (a provider may cut a reasoning-only stream and
+                // still answer end_turn), and ok:true would end the thread quietly
+                // while the person's message went unanswered. Keep the completion,
+                // but report it as a failure so terminal chips, incidents and
+                // follow-ups see what happened.
+                let finalOk = ok;
+                let finalStopReason = stopReason;
+                if (finalOk && finalStopReason === null && !current.state.producedItem) {
+                    finalOk = false;
+                    finalStopReason = "empty_turn";
+                    emit({
+                        ...base(threadId, current.turnId),
+                        type: "runtime.error",
+                        message: `${DRIVER_KIND} ended the turn with no reply, image, or tool result`,
+                    });
+                }
+                emit({ ...base(threadId, current.turnId), type: "turn.completed", ok: finalOk, stopReason: finalStopReason, cost: null });
                 if (session.child.exitCode === null && !session.closing && !session.dead) {
                     armIdle(threadId);
                 }
@@ -426,7 +484,7 @@ export function createAcpDriver(support) {
                     if (timeoutMs) {
                         timer = setTimeout(() => {
                             rpcPending.delete(id);
-                            reject(new Error(`${method} timed out`));
+                            reject(Object.assign(new Error(`${method} timed out`), { acpSessionFailure: true }));
                         }, timeoutMs);
                         timer.unref?.();
                     }
@@ -455,6 +513,7 @@ export function createAcpDriver(support) {
                     };
                     armIdle();
                     rpcPending.set(id, {
+                        method,
                         // Consume configuration in wire order: an update following this
                         // response may arrive before the awaiting continuation resumes.
                         resolve: (result) => { receive?.(result); resolve(result); },
@@ -686,6 +745,7 @@ export function createAcpDriver(support) {
                             const delta = content?.text;
                             if (content?.type === "image" && typeof content.data === "string" && content.data) {
                                 current.flushAssistantText();
+                                current.state.producedItem = true;
                                 emit({
                                     ...base(threadId, current.turnId),
                                     type: "item.completed",
@@ -722,6 +782,7 @@ export function createAcpDriver(support) {
                         }
                         case "tool_call_update": {
                             if (u.status === "completed" || u.status === "failed") {
+                                current.state.producedItem = true;
                                 emit({
                                     ...base(threadId, current.turnId),
                                     type: "item.completed",
@@ -788,9 +849,7 @@ export function createAcpDriver(support) {
                                 if (pend.idleTimer)
                                     clearTimeout(pend.idleTimer);
                                 if (msg.error) {
-                                    const error = new Error(msg.error.message ?? JSON.stringify(msg.error));
-                                    Object.assign(error, { code: msg.error.code, data: msg.error.data });
-                                    pend.reject(error);
+                                    pend.reject(acpRpcError(msg.error, pend.method));
                                 }
                                 else {
                                     pend.resolve(msg.result);
@@ -923,6 +982,10 @@ export function createAcpDriver(support) {
                 const envFingerprint = createHash("sha256").update(JSON.stringify(spawnEnv)).digest("hex").slice(0, 16);
                 const contractKey = JSON.stringify([launch.command, launch.args ?? [], spawnArgs, cwd, turnConfig.fullAuto === true, envFingerprint]);
                 const sessionKey = JSON.stringify(mcpServers);
+                if (turn.sessionReset) {
+                    closeSession(threadId, "reset");
+                    sessionAllows.delete(threadId);
+                }
                 const pooled = sessions.get(threadId);
                 let session;
                 if (pooled && !pooled.dead && !pooled.closing && pooled.contractKey === contractKey) {
@@ -948,7 +1011,7 @@ export function createAcpDriver(support) {
                 // respawns the child, every wire call must reach the live record, so
                 // nothing captures the connection off it.
                 const request = (method, params, timeoutMs, receive, idleMs, idleMessage) => session.acp.request(method, params, timeoutMs, receive, idleMs, idleMessage);
-                const state = { settled: false, promptSent: false, text: "" };
+                const state = { settled: false, promptSent: false, text: "", producedItem: false };
                 const asks = new Map();
                 const modelOf = (result) => {
                     const option = (Array.isArray(result?.configOptions) ? result.configOptions : []).find((entry) => entry?.id === (support.selectModel?.configId ?? "model"));
@@ -987,6 +1050,7 @@ export function createAcpDriver(support) {
                     state.text = "";
                     if (!text.trim())
                         return;
+                    state.producedItem = true;
                     emit({ ...base(threadId, turnId), type: "item.completed", itemType: "assistant_text", text });
                 };
                 const current = {
@@ -1073,8 +1137,10 @@ export function createAcpDriver(support) {
                         };
                         let runtimeAcceptsImages = await handshake();
                         let init = session.initResult;
-                        const cursor = typeof turn.resumeCursor === "string" ? turn.resumeCursor : null;
+                        const cursor = !turn.sessionReset && typeof turn.resumeCursor === "string" ? turn.resumeCursor : null;
                         let sessionResult = null;
+                        let promptTurn = turn;
+                        let rebuiltFromReplay = false;
                         for (;;) {
                             const liveSessionId = session.sessionId;
                             if (liveSessionId !== null && session.sessionKey === sessionKey && (cursor === null || cursor === liveSessionId)) {
@@ -1100,7 +1166,17 @@ export function createAcpDriver(support) {
                                         }
                                     });
                                 }
-                                catch {
+                                catch (error) {
+                                    const classification = support.classifyError?.(error);
+                                    // OpenCode encodes ACPSessionNotFoundError as invalidParams
+                                    // with just the rejected sessionId. Other invalidParams
+                                    // responses (model/config errors) must not erase history.
+                                    const data = error?.data;
+                                    const missingSession = data && typeof data === "object" && !Array.isArray(data)
+                                        && data.sessionId === cursor && Object.keys(data).length === 1;
+                                    if (classification === "invalid_credentials" || classification === "inactive_subscription"
+                                        || (error?.code === -32602 && !missingSession))
+                                        throw error;
                                     /* session gone, load unsupported, or too slow — the
                                      * fallbacks below choose between one fresh process and a
                                      * genuinely new session */
@@ -1127,8 +1203,16 @@ export function createAcpDriver(support) {
                             }
                             // a genuinely fresh native session forgets what the previous
                             // one allowed
-                            if (!cursor)
-                                sessionAllows.delete(threadId);
+                            sessionAllows.delete(threadId);
+                            if (cursor) {
+                                const recovery = recoveryPromptFor({
+                                    recoveryText: turn.recoveryText,
+                                    currentText: turn.text,
+                                    failure: "before-accept",
+                                });
+                                promptTurn = { ...turn, text: recovery.text };
+                                rebuiltFromReplay = recovery.replayed;
+                            }
                             sessionResult = await request("session/new", { cwd, mcpServers: sessionServers }, NEW_SESSION_TIMEOUT, (result) => {
                                 session.sessionId = typeof result?.sessionId === "string" ? result.sessionId : null;
                                 session.sessionKey = sessionKey;
@@ -1151,6 +1235,7 @@ export function createAcpDriver(support) {
                                 type: "session.started",
                                 sessionId,
                                 model: selectedModel ?? init?._meta?.modelState?.currentModelId ?? cliTurn.model ?? null,
+                                ...(rebuiltFromReplay ? { rebuilt: true } : {}),
                             });
                         };
                         try {
@@ -1177,7 +1262,7 @@ export function createAcpDriver(support) {
                                         ? sessionResult.models.availableModels
                                         : [],
                                 });
-                                // initialize's currentModelId is the CLI default (grok-4.6),
+                                // initialize's currentModelId is the CLI default,
                                 // not the model this turn asked for. After a successful pin,
                                 // report the slug we set so the UI does not claim otherwise.
                                 if (!selectedModel && cliTurn.model)
@@ -1199,10 +1284,10 @@ export function createAcpDriver(support) {
                         }
                         emitSessionStarted();
                         const text = support.buildPromptText
-                            ? support.buildPromptText(turn)
-                            : turn.system
-                                ? `${turn.system}\n\n${turn.text}`
-                                : turn.text;
+                            ? support.buildPromptText(promptTurn)
+                            : promptTurn.system
+                                ? `${promptTurn.system}\n\n${promptTurn.text}`
+                                : promptTurn.text;
                         const imageBlocks = support.images === true && runtimeAcceptsImages
                             ? await readAcpImageBlocks(turn.images ?? [])
                             : [];
@@ -1261,11 +1346,14 @@ export function createAcpDriver(support) {
                                 message,
                                 ...(needsAuth ? { setup: true } : {}),
                             });
-                            // A prompt that went idle has a wedged child under the RPC — it
-                            // will never answer the next prompt either. Do not leave it
-                            // pooled: close it so the next turn spawns a fresh agent.
-                            if (e?.acpPromptStall === true && session.child.exitCode === null && !session.closing) {
-                                closeSession(threadId, "prompt-stall");
+                            // Internal RPC failures can leave a live child poisoned just
+                            // like a silent prompt. Evict before completion listeners can
+                            // start the next turn. Never replay this accepted prompt: it
+                            // may already have executed tools. The next explicit turn can
+                            // resume the recorded session on a fresh process.
+                            if (!needsAuth && (e?.acpPromptStall === true || e?.acpSessionFailure === true
+                                || code === "upstream_outage") && session.child.exitCode === null && !session.closing) {
+                                closeSession(threadId, e?.acpPromptStall === true ? "prompt-stall" : "rpc-failure");
                             }
                             settle(threadId, session, false, needsAuth ? "auth_required" : "rpc_error");
                         }
@@ -1278,7 +1366,7 @@ export function createAcpDriver(support) {
                 if (support.snapshot)
                     return support.snapshot(env, config, instanceId);
                 const version = await new Promise((resolve) => {
-                    execCli(config.cli, ["--version"], { timeout: 8000, env }, (err, stdout) => resolve(err ? null : stdout.trim()));
+                    execCli(config.cli, ["--version"], { timeout: 8000, env }, (err, stdout, stderr) => resolve(err ? null : versionFromProbe(stdout, stderr)));
                 });
                 if (!version)
                     return { state: "unavailable", reason: `\`${config.cli}\` CLI not found` };