feat(cli): add ACP session creation and listing - #3744

Thanks for adding the ACP session lifecycle in a focused layer. I found two production-path issues that look worth addressing before this moves forward. These are suggestions from an outside review, so please do push back if an ACP lifecycle or bootstrap guarantee changes either premise.

AI-assisted review disclosure: Codex ran independent protocol, lifecycle, and test analysis lanes; Astro-Han is the contributor of record for this review.

Approving. Reviewed the registry, the Runtime Host seams, and the ACP wiring; boundaries hold up.

Verified explicitly:

• cwd filtering is canonical on both sides. session/new stores workspaceResolver's realpath-canonicalized cwd, and #list realpaths the client-supplied filter before comparing against hostCwd — so a session created through this adapter is not filtered out of its own session/list on symlinked paths (macOS /tmp etc.).
• Legacy omission is exact. 'kind' in session only matches unsupported_legacy_record; SessionCatalogProjection and the separate shared-session projection are unaffected.
• Subscription lifecycle is race-safe. Dispose-during-connect and dispose-during-open both close the late-arriving resource; #records.set and the closing check are synchronous-adjacent so no record can register after disposal begins. Capacity accounting (#activeSubscriptions + #pendingSubscriptionOpens) mirrors the Host's own SESSION_CONNECTION_SUBSCRIPTION_MAX_ITEMS = 16 admission, and client-generated session ids make session.create retries collide safely (operation_conflict / existing-record probe).
• One-shot subscription open on the reconnecting connection (#requireCurrent('subscription.open')) correctly refuses to silently land on a replacement Host epoch.
• Cursor codec is strict: versioned, size-bounded, canonical base64url, revision format-checked, and cursor_cwd_mismatch rejects cross-filter reuse before any Host I/O.
• connectRuntimeHostCliConnection split also fixes a pre-existing leak: initialConnection is now closed if reconnecting-connection setup fails, and acquireAbortably closes a connection that resolves after abort.

Non-blocking notes (P3, no action needed):

• #records retains EOF'd/failed subscriptions for inspect() for the lifetime of the ACP connection — slow unbounded growth across many session/new calls in one editor session, but each entry is small (transcript: none) and nothing reads them on the hot path.
• A subscription that dies mid-session is recorded on the record but never surfaces to the ACP client (no notification exists yet). Fine for this PR's scope (new/list only); worth keeping in mind when session/prompt lands, since a dead subscription will then be user-visible.

Thanks for the work on this one. The two findings from my first pass are properly fixed, and me2seeks' checklist holds up under a second read: cwd canonicalisation lives in the Host's workspace resolver, the capacity reservation is a synchronous check-then-increment so 17 concurrent creates cannot race it, dispose-during-connect and dispose-during-open both close the late resource, and the one-shot open never lands on a replacement Host. Nice.

What I want to raise is one design question, because I think it decides whether this PR lands as a net simplification or as a new constraint the next PRs have to live with.

Does PR2 need to attach a subscription at session/new? I went looking for what the subscription buys in this PR and could not find a reader. record.snapshot and record.failure are only read by inspect(), and every caller of inspect() is in the tests. On the Host side I checked what happens with zero subscribers: the coordinator drops its in-memory projection (#sessions.delete) and nothing else; the durable Session is untouched. So a session/new that only does session.create and returns the id is a complete PR2.

If attach moves to the first session/prompt in PR3, which is also ACP's natural shape (clients create many sessions and prompt a few), these all go with it: the 16-session ceiling and its -32603 (a ceiling the description does not mention today, and one an editor user can only clear by restarting the agent), #reserveSubscriptionCapacity and the pending/active counters, #consume, inspect() and its two exported types, the #records retention that me2seeks flagged, the SESSION_CONNECTION_SUBSCRIPTION_MAX_ITEMS protocol export, the compatible-change declaration (and with it the epoch question in the other thread), and roughly 220 lines of tests that exist to observe inspect(). The registry ends up about half its current size, and PR3 gets to decide the attach lifecycle with a real consumer in hand.

I know you pushed back on lazy attachment earlier as conflicting with PR2's boundary. My read is that the boundary is the thing under question: I could not find a constraint that requires attaching at create time, only the decision to do so. If there is one I have missed, say so and I will drop this.

If you would rather keep the attach, that is a legitimate call for PR2, and then three small things before approval: the declaration's epoch must equal main's at merge time (93 today; it will drift again, so set it last), maka --help at cli-core.ts:136 still says "initialize only", and the 16-session ceiling should be stated in the description and in that help line.

Either way, a few things that are independent of the decision, inline below and here:

• readRuntimeHostSessions now builds on the single-page reader, but only readNext catches revision_changed; readFirst lets RuntimeHostSessionCatalogRevisionChangedError escape to callers that only know RuntimeHostCatalogReadError. Unreachable today because list_start sends no revision, but a two-line catch keeps that structural rather than Host-dependent.
• ACP's schema has mcpServers as a required field on session/new and no capability bit for "no MCP at all", so any editor with a context server configured gets -32602 from this adapter. Not a PR2 problem since prompt is not here yet, but it needs an answer before PR3; if you have a Zed handy, one real session/new would settle what clients actually send.
• The cursor codec's base64url canonicalisation and the exact-four-keys check are at odds with the v version field: either the cursor is opaque and any foreign byte is rejected (then v is dead), or v is the compatibility mechanism (then the two checks should go). One or the other.

Evidence boundary: static read of 711045e6 against main 6c632b13; maka-agent (737) and @maka/runtime-host (1555) suites green locally; the epoch guard was run on a locally built merge result and exits 2 as expected. No real editor was connected.

AI-assisted review: drafted with Maka; I verified the zero-subscriber Host path, the inspect() consumer search, and the guard result myself.

Approving 7cbd25e9. This is the PR2 I was hoping for: session/new is session.create and an id, session/list is a filtered page over the catalog reader, and the registry is down from 571 to 399 lines. The subscription machinery is gone without residue: no capacity reservation, no inspect(), no SESSION_CONNECTION_SUBSCRIPTION_MAX_ITEMS export, no compatible-change declaration, no alias on the connection, and protocol/, server/, connection.ts and reconnecting-connection.ts are byte-identical to main. So the epoch question dissolves too. The seventeen-session proof runs against a real Host in a child process, and the stdio-server test drives session/new through a connection that has no subscription method at all, which is the structural version of the same fact. readFirst and readNext now share one revision-changed retry, the cursor is opaque with v dropped and the exact-key check kept, and the help line matches. Merge-tree against main is clean, CI is green.

One thing to carry into PR3 rather than fix here: mcpServers still returns -32602 when non-empty, and the ACP schema makes the field required. Before session/prompt lands, one real session/new from Zed or another editor with a context server configured would settle what clients actually send.

Two small ones, take or leave: the in-process seventeen-session test asserts subscriptionOpens === 0 on a counter nothing in the registry can increment, so it cannot fail; the child-process and stdio-server tests already carry that obligation and this one can go, along with the last openSessionSubscriptionOnce string in the tree. And session/list can return an empty page with a nextCursor when client-side cwd filtering empties a Host page, which is fine by ACP but worth one sentence in the body.

Evidence boundary: static read of 7cbd25e9 against main 92fa5281; affected test:dist files run for maka-agent and @maka/runtime-host (33 + 57 + 39 passing), lint and format clean; no editor client connected.

AI-assisted review: drafted with Maka; I verified the deletions against main, the child-process proof and the merge result myself.