zcode-acp-server 0.73.0 → 0.75.0

package/dist/remote/session-close-endpoint.d.ts

@@ -20,6 +20,14 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { ZcodeAcpServer } from "../server.js";
+/**
+ * Force close: how long to wait for the cancelled turn(s) to settle before
+ * evicting the resident runtime anyway (the eviction kills any generation
+ * that ignored the stop pair). Test hook override via the setter below.
+ */
+export declare let forceSettleMs: number;
+/** Test hook: shrink the force-close settle bound so tests don't sleep. */
+export declare function setForceSettleMsForTests(ms: number): void;
 export interface ServeTerminateDecision {
     /** Terminate this bridge once the close response has flushed. */
     terminate: boolean;

package/dist/remote/session-close-endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-close-endpoint.d.ts","sourceRoot":"","sources":["../../src/remote/session-close-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAsBnD,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,SAAS,EAAE,OAAO,CAAC;IACnB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,MAAM,EACvB,GAAG,GAAE;IAAE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAAgB,GACtF,sBAAsB,GAAG,IAAI,CAQ/B;AAcD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAMvE;AAoHD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,cAAc,GACrB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAWxE"}
+{"version":3,"file":"session-close-endpoint.d.ts","sourceRoot":"","sources":["../../src/remote/session-close-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAsBnD;;;;GAIG;AACH,eAAO,IAAI,aAAa,QAAQ,CAAC;AAEjC,2EAA2E;AAC3E,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAEzD;AAuBD,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,SAAS,EAAE,OAAO,CAAC;IACnB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,MAAM,EACvB,GAAG,GAAE;IAAE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAAgB,GACtF,sBAAsB,GAAG,IAAI,CAQ/B;AAcD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAMvE;AA8ID;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,cAAc,GACrB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAWxE"}

package/dist/remote/session-close-endpoint.js

@@ -19,6 +19,7 @@
  * one stays gone. A running turn is the one case we CAN observe and reject.
  */
 import process from "node:process";
+import { cancelSessionTurns } from "../handlers/session.js";
 import { log } from "../utils.js";
 import { stopPollersForSession } from "../workflow/poller.js";
 function sendText(res, code, message) {
@@ -37,6 +38,36 @@ function sendJson(res, code, body) {
 }
 /** Grace before the bridge exits itself when the TUI group signal missed. */
 const SELF_EXIT_MS = 1_500;
+/**
+ * Force close: how long to wait for the cancelled turn(s) to settle before
+ * evicting the resident runtime anyway (the eviction kills any generation
+ * that ignored the stop pair). Test hook override via the setter below.
+ */
+export let forceSettleMs = 3_000;
+/** Test hook: shrink the force-close settle bound so tests don't sleep. */
+export function setForceSettleMsForTests(ms) {
+    forceSettleMs = ms;
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const MAX_CLOSE_BODY_BYTES = 256;
+/**
+ * Read the optional close body without trusting Content-Type (the hub's
+ * forward-and-relay proxy pipes bytes through without forwarding headers).
+ * Empty body → undefined; anything malformed throws for the 400 path.
+ */
+async function readCloseBody(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > MAX_CLOSE_BODY_BYTES)
+            throw new Error("body too large");
+        chunks.push(chunk);
+    }
+    if (chunks.length === 0)
+        return undefined;
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
 /**
  * Should closing a session TERMINATE this bridge? Only for remote-incubated
  * instances (ZCODE_ACP_REMOTE_ORIGIN=serve, ADR-0016): their CLI was spawned
@@ -129,8 +160,18 @@ function terminateAfterFlush(decision, res) {
         run();
 }
 async function handleClose(server, req, res, sessionId) {
-    // Consume any request body so the client's connection drains cleanly.
-    req.resume();
+    // Optional JSON body: {force: true} stops an in-flight turn before closing
+    // (an explicit terminate gesture — the desktop's End session). Absent body
+    // keeps the plain ADR-0006 contract.
+    let body;
+    try {
+        body = await readCloseBody(req);
+    }
+    catch {
+        sendText(res, 400, "invalid body");
+        return;
+    }
+    const force = body?.force === true;
     // An empty REMOTE-created placeholder (no turn yet) has no summary but IS
     // advertised by discovery — it must be closable too, or it blocks the
     // last-close CLI termination forever (advertisedSessionCount never drops).
@@ -139,10 +180,27 @@ async function handleClose(server, req, res, sessionId) {
         return;
     }
     const zcodeSid = server.resolveSid(sessionId);
-    if (zcodeSid && [...server.pendingTurns.values()].some((t) => t.zcodeSid === zcodeSid)) {
-        sendText(res, 409, "session is running — cancel the turn first");
+    const running = zcodeSid !== undefined &&
+        [...server.pendingTurns.values()].some((t) => t.zcodeSid === zcodeSid);
+    if (running && !force) {
+        sendText(res, 409, 'session is running — cancel the turn first (or send {"force":true})');
         return;
     }
+    if (running && zcodeSid !== undefined) {
+        // Force close (ADR-0006 amendment): ESC semantics without a client
+        // connection — flag the turns cancelled, fire the stop pair, then give
+        // them a bounded window to settle (the stop's terminal event persists
+        // partial output cleanly) before the runtime eviction below proceeds
+        // regardless. The eviction kills any generation that ignored the stop.
+        cancelSessionTurns(server, zcodeSid);
+        log(`remote: force close cancelling in-flight turn(s) for ${zcodeSid}`);
+        const deadline = Date.now() + forceSettleMs;
+        while (Date.now() < deadline) {
+            if (![...server.pendingTurns.values()].some((t) => t.zcodeSid === zcodeSid))
+                break;
+            await sleep(50);
+        }
+    }
     server.sessionSummaries.delete(sessionId);
     server.remoteCreatedSessions.delete(sessionId);
     // Workflow-run progress pollers address this session's journal — stop them

package/dist/remote/session-close-endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-close-endpoint.js","sourceRoot":"","sources":["../../src/remote/session-close-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,OAAO,MAAM,cAAc,CAAC;AAGnC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,SAAS,QAAQ,CAAC,GAAmB,EAAE,IAAY,EAAE,OAAe;IAClE,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO;IAC9B,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;IACtD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,IAAY,EAAE,IAA6B;IAChF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;QAClB,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;KAC7C,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,MAAM,YAAY,GAAG,KAAK,CAAC;AAS3B;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,eAAuB,EACvB,MAA4E,OAAO,CAAC,GAAG;IAEvF,IAAI,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,eAAe,GAAG,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1E,OAAO;QACL,SAAS,EAAE,IAAI;QACf,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,MAAsB;IACpD,IAAI,KAAK,GAAG,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,KAAK,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,IAAY;IAC3D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,mBAAmB,CAAC,QAAgC,EAAE,GAAmB;IAChF,MAAM,GAAG,GAAG,GAAG,EAAE;QACf,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC3C,GAAG,CAAC,8DAA8D,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;YACxF,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,GAAG,CACD,kCAAkC;oBAChC,IAAI,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,uCAAuC,CACxF,CAAC;YACJ,CAAC;YACD,iEAAiE;YACjE,yEAAyE;YACzE,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBAC7B,GAAG,CAAC,oDAAoD,GAAG,EAAE,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,4DAA4D;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClD,CAAC,CAAC;IACF,6EAA6E;IAC7E,IAAI,GAAG,CAAC,aAAa;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;;QAC1C,GAAG,EAAE,CAAC;AACb,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,MAAsB,EACtB,GAAoB,EACpB,GAAmB,EACnB,SAAiB;IAEjB,sEAAsE;IACtE,GAAG,CAAC,MAAM,EAAE,CAAC;IAEb,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5F,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;QACvF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,4CAA4C,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,2EAA2E;IAC3E,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,QAAQ;QAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC9C,2EAA2E;IAC3E,sEAAsE;IACtE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,QAAQ,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,6CAA6C,QAAQ,6BAA6B,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CACD,+CAA+C;gBAC7C,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,GAAG,CAAC,mBAAmB,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,yCAAyC,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,sBAAsB,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,gEAAgE;QAChE,wEAAwE;QACxE,wEAAwE;QACxE,qEAAqE;QACrE,mDAAmD;QACnD,MAAM,OAAO,CAAC,GAAG,CACf,MAAM;aACH,cAAc,CAAC,SAAS,CAAC;aACzB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACX,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAChF,CACJ,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,IAAI,SAAS,EAAE,SAAS;QAAE,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAsB;IAEtB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,KAAK,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACvD,IAAI,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,OAAO,EAAE,CAAC;;gBAC9B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"session-close-endpoint.js","sourceRoot":"","sources":["../../src/remote/session-close-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,SAAS,QAAQ,CAAC,GAAmB,EAAE,IAAY,EAAE,OAAe;IAClE,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO;IAC9B,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;IACtD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,IAAY,EAAE,IAA6B;IAChF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;QAClB,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;KAC7C,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,MAAM,YAAY,GAAG,KAAK,CAAC;AAE3B;;;;GAIG;AACH,MAAM,CAAC,IAAI,aAAa,GAAG,KAAK,CAAC;AAEjC,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB,CAAC,EAAU;IACjD,aAAa,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEtF,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,GAAoB;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,IAAI,IAAK,KAAgB,CAAC,MAAM,CAAC;QACjC,IAAI,IAAI,GAAG,oBAAoB;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,eAAuB,EACvB,MAA4E,OAAO,CAAC,GAAG;IAEvF,IAAI,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,eAAe,GAAG,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1E,OAAO;QACL,SAAS,EAAE,IAAI;QACf,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,MAAsB;IACpD,IAAI,KAAK,GAAG,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,KAAK,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,IAAY;IAC3D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,mBAAmB,CAAC,QAAgC,EAAE,GAAmB;IAChF,MAAM,GAAG,GAAG,GAAG,EAAE;QACf,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC3C,GAAG,CAAC,8DAA8D,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;YACxF,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,GAAG,CACD,kCAAkC;oBAChC,IAAI,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,uCAAuC,CACxF,CAAC;YACJ,CAAC;YACD,iEAAiE;YACjE,yEAAyE;YACzE,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBAC7B,GAAG,CAAC,oDAAoD,GAAG,EAAE,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,4DAA4D;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClD,CAAC,CAAC;IACF,6EAA6E;IAC7E,IAAI,GAAG,CAAC,aAAa;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;;QAC1C,GAAG,EAAE,CAAC;AACb,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,MAAsB,EACtB,GAAoB,EACpB,GAAmB,EACnB,SAAiB;IAEjB,2EAA2E;IAC3E,2EAA2E;IAC3E,qCAAqC;IACrC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAI,IAAwC,EAAE,KAAK,KAAK,IAAI,CAAC;IAExE,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5F,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS;QACtB,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACzE,IAAI,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACtB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,qEAAqE,CAAC,CAAC;QAC1F,OAAO;IACT,CAAC;IACD,IAAI,OAAO,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACtC,mEAAmE;QACnE,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrC,GAAG,CAAC,wDAAwD,QAAQ,EAAE,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC;QAC5C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;gBAAE,MAAM;YACnF,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,2EAA2E;IAC3E,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,QAAQ;QAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC9C,2EAA2E;IAC3E,sEAAsE;IACtE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,QAAQ,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,6CAA6C,QAAQ,6BAA6B,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CACD,+CAA+C;gBAC7C,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,GAAG,CAAC,mBAAmB,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,yCAAyC,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,sBAAsB,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,gEAAgE;QAChE,wEAAwE;QACxE,wEAAwE;QACxE,qEAAqE;QACrE,mDAAmD;QACnD,MAAM,OAAO,CAAC,GAAG,CACf,MAAM;aACH,cAAc,CAAC,SAAS,CAAC;aACzB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACX,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAChF,CACJ,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,IAAI,SAAS,EAAE,SAAS;QAAE,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAsB;IAEtB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,KAAK,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACvD,IAAI,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,OAAO,EAAE,CAAC;;gBAC9B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/docs/BACKLOG.md

@@ -109,6 +109,40 @@ New in 3.15.1, bridge-relevant:
      v3 payloads gained only OPTIONAL fields (`turn.started.executionStartedAt`,
      permission `approvalMode`, `session/read` `contentProfile`).
 
+**3.16.1 sync (2026-10-19, commit `0a1fc56d` — checkout synced, protocol
+surface audited, no bridge action)**: first CLI bump since 3.14 — app-server
+`0.16.9` → `0.17.0` (source root 3.15.1 → 3.16.1; 4,502 files, mostly desktop
+E2E/UI). The desktop on this machine is 3.15.3 (still bundles the 0.16.9-era
+`zcode.cjs`) — nothing changes for a running bridge today; this note covers the
+next desktop update. Protocol drift is small and additive except ONE param
+removal: `session/list` dropped `includeArchived` and now filters `deleted`
+rows itself (plus parent-chain ownership proofs for explicit `sessionIds`
+queries — `listSessions` rewrite). The bridge never sends `includeArchived`
+and applies its own tasks-index tombstone filter, so both are no-ops here.
+Additive surface: `additionalDirectories` (optional) on `session/create` +
+`session/resume`; `toolSearchMode` (default `"off"`) + `additionalDirectories`
+on the `session/requestRuntimePreferences` RESULT schema — the bridge's
+three-field auto-reply (`src/backend/client.ts`) still validates: the schema
+stays `.strict()`, every sent key is known, new fields carry defaults; new
+`provider/refreshRegistry` method (worker rebuilds its in-process registry
+from the Environment's config store — a host-side companion to
+`provider/updateAccountConfig`, which is unchanged); MCP server `alwaysLoad`;
+runtime capability `historyFirst`. Verified zero-diff on every Gotchas-cited
+behavior file: the provider bootstrap quartet (`provider-runtime-env.ts`,
+`runtime-paths.ts`, `zcode-builtin-provider-config-source.ts`,
+`registry-service.ts`), `model-catalog-port.ts` (the `values.at(-1)`
+default-level rule), `session-mode-port.ts`, `execution-state.ts`, the
+setModel/resume schemas, and the runtime-headers path. `server-operations.ts`
+moved 238 lines but no hunk touches the stop/compact/send-busy turn loop
+(`sendPrompt`'s `activeAbortController`, compact's `state.updated` swallow,
+the `-32010` window) — hunks are listSessions, createWithProjection,
+activateSessionForResume, background-turn allowlist, runtime-prefs resolution.
+`session-flow.ts` (+31/−9) is Highspeed selection queueing (queue items keep
+only the ordinary selection; execution bundles stay in-memory) — internal v4
+queue mechanics, the v4 stop path is untouched. Model-selection persistence
+semantics unchanged (`ensureSessionPersisted` / `restorePersistedModelSelection`;
+`turn-model.ts` adds Highspeed/off-peak capture, not persistence).
+
 **3.14.0 audit (2026-09-20, app-server 0.16.9 — live-probed end to end)**: the
 dynamic-workflow family (ten model tools led by `CreateWorkflow`) is OFF by
 default headless and enabled per PROCESS via

package/docs/CLI.md

@@ -96,42 +96,45 @@ node dist/cli.js quota -w
 
 ## Opencode Go setup
 
-Opencode Go has no JSON API for subscription usage — the CLI scrapes the
-authenticated dashboard at `opencode.ai/workspace/<id>/go`, so it needs your
-browser `auth` cookie. Credentials are read from three sources, **merged
-field-by-field, highest precedence first**:
-
-- **Our config file** (`~/.config/zcode-acp/config.json`, `quota` section —
-  the preferred home):
+Two credential sources drive the Go usage card — **picked automatically,
+cookies preferred** (they report usage in 0.1-percent steps; the API key
+reports integer percents but never expires and needs no browser):
+
+- **API key** (recommended, cookie-free): at
+  [opencode.ai/console](https://opencode.ai/console) → **Keys** → Add Service
+  Account → Add API Key (query permissions suffice), then either:
+  - config file (`~/.config/zcode-acp/config.json`, `quota` section):
+    ```json
+    { "quota": { "opencodeGoApiKey": "oc_sk_your_key" } }
+    ```
+  - or environment variable:
+    ```bash
+    export OPENCODE_GO_API_KEY="oc_sk_your_key"
+    ```
+- **Console cookies** (higher precision, expires with the browser session):
+  `opencode.ai` console login → browser DevTools (F12) → Application →
+  Cookies → copy the `auth` cookie value and the `__Host-console_session`
+  value, plus the `wrk_…` workspace id from the console URL, into any of the
+  three merged sources (highest precedence first):
   ```json
   { "quota": {
       "opencodeGoWorkspaceId": "wrk_your_workspace_id",
-      "opencodeGoAuthCookie": "Fe26.2**your_cookie_value"
-  } }
+      "opencodeGoAuthCookie": "Fe26.2**your_cookie_value",
+      "opencodeGoSessionToken": "st_your_session_token" } }
   ```
-- **Environment variables** (override the legacy file below):
   ```bash
   export OPENCODE_GO_WORKSPACE_ID="wrk_your_workspace_id"
   export OPENCODE_GO_AUTH_COOKIE="Fe26.2**your_cookie_value"
+  export OPENCODE_GO_SESSION_TOKEN="st_your_session_token"
   ```
-- **Legacy config file**: `~/.pi/agent/opencode-go.json` — same convention as
-  the `@beyona/pi-zai-usage` Pi extension, kept so existing setups keep
-  working unchanged.
-  ```json
-  { "workspaceId": "wrk_your_workspace_id", "authCookie": "Fe26.2**your_cookie_value" }
-  ```
-
-How to get the values:
-
-1. **Workspace ID** — open `https://opencode.ai`, navigate to your Go
-   workspace, and copy the `wrk_…` id from the URL
-   (`https://opencode.ai/workspace/<wrk_…>/go`).
-2. **Auth cookie** — open browser DevTools (F12) → Application → Cookies →
-   `opencode.ai` → copy the value of the cookie named `auth` (it starts with
-   `Fe26.2**`).
-
-Without credentials, the default multi-provider mode silently shows GLM only
-(no error). Running `zcode-acp quota go` without credentials prints a setup hint.
+  The legacy `~/.pi/agent/opencode-go.json` file
+  (`{ workspaceId, authCookie, sessionToken }`, the `@beyona/pi-zai-usage`
+  convention) still works as the lowest-precedence source.
+
+When both are configured and the cookies expire (the console API answers
+400/401/403), the card seamlessly falls back to the API key. Without any
+credentials, the default multi-provider mode silently shows GLM only (no
+error); `zcode-acp quota go` without credentials prints a setup hint.
 
 ## Ollama Cloud setup
 

package/docs/adr/0006-remote-session-close.md

@@ -26,6 +26,20 @@ in-use signal, a pending turn, is rejected outright (409). A bridge-restart
 auto-resume alone does not resurrect a closed session — `registerSession`
 writes a summary with `hasActivity` unset.
 
+Amendment (2026-10-20) — force close. The 409 guard protects conversations
+from a mere list refresh, but it also blocks the client that MEANT to
+terminate: a desktop user pressing "End session" on a running conversation
+got the refusal and no path to act on it (observed live: the session kept
+generating until the user walked to the hosting CLI window and stopped it
+there). A close body `{"force":true}` now opts an explicit gesture through:
+the bridge applies ESC semantics without a client connection (flag the
+session's in-flight turns cancelled, fire the stop pair), waits a bounded
+~3s for them to settle so the stop's terminal event persists partial output,
+then proceeds with the eviction regardless — the `session/close` runtime
+eviction already documented as the drain gate's kill escalation finishes any
+generation that ignored the stop. Plain close keeps the refuse-when-running
+contract; nothing changes for clients that send no body.
+
 The hub stays a router (ADR-0002): the POST is forwarded by instance id and
 session id only; the running guard and retirement semantics live in the
 bridge. One implementation note for future write proxies: aborting the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zcode-acp-server",
-  "version": "0.73.0",
+  "version": "0.75.0",
   "description": "Agent Client Protocol (ACP) server bridging headless ZCode to editors like Zed and JetBrains.",
   "type": "module",
   "license": "Apache-2.0",