docs(maestro): document the claude-code-acp install (#134)

SIGTERM now counts as a shutdown alongside ctrl-c: systemd stops the
unit with SIGTERM, and with KillMode=process nothing else would reach
the claude-code-acp children. After the listener drains the manager
terminates every adapter before the process exits.

Cargo.toml

@@ -10,6 +10,7 @@ repository = "https://git.naps.pt/naps62/maestro"
 publish = false
 
 [workspace.dependencies]
+agent-client-protocol = "2.1"
 axum = { version = "0.7", features = ["ws"] }
 chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] }
 clap = { version = "4.5", features = ["derive", "env"] }
@@ -17,6 +18,7 @@ crossterm = { version = "0.28", features = ["event-stream"] }
 dirs = "5"
 futures-util = { version = "0.3", default-features = false, features = ["sink", "std"] }
 libc = "0.2"
+maestro-acp = { path = "crates/maestro-acp" }
 maestro-config = { path = "crates/maestro-config" }
 # `default-features = false` so each consumer opts into `haiku-autoname`
 # through its own feature of the same name (#131); a workspace entry that
@@ -38,6 +40,7 @@ tempfile = "3"
 thiserror = "1"
 tokio = { version = "1", features = ["macros", "rt-multi-thread", "sync", "time", "net", "io-util", "fs", "signal", "process"] }
 tokio-tungstenite = "0.21"
+tokio-util = { version = "0.7", features = ["compat"] }
 toml = "0.8"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }

crates/maestro-acp/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "maestro-acp"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+publish.workspace = true
+description = "ACP client role: one claude-code-acp child per structured session"
+
+[dependencies]
+agent-client-protocol.workspace = true
+libc.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+tokio.workspace = true
+tokio-util.workspace = true
+tracing.workspace = true
+
+[dev-dependencies]
+tempfile.workspace = true

crates/maestro-acp/src/lib.rs

@@ -0,0 +1,468 @@
+//! ACP client role for the daemon (#134): one `claude-code-acp` child per
+//! structured session.
+//!
+//! The daemon is the client; the adapter is the agent. [`spawn`] starts the
+//! adapter as a child process with stdio pipes, in the session's `cwd` with
+//! the session's env, runs the `initialize` + `session/new` handshake, and
+//! hands back an [`AcpSession`] that owns the connection for the life of the
+//! session.
+//!
+//! **The handshake declares almost nothing.** `initialize` reports
+//! `fs.readTextFile`, `fs.writeTextFile` and `terminal` as `false`, so the
+//! adapter uses Claude Code's own Read / Write / Bash instead of asking the
+//! daemon to act on its behalf — exactly what already happens in the
+//! terminal view. `session/request_permission` is the one client method that
+//! gets a real implementation, in #139; here it is a stub that declines.
+//!
+//! Every `session/update` notification the adapter sends lands on an
+//! unbounded channel the session owns ([`AcpSession::take_updates`]). Nothing
+//! is dropped while nobody reads: #135 takes the receiver and persists each
+//! notification to the per-session event log before broadcasting it.
+//!
+//! The child is a child of the daemon, full stop. It shares the daemon's
+//! process group, is marked to receive `SIGTERM` when the daemon dies
+//! (`PR_SET_PDEATHSIG` on Linux), and [`AcpSession::terminate`] is what both
+//! `DELETE /api/sessions/:id` and daemon shutdown call: `session/cancel`, a
+//! short wait, then `SIGTERM`, then `SIGKILL` as the last resort.
+
+#![deny(missing_debug_implementations)]
+
+use std::collections::{HashMap, VecDeque};
+use std::ffi::OsString;
+use std::path::{Path, PathBuf};
+use std::process::{ExitStatus, Stdio};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use agent_client_protocol::schema::v1::{
+    CancelNotification, ClientCapabilities, FileSystemCapabilities, Implementation,
+    InitializeRequest, NewSessionRequest, RequestPermissionOutcome, RequestPermissionRequest,
+    RequestPermissionResponse, SessionId, SessionNotification,
+};
+use agent_client_protocol::schema::ProtocolVersion;
+use agent_client_protocol::{ByteStreams, Client};
+use tokio::io::AsyncBufReadExt;
+use tokio::sync::{mpsc, oneshot, watch};
+use tokio_util::compat::{TokioAsyncReadCompatExt, TokioAsyncWriteCompatExt};
+
+pub use agent_client_protocol::schema::v1 as schema;
+
+/// The adapter binary, resolved on `PATH`.
+pub const ADAPTER_BIN: &str = "claude-code-acp";
+
+/// How to install the adapter when it is missing. Named in the error so an
+/// operator staring at a failed session knows what to run.
+pub const INSTALL_COMMAND: &str =
+    "npm install -g --prefix ~/.local @zed-industries/claude-code-acp";
+
+/// How long `initialize` + `session/new` may take before the spawn is
+/// declared failed. The real adapter boots a node process and the Claude
+/// Code SDK behind it; a slow machine takes seconds, never a minute.
+pub const HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(60);
+
+/// How long [`AcpSession::terminate`] waits after `session/cancel` before
+/// sending `SIGTERM`. Cancel is a courtesy that lets the adapter finish the
+/// turn it is on; the signal is what actually ends it.
+pub const CANCEL_GRACE: Duration = Duration::from_millis(500);
+
+/// How long [`AcpSession::terminate`] waits after `SIGTERM` before `SIGKILL`.
+pub const TERM_GRACE: Duration = Duration::from_secs(2);
+
+/// Bytes of the child's stderr kept for the failure message.
+const STDERR_TAIL_BYTES: usize = 4096;
+
+/// What [`spawn`] needs to start one adapter.
+#[derive(Debug, Clone)]
+pub struct SpawnConfig {
+    /// Working directory of the child and `cwd` of `session/new`.
+    pub cwd: PathBuf,
+    /// Environment laid over the daemon's own for the child. A `PATH` in
+    /// here is also what the adapter is resolved against, since that is the
+    /// `PATH` the child would see.
+    pub env: HashMap<String, String>,
+    /// Upper bound on the handshake; [`HANDSHAKE_TIMEOUT`] by default.
+    pub handshake_timeout: Duration,
+}
+
+impl SpawnConfig {
+    pub fn new(cwd: impl Into<PathBuf>, env: HashMap<String, String>) -> Self {
+        Self {
+            cwd: cwd.into(),
+            env,
+            handshake_timeout: HANDSHAKE_TIMEOUT,
+        }
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum AcpError {
+    /// The adapter is not on `PATH`. The message names the install command
+    /// so the failed session is actionable rather than silently dead.
+    #[error("{ADAPTER_BIN} not found on PATH; install it with: {INSTALL_COMMAND}")]
+    AdapterMissing,
+    #[error("failed to start {ADAPTER_BIN}: {0}")]
+    Spawn(#[source] std::io::Error),
+    /// The adapter answered the handshake with an error.
+    #[error("ACP handshake failed: {0}")]
+    Handshake(String),
+    /// The adapter went away before the handshake finished. Carries the
+    /// tail of its stderr, which is where a missing Claude login shows up.
+    #[error("{ADAPTER_BIN} exited during the ACP handshake ({status}){stderr}")]
+    ExitedEarly { status: String, stderr: String },
+    #[error("ACP handshake timed out after {0:?}")]
+    HandshakeTimeout(Duration),
+}
+
+/// Resolve [`ADAPTER_BIN`] against the `PATH` the child would run with: the
+/// session env's `PATH` when it sets one, the daemon's own otherwise.
+pub fn resolve_adapter(env: &HashMap<String, String>) -> Option<PathBuf> {
+    let path: OsString = match env.get("PATH") {
+        Some(p) => OsString::from(p),
+        None => std::env::var_os("PATH")?,
+    };
+    std::env::split_paths(&path)
+        .filter(|dir| !dir.as_os_str().is_empty())
+        .map(|dir| dir.join(ADAPTER_BIN))
+        .find(|candidate| is_executable(candidate))
+}
+
+fn is_executable(path: &Path) -> bool {
+    use std::os::unix::fs::PermissionsExt;
+    std::fs::metadata(path)
+        .map(|m| m.is_file() && m.permissions().mode() & 0o111 != 0)
+        .unwrap_or(false)
+}
+
+enum Command {
+    Cancel,
+    Close,
+}
+
+/// Why the handshake did not produce a session id.
+enum ReadyError {
+    /// The adapter answered with an error.
+    Handshake(String),
+    /// The transport closed under the request: the child is gone.
+    Closed,
+}
+
+fn ready_error(e: agent_client_protocol::Error) -> ReadyError {
+    if agent_client_protocol::is_incoming_transport_closed(&e) {
+        ReadyError::Closed
+    } else {
+        ReadyError::Handshake(e.to_string())
+    }
+}
+
+/// A live ACP connection to one adapter child. Dropping it sends `SIGTERM`
+/// if the child is still running; [`AcpSession::terminate`] is the polite
+/// version.
+#[derive(Debug)]
+pub struct AcpSession {
+    session_id: String,
+    pid: u32,
+    commands: mpsc::UnboundedSender<Command>,
+    updates: Mutex<Option<mpsc::UnboundedReceiver<SessionNotification>>>,
+    exit: watch::Receiver<Option<ExitStatus>>,
+}
+
+impl AcpSession {
+    /// The id `session/new` returned. What a respawn passes to
+    /// `session/load` (#135).
+    pub fn session_id(&self) -> &str {
+        &self.session_id
+    }
+
+    /// The adapter's pid.
+    pub fn pid(&self) -> u32 {
+        self.pid
+    }
+
+    /// Whether the child has been reaped.
+    pub fn has_exited(&self) -> bool {
+        self.exit.borrow().is_some()
+    }
+
+    /// Wait for the child to exit.
+    pub async fn wait(&self) -> Option<ExitStatus> {
+        wait_exit(&self.exit).await
+    }
+
+    /// The stream of raw `session/update` notifications, handed out once.
+    /// Notifications that arrived before the take are still queued on it.
+    pub fn take_updates(&self) -> Option<mpsc::UnboundedReceiver<SessionNotification>> {
+        self.updates.lock().expect("updates mutex").take()
+    }
+
+    /// Send `session/cancel`. Fire-and-forget: a closed connection means the
+    /// child is already gone, which is the outcome cancel was after.
+    pub fn cancel(&self) {
+        let _ = self.commands.send(Command::Cancel);
+    }
+
+    /// End the child: `session/cancel`, wait `cancel_grace`, `SIGTERM`, wait
+    /// `term_grace`, `SIGKILL`. Returns once the child has been reaped.
+    pub async fn terminate(&self, cancel_grace: Duration, term_grace: Duration) {
+        if self.has_exited() {
+            return;
+        }
+        self.cancel();
+        if tokio::time::timeout(cancel_grace, self.wait())
+            .await
+            .is_ok()
+        {
+            return;
+        }
+        self.signal(libc::SIGTERM);
+        if tokio::time::timeout(term_grace, self.wait()).await.is_ok() {
+            return;
+        }
+        tracing::warn!(
+            pid = self.pid,
+            "{ADAPTER_BIN} ignored SIGTERM; sending SIGKILL"
+        );
+        self.signal(libc::SIGKILL);
+        let _ = self.commands.send(Command::Close);
+        self.wait().await;
+    }
+
+    fn signal(&self, sig: libc::c_int) {
+        signal_pid(self.pid, sig);
+    }
+}
+
+impl Drop for AcpSession {
+    fn drop(&mut self) {
+        let _ = self.commands.send(Command::Close);
+        if !self.has_exited() {
+            self.signal(libc::SIGTERM);
+        }
+    }
+}
+
+/// Start the adapter for one session and run the handshake.
+///
+/// Fails without a running child: on any error the process is already
+/// signalled, so a failed session never leaves a stray adapter behind.
+pub async fn spawn(config: SpawnConfig) -> Result<AcpSession, AcpError> {
+    let adapter = resolve_adapter(&config.env).ok_or(AcpError::AdapterMissing)?;
+
+    let mut cmd = tokio::process::Command::new(&adapter);
+    cmd.current_dir(&config.cwd)
+        .envs(&config.env)
+        // Claude Code refuses to start when it thinks it is nested inside
+        // another Claude Code session; a daemon launched from one would
+        // otherwise never get a structured session up.
+        .env_remove("CLAUDECODE")
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        // If the daemon is dropped without a graceful shutdown the runtime
+        // still tears the task holding this `Child` down, and that kills it.
+        .kill_on_drop(true);
+    #[cfg(target_os = "linux")]
+    {
+        // Same process group as the daemon (no setpgid), and SIGTERM when the
+        // daemon dies however it dies: an agent that outlives its daemon is
+        // exactly the orphan #134 rules out.
+        // SAFETY: prctl is async-signal-safe and touches no shared state.
+        unsafe {
+            cmd.pre_exec(|| {
+                libc::prctl(libc::PR_SET_PDEATHSIG, libc::SIGTERM);
+                Ok(())
+            });
+        }
+    }
+    let mut child = cmd.spawn().map_err(AcpError::Spawn)?;
+    let pid = child.id().expect("child pid is known before wait");
+    let stdin = child.stdin.take().expect("piped stdin");
+    let stdout = child.stdout.take().expect("piped stdout");
+    let stderr = child.stderr.take().expect("piped stderr");
+
+    let stderr_tail = Arc::new(Mutex::new(VecDeque::<u8>::new()));
+    tokio::spawn(drain_stderr(stderr, pid, stderr_tail.clone()));
+
+    let (exit_tx, exit_rx) = watch::channel(None);
+    tokio::spawn(async move {
+        let status = child.wait().await.ok();
+        tracing::debug!(pid, ?status, "{ADAPTER_BIN} exited");
+        let _ = exit_tx.send(status);
+    });
+
+    let (updates_tx, updates_rx) = mpsc::unbounded_channel();
+    let (commands_tx, commands_rx) = mpsc::unbounded_channel();
+    let (ready_tx, ready_rx) = oneshot::channel();
+    let transport = ByteStreams::new(stdin.compat_write(), stdout.compat());
+    tokio::spawn(run_connection(
+        transport,
+        config.cwd.clone(),
+        updates_tx,
+        commands_rx,
+        ready_tx,
+    ));
+
+    let outcome = tokio::time::timeout(config.handshake_timeout, ready_rx).await;
+    let failure = match outcome {
+        Ok(Ok(Ok(session_id))) => {
+            return Ok(AcpSession {
+                session_id,
+                pid,
+                commands: commands_tx,
+                updates: Mutex::new(Some(updates_rx)),
+                exit: exit_rx,
+            });
+        }
+        Ok(Ok(Err(ReadyError::Handshake(message)))) => AcpError::Handshake(message),
+        Ok(Ok(Err(ReadyError::Closed))) | Ok(Err(_)) => {
+            // The connection ended before the handshake did: the child went
+            // away. Reap it so the status is real, then report.
+            let status = wait_exit(&exit_rx).await;
+            let stderr = {
+                let mut tail = stderr_tail.lock().expect("stderr tail");
+                tail.make_contiguous();
+                String::from_utf8_lossy(tail.as_slices().0)
+                    .trim()
+                    .to_string()
+            };
+            AcpError::ExitedEarly {
+                status: status.map_or_else(|| "unknown status".into(), |s| s.to_string()),
+                stderr: if stderr.is_empty() {
+                    String::new()
+                } else {
+                    format!(": {stderr}")
+                },
+            }
+        }
+        Err(_) => AcpError::HandshakeTimeout(config.handshake_timeout),
+    };
+    // No half-started adapter survives a failed spawn.
+    let _ = commands_tx.send(Command::Close);
+    signal_pid(pid, libc::SIGTERM);
+    if tokio::time::timeout(TERM_GRACE, wait_exit(&exit_rx))
+        .await
+        .is_err()
+    {
+        signal_pid(pid, libc::SIGKILL);
+        wait_exit(&exit_rx).await;
+    }
+    Err(failure)
+}
+
+async fn wait_exit(exit: &watch::Receiver<Option<ExitStatus>>) -> Option<ExitStatus> {
+    let mut exit = exit.clone();
+    let status = exit.wait_for(|s| s.is_some()).await.ok()?;
+    *status
+}
+
+fn signal_pid(pid: u32, sig: libc::c_int) {
+    // ESRCH just means the child is already gone.
+    // SAFETY: plain syscall on a pid we spawned and have not reaped.
+    unsafe {
+        libc::kill(pid as libc::pid_t, sig);
+    }
+}
+
+/// The capabilities the daemon declares: none of the filesystem or terminal
+/// surface, so the adapter falls back to Claude Code's own tools.
+fn client_capabilities() -> ClientCapabilities {
+    ClientCapabilities::new()
+        .fs(FileSystemCapabilities::new()
+            .read_text_file(false)
+            .write_text_file(false))
+        .terminal(false)
+}
+
+async fn run_connection<T>(
+    transport: T,
+    cwd: PathBuf,
+    updates_tx: mpsc::UnboundedSender<SessionNotification>,
+    mut commands_rx: mpsc::UnboundedReceiver<Command>,
+    ready_tx: oneshot::Sender<Result<String, ReadyError>>,
+) where
+    T: agent_client_protocol::ConnectTo<Client> + 'static,
+{
+    let result = Client
+        .builder()
+        .name("maestro")
+        .on_receive_notification(
+            async move |notification: SessionNotification, _cx| {
+                // A dropped receiver only means nobody wants updates any more.
+                let _ = updates_tx.send(notification);
+                Ok(())
+            },
+            agent_client_protocol::on_receive_notification!(),
+        )
+        .on_receive_request(
+            async move |request: RequestPermissionRequest, responder, _cx| {
+                // Stub until #139: decline rather than grant something the
+                // operator never saw.
+                tracing::warn!(
+                    session = %request.session_id,
+                    "session/request_permission declined: not implemented yet (#139)"
+                );
+                responder.respond(RequestPermissionResponse::new(
+                    RequestPermissionOutcome::Cancelled,
+                ))
+            },
+            agent_client_protocol::on_receive_request!(),
+        )
+        .connect_with(transport, async move |cx| {
+            let init = InitializeRequest::new(ProtocolVersion::V1)
+                .client_capabilities(client_capabilities())
+                .client_info(Implementation::new("maestro", env!("CARGO_PKG_VERSION")));
+            if let Err(e) = cx.send_request(init).block_task().await {
+                let _ = ready_tx.send(Err(ready_error(e)));
+                return Ok(());
+            }
+            let created = match cx
+                .send_request(NewSessionRequest::new(cwd))
+                .block_task()
+                .await
+            {
+                Ok(r) => r,
+                Err(e) => {
+                    let _ = ready_tx.send(Err(ready_error(e)));
+                    return Ok(());
+                }
+            };
+            let session_id = created.session_id.0.to_string();
+            let _ = ready_tx.send(Ok(session_id.clone()));
+
+            loop {
+                tokio::select! {
+                    cmd = commands_rx.recv() => match cmd {
+                        Some(Command::Cancel) => {
+                            let _ = cx.send_notification(CancelNotification::new(
+                                SessionId::new(session_id.as_str()),
+                            ));
+                        }
+                        Some(Command::Close) | None => break,
+                    },
+                    _ = cx.incoming_closed() => break,
+                }
+            }
+            Ok(())
+        })
+        .await;
+    if let Err(e) = result {
+        tracing::debug!(error = %e, "ACP connection ended with an error");
+    }
+}
+
+async fn drain_stderr(
+    stderr: tokio::process::ChildStderr,
+    pid: u32,
+    tail: Arc<Mutex<VecDeque<u8>>>,
+) {
+    let mut lines = tokio::io::BufReader::new(stderr).lines();
+    while let Ok(Some(line)) = lines.next_line().await {
+        tracing::debug!(pid, "{ADAPTER_BIN}: {line}");
+        let mut tail = tail.lock().expect("stderr tail");
+        tail.extend(line.as_bytes());
+        tail.push_back(b'\n');
+        while tail.len() > STDERR_TAIL_BYTES {
+            tail.pop_front();
+        }
+        tail.make_contiguous();
+    }
+}

crates/maestro-acp/tests/fake_acp_agent.py

@@ -0,0 +1,98 @@
+#!/usr/bin/env python3
+"""A deterministic stand-in for `claude-code-acp` (#134).
+
+Speaks just enough JSON-RPC over stdio for the daemon's handshake:
+answers `initialize` and `session/new`, logs every method it receives, and
+exits on SIGTERM. Tests point `PATH` at a directory holding this file under
+the adapter's name, so the real adapter (which needs Claude auth and is
+slow) never runs in the deterministic suite.
+
+Environment knobs, all optional:
+
+  FAKE_ACP_LOG            append one line per event to this file:
+                            start pid=<pid> cwd=<cwd>
+                            env <NAME>=<value>       (for FAKE_ACP_ECHO_ENV)
+                            caps <json of clientCapabilities>
+                            recv <method>
+                            signal SIGTERM
+  FAKE_ACP_ECHO_ENV       name of one env var to log at start
+  FAKE_ACP_INIT_FAIL=1    answer `initialize` with a JSON-RPC error
+  FAKE_ACP_EXIT_AFTER_NEW=1  exit 0 right after answering `session/new`
+  FAKE_ACP_EXIT_ON_CANCEL=1  exit 0 on `session/cancel` (default: keep running
+                             so the SIGTERM path is exercised)
+"""
+import json
+import os
+import signal
+import sys
+
+LOG = os.environ.get("FAKE_ACP_LOG")
+
+
+def log(line):
+    if not LOG:
+        return
+    with open(LOG, "a") as f:
+        f.write(line + "\n")
+        f.flush()
+
+
+def send(obj):
+    sys.stdout.write(json.dumps(obj) + "\n")
+    sys.stdout.flush()
+
+
+def on_sigterm(_signum, _frame):
+    log("signal SIGTERM")
+    sys.exit(0)
+
+
+signal.signal(signal.SIGTERM, on_sigterm)
+
+log(f"start pid={os.getpid()} cwd={os.getcwd()}")
+echo = os.environ.get("FAKE_ACP_ECHO_ENV")
+if echo:
+    log(f"env {echo}={os.environ.get(echo, '')}")
+
+session_id = f"fake-{os.getpid()}"
+
+for raw in sys.stdin:
+    raw = raw.strip()
+    if not raw:
+        continue
+    msg = json.loads(raw)
+    method = msg.get("method")
+    if method is None:
+        # A response to something we sent; nothing to do.
+        continue
+    log(f"recv {method}")
+    rid = msg.get("id")
+    params = msg.get("params") or {}
+
+    if method == "initialize":
+        log("caps " + json.dumps(params.get("clientCapabilities", {}), sort_keys=True))
+        if os.environ.get("FAKE_ACP_INIT_FAIL") == "1":
+            send({"jsonrpc": "2.0", "id": rid,
+                  "error": {"code": -32000, "message": "fake init failure"}})
+            continue
+        send({"jsonrpc": "2.0", "id": rid, "result": {
+            "protocolVersion": params.get("protocolVersion", 1),
+            "agentCapabilities": {"loadSession": True},
+            "agentInfo": {"name": "fake-acp-agent", "version": "0.0.0"},
+            "authMethods": [],
+        }})
+    elif method == "session/new":
+        send({"jsonrpc": "2.0", "id": rid, "result": {"sessionId": session_id}})
+        send({"jsonrpc": "2.0", "method": "session/update", "params": {
+            "sessionId": session_id,
+            "update": {"sessionUpdate": "agent_message_chunk",
+                       "content": {"type": "text", "text": "hello from fake"}},
+        }})
+        if os.environ.get("FAKE_ACP_EXIT_AFTER_NEW") == "1":
+            sys.exit(0)
+    elif method == "session/cancel":
+        if os.environ.get("FAKE_ACP_EXIT_ON_CANCEL") == "1":
+            sys.exit(0)
+    elif rid is not None:
+        send({"jsonrpc": "2.0", "id": rid,
+              "error": {"code": -32601, "message": f"method not found: {method}"}})

crates/maestro-acp/tests/spawn.rs

@@ -0,0 +1,292 @@
+//! `maestro-acp` against the fake adapter in `tests/fake_acp_agent.py`, plus
+//! one ignored test against the real `claude-code-acp`.
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use maestro_acp::schema::{ContentBlock, SessionUpdate};
+use maestro_acp::{AcpError, SpawnConfig, ADAPTER_BIN, INSTALL_COMMAND};
+use tempfile::TempDir;
+
+fn fake_agent() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fake_acp_agent.py")
+}
+
+/// A temp `bin/` holding the fake agent under the adapter's name, plus a
+/// log file the agent appends to. `PATH` for the spawn is just that dir.
+struct Fake {
+    dir: TempDir,
+}
+
+impl Fake {
+    fn new() -> Self {
+        let dir = TempDir::new().unwrap();
+        let bin = dir.path().join("bin");
+        std::fs::create_dir_all(&bin).unwrap();
+        std::fs::copy(fake_agent(), bin.join(ADAPTER_BIN)).unwrap();
+        Self { dir }
+    }
+
+    fn log_path(&self) -> PathBuf {
+        self.dir.path().join("agent.log")
+    }
+
+    fn log(&self) -> String {
+        std::fs::read_to_string(self.log_path()).unwrap_or_default()
+    }
+
+    /// The fake's `bin/` first, so it shadows any real adapter, then the
+    /// process `PATH` so the script's `python3` still resolves.
+    fn env(&self) -> HashMap<String, String> {
+        let path = format!(
+            "{}:{}",
+            self.dir.path().join("bin").display(),
+            std::env::var("PATH").unwrap_or_default()
+        );
+        HashMap::from([
+            ("PATH".to_string(), path),
+            (
+                "FAKE_ACP_LOG".to_string(),
+                self.log_path().to_string_lossy().into_owned(),
+            ),
+        ])
+    }
+
+    fn config(&self, cwd: &Path) -> SpawnConfig {
+        let mut config = SpawnConfig::new(cwd, self.env());
+        config.handshake_timeout = Duration::from_secs(10);
+        config
+    }
+
+    async fn wait_for_log(&self, needle: &str) {
+        let deadline = Instant::now() + Duration::from_secs(5);
+        while Instant::now() < deadline {
+            if self.log().contains(needle) {
+                return;
+            }
+            tokio::time::sleep(Duration::from_millis(20)).await;
+        }
+        panic!("log never contained {needle:?}:\n{}", self.log());
+    }
+}
+
+fn pid_alive(pid: u32) -> bool {
+    Path::new(&format!("/proc/{pid}")).exists()
+        && std::fs::read_to_string(format!("/proc/{pid}/stat"))
+            .map(|s| !s.contains(") Z "))
+            .unwrap_or(false)
+}
+
+#[tokio::test]
+async fn spawn_runs_adapter_in_cwd_with_env_and_restrictive_caps() {
+    let fake = Fake::new();
+    let cwd = TempDir::new().unwrap();
+    let mut config = fake.config(cwd.path());
+    config
+        .env
+        .insert("FAKE_ACP_ECHO_ENV".into(), "MAESTRO_SESSION_ID".into());
+    config
+        .env
+        .insert("MAESTRO_SESSION_ID".into(), "sess-123".into());
+
+    let session = maestro_acp::spawn(config).await.expect("spawn");
+    assert!(session.session_id().starts_with("fake-"));
+    assert!(pid_alive(session.pid()));
+
+    let log = fake.log();
+    let cwd_canon = cwd.path().canonicalize().unwrap();
+    assert!(
+        log.contains(&format!("cwd={}", cwd_canon.display())),
+        "child cwd missing from log:\n{log}"
+    );
+    assert!(log.contains("env MAESTRO_SESSION_ID=sess-123"), "{log}");
+    assert!(log.contains("recv initialize"), "{log}");
+    assert!(log.contains("recv session/new"), "{log}");
+    let caps = log
+        .lines()
+        .find_map(|l| l.strip_prefix("caps "))
+        .expect("caps line");
+    let caps: serde_json::Value = serde_json::from_str(caps).unwrap();
+    assert_eq!(caps["fs"]["readTextFile"], false);
+    assert_eq!(caps["fs"]["writeTextFile"], false);
+    assert_eq!(caps["terminal"], false);
+
+    session
+        .terminate(Duration::from_millis(100), Duration::from_secs(2))
+        .await;
+}
+
+#[tokio::test]
+async fn missing_adapter_names_the_install_command() {
+    let empty = TempDir::new().unwrap();
+    let cwd = TempDir::new().unwrap();
+    let env = HashMap::from([(
+        "PATH".to_string(),
+        empty.path().to_string_lossy().into_owned(),
+    )]);
+    let err = maestro_acp::spawn(SpawnConfig::new(cwd.path(), env))
+        .await
+        .expect_err("no adapter on PATH");
+    assert!(matches!(err, AcpError::AdapterMissing));
+    let msg = err.to_string();
+    assert!(msg.contains(ADAPTER_BIN), "{msg}");
+    assert!(msg.contains(INSTALL_COMMAND), "{msg}");
+}
+
+#[tokio::test]
+async fn session_updates_reach_the_taken_receiver() {
+    let fake = Fake::new();
+    let cwd = TempDir::new().unwrap();
+    let session = maestro_acp::spawn(fake.config(cwd.path()))
+        .await
+        .expect("spawn");
+
+    let mut updates = session.take_updates().expect("first take");
+    assert!(session.take_updates().is_none(), "handed out once");
+    let first = tokio::time::timeout(Duration::from_secs(5), updates.recv())
+        .await
+        .expect("update within 5s")
+        .expect("channel open");
+    assert_eq!(first.session_id.0.as_ref(), session.session_id());
+    match first.update {
+        SessionUpdate::AgentMessageChunk(chunk) => match chunk.content {
+            ContentBlock::Text(t) => assert_eq!(t.text, "hello from fake"),
+            other => panic!("unexpected content {other:?}"),
+        },
+        other => panic!("unexpected update {other:?}"),
+    }
+
+    session
+        .terminate(Duration::from_millis(100), Duration::from_secs(2))
+        .await;
+}
+
+#[tokio::test]
+async fn terminate_sends_cancel_then_sigterm() {
+    let fake = Fake::new();
+    let cwd = TempDir::new().unwrap();
+    let session = maestro_acp::spawn(fake.config(cwd.path()))
+        .await
+        .expect("spawn");
+    let pid = session.pid();
+
+    session
+        .terminate(Duration::from_millis(200), Duration::from_secs(2))
+        .await;
+    assert!(session.has_exited());
+    fake.wait_for_log("signal SIGTERM").await;
+
+    let log = fake.log();
+    let cancel = log.find("recv session/cancel").expect("cancel logged");
+    let term = log.find("signal SIGTERM").expect("SIGTERM logged");
+    assert!(cancel < term, "cancel must precede SIGTERM:\n{log}");
+    assert!(!pid_alive(pid), "child {pid} still alive");
+}
+
+#[tokio::test]
+async fn terminate_is_satisfied_by_an_exit_on_cancel() {
+    let fake = Fake::new();
+    let cwd = TempDir::new().unwrap();
+    let mut config = fake.config(cwd.path());
+    config
+        .env
+        .insert("FAKE_ACP_EXIT_ON_CANCEL".into(), "1".into());
+    let session = maestro_acp::spawn(config).await.expect("spawn");
+
+    session
+        .terminate(Duration::from_secs(2), Duration::from_secs(2))
+        .await;
+    assert!(session.has_exited());
+    let log = fake.log();
+    assert!(log.contains("recv session/cancel"), "{log}");
+    assert!(!log.contains("signal SIGTERM"), "cancel was enough:\n{log}");
+}
+
+#[tokio::test]
+async fn handshake_error_fails_the_spawn_and_reaps_the_child() {
+    let fake = Fake::new();
+    let cwd = TempDir::new().unwrap();
+    let mut config = fake.config(cwd.path());
+    config.env.insert("FAKE_ACP_INIT_FAIL".into(), "1".into());
+
+    let err = maestro_acp::spawn(config).await.expect_err("init fails");
+    assert!(matches!(err, AcpError::Handshake(_)), "{err}");
+    assert!(err.to_string().contains("fake init failure"), "{err}");
+    // Closing the connection gives the fake EOF on stdin; the SIGTERM that
+    // follows may find it already gone. Either way it must not survive.
+    let pid: u32 = fake
+        .log()
+        .lines()
+        .find_map(|l| l.strip_prefix("start pid="))
+        .and_then(|rest| rest.split(' ').next())
+        .and_then(|p| p.parse().ok())
+        .expect("pid in log");
+    let deadline = Instant::now() + Duration::from_secs(5);
+    while pid_alive(pid) && Instant::now() < deadline {
+        tokio::time::sleep(Duration::from_millis(20)).await;
+    }
+    assert!(!pid_alive(pid), "child {pid} outlived the failed spawn");
+}
+
+#[tokio::test]
+async fn early_exit_is_observed_after_a_successful_handshake() {
+    let fake = Fake::new();
+    let cwd = TempDir::new().unwrap();
+    let mut config = fake.config(cwd.path());
+    config
+        .env
+        .insert("FAKE_ACP_EXIT_AFTER_NEW".into(), "1".into());
+    let session = maestro_acp::spawn(config).await.expect("spawn");
+
+    let status = tokio::time::timeout(Duration::from_secs(5), session.wait())
+        .await
+        .expect("exit within 5s")
+        .expect("status");
+    assert!(status.success(), "{status}");
+    assert!(session.has_exited());
+}
+
+#[tokio::test]
+async fn child_exit_before_handshake_reports_exited_early() {
+    // A "adapter" that dies before answering anything.
+    let dir = TempDir::new().unwrap();
+    let bin = dir.path().join("bin");
+    std::fs::create_dir_all(&bin).unwrap();
+    let script = bin.join(ADAPTER_BIN);
+    std::fs::write(&script, "#!/bin/sh\necho 'not logged in' >&2\nexit 3\n").unwrap();
+    {
+        use std::os::unix::fs::PermissionsExt;
+        std::fs::set_permissions(&script, std::fs::Permissions::from_mode(0o755)).unwrap();
+    }
+    let cwd = TempDir::new().unwrap();
+    let env = HashMap::from([("PATH".to_string(), bin.to_string_lossy().into_owned())]);
+    let mut config = SpawnConfig::new(cwd.path(), env);
+    config.handshake_timeout = Duration::from_secs(10);
+
+    let err = maestro_acp::spawn(config).await.expect_err("child died");
+    match &err {
+        AcpError::ExitedEarly { status, stderr } => {
+            assert!(status.contains('3'), "{status}");
+            assert!(stderr.contains("not logged in"), "{stderr}");
+        }
+        other => panic!("unexpected {other:?}"),
+    }
+}
+
+/// End to end against the installed `claude-code-acp`. Needs Claude auth,
+/// takes seconds, so it is opt-in: `cargo test -p maestro-acp -- --ignored`.
+#[tokio::test]
+#[ignore]
+async fn real_adapter_handshake() {
+    let cwd = TempDir::new().unwrap();
+    let session = maestro_acp::spawn(SpawnConfig::new(cwd.path(), HashMap::new()))
+        .await
+        .expect("real claude-code-acp handshake");
+    assert!(!session.session_id().is_empty());
+    assert!(pid_alive(session.pid()));
+    session
+        .terminate(maestro_acp::CANCEL_GRACE, maestro_acp::TERM_GRACE)
+        .await;
+    assert!(session.has_exited());
+}

crates/maestro-cli/src/dispatch.rs

@@ -96,20 +96,32 @@ pub async fn dispatch(
 }
 
 /// `maestro hooks install` (#106): write the shipped hook script under the
-/// user's data dir and register it in their Claude Code settings. Idempotent
-/// and foreign-hook-preserving — the guarantees live in [`maestro_hooks`].
+/// user's data dir and register it in every agent's hook file. Idempotent and
+/// foreign-hook-preserving — the guarantees live in [`maestro_hooks`]. One
+/// agent failing is reported and does not stop the others.
 #[allow(clippy::result_large_err)]
 fn run_hooks_install() -> Result<(), CliError> {
     let home = dirs::home_dir().ok_or(CliError::NoHome)?;
-    let changed = maestro_hooks::install_for_home(&home)?;
-    if changed {
-        println!(
-            "installed claude-code activity hook: {} → {}",
-            maestro_hooks::script_path(&home).display(),
-            maestro_hooks::settings_path(&home).display()
-        );
-    } else {
-        println!("claude-code activity hook already up to date");
+    let script = maestro_hooks::script_path(&home);
+    for (target, result) in maestro_hooks::install_for_home(&home) {
+        let agent = target.label();
+        let settings = target.settings_path(&home);
+        match result {
+            Ok(true) => {
+                println!(
+                    "installed {agent} activity hook: {} → {}",
+                    script.display(),
+                    settings.display()
+                );
+                if target == maestro_hooks::Target::Codex {
+                    // Codex will not run a hook it has not been told to
+                    // trust, and that approval is the operator's to give.
+                    println!("  codex will ask you to trust this hook the next time it starts");
+                }
+            }
+            Ok(false) => println!("{agent} activity hook already up to date"),
+            Err(e) => eprintln!("{agent} activity hook not installed: {e}"),
+        }
     }
     Ok(())
 }

crates/maestro-cli/src/sessions.rs

@@ -51,6 +51,7 @@ pub async fn run_spawn(client: &DaemonClient, args: SpawnArgs) -> Result<Session
     };
 
     let body = CreateSessionRequest {
+        view: Default::default(),
         cwd: args.cwd.clone(),
         command: args.command.clone(),
         env,
@@ -188,7 +189,6 @@ fn print_session_table(out: &mut impl Write, sessions: &[Session], info: &Daemon
         let status = match s.status {
             SessionStatus::Running => "running",
             SessionStatus::Dead => "dead",
-            SessionStatus::Dormant => "dormant",
         };
         let activity = match s.activity {
             ActivityState::Active => "active",
@@ -237,6 +237,7 @@ mod tests {
 
     fn session(cwd: &str, command: &str, id: u128) -> Session {
         Session {
+            view: Default::default(),
             id: Uuid::from_u128(id),
             cwd: PathBuf::from(cwd),
             command: command.into(),
@@ -253,7 +254,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: None,
-            agent_session_id: None,
+            acp_session_id: None,
         }
     }
 

crates/maestro-cli/tests/against_mock_daemon.rs

@@ -28,7 +28,6 @@ async fn info_carries_version_and_presets() {
             id: "claude".into(),
             label: "Claude".into(),
             command: "claude".into(),
-            resume_command: None,
         }],
         ..Default::default()
     });
@@ -92,6 +91,7 @@ async fn spawn_round_trips_through_the_daemon() {
     let created = mock
         .client()
         .create_session(&maestro_protocol::CreateSessionRequest {
+            view: Default::default(),
             cwd: "/home/mock".into(),
             command: "bash".into(),
             env: Default::default(),

crates/maestro-config/src/lib.rs

@@ -313,19 +313,16 @@ pub fn builtin_presets() -> Vec<SpawnPreset> {
             id: "claude".into(),
             label: "Claude".into(),
             command: "claude".into(),
-            resume_command: Some("claude --resume {agent_session}".into()),
         },
         SpawnPreset {
             id: "opencode".into(),
             label: "opencode".into(),
             command: "opencode".into(),
-            resume_command: None,
         },
         SpawnPreset {
             id: "zsh".into(),
             label: "Shell".into(),
             command: "zsh".into(),
-            resume_command: None,
         },
     ]
 }
@@ -337,7 +334,6 @@ pub fn custom_preset() -> SpawnPreset {
         id: CUSTOM_PRESET_ID.into(),
         label: "Custom…".into(),
         command: String::new(),
-        resume_command: None,
     }
 }
 
@@ -511,18 +507,6 @@ auto_install = false
         assert!(custom.command.is_empty());
     }
 
-    #[test]
-    fn builtin_claude_preset_resumes_by_agent_session() {
-        let claude = builtin_presets()
-            .into_iter()
-            .find(|preset| preset.id == "claude")
-            .expect("Claude preset");
-        assert_eq!(
-            claude.resume_command.as_deref(),
-            Some("claude --resume {agent_session}")
-        );
-    }
-
     #[test]
     fn spawn_presets_override_replaces_builtins() {
         // Present list replaces the built-ins entirely; custom still appended.
@@ -531,7 +515,6 @@ auto_install = false
                 id: "fish".into(),
                 label: "fish".into(),
                 command: "fish".into(),
-                resume_command: None,
             }]),
             ..Default::default()
         };
@@ -568,7 +551,6 @@ auto_install = false
                 id: "  ".into(),
                 label: "x".into(),
                 command: "x".into(),
-                resume_command: None,
             }]),
             ..Default::default()
         };
@@ -579,7 +561,6 @@ auto_install = false
                 id: "x".into(),
                 label: "x".into(),
                 command: "".into(),
-                resume_command: None,
             }]),
             ..Default::default()
         };
@@ -597,13 +578,11 @@ auto_install = false
                     id: "a".into(),
                     label: "a".into(),
                     command: "a".into(),
-                    resume_command: None,
                 },
                 SpawnPreset {
                     id: "a".into(),
                     label: "a2".into(),
                     command: "a2".into(),
-                    resume_command: None,
                 },
             ]),
             ..Default::default()
@@ -618,7 +597,6 @@ auto_install = false
                 id: "custom".into(),
                 label: "Custom".into(),
                 command: "whatever".into(),
-                resume_command: None,
             }]),
             ..Default::default()
         };
@@ -654,27 +632,6 @@ presets = [
         assert_eq!(ids, ["claude", "zsh", "custom"]);
     }
 
-    #[test]
-    fn spawn_preset_parses_resume_command_from_issue_example() {
-        let cfg = toml::from_str::<MaestroConfigFile>(
-            r#"
-[spawn]
-presets = [
-  { id = "claude", command = "claude --dangerously-skip-permissions", resume_command = "claude --dangerously-skip-permissions --resume {agent_session}" }
-]
-"#,
-        )
-        .expect("issue #165 example parses");
-
-        let preset = &cfg.spawn.presets.expect("configured presets")[0];
-        assert_eq!(preset.id, "claude");
-        assert_eq!(preset.command, "claude --dangerously-skip-permissions");
-        assert_eq!(
-            preset.resume_command.as_deref(),
-            Some("claude --dangerously-skip-permissions --resume {agent_session}")
-        );
-    }
-
     #[test]
     fn spawn_project_scan_fields_default_to_none() {
         // Absent [spawn].project_* → None; the daemon applies its own defaults.

crates/maestro-daemon/Cargo.toml

@@ -28,6 +28,7 @@ dirs.workspace = true
 futures-util.workspace = true
 include_dir = { workspace = true, optional = true }
 libc.workspace = true
+maestro-acp.workspace = true
 mime_guess = { workspace = true, optional = true }
 maestro-config.workspace = true
 maestro-hooks = { workspace = true, default-features = false }
@@ -42,6 +43,7 @@ tracing-subscriber.workspace = true
 uuid.workspace = true
 
 [dev-dependencies]
+libc.workspace = true
 reqwest.workspace = true
 tokio-tungstenite.workspace = true
 urlencoding = "2"

crates/maestro-daemon/src/boot_id.rs

@@ -1,62 +0,0 @@
-//! Tells a daemon restart from a host reboot (#164).
-//!
-//! `/proc/sys/kernel/random/boot_id` is fixed for the life of the kernel and
-//! changes on every boot. [`SessionManager::recover`] compares it against the
-//! value it stored on the previous run: a difference means every session from
-//! before is provably dead, so the tmux probe can be skipped and those
-//! sessions registered dormant directly instead of relying on tmux reporting
-//! an empty list.
-
-use std::path::Path;
-
-/// Where the daemon reads the running kernel's boot id. Behind a trait so
-/// tests can simulate a changed (or unreadable) boot id without rebooting the
-/// machine.
-pub trait BootIdSource: std::fmt::Debug + Send + Sync + 'static {
-    /// Current boot id, or `None` if it can't be determined (non-Linux,
-    /// restricted `/proc`, missing or empty file).
-    fn current(&self) -> Option<String>;
-}
-
-/// Production source: `/proc/sys/kernel/random/boot_id`.
-#[derive(Debug, Default)]
-pub struct ProcBootId;
-
-impl BootIdSource for ProcBootId {
-    fn current(&self) -> Option<String> {
-        read_boot_id(Path::new("/proc/sys/kernel/random/boot_id"))
-    }
-}
-
-fn read_boot_id(path: &Path) -> Option<String> {
-    let contents = std::fs::read_to_string(path).ok()?;
-    let trimmed = contents.trim();
-    (!trimmed.is_empty()).then(|| trimmed.to_string())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn reads_trimmed_contents() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("boot_id");
-        std::fs::write(&path, "abc-123\n").unwrap();
-        assert_eq!(read_boot_id(&path).as_deref(), Some("abc-123"));
-    }
-
-    #[test]
-    fn missing_file_returns_none() {
-        let dir = tempfile::tempdir().unwrap();
-        assert_eq!(read_boot_id(&dir.path().join("missing")), None);
-    }
-
-    #[test]
-    fn empty_file_returns_none() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("boot_id");
-        std::fs::write(&path, "\n").unwrap();
-        assert_eq!(read_boot_id(&path), None);
-    }
-}

crates/maestro-daemon/src/cli.rs

@@ -51,17 +51,23 @@ async fn run(config_override: Option<PathBuf>) -> Result<(), Box<dyn Error>> {
     // First-start hook auto-install (#106). Best-effort, before serving: a
     // session spawned right away should already carry the hook.
     if config.hooks_auto_install {
-        match crate::hooks::auto_install(&config.home_dir) {
-            crate::hooks::AutoInstallOutcome::Installed => {
-                tracing::info!("installed claude-code activity hook (#106)");
+        for (target, outcome) in crate::hooks::auto_install(&config.home_dir) {
+            let agent = target.label();
+            match outcome {
+                crate::hooks::AutoInstallOutcome::Installed => {
+                    tracing::info!(agent, "installed activity hook (#106)");
+                }
+                crate::hooks::AutoInstallOutcome::Upgraded => {
+                    tracing::info!(agent, "updated activity hook to this build (#106)");
+                }
+                crate::hooks::AutoInstallOutcome::Failed => {
+                    tracing::warn!(
+                        agent,
+                        "hooks auto-install failed; run `maestro hooks install` manually"
+                    );
+                }
+                _ => {}
             }
-            crate::hooks::AutoInstallOutcome::Upgraded => {
-                tracing::info!("updated claude-code activity hook to this build (#106)");
-            }
-            crate::hooks::AutoInstallOutcome::Failed => {
-                tracing::warn!("hooks auto-install failed; run `maestro hooks install` manually");
-            }
-            _ => {}
         }
     }
     // No worktree dir to pre-create: without an override the worktrees live
@@ -83,11 +89,7 @@ async fn run(config_override: Option<PathBuf>) -> Result<(), Box<dyn Error>> {
     .with_spawn_history(crate::spawn_history::SpawnHistory::new(
         config.spawn_history_path(),
         config.spawn_history_days,
-    ))
-    .with_boot_id(
-        config.boot_id_path(),
-        std::sync::Arc::new(crate::boot_id::ProcBootId),
-    );
+    ));
     // Spawned sessions learn where to report back (#103). Derived from the
     // configured bind address; set before any spawn can happen.
     manager.set_daemon_url(format!("http://{}", config.bind_addr));
@@ -104,7 +106,7 @@ async fn run(config_override: Option<PathBuf>) -> Result<(), Box<dyn Error>> {
     projects.start_background_refresh();
 
     let router = local_api::router(local_api::state_for(
-        manager,
+        manager.clone(),
         config.hostname.clone(),
         config.home_dir.clone(),
         config.spawn_presets.clone(),
@@ -116,14 +118,25 @@ async fn run(config_override: Option<PathBuf>) -> Result<(), Box<dyn Error>> {
     let bound = listener.local_addr()?;
     tracing::info!(addr = %bound, "API listening");
 
+    // Ctrl-C at a terminal or SIGTERM from systemd: either one is a
+    // shutdown, and both must reach the adapter children below (#134). The
+    // unit's `KillMode=process` signals only the daemon, so nothing else
+    // would end them.
     let shutdown = async {
-        let _ = tokio::signal::ctrl_c().await;
-        tracing::info!("ctrl-c received — shutting down");
+        let mut sigterm = tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate())
+            .expect("install SIGTERM handler");
+        tokio::select! {
+            _ = tokio::signal::ctrl_c() => tracing::info!("ctrl-c received — shutting down"),
+            _ = sigterm.recv() => tracing::info!("SIGTERM received — shutting down"),
+        }
     };
 
     axum::serve(listener, router)
         .tcp_nodelay(true)
         .with_graceful_shutdown(shutdown)
         .await?;
+    // tmux sessions outlive the daemon by design; structured sessions'
+    // adapter children do not (#134).
+    manager.shutdown().await;
     Ok(())
 }

crates/maestro-daemon/src/config.rs

@@ -112,12 +112,6 @@ impl DaemonConfig {
     pub fn spawn_history_path(&self) -> PathBuf {
         self.state_dir.join("spawn-history.jsonl")
     }
-
-    /// Where recovery records the kernel boot id it saw last (#164):
-    /// `<state_dir>/boot_id`.
-    pub fn boot_id_path(&self) -> PathBuf {
-        self.state_dir.join("boot_id")
-    }
 }
 
 /// Env-var overrides applied by [`load_config`]. Tests pass explicit

crates/maestro-daemon/src/hooks.rs

@@ -1,37 +1,53 @@
 //! First-start hook auto-install (#106).
 //!
-//! The daemon runs [`auto_install`] once at startup: unless the user's
-//! `~/.claude/settings.json` already carries exactly what this build ships
-//! (and `[hooks].auto_install` hasn't opted out — checked by the caller), the
-//! same installer `maestro hooks install` uses writes it. That covers
-//! upgrades as well as first starts: an install from a maestro that had fewer
-//! events — #131 added `UserPromptSubmit` to a hook #106 had already put in
-//! everyone's settings — is rewritten rather than left half-wired. Best-effort:
-//! a failure is warned about and never blocks startup. The same global hook
-//! serves every Claude Code session on the machine, so nothing here targets
-//! repositories or worktrees.
+//! The daemon runs [`auto_install`] once at startup: for every agent maestro
+//! knows how to hook ([`maestro_hooks::Target`]), unless that agent's hook
+//! file already carries exactly what this build ships (and `[hooks]
+//! .auto_install` hasn't opted out — checked by the caller), the same
+//! installer `maestro hooks install` uses writes it. That covers upgrades as
+//! well as first starts: an install from a maestro that had fewer events —
+//! #131 added `UserPromptSubmit` to a hook #106 had already put in everyone's
+//! settings — is rewritten rather than left half-wired. Best-effort: a
+//! failure is warned about and never blocks startup, and one target failing
+//! does not stop the others. The same global hook serves every session on the
+//! machine, so nothing here targets repositories or worktrees.
 
 use std::path::Path;
 
-/// Install the Claude Code activity hook for `home_dir` unless the current
-/// one is already there or the home dir is unresolvable (`""`). Returns what
-/// happened; an older install being brought up to date is
-/// [`AutoInstallOutcome::Upgraded`], so the log can say so.
-pub fn auto_install(home_dir: &str) -> AutoInstallOutcome {
+use maestro_hooks::Target;
+
+/// Install the activity hook for every [`Target`] under `home_dir`, skipping
+/// any whose install is already current. Returns what happened per target —
+/// an older install being brought up to date is
+/// [`AutoInstallOutcome::Upgraded`], so the log can say so. An unresolvable
+/// home dir (`""`) reports every target as [`AutoInstallOutcome::Skipped`].
+pub fn auto_install(home_dir: &str) -> Vec<(Target, AutoInstallOutcome)> {
+    Target::ALL
+        .iter()
+        .map(|&target| (target, auto_install_target(target, home_dir)))
+        .collect()
+}
+
+fn auto_install_target(target: Target, home_dir: &str) -> AutoInstallOutcome {
     if home_dir.is_empty() {
         return AutoInstallOutcome::Skipped;
     }
-    let settings = maestro_hooks::settings_path(Path::new(home_dir));
-    let script = maestro_hooks::script_path(Path::new(home_dir));
-    if maestro_hooks::is_current(&settings, &script) {
+    let home = Path::new(home_dir);
+    let settings = target.settings_path(home);
+    let script = maestro_hooks::script_path(home);
+    if maestro_hooks::is_current(target, &settings, &script) {
         return AutoInstallOutcome::AlreadyPresent;
     }
     let stale = maestro_hooks::is_installed(&settings);
-    match maestro_hooks::install_for_home(Path::new(home_dir)) {
+    match maestro_hooks::install_target(target, home) {
         Ok(_) if stale => AutoInstallOutcome::Upgraded,
         Ok(_) => AutoInstallOutcome::Installed,
         Err(e) => {
-            tracing::warn!(error = %e, "hooks auto-install failed (non-fatal)");
+            tracing::warn!(
+                target = target.label(),
+                error = %e,
+                "hooks auto-install failed (non-fatal)"
+            );
             AutoInstallOutcome::Failed
         }
     }
@@ -52,15 +68,50 @@ pub enum AutoInstallOutcome {
 mod tests {
     use super::*;
 
+    /// The outcome recorded for one target.
+    fn outcome(outcomes: &[(Target, AutoInstallOutcome)], target: Target) -> AutoInstallOutcome {
+        outcomes
+            .iter()
+            .find(|(t, _)| *t == target)
+            .map(|(_, o)| *o)
+            .expect("every target is reported")
+    }
+
     /// Everything happens under a temp `$HOME`; the developer's own
-    /// `~/.claude/settings.json` is never read or written.
+    /// `~/.claude/settings.json` and `~/.codex/hooks.json` are never read or
+    /// written.
     #[test]
     fn installs_when_settings_carry_no_maestro_hook() {
         let dir = tempfile::tempdir().unwrap();
-        let outcome = auto_install(dir.path().to_str().unwrap());
-        assert_eq!(outcome, AutoInstallOutcome::Installed);
-        let settings = dir.path().join(".claude/settings.json");
-        assert!(maestro_hooks::is_installed(&settings));
+        let outcomes = auto_install(dir.path().to_str().unwrap());
+        for target in Target::ALL {
+            assert_eq!(
+                outcome(&outcomes, target),
+                AutoInstallOutcome::Installed,
+                "{}",
+                target.label()
+            );
+            assert!(maestro_hooks::is_installed(
+                &target.settings_path(dir.path())
+            ));
+        }
+    }
+
+    /// Every agent maestro knows about is hooked, not just Claude Code: a
+    /// codex session reports activity and its first prompt the same way.
+    #[test]
+    fn codex_gets_its_own_hook_file() {
+        let dir = tempfile::tempdir().unwrap();
+        auto_install(dir.path().to_str().unwrap());
+        let hooks = dir.path().join(".codex/hooks.json");
+        let root: serde_json::Value =
+            serde_json::from_str(&std::fs::read_to_string(&hooks).unwrap()).unwrap();
+        let events = root["hooks"].as_object().unwrap();
+        assert!(events.contains_key("PermissionRequest"));
+        assert!(
+            !events.contains_key("Notification"),
+            "codex has no Notification"
+        );
     }
 
     #[test]
@@ -69,14 +120,22 @@ mod tests {
         let home = dir.path().to_str().unwrap();
         auto_install(home);
         // A current install is left exactly as it is.
-        let settings = dir.path().join(".claude/settings.json");
-        let before = std::fs::read_to_string(&settings).unwrap();
-        assert_eq!(auto_install(home), AutoInstallOutcome::AlreadyPresent);
-        assert_eq!(
-            before,
-            std::fs::read_to_string(&settings).unwrap(),
-            "already-installed settings must not be rewritten"
-        );
+        let before: Vec<String> = Target::ALL
+            .iter()
+            .map(|t| std::fs::read_to_string(t.settings_path(dir.path())).unwrap())
+            .collect();
+        let outcomes = auto_install(home);
+        for (i, target) in Target::ALL.iter().enumerate() {
+            assert_eq!(
+                outcome(&outcomes, *target),
+                AutoInstallOutcome::AlreadyPresent
+            );
+            assert_eq!(
+                before[i],
+                std::fs::read_to_string(target.settings_path(dir.path())).unwrap(),
+                "already-installed settings must not be rewritten"
+            );
+        }
     }
 
     /// An install from an older maestro — present, but missing an event this
@@ -87,7 +146,7 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let home = dir.path().to_str().unwrap();
         auto_install(home);
-        let settings = dir.path().join(".claude/settings.json");
+        let settings = Target::ClaudeCode.settings_path(dir.path());
         let script = maestro_hooks::script_path(dir.path());
 
         let mut root: serde_json::Value =
@@ -96,12 +155,23 @@ mod tests {
         std::fs::write(&settings, serde_json::to_string_pretty(&root).unwrap()).unwrap();
         std::fs::write(&script, "#!/bin/sh\nexit 0\n").unwrap();
 
-        assert_eq!(auto_install(home), AutoInstallOutcome::Upgraded);
-        assert!(maestro_hooks::is_current(&settings, &script));
+        let outcomes = auto_install(home);
+        assert_eq!(
+            outcome(&outcomes, Target::ClaudeCode),
+            AutoInstallOutcome::Upgraded
+        );
+        assert!(maestro_hooks::is_current(
+            Target::ClaudeCode,
+            &settings,
+            &script
+        ));
     }
 
     #[test]
     fn unresolvable_home_is_skipped() {
-        assert_eq!(auto_install(""), AutoInstallOutcome::Skipped);
+        let outcomes = auto_install("");
+        for target in Target::ALL {
+            assert_eq!(outcome(&outcomes, target), AutoInstallOutcome::Skipped);
+        }
     }
 }

crates/maestro-daemon/src/lib.rs

@@ -12,7 +12,6 @@ pub mod attach;
 /// Naming a session after its first prompt (#131).
 #[cfg(feature = "haiku-autoname")]
 pub mod autoname;
-pub mod boot_id;
 pub mod branches;
 pub mod cli;
 pub mod config;

crates/maestro-daemon/src/local_api.rs

@@ -307,11 +307,7 @@ async fn report_activity(
     Path(id): Path<Uuid>,
     Json(body): Json<ReportActivityRequest>,
 ) -> Response {
-    match s
-        .manager
-        .report_activity(id, body.state, body.detail, body.session_id)
-        .await
-    {
+    match s.manager.report_activity(id, body.state, body.detail).await {
         Ok(()) => StatusCode::NO_CONTENT.into_response(),
         Err(e) => {
             let info = e.to_error_info();

crates/maestro-daemon/src/session.rs

@@ -12,14 +12,14 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use chrono::Utc;
+use maestro_acp::{AcpSession, SpawnConfig};
 use maestro_protocol::{
     ActivityState, CatalogEvent, CreateSessionRequest, ErrorInfo, NameSource, Session,
-    SessionStatus, WorktreeSpec, NAME_KEY, NAME_SOURCE_KEY,
+    SessionStatus, SessionView, WorktreeSpec, NAME_KEY, NAME_SOURCE_KEY,
 };
 use tokio::sync::{broadcast, Mutex};
 use uuid::Uuid;
 
-use crate::boot_id::BootIdSource;
 use crate::panes::Panes;
 use crate::pty::{pipe_pane_command, PtyBridge};
 use crate::sidecar::{SidecarError, SidecarStore};
@@ -63,10 +63,7 @@ pub struct SessionRecord {
     /// `base_repo` from the original `WorktreeSpec`. Needed because `git
     /// worktree remove` is invoked from the base repo.
     pub worktree_base_repo: Option<PathBuf>,
-    /// The PTY bridge feeding this session's attach stream. `None` for a
-    /// `Dormant` session (#162): there is no pane behind it, so there is
-    /// nothing to pipe and nothing to attach to.
-    pub bridge: Option<PtyBridge>,
+    pub bridge: PtyBridge,
     /// Agent-reported activity (#105) still within its TTL. While in force it
     /// outranks the activity pass's own inference; when it lapses, inference
     /// resumes and [`Session::activity_detail`] is cleared with it. This
@@ -91,6 +88,12 @@ pub struct SessionRecord {
     /// glow, this holds through focus loss until the session does new work.
     /// Daemon-local; never rides the wire.
     pub awaiting_suppressed: bool,
+    /// The `claude-code-acp` child behind a [`SessionView::Structured`]
+    /// session (#134): its connection, pid and the raw notification stream.
+    /// `None` for terminal sessions and for a structured session whose
+    /// adapter never came up. Shared so a kill or shutdown can terminate it
+    /// outside the sessions lock. Daemon-local; never rides the wire.
+    pub acp: Option<Arc<AcpSession>>,
 }
 
 #[derive(Debug, thiserror::Error)]
@@ -180,25 +183,6 @@ struct Inner {
     /// client that reconnects never collides with the registration its
     /// previous socket has not finished releasing.
     next_viewport: AtomicU64,
-    /// Boot-id tracking for `recover` (#164). `None` — the default — means
-    /// reboot detection is unwired, which behaves exactly like a boot id
-    /// that could never be read: always fall back to probing tmux.
-    boot_id: Option<BootIdConfig>,
-}
-
-/// Where recovery persists the boot id it last saw, and how it reads the
-/// current one. See [`crate::boot_id`].
-struct BootIdConfig {
-    path: PathBuf,
-    source: Arc<dyn BootIdSource>,
-}
-
-impl std::fmt::Debug for BootIdConfig {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("BootIdConfig")
-            .field("path", &self.path)
-            .finish_non_exhaustive()
-    }
 }
 
 impl SessionManager {
@@ -241,7 +225,6 @@ impl SessionManager {
                 events,
                 viewports: Mutex::new(Viewports::new()),
                 next_viewport: AtomicU64::new(0),
-                boot_id: None,
             }),
         }
     }
@@ -271,21 +254,6 @@ impl SessionManager {
         self
     }
 
-    /// Wire boot-id tracking for `recover` (#164). Builder, called once right
-    /// after construction like the other `with_*` methods. Without it,
-    /// `recover` always falls back to probing tmux — the same as a boot id
-    /// that could never be read.
-    ///
-    /// # Panics
-    ///
-    /// If the handle has already been cloned.
-    pub fn with_boot_id(mut self, path: PathBuf, source: Arc<dyn BootIdSource>) -> Self {
-        let inner = Arc::get_mut(&mut self.inner)
-            .expect("with_boot_id must be called before the SessionManager is cloned");
-        inner.boot_id = Some(BootIdConfig { path, source });
-        self
-    }
-
     /// Set the daemon's own HTTP base URL (#103), exported to every session
     /// spawned afterwards as `MAESTRO_URL`. Unlike the `with_*` builders this
     /// is a plain setter: the daemon runner learns its bound address after
@@ -326,14 +294,52 @@ impl SessionManager {
         sessions.values().map(|r| r.session.clone()).collect()
     }
 
+    /// The raw `session/update` stream of a structured session (#134),
+    /// handed out once; `None` for a terminal session, a session whose
+    /// adapter never came up, or a stream already taken. Notifications that
+    /// arrived before the take are still queued. #135 takes it to feed the
+    /// per-session event log.
+    pub async fn take_acp_updates(
+        &self,
+        id: Uuid,
+    ) -> Option<tokio::sync::mpsc::UnboundedReceiver<maestro_acp::schema::SessionNotification>>
+    {
+        let sessions = self.inner.sessions.lock().await;
+        sessions.get(&id)?.acp.as_ref()?.take_updates()
+    }
+
+    /// End every adapter child before the daemon exits (#134): each gets
+    /// `session/cancel`, then SIGTERM, concurrently. The sessions stay in
+    /// the map, marked Dead and written through to their sidecars, so what
+    /// is on disk after the restart is truthful. tmux sessions are left
+    /// alone — surviving a restart is what they are for.
+    pub async fn shutdown(&self) {
+        let children: Vec<(Uuid, Arc<AcpSession>)> = {
+            let sessions = self.inner.sessions.lock().await;
+            sessions
+                .iter()
+                .filter(|(_, r)| r.session.status == SessionStatus::Running)
+                .filter_map(|(id, r)| r.acp.clone().map(|acp| (*id, acp)))
+                .collect()
+        };
+        if children.is_empty() {
+            return;
+        }
+        tracing::info!(count = children.len(), "shutdown: ending adapter children");
+        let terminations = children
+            .iter()
+            .map(|(_, acp)| acp.terminate(maestro_acp::CANCEL_GRACE, maestro_acp::TERM_GRACE));
+        futures_util::future::join_all(terminations).await;
+        for (id, _) in children {
+            mark_session_dead(&self.inner, id).await;
+        }
+    }
+
     /// Subscribe to a session's PTY broadcast. `None` if the session is
     /// unknown to this daemon.
     pub async fn subscribe_pty(&self, id: Uuid) -> Option<broadcast::Receiver<Vec<u8>>> {
         let sessions = self.inner.sessions.lock().await;
-        sessions
-            .get(&id)
-            .and_then(|r| r.bridge.as_ref())
-            .map(|b| b.subscribe())
+        sessions.get(&id).map(|r| r.bridge.subscribe())
     }
 
     /// Subscribe to a session's PTY broadcast and return the replay buffer
@@ -352,26 +358,19 @@ impl SessionManager {
         let (result, updated) = {
             let mut sessions = self.inner.sessions.lock().await;
             let rec = sessions.get_mut(&id)?;
-            let SessionRecord {
-                session, bridge, ..
-            } = &mut *rec;
-            // #162: a dormant session has no bridge and no pane — nothing was
-            // ever piped for it, so there is no stream to hand back and the
-            // attach reads as unknown. Checked before anything is stamped.
-            let bridge = bridge.as_ref()?;
-            session.last_focused_at = Some(Utc::now());
-            let updated = session.clone();
+            rec.session.last_focused_at = Some(Utc::now());
+            let updated = rec.session.clone();
             // For a live session, tmux's own screen beats the byte tail: the
             // tail starts mid-stream, so a full-screen program (an agent TUI)
             // replayed from it renders as garbage until something forces a
             // repaint. A dead session has no pane left to capture, so it
             // keeps the byte tail.
-            let alive = session.status == SessionStatus::Running;
+            let alive = rec.session.status == SessionStatus::Running && rec.acp.is_none();
             // The capture shells out to tmux while the replay lock is held,
             // which parks the reader for the length of one tmux round-trip.
             // That only happens on attach, and the alternative is a seam in
             // the stream.
-            let result = bridge.subscribe_with_snapshot(|| {
+            let result = rec.bridge.subscribe_with_snapshot(|| {
                 if !alive {
                     return None;
                 }
@@ -476,20 +475,48 @@ impl SessionManager {
         {
             session_env.insert("MAESTRO_URL".into(), url);
         }
-        let spawned = {
-            let tmux = self.inner.tmux.clone();
-            let cwd = effective_cwd.clone();
-            let command = req.command.clone();
-            let sink = pipe_pane_command(&fifo_path);
-            let env = session_env.clone();
-            tmux_blocking(move || tmux.new_session_piped(id, &cwd, &command, &env, &sink)).await
+        // A structured session (#134) gets no tmux pane: the agent is a
+        // child of the daemon, driven over ACP. An adapter that cannot come
+        // up still yields a session — Dead, with the reason on it — so the
+        // operator sees what to fix instead of a silently missing session.
+        let (acp, acp_failure) = match req.view {
+            SessionView::Structured => {
+                match maestro_acp::spawn(SpawnConfig::new(
+                    &effective_cwd,
+                    session_env
+                        .iter()
+                        .map(|(k, v)| (k.clone(), v.clone()))
+                        .collect(),
+                ))
+                .await
+                {
+                    Ok(acp) => (Some(Arc::new(acp)), None),
+                    Err(e) => {
+                        tracing::warn!(%id, error = %e, "structured session: adapter failed to start");
+                        (None, Some(e.to_string()))
+                    }
+                }
+            }
+            SessionView::Terminal => {
+                let spawned = {
+                    let tmux = self.inner.tmux.clone();
+                    let cwd = effective_cwd.clone();
+                    let command = req.command.clone();
+                    let sink = pipe_pane_command(&fifo_path);
+                    let env = session_env.clone();
+                    tmux_blocking(move || tmux.new_session_piped(id, &cwd, &command, &env, &sink))
+                        .await
+                };
+                if let Err(e) = spawned {
+                    // `bridge` drops at the end of this block, closing the
+                    // FIFO reader.
+                    let _ = std::fs::remove_file(&fifo_path);
+                    self.rollback_worktree(&worktree_base_repo, &worktree_path);
+                    return Err(SessionError::Tmux(e));
+                }
+                (None, None)
+            }
         };
-        if let Err(e) = spawned {
-            // `bridge` drops at the end of this block, closing the FIFO reader.
-            let _ = std::fs::remove_file(&fifo_path);
-            self.rollback_worktree(&worktree_base_repo, &worktree_path);
-            return Err(SessionError::Tmux(e));
-        }
 
         // Capture spawn-history inputs before `req` is partially moved into
         // `session`. `history_cwd` is the *chosen* working dir (the request
@@ -512,13 +539,21 @@ impl SessionManager {
                     base_repo: base_repo.clone(),
                 },
             ),
-            status: SessionStatus::Running,
+            status: if acp_failure.is_some() {
+                SessionStatus::Dead
+            } else {
+                SessionStatus::Running
+            },
             created_at: Utc::now(),
             // A freshly-spawned session is producing its initial output; the
             // activity watcher refines `foreground`/`activity` on its next tick.
             foreground: None,
-            activity: ActivityState::Active,
-            activity_detail: None,
+            activity: if acp_failure.is_some() {
+                ActivityState::Error
+            } else {
+                ActivityState::Active
+            },
+            activity_detail: acp_failure,
             last_activity_at: Utc::now(),
             activity_since: chrono::Utc::now(),
 
@@ -527,14 +562,23 @@ impl SessionManager {
             // fresh tree has nothing in the way anyway.
             blocked_work: None,
             last_focused_at: None,
-            agent_session_id: None,
+            acp_session_id: acp.as_ref().map(|a| a.session_id().to_string()),
+            view: req.view,
         };
 
         if let Err(e) = self.inner.sidecar.write(&session) {
-            // tmux already spawned the session; kill it so no ghost survives a
+            // The process already started; end it so no ghost survives a
             // failed sidecar write, then unwind the FIFO + worktree.
-            let tmux = self.inner.tmux.clone();
-            let _ = tmux_blocking(move || tmux.kill_session(id)).await;
+            match &acp {
+                Some(acp) => {
+                    acp.terminate(maestro_acp::CANCEL_GRACE, maestro_acp::TERM_GRACE)
+                        .await
+                }
+                None => {
+                    let tmux = self.inner.tmux.clone();
+                    let _ = tmux_blocking(move || tmux.kill_session(id)).await;
+                }
+            }
             let _ = std::fs::remove_file(&fifo_path);
             self.rollback_worktree(&worktree_base_repo, &worktree_path);
             return Err(SessionError::Sidecar(e));
@@ -549,13 +593,14 @@ impl SessionManager {
                     fifo_path,
                     worktree_path,
                     worktree_base_repo,
-                    bridge: Some(bridge),
+                    bridge,
                     reported_activity: None,
                     settled: false,
                     #[cfg(feature = "haiku-autoname")]
                     naming: false,
                     focused_since: None,
                     awaiting_suppressed: false,
+                    acp,
                 },
             );
         }
@@ -625,7 +670,9 @@ impl SessionManager {
                         .worktree_base_repo
                         .clone()
                         .zip(record.worktree_path.clone()),
-                    record.session.status == SessionStatus::Running,
+                    // A structured session has no pane to kill; its child is
+                    // ended through the ACP handle in `cleanup_record`.
+                    record.session.status == SessionStatus::Running && record.acp.is_none(),
                 ),
             }
         };
@@ -701,21 +748,9 @@ impl SessionManager {
     /// and start a `PtyBridge`. Sessions whose sidecar references a `cwd`
     /// that no longer exists are still adopted — the spec does not require
     /// us to repair them.
-    ///
-    /// #164: when the kernel's boot id has changed since the last run, the
-    /// tmux probe below is skipped entirely — a reboot kills the tmux server,
-    /// so every previous session is already dead and there is nothing tmux
-    /// could truthfully adopt. [`Self::register_dormant`] then registers all
-    /// of them directly.
     pub async fn recover(&self) -> Result<usize, SessionError> {
         tokio::fs::create_dir_all(&self.inner.fifo_dir).await?;
-        let rebooted = self.check_boot_id().await;
-        let live = if rebooted {
-            // #164: every session from the previous boot is provably dead —
-            // no tmux server survives a reboot — so there is nothing to gain
-            // from asking it and no session it could honestly report back.
-            Vec::new()
-        } else {
+        let live = {
             let tmux = self.inner.tmux.clone();
             tmux_blocking(move || tmux.list_sessions()).await?
         };
@@ -745,7 +780,10 @@ impl SessionManager {
                     current_cwd: None,
                     blocked_work: None,
                     last_focused_at: None,
-                    agent_session_id: None,
+                    acp_session_id: None,
+                    // Unknown on adoption without a sidecar; matches every
+                    // other field's forward-compat default.
+                    view: maestro_protocol::SessionView::Terminal,
                 },
             };
             let fifo_path = self.inner.fifo_dir.join(format!("{id}.fifo"));
@@ -770,13 +808,16 @@ impl SessionManager {
                     // directory blocks that branch forever (#54 review).
                     worktree_path: session.worktree.as_ref().map(|w| w.path.clone()),
                     worktree_base_repo: session.worktree.as_ref().map(|w| w.base_repo.clone()),
-                    bridge: Some(bridge),
+                    bridge,
                     reported_activity: None,
                     settled: false,
                     #[cfg(feature = "haiku-autoname")]
                     naming: false,
                     focused_since: None,
                     awaiting_suppressed: false,
+                    // A structured session's adapter died with the previous
+                    // daemon; only tmux-backed sessions can be adopted.
+                    acp: None,
                 },
             );
             let _ = self
@@ -785,144 +826,16 @@ impl SessionManager {
                 .send(CatalogEvent::SessionAdded { session });
             adopted += 1;
         }
-        self.register_dormant(rebooted).await;
         Ok(adopted)
     }
 
-    /// Compare the running kernel's boot id against the one recovery stored
-    /// last time (#164), then persist the current one for next time. Returns
-    /// `true` only when both are known and differ — a host reboot.
-    ///
-    /// A missing stored value (first run) or an unreadable current one
-    /// (non-Linux, restricted `/proc`, unwired in this build) both read as
-    /// "no reboot", which is today's behaviour: fall back to probing tmux.
-    async fn check_boot_id(&self) -> bool {
-        let Some(cfg) = &self.inner.boot_id else {
-            return false;
-        };
-        let Some(current) = cfg.source.current() else {
-            return false;
-        };
-        let stored = tokio::fs::read_to_string(&cfg.path)
-            .await
-            .ok()
-            .map(|s| s.trim().to_string())
-            .filter(|s| !s.is_empty());
-        let rebooted = stored.is_some_and(|s| s != current);
-        if let Some(parent) = cfg.path.parent() {
-            let _ = tokio::fs::create_dir_all(parent).await;
-        }
-        if let Err(e) = tokio::fs::write(&cfg.path, &current).await {
-            tracing::warn!(error = ?e, path = %cfg.path.display(), "recover: failed to persist boot id");
-        }
-        rebooted
-    }
-
-    /// Second recovery pass (#162): register every sidecar tmux had nothing to
-    /// adopt as a [`SessionStatus::Dormant`] session.
-    ///
-    /// A host reboot kills the tmux server, so the first pass runs over an
-    /// empty list and every session would otherwise disappear from the API
-    /// while its sidecar sat untouched on disk. A dormant record keeps the id,
-    /// name, cwd, command, worktree and `created_at` — everything the sidecar
-    /// holds — so the operator still has a record of what was running. It has
-    /// no tmux session and no [`PtyBridge`] behind it: it cannot be attached
-    /// to, cannot be typed into, and is skipped by both watcher passes. The
-    /// only thing left to do with one is dismiss it, which removes the sidecar
-    /// so the next recovery does not bring it back.
-    ///
-    /// Activity is not carried over: whatever the session was doing, it is not
-    /// doing it now. The rest of the sidecar is left as written.
-    ///
-    /// #163: a sidecar whose `cwd` no longer exists is pruned instead —
-    /// nothing can be resumed in a directory that is gone, so the honest move
-    /// is to delete the sidecar rather than register a record no operator can
-    /// act on. A sidecar whose `cwd` still exists is kept regardless of age.
-    ///
-    /// `rebooted` (#164) only changes what gets logged: a detected reboot
-    /// names the count even when it is zero, so the operator sees that
-    /// recovery told a reboot from a restart instead of a log that stays
-    /// silent either way.
-    async fn register_dormant(&self, rebooted: bool) {
-        let stored = match self.inner.sidecar.load_all() {
-            Ok(stored) => stored,
-            Err(e) => {
-                tracing::warn!(error = ?e, "recover: reading sidecars for dormant sessions failed");
-                return;
-            }
-        };
-        let mut registered = Vec::new();
-        let mut pruned = 0usize;
-        {
-            let mut sessions = self.inner.sessions.lock().await;
-            for mut session in stored {
-                if sessions.contains_key(&session.id) {
-                    // Adopted live by the first pass; its sidecar is on disk too.
-                    continue;
-                }
-                if !session.cwd.exists() {
-                    if let Err(e) = self.inner.sidecar.delete(session.id) {
-                        tracing::warn!(error = ?e, id = %session.id, "recover: failed to prune sidecar with missing cwd");
-                    }
-                    pruned += 1;
-                    continue;
-                }
-                let id = session.id;
-                session.status = SessionStatus::Dormant;
-                session.foreground = None;
-                session.activity = ActivityState::Idle;
-                session.activity_detail = None;
-                sessions.insert(
-                    id,
-                    SessionRecord {
-                        session: session.clone(),
-                        fifo_path: self.inner.fifo_dir.join(format!("{id}.fifo")),
-                        // Still known, so a dismissal cleans the worktree up —
-                        // the same reason recovery restores it for a live
-                        // session (#54 review).
-                        worktree_path: session.worktree.as_ref().map(|w| w.path.clone()),
-                        worktree_base_repo: session.worktree.as_ref().map(|w| w.base_repo.clone()),
-                        bridge: None,
-                        reported_activity: None,
-                        settled: false,
-                        #[cfg(feature = "haiku-autoname")]
-                        naming: false,
-                        focused_since: None,
-                        awaiting_suppressed: false,
-                    },
-                );
-                registered.push(session);
-            }
-        }
-        if rebooted {
-            tracing::info!(
-                dormant = registered.len(),
-                "host rebooted, sessions dormant"
-            );
-        } else if !registered.is_empty() {
-            tracing::info!(
-                dormant = registered.len(),
-                "registered sessions with no live tmux as dormant"
-            );
-        }
-        if pruned > 0 {
-            tracing::info!(pruned, "pruned sidecars whose cwd no longer exists");
-        }
-        for session in registered {
-            let _ = self
-                .inner
-                .events
-                .send(CatalogEvent::SessionAdded { session });
-        }
-    }
-
-    /// Forward keystrokes to a session's pane. A dead or dormant session is
-    /// read-only — its pane is gone, so this is a no-op rather than a tmux
-    /// failure the client would have to interpret.
+    /// Forward keystrokes to a session's pane. A dead session is read-only —
+    /// its pane is gone, so this is a no-op rather than a tmux failure the
+    /// client would have to interpret.
     pub async fn send_keys(&self, id: Uuid, bytes: &[u8]) -> Result<(), SessionError> {
         match self.status(id).await {
             None => return Err(SessionError::NotFound(id)),
-            Some(SessionStatus::Dead | SessionStatus::Dormant) => return Ok(()),
+            Some(SessionStatus::Dead) => return Ok(()),
             Some(SessionStatus::Running) => {}
         }
         let tmux = self.inner.tmux.clone();
@@ -935,15 +848,13 @@ impl SessionManager {
     /// Type `text` into a session's pane, with an Enter after it when
     /// `submit` is set.
     ///
-    /// Unlike [`Self::send_keys`], a dead or dormant session is an error: the
-    /// caller asked for text to land somewhere, and a silent success would let
-    /// a script believe an agent had been told something it never heard.
+    /// Unlike [`Self::send_keys`], a dead session is an error: the caller
+    /// asked for text to land somewhere, and a silent success would let a
+    /// script believe an agent had been told something it never heard.
     pub async fn send_input(&self, id: Uuid, text: &str, submit: bool) -> Result<(), SessionError> {
         match self.status(id).await {
             None => return Err(SessionError::NotFound(id)),
-            Some(SessionStatus::Dead | SessionStatus::Dormant) => {
-                return Err(SessionError::NotRunning(id))
-            }
+            Some(SessionStatus::Dead) => return Err(SessionError::NotRunning(id)),
             Some(SessionStatus::Running) => {}
         }
         let tmux = self.inner.tmux.clone();
@@ -961,12 +872,12 @@ impl SessionManager {
         Ok(())
     }
 
-    /// Resize a session's window. No-op for a dead or dormant session, as with
+    /// Resize a session's window. No-op for a dead session, as with
     /// [`Self::send_keys`].
     pub async fn resize(&self, id: Uuid, cols: u16, rows: u16) -> Result<(), SessionError> {
         match self.status(id).await {
             None => return Err(SessionError::NotFound(id)),
-            Some(SessionStatus::Dead | SessionStatus::Dormant) => return Ok(()),
+            Some(SessionStatus::Dead) => return Ok(()),
             Some(SessionStatus::Running) => {}
         }
         let tmux = self.inner.tmux.clone();
@@ -1074,18 +985,11 @@ impl SessionManager {
     /// A report that changes the effective state restarts `activity_since`
     /// (#104's clock); re-reporting an unchanged state only extends the TTL
     /// and stays silent on the event stream at steady state.
-    ///
-    /// `agent_session_id` (#161) is the agent's own conversation id, parsed
-    /// by the caller from the hook payload's `session_id` field. It is
-    /// written once — the first report that carries one wins — and the
-    /// sidecar is only rewritten on that transition, never on every report,
-    /// since an agent's session id never changes mid-session.
     pub async fn report_activity(
         &self,
         id: Uuid,
         state: ActivityState,
         detail: Option<String>,
-        agent_session_id: Option<String>,
     ) -> Result<(), SessionError> {
         let updated = {
             let mut sessions = self.inner.sessions.lock().await;
@@ -1101,16 +1005,7 @@ impl SessionManager {
                 state,
                 self.inner.report_ttl,
             ));
-            let newly_identified =
-                rec.session.agent_session_id.is_none() && agent_session_id.is_some();
-            if newly_identified {
-                rec.session.agent_session_id = agent_session_id;
-                self.inner
-                    .sidecar
-                    .write(&rec.session)
-                    .map_err(SessionError::Sidecar)?;
-            }
-            (changed || newly_identified).then(|| rec.session.clone())
+            changed.then(|| rec.session.clone())
         };
         if let Some(session) = updated {
             let _ = self
@@ -1292,21 +1187,36 @@ async fn run_liveness_pass(inner: &Arc<Inner>) {
     // be competing to start the tmux server).
     // Only sessions we still believe are running can transition; a session
     // already marked Dead must not re-emit an update on every 2s tick.
-    let known: Vec<Uuid> = {
+    // A structured session (#134) is not in tmux at all: its liveness is its
+    // adapter child, checked through the ACP handle instead.
+    let (tmux_backed, acp_backed): (Vec<Uuid>, Vec<(Uuid, Arc<AcpSession>)>) = {
         let sessions = inner.sessions.lock().await;
         if sessions.is_empty() {
             return;
         }
-        sessions
+        let running = sessions
             .iter()
-            .filter(|(_, r)| r.session.status == SessionStatus::Running)
-            .map(|(id, _)| *id)
-            .collect()
+            .filter(|(_, r)| r.session.status == SessionStatus::Running);
+        let mut tmux_backed = Vec::new();
+        let mut acp_backed = Vec::new();
+        for (id, record) in running {
+            match &record.acp {
+                Some(acp) => acp_backed.push((*id, acp.clone())),
+                None => tmux_backed.push(*id),
+            }
+        }
+        (tmux_backed, acp_backed)
     };
-    if known.is_empty() {
-        return;
+
+    for (id, acp) in acp_backed {
+        if acp.has_exited() {
+            mark_session_dead(inner, id).await;
+        }
     }
 
+    if tmux_backed.is_empty() {
+        return;
+    }
     let live_ids = {
         let tmux = inner.tmux.clone();
         match tmux_blocking(move || tmux.list_sessions()).await {
@@ -1319,7 +1229,7 @@ async fn run_liveness_pass(inner: &Arc<Inner>) {
     };
     let live: HashSet<Uuid> = live_ids.into_iter().collect();
 
-    for id in known {
+    for id in tmux_backed {
         if !live.contains(&id) {
             mark_session_dead(inner, id).await;
         }
@@ -1383,11 +1293,7 @@ async fn run_activity_pass(inner: &Arc<Inner>) {
                     rec.session.activity_detail = None;
                 }
             }
-            // Only `Running` sessions reach this pass, and every one of them
-            // has a bridge; a dormant session has neither pane nor bridge.
-            let Some(idle) = rec.bridge.as_ref().map(|b| b.idle_for()) else {
-                continue;
-            };
+            let idle = rec.bridge.idle_for();
             // #105: while a report is in force it supplies the state and
             // nothing here may overwrite it; only an unreported session is
             // decided by inference.
@@ -1505,10 +1411,8 @@ async fn run_blocked_work_pass(inner: &Arc<Inner>) {
 /// alone and stays attached to the dead record for a later forced dismissal
 /// (#81), which leaves it on disk too.
 ///
-/// A dead session does not come back as dead across a daemon restart: its
-/// sidecar survives, so [`SessionManager::recover`]'s second pass registers it
-/// as [`SessionStatus::Dormant`] (#162) — accurate either way, since neither
-/// has a pane behind it.
+/// Dead sessions do not survive a daemon restart: [`SessionManager::recover`]
+/// adopts only what tmux still holds.
 async fn mark_session_dead(inner: &Arc<Inner>, id: Uuid) {
     let flipped = {
         let mut sessions = inner.sessions.lock().await;
@@ -1517,9 +1421,7 @@ async fn mark_session_dead(inner: &Arc<Inner>, id: Uuid) {
                 record.session.status = SessionStatus::Dead;
                 // Release anyone attached; the scrollback survives for a later
                 // attach.
-                if let Some(bridge) = record.bridge.as_mut() {
-                    bridge.seal();
-                }
+                record.bridge.seal();
                 let session = record.session.clone();
                 let worktree = record
                     .worktree_base_repo
@@ -1533,14 +1435,13 @@ async fn mark_session_dead(inner: &Arc<Inner>, id: Uuid) {
     let Some((mut session, worktree)) = flipped else {
         return;
     };
-    tracing::info!(%id, "session vanished from tmux — marking dead");
+    tracing::info!(%id, "session process gone — marking dead");
 
     if let Some(wt) = &worktree {
         if settle_worktree_on_exit(inner, id, wt).await {
             // The tree is settled (removed); a stale "in the way" would
             // describe something the session no longer holds.
             session.blocked_work = None;
-            session.worktree = None;
             let mut sessions = inner.sessions.lock().await;
             if let Some(record) = sessions.get_mut(&id) {
                 record.session.worktree = None;
@@ -1636,6 +1537,11 @@ async fn cleanup_record(
         let tmux = inner.tmux.clone();
         let _ = tmux_blocking(move || tmux.kill_session(id)).await;
     }
+    if let Some(acp) = &record.acp {
+        // `session/cancel`, a short wait, then SIGTERM (#134).
+        acp.terminate(maestro_acp::CANCEL_GRACE, maestro_acp::TERM_GRACE)
+            .await;
+    }
     let _ = std::fs::remove_file(&record.fifo_path);
     if let Err(e) = inner.sidecar.delete(id) {
         tracing::warn!(error = ?e, %id, "cleanup: failed to delete sidecar");

crates/maestro-daemon/src/worktree.rs

@@ -111,16 +111,33 @@ impl WorktreeManager {
         // Clear registrations whose directory is gone first, so a
         // previously-leaked entry doesn't push this branch to a suffix.
         prune(base_repo)?;
-        // Anything occupying the target — a tree we left behind, one the
-        // operator made, an unrelated directory — is sidestepped with a
-        // numeric suffix on the directory; the branch stays whatever was
-        // requested (#77). The daemon never adopts what it finds.
-        let mut path = self.target_path(base_repo, branch);
-        let mut n = 1;
-        while path.symlink_metadata().is_ok() {
-            n += 1;
-            path = self.target_path_suffixed(base_repo, branch, n);
-        }
+        let (branch, path) = if create_branch {
+            // Worktrees are commonly abandoned without deleting their branch,
+            // so a random handle can collide with one of its own past runs.
+            // Unlike the `add_existing` arm below, the suffix goes on the
+            // branch name itself — the path is derived from it anyway.
+            let mut candidate = branch.to_string();
+            let mut path = self.target_path(base_repo, &candidate);
+            let mut n = 1;
+            while path.symlink_metadata().is_ok() || branch_exists(base_repo, &candidate) {
+                n += 1;
+                candidate = format!("{branch}-{n}");
+                path = self.target_path(base_repo, &candidate);
+            }
+            (candidate, path)
+        } else {
+            // Existing branch: the name must stay exact, so only the
+            // directory — anything occupying it, ours or the operator's — is
+            // sidestepped with a numeric suffix (#77). The daemon never
+            // adopts what it finds.
+            let mut path = self.target_path(base_repo, branch);
+            let mut n = 1;
+            while path.symlink_metadata().is_ok() {
+                n += 1;
+                path = self.target_path_suffixed(base_repo, branch, n);
+            }
+            (branch.to_string(), path)
+        };
         // The parent (`<repo>/worktrees` or the override root) may not exist
         // yet; the target itself must not.
         if let Some(parent) = path.parent() {
@@ -129,10 +146,10 @@ impl WorktreeManager {
         let mut cmd = Command::new("git");
         cmd.arg("-C").arg(base_repo).args(["worktree", "add"]);
         if create_branch {
-            cmd.arg("-b").arg(branch).arg(&path);
+            cmd.arg("-b").arg(&branch).arg(&path);
         } else {
             // Existing branch: `worktree add <path> <branch>` with no `-b`.
-            cmd.arg(&path).arg(branch);
+            cmd.arg(&path).arg(&branch);
         }
         let out = cmd.output()?;
         check(out)?;
@@ -266,6 +283,17 @@ fn branch_relpath(branch: &str) -> Option<PathBuf> {
     Some(candidate.to_path_buf())
 }
 
+/// Whether `refs/heads/<branch>` already exists in `base_repo`.
+fn branch_exists(base_repo: &Path, branch: &str) -> bool {
+    Command::new("git")
+        .arg("-C")
+        .arg(base_repo)
+        .args(["show-ref", "--verify", "--quiet"])
+        .arg(format!("refs/heads/{branch}"))
+        .status()
+        .is_ok_and(|s| s.success())
+}
+
 /// `git -C <base_repo> worktree prune` — drops registrations whose directory
 /// no longer exists.
 fn prune(base_repo: &Path) -> Result<(), WorktreeError> {

crates/maestro-daemon/tests/acp.rs

@@ -0,0 +1,296 @@
+//! Structured sessions (#134): a `claude-code-acp` child per session instead
+//! of a tmux pane. Runs against the fake adapter in
+//! `crates/maestro-acp/tests/fake_acp_agent.py`; nothing here needs Claude.
+
+mod common;
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use common::{wait_for_async, DaemonFixture};
+use maestro_acp::{ADAPTER_BIN, INSTALL_COMMAND};
+use maestro_protocol::{ActivityState, CreateSessionRequest, SessionStatus, SessionView};
+use tempfile::TempDir;
+
+fn fake_agent() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("../maestro-acp/tests/fake_acp_agent.py")
+}
+
+/// The fake adapter installed as `claude-code-acp` in a temp `bin/`, with
+/// the log file it appends to. `env()` is what a spawn request carries.
+struct Fake {
+    dir: TempDir,
+}
+
+impl Fake {
+    fn new() -> Self {
+        let dir = TempDir::new().unwrap();
+        let bin = dir.path().join("bin");
+        std::fs::create_dir_all(&bin).unwrap();
+        std::fs::copy(fake_agent(), bin.join(ADAPTER_BIN)).unwrap();
+        Self { dir }
+    }
+
+    fn log_path(&self) -> PathBuf {
+        self.dir.path().join("agent.log")
+    }
+
+    fn log(&self) -> String {
+        std::fs::read_to_string(self.log_path()).unwrap_or_default()
+    }
+
+    /// Fake `bin/` first so it shadows any real adapter, then the process
+    /// `PATH` so the script's `python3` still resolves.
+    fn env(&self) -> HashMap<String, String> {
+        let path = format!(
+            "{}:{}",
+            self.dir.path().join("bin").display(),
+            std::env::var("PATH").unwrap_or_default()
+        );
+        HashMap::from([
+            ("PATH".to_string(), path),
+            (
+                "FAKE_ACP_LOG".to_string(),
+                self.log_path().to_string_lossy().into_owned(),
+            ),
+        ])
+    }
+
+    /// The pid the fake logged at start, once it has.
+    fn pid(&self) -> u32 {
+        self.log()
+            .lines()
+            .find_map(|l| l.strip_prefix("start pid="))
+            .and_then(|rest| rest.split(' ').next())
+            .and_then(|p| p.parse().ok())
+            .expect("pid in log")
+    }
+}
+
+fn structured(cwd: &Path, env: HashMap<String, String>) -> CreateSessionRequest {
+    CreateSessionRequest {
+        view: SessionView::Structured,
+        cwd: cwd.to_path_buf(),
+        command: "claude".into(),
+        env,
+        metadata: HashMap::new(),
+        worktree: None,
+    }
+}
+
+fn pid_alive(pid: u32) -> bool {
+    std::fs::read_to_string(format!("/proc/{pid}/stat"))
+        .map(|s| !s.contains(") Z "))
+        .unwrap_or(false)
+}
+
+async fn wait_for_exit(pid: u32) {
+    let deadline = Instant::now() + Duration::from_secs(5);
+    while pid_alive(pid) && Instant::now() < deadline {
+        tokio::time::sleep(Duration::from_millis(20)).await;
+    }
+    assert!(!pid_alive(pid), "pid {pid} still alive");
+}
+
+#[tokio::test]
+async fn structured_spawn_starts_the_adapter_in_cwd_with_session_env() {
+    let fx = DaemonFixture::new();
+    let fake = Fake::new();
+    let cwd = TempDir::new().unwrap();
+    let mut env = fake.env();
+    env.insert("FAKE_ACP_ECHO_ENV".into(), "MAESTRO_SESSION_ID".into());
+
+    let session = fx
+        .manager
+        .create(structured(cwd.path(), env))
+        .await
+        .expect("create");
+
+    assert_eq!(session.view, SessionView::Structured);
+    assert_eq!(session.status, SessionStatus::Running);
+    let acp_id = session.acp_session_id.clone().expect("acp session id");
+    assert!(acp_id.starts_with("fake-"), "{acp_id}");
+
+    // The child ran in the session cwd with the session's env — including
+    // the identity the daemon injects, so the agent knows which session it
+    // is (#103).
+    let log = fake.log();
+    let cwd_canon = cwd.path().canonicalize().unwrap();
+    assert!(
+        log.contains(&format!("cwd={}", cwd_canon.display())),
+        "{log}"
+    );
+    assert!(
+        log.contains(&format!("env MAESTRO_SESSION_ID={}", session.id)),
+        "{log}"
+    );
+
+    // No tmux pane was created for it: the agent is the daemon's child.
+    let panes = fx.tmux.tmux.list_sessions().expect("list");
+    assert!(
+        !panes.contains(&session.id),
+        "structured session got a tmux pane"
+    );
+
+    // The sidecar carries the id a respawn will pass to session/load (#135).
+    let sidecar: maestro_protocol::Session = serde_json::from_slice(
+        &std::fs::read(fx.sidecar_dir().join(format!("{}.json", session.id))).unwrap(),
+    )
+    .unwrap();
+    assert_eq!(sidecar.acp_session_id.as_deref(), Some(acp_id.as_str()));
+
+    // The raw notification stream is reachable for #135, handed out once.
+    let mut updates = fx
+        .manager
+        .take_acp_updates(session.id)
+        .await
+        .expect("updates receiver");
+    assert!(fx.manager.take_acp_updates(session.id).await.is_none());
+    let first = tokio::time::timeout(Duration::from_secs(5), updates.recv())
+        .await
+        .expect("an update within 5s")
+        .expect("channel open");
+    assert_eq!(first.session_id.0.as_ref(), acp_id);
+
+    fx.manager.kill(session.id, false).await.expect("kill");
+}
+
+#[tokio::test]
+async fn missing_adapter_yields_a_failed_session_naming_the_install_command() {
+    let fx = DaemonFixture::new();
+    let empty = TempDir::new().unwrap();
+    let cwd = TempDir::new().unwrap();
+    let env = HashMap::from([(
+        "PATH".to_string(),
+        empty.path().to_string_lossy().into_owned(),
+    )]);
+
+    let session = fx
+        .manager
+        .create(structured(cwd.path(), env))
+        .await
+        .expect("a failed session, not an error");
+
+    assert_eq!(session.status, SessionStatus::Dead);
+    assert_eq!(session.activity, ActivityState::Error);
+    let detail = session.activity_detail.clone().expect("actionable detail");
+    assert!(detail.contains(ADAPTER_BIN), "{detail}");
+    assert!(detail.contains(INSTALL_COMMAND), "{detail}");
+    assert_eq!(session.acp_session_id, None);
+
+    // It is a real session: listed, on disk, and dismissable like any other
+    // dead one.
+    assert!(fx.manager.has(session.id).await);
+    assert!(fx
+        .sidecar_dir()
+        .join(format!("{}.json", session.id))
+        .exists());
+    fx.manager.kill(session.id, false).await.expect("dismiss");
+    assert!(!fx.manager.has(session.id).await);
+}
+
+#[tokio::test]
+async fn kill_sends_cancel_then_sigterm_and_removes_the_sidecar() {
+    let fx = DaemonFixture::new();
+    let fake = Fake::new();
+    let cwd = TempDir::new().unwrap();
+    let mut events = fx.manager.events();
+
+    let session = fx
+        .manager
+        .create(structured(cwd.path(), fake.env()))
+        .await
+        .expect("create");
+    let pid = fake.pid();
+    assert!(pid_alive(pid));
+
+    fx.manager.kill(session.id, false).await.expect("kill");
+
+    wait_for_exit(pid).await;
+    let log = fake.log();
+    let cancel = log.find("recv session/cancel").expect("cancel logged");
+    let term = log.find("signal SIGTERM").expect("SIGTERM logged");
+    assert!(cancel < term, "cancel must precede SIGTERM:\n{log}");
+    assert!(!fx.manager.has(session.id).await);
+    assert!(!fx
+        .sidecar_dir()
+        .join(format!("{}.json", session.id))
+        .exists());
+
+    let mut removed = false;
+    while let Ok(ev) = events.try_recv() {
+        if matches!(ev, maestro_protocol::CatalogEvent::SessionRemoved { id } if id == session.id) {
+            removed = true;
+        }
+    }
+    assert!(removed, "SessionRemoved never broadcast");
+}
+
+#[tokio::test]
+async fn shutdown_reaps_every_adapter_child() {
+    let fx = DaemonFixture::new();
+    let cwd = TempDir::new().unwrap();
+    let a = Fake::new();
+    let b = Fake::new();
+
+    let sa = fx
+        .manager
+        .create(structured(cwd.path(), a.env()))
+        .await
+        .expect("create a");
+    let sb = fx
+        .manager
+        .create(structured(cwd.path(), b.env()))
+        .await
+        .expect("create b");
+    let (pa, pb) = (a.pid(), b.pid());
+    assert!(pid_alive(pa) && pid_alive(pb));
+
+    fx.manager.shutdown().await;
+
+    wait_for_exit(pa).await;
+    wait_for_exit(pb).await;
+    assert!(a.log().contains("signal SIGTERM"), "{}", a.log());
+    assert!(b.log().contains("signal SIGTERM"), "{}", b.log());
+    // Still listed, now Dead: the sidecar is truthful for whoever reads it
+    // after the restart (#135).
+    assert_eq!(fx.manager.status(sa.id).await, Some(SessionStatus::Dead));
+    assert_eq!(fx.manager.status(sb.id).await, Some(SessionStatus::Dead));
+    let sidecar: maestro_protocol::Session = serde_json::from_slice(
+        &std::fs::read(fx.sidecar_dir().join(format!("{}.json", sa.id))).unwrap(),
+    )
+    .unwrap();
+    assert_eq!(sidecar.status, SessionStatus::Dead);
+}
+
+#[tokio::test]
+async fn adapter_exit_marks_the_session_dead_and_keeps_it_listed() {
+    let fx = DaemonFixture::new();
+    let fake = Fake::new();
+    let cwd = TempDir::new().unwrap();
+
+    let session = fx
+        .manager
+        .create(structured(cwd.path(), fake.env()))
+        .await
+        .expect("create");
+    fx.manager.start_liveness_watcher(Duration::from_millis(50));
+
+    // The agent dies out from under the daemon: the liveness pass, not tmux,
+    // is what notices for a structured session.
+    let pid = fake.pid();
+    unsafe {
+        libc::kill(pid as libc::pid_t, libc::SIGTERM);
+    }
+    wait_for_exit(pid).await;
+
+    wait_for_async(Duration::from_secs(3), || async {
+        fx.manager.status(session.id).await == Some(SessionStatus::Dead)
+    })
+    .await;
+    assert!(fx.manager.has(session.id).await);
+
+    fx.manager.kill(session.id, false).await.expect("dismiss");
+    assert!(!fx.manager.has(session.id).await);
+}

crates/maestro-daemon/tests/activity_report.rs

@@ -18,7 +18,6 @@ use uuid::Uuid;
 
 struct Fixture {
     manager: SessionManager,
-    sidecar: SidecarStore,
     _tmux: TmuxFixture,
     _state_dir: TempDir,
 }
@@ -26,17 +25,15 @@ struct Fixture {
 async fn fixture(ttl: Duration) -> Fixture {
     let tmux = TmuxFixture::new();
     let state_dir = TempDir::new().unwrap();
-    let sidecar = SidecarStore::new(state_dir.path().join("sessions"));
     let manager = SessionManager::new(
         Arc::new(tmux.tmux.clone()),
-        sidecar.clone(),
+        SidecarStore::new(state_dir.path().join("sessions")),
         WorktreeManager::new(None),
         state_dir.path().join("fifos"),
     )
     .with_activity_report_ttl(ttl);
     Fixture {
         manager,
-        sidecar,
         _tmux: tmux,
         _state_dir: state_dir,
     }
@@ -45,6 +42,7 @@ async fn fixture(ttl: Duration) -> Fixture {
 async fn spawn_sleeping(manager: &SessionManager) -> Uuid {
     manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: "/tmp".into(),
             command: "sleep 60".into(),
             env: Default::default(),
@@ -70,7 +68,7 @@ async fn report_on_unknown_session_is_not_found() {
     let fx = fixture(Duration::from_secs(300)).await;
     let err = fx
         .manager
-        .report_activity(Uuid::new_v4(), ActivityState::Idle, None, None)
+        .report_activity(Uuid::new_v4(), ActivityState::Idle, None)
         .await
         .unwrap_err();
     assert!(matches!(err, maestro_daemon::SessionError::NotFound(_)));
@@ -86,7 +84,6 @@ async fn report_sets_error_state_and_detail() {
             id,
             ActivityState::Error,
             Some("cargo build failed: link error".into()),
-            None,
         )
         .await
         .unwrap();
@@ -105,7 +102,7 @@ async fn replacing_a_report_replaces_both_state_and_detail() {
     let id = spawn_sleeping(&fx.manager).await;
 
     fx.manager
-        .report_activity(id, ActivityState::Error, Some("first failure".into()), None)
+        .report_activity(id, ActivityState::Error, Some("first failure".into()))
         .await
         .unwrap();
     fx.manager
@@ -113,7 +110,6 @@ async fn replacing_a_report_replaces_both_state_and_detail() {
             id,
             ActivityState::AwaitingInput,
             Some("needs approval".into()),
-            None,
         )
         .await
         .unwrap();
@@ -130,7 +126,7 @@ async fn detail_is_capped_server_side() {
 
     let long = "x".repeat(10_000);
     fx.manager
-        .report_activity(id, ActivityState::Error, Some(long), None)
+        .report_activity(id, ActivityState::Error, Some(long))
         .await
         .unwrap();
 
@@ -149,12 +145,7 @@ async fn reported_state_survives_watcher_ticks_until_the_ttl_then_inference_resu
     fx.manager.start_liveness_watcher(Duration::from_millis(50));
 
     fx.manager
-        .report_activity(
-            id,
-            ActivityState::Error,
-            Some("agent died mid-run".into()),
-            None,
-        )
+        .report_activity(id, ActivityState::Error, Some("agent died mid-run".into()))
         .await
         .unwrap();
 
@@ -172,73 +163,3 @@ async fn reported_state_survives_watcher_ticks_until_the_ttl_then_inference_resu
     })
     .await;
 }
-
-#[tokio::test]
-async fn a_reported_session_id_is_recorded_on_the_session() {
-    let fx = fixture(Duration::from_secs(300)).await;
-    let id = spawn_sleeping(&fx.manager).await;
-
-    fx.manager
-        .report_activity(id, ActivityState::Active, None, Some("conv-abc123".into()))
-        .await
-        .unwrap();
-
-    let s = observed(&fx.manager, id).await;
-    assert_eq!(s.agent_session_id.as_deref(), Some("conv-abc123"));
-}
-
-/// #161: a session id does not change mid-session, so once set it is never
-/// overwritten by a later report — even one that names a different id.
-#[tokio::test]
-async fn a_reported_session_id_is_written_once_and_never_replaced() {
-    let fx = fixture(Duration::from_secs(300)).await;
-    let id = spawn_sleeping(&fx.manager).await;
-
-    fx.manager
-        .report_activity(id, ActivityState::Active, None, Some("conv-first".into()))
-        .await
-        .unwrap();
-    fx.manager
-        .report_activity(id, ActivityState::Active, None, Some("conv-second".into()))
-        .await
-        .unwrap();
-
-    let s = observed(&fx.manager, id).await;
-    assert_eq!(s.agent_session_id.as_deref(), Some("conv-first"));
-}
-
-#[tokio::test]
-async fn a_reported_session_id_survives_recovery_from_the_sidecar() {
-    let fx = fixture(Duration::from_secs(300)).await;
-    let id = spawn_sleeping(&fx.manager).await;
-
-    fx.manager
-        .report_activity(id, ActivityState::Active, None, Some("conv-abc123".into()))
-        .await
-        .unwrap();
-
-    let stored = fx
-        .sidecar
-        .read(id)
-        .expect("sidecar read")
-        .expect("sidecar present");
-    assert_eq!(stored.agent_session_id.as_deref(), Some("conv-abc123"));
-
-    // The sidecar holding the id is only half the claim: a restarted daemon
-    // has to carry it back onto the recovered session, which is what a resume
-    // reads. Build a parallel manager over the same tmux server and state
-    // dirs and recover through it.
-    let revived = SessionManager::new(
-        Arc::new(fx._tmux.tmux.clone()),
-        fx.sidecar.clone(),
-        WorktreeManager::new(None),
-        fx._state_dir.path().join("fifos"),
-    );
-    revived.recover().await.expect("recover");
-    let recovered = observed(&revived, id).await;
-    assert_eq!(
-        recovered.agent_session_id.as_deref(),
-        Some("conv-abc123"),
-        "the recovered session must carry the agent session id, not just the sidecar"
-    );
-}

crates/maestro-daemon/tests/attach.rs

@@ -75,6 +75,7 @@ async fn create_bash_session(h: &Harness) -> Uuid {
     let s = h
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd_path,
             command: "bash --noprofile --norc".into(),
             env: HashMap::new(),

crates/maestro-daemon/tests/autoname.rs

@@ -50,6 +50,7 @@ async fn spawn(manager: &SessionManager, name: Option<&str>) -> Uuid {
     };
     manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: "/tmp".into(),
             command: "sleep 60".into(),
             env: Default::default(),

crates/maestro-daemon/tests/blocked_work_cost.rs

@@ -19,6 +19,7 @@ use tempfile::TempDir;
 
 fn request(cwd: &std::path::Path, repo: &std::path::Path, branch: &str) -> CreateSessionRequest {
     CreateSessionRequest {
+        view: Default::default(),
         cwd: cwd.to_path_buf(),
         command: "sleep 30".into(),
         env: HashMap::new(),

crates/maestro-daemon/tests/local_api.rs

@@ -174,6 +174,7 @@ async fn list_sessions_starts_empty_and_reflects_creates() {
     assert!(empty.is_empty());
 
     let req = CreateSessionRequest {
+        view: Default::default(),
         cwd: "/tmp".into(),
         command: "sleep 60".into(),
         env: HashMap::new(),
@@ -390,6 +391,7 @@ async fn patch_session_renames_it() {
     let session = h
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: "/tmp".into(),
             command: "sleep 60".into(),
             env: HashMap::new(),
@@ -432,6 +434,7 @@ async fn post_focus_stamps_last_focused_at() {
     let session = h
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: "/tmp".into(),
             command: "sleep 60".into(),
             env: HashMap::new(),
@@ -465,6 +468,7 @@ async fn delete_owned_session_kills_it() {
     let session = h
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: "/tmp".into(),
             command: "sleep 60".into(),
             env: HashMap::new(),
@@ -486,6 +490,7 @@ async fn delete_owned_session_kills_it() {
 async fn spawn_via_manager(h: &Harness) -> Uuid {
     h.manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: "/tmp".into(),
             command: "sleep 60".into(),
             env: HashMap::new(),
@@ -526,33 +531,6 @@ async fn post_activity_reports_error_with_detail() {
     assert_eq!(s.activity_detail.as_deref(), Some("cargo build failed"));
 }
 
-/// #161: a reported `session_id` lands on the session as `agent_session_id`.
-#[tokio::test]
-async fn post_activity_records_the_reported_session_id() {
-    let h = spawn("naps-laptop").await;
-    let id = spawn_via_manager(&h).await;
-
-    let resp = reqwest::Client::new()
-        .post(url(h.addr, &format!("/api/sessions/{id}/activity")))
-        .json(&serde_json::json!({
-            "state": "Active",
-            "session_id": "conv-abc123"
-        }))
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), reqwest::StatusCode::NO_CONTENT);
-
-    let sessions: Vec<Session> = reqwest::get(url(h.addr, "/api/sessions"))
-        .await
-        .unwrap()
-        .json()
-        .await
-        .unwrap();
-    let s = sessions.iter().find(|s| s.id == id).unwrap();
-    assert_eq!(s.agent_session_id.as_deref(), Some("conv-abc123"));
-}
-
 #[tokio::test]
 async fn post_activity_to_unknown_session_returns_404() {
     let h = spawn("naps-laptop").await;
@@ -622,6 +600,7 @@ async fn delete_a_session_whose_worktree_holds_unsaved_work_returns_409_with_the
     let session = h
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: repo.path().to_path_buf(),
             command: "sleep 60".into(),
             env: HashMap::new(),
@@ -674,6 +653,7 @@ async fn delete_with_force_ends_the_session_and_keeps_the_worktree() {
     let session = h
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: repo.path().to_path_buf(),
             command: "sleep 60".into(),
             env: HashMap::new(),
@@ -707,6 +687,7 @@ async fn attach_ws_streams_pty_bytes() {
     let session = h
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: "/tmp".into(),
             command: "bash --noprofile --norc".into(),
             env: HashMap::new(),
@@ -775,6 +756,7 @@ async fn events_ws_sends_a_snapshot_then_streams_deltas() {
     let created = h
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -819,6 +801,7 @@ async fn every_events_subscriber_gets_its_own_snapshot() {
 
     h.manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),

crates/maestro-daemon/tests/rename.rs

@@ -51,6 +51,7 @@ async fn spawn_named(manager: &SessionManager, name: Option<&str>) -> Uuid {
     };
     manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: "/tmp".into(),
             command: "sleep 60".into(),
             env: Default::default(),

crates/maestro-daemon/tests/session_decisions.rs

@@ -64,6 +64,7 @@ impl Fx {
 
     fn request(&self, command: &str) -> CreateSessionRequest {
         CreateSessionRequest {
+            view: Default::default(),
             cwd: self.tmp.path().to_path_buf(),
             command: command.into(),
             env: HashMap::new(),

crates/maestro-daemon/tests/session_manager.rs

@@ -9,7 +9,6 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use common::{init_bare_repo, init_repo, push_all_to_origin, wait_for_async, DaemonFixture};
-use maestro_daemon::sidecar::SidecarStore;
 use maestro_daemon::SessionError;
 use maestro_protocol::CreateSessionRequest;
 use maestro_protocol::{CatalogEvent, SessionStatus, WorktreeSpec};
@@ -23,6 +22,7 @@ async fn create_then_kill_round_trip() {
     let session = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -64,6 +64,7 @@ async fn create_appends_to_spawn_history() {
     let session = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -93,6 +94,7 @@ async fn create_without_history_logs_nothing() {
     let cwd = TempDir::new().unwrap();
     fx.manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -115,6 +117,7 @@ async fn recover_adopts_existing_tmux_sessions() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -141,356 +144,6 @@ async fn recover_adopts_existing_tmux_sessions() {
     assert_eq!(snap[0].command, "sleep 30");
 }
 
-/// #162: a host reboot kills the tmux server, so recovery finds nothing to
-/// adopt while every sidecar is still on disk. Those sessions come back as
-/// `Dormant` — a record of what was running — rather than vanishing from the
-/// API and leaving the operator with nothing.
-#[tokio::test]
-async fn recover_registers_orphaned_sidecars_as_dormant() {
-    let fx = DaemonFixture::new();
-    let cwd = TempDir::new().unwrap();
-    let mut metadata = HashMap::new();
-    metadata.insert(
-        maestro_protocol::NAME_KEY.to_string(),
-        serde_json::Value::String("after-reboot".into()),
-    );
-
-    let s = fx
-        .manager
-        .create(CreateSessionRequest {
-            cwd: cwd.path().to_path_buf(),
-            command: "sleep 30".into(),
-            env: HashMap::new(),
-            metadata,
-            worktree: None,
-        })
-        .await
-        .expect("create");
-
-    // The reboot: the tmux server is gone, the sidecar is untouched.
-    fx.tmux.tmux.kill_server().expect("kill tmux server");
-
-    let revived = revive(&fx);
-    let adopted = revived.recover().await.expect("recover");
-    assert_eq!(adopted, 0, "no live tmux session left to adopt");
-
-    let snap = revived.snapshot().await;
-    assert_eq!(snap.len(), 1, "the sidecar's session is still listed");
-    assert_eq!(snap[0].id, s.id);
-    assert_eq!(snap[0].status, SessionStatus::Dormant);
-    assert_eq!(snap[0].command, "sleep 30");
-    assert_eq!(snap[0].cwd, s.cwd);
-    assert_eq!(snap[0].created_at, s.created_at);
-    assert_eq!(
-        snap[0]
-            .metadata
-            .get(maestro_protocol::NAME_KEY)
-            .and_then(|v| v.as_str()),
-        Some("after-reboot"),
-    );
-}
-
-/// #162: a session tmux still holds is adopted `Running` by the first pass and
-/// must not be re-registered as dormant by the second — the sidecar is on disk
-/// for both.
-#[tokio::test]
-async fn recover_does_not_mark_adopted_sessions_dormant() {
-    let fx = DaemonFixture::new();
-    let cwd = TempDir::new().unwrap();
-
-    let live = fx
-        .manager
-        .create(CreateSessionRequest {
-            cwd: cwd.path().to_path_buf(),
-            command: "sleep 30".into(),
-            env: HashMap::new(),
-            metadata: HashMap::new(),
-            worktree: None,
-        })
-        .await
-        .expect("create live");
-    let orphan = fx
-        .manager
-        .create(CreateSessionRequest {
-            cwd: cwd.path().to_path_buf(),
-            command: "sleep 31".into(),
-            env: HashMap::new(),
-            metadata: HashMap::new(),
-            worktree: None,
-        })
-        .await
-        .expect("create orphan");
-    // Only the second session loses its pane.
-    fx.tmux.tmux.kill_session(orphan.id).expect("kill session");
-
-    let revived = revive(&fx);
-    assert_eq!(revived.recover().await.expect("recover"), 1);
-
-    let mut snap = revived.snapshot().await;
-    snap.sort_by_key(|s| s.command.clone());
-    assert_eq!(snap.len(), 2);
-    assert_eq!(snap[0].id, live.id);
-    assert_eq!(snap[0].status, SessionStatus::Running);
-    assert_eq!(snap[1].id, orphan.id);
-    assert_eq!(snap[1].status, SessionStatus::Dormant);
-}
-
-/// #163: a sidecar whose `cwd` no longer exists is pruned instead of
-/// registered dormant — the worktree it pointed at is gone, so there is
-/// nothing left to resume.
-#[tokio::test]
-async fn recover_deletes_sidecar_when_cwd_gone() {
-    let fx = DaemonFixture::new();
-    let cwd = TempDir::new().unwrap();
-    let cwd_path = cwd.path().to_path_buf();
-
-    let s = fx
-        .manager
-        .create(CreateSessionRequest {
-            cwd: cwd_path.clone(),
-            command: "sleep 30".into(),
-            env: HashMap::new(),
-            metadata: HashMap::new(),
-            worktree: None,
-        })
-        .await
-        .expect("create");
-
-    fx.tmux.tmux.kill_server().expect("kill tmux server");
-    drop(cwd);
-    std::fs::remove_dir_all(&cwd_path).ok();
-    assert!(!cwd_path.exists());
-
-    let revived = revive(&fx);
-    let adopted = revived.recover().await.expect("recover");
-    assert_eq!(adopted, 0);
-
-    assert!(!revived.has(s.id).await);
-    assert!(!fx.sidecar_dir().join(format!("{}.json", s.id)).exists());
-}
-
-/// #163: a sidecar whose `cwd` still exists is left alone regardless of age
-/// — it is registered dormant like any other orphan.
-#[tokio::test]
-async fn recover_keeps_dormant_sidecar_when_cwd_exists() {
-    let fx = DaemonFixture::new();
-    let cwd = TempDir::new().unwrap();
-
-    let s = fx
-        .manager
-        .create(CreateSessionRequest {
-            cwd: cwd.path().to_path_buf(),
-            command: "sleep 30".into(),
-            env: HashMap::new(),
-            metadata: HashMap::new(),
-            worktree: None,
-        })
-        .await
-        .expect("create");
-    fx.tmux.tmux.kill_server().expect("kill tmux server");
-
-    let revived = revive(&fx);
-    revived.recover().await.expect("recover");
-
-    assert!(revived.has(s.id).await);
-    assert!(fx.sidecar_dir().join(format!("{}.json", s.id)).exists());
-    let snap = revived.snapshot().await;
-    assert_eq!(snap[0].status, SessionStatus::Dormant);
-}
-
-/// #164: a fake [`maestro_daemon::boot_id::BootIdSource`] lets tests simulate
-/// a changed (or unreadable) boot id without rebooting the machine.
-#[derive(Debug)]
-struct FakeBootId(Option<String>);
-
-impl maestro_daemon::boot_id::BootIdSource for FakeBootId {
-    fn current(&self) -> Option<String> {
-        self.0.clone()
-    }
-}
-
-fn revive_with_boot_id(
-    fx: &DaemonFixture,
-    boot_id_path: PathBuf,
-    current: Option<&str>,
-) -> maestro_daemon::SessionManager {
-    maestro_daemon::SessionManager::new(
-        Arc::new(fx.tmux.tmux.clone()),
-        maestro_daemon::sidecar::SidecarStore::new(fx.sidecar_dir()),
-        maestro_daemon::worktree::WorktreeManager::new(None),
-        fx.fifo_dir(),
-    )
-    .with_boot_id(
-        boot_id_path,
-        Arc::new(FakeBootId(current.map(String::from))),
-    )
-}
-
-/// #164: a changed boot id means every session from the previous boot is
-/// already dead, so recovery must not trust tmux to say so — it skips the
-/// probe outright. Proven by leaving the tmux session alive: if the probe
-/// ran, it would come back `Running`, not `Dormant`.
-#[tokio::test]
-async fn recover_skips_tmux_probe_when_boot_id_changed() {
-    let fx = DaemonFixture::new();
-    let cwd = TempDir::new().unwrap();
-    let s = fx
-        .manager
-        .create(CreateSessionRequest {
-            cwd: cwd.path().to_path_buf(),
-            command: "sleep 30".into(),
-            env: HashMap::new(),
-            metadata: HashMap::new(),
-            worktree: None,
-        })
-        .await
-        .expect("create");
-
-    let boot_id_path = fx.state_dir.path().join("boot_id");
-    std::fs::write(&boot_id_path, "previous-boot").unwrap();
-
-    // tmux session is still alive — a probe would find it if one ran.
-    let revived = revive_with_boot_id(&fx, boot_id_path.clone(), Some("current-boot"));
-    let adopted = revived.recover().await.expect("recover");
-    assert_eq!(adopted, 0, "reboot detected: nothing adopted live");
-
-    let snap = revived.snapshot().await;
-    assert_eq!(snap.len(), 1);
-    assert_eq!(snap[0].id, s.id);
-    assert_eq!(snap[0].status, SessionStatus::Dormant);
-
-    // The current boot id is now the stored one, for the next comparison.
-    assert_eq!(
-        std::fs::read_to_string(&boot_id_path).unwrap().trim(),
-        "current-boot"
-    );
-}
-
-/// #164: an unchanged boot id is a plain restart — recovery probes tmux as
-/// before and adopts the still-live session `Running`.
-#[tokio::test]
-async fn recover_probes_tmux_when_boot_id_unchanged() {
-    let fx = DaemonFixture::new();
-    let cwd = TempDir::new().unwrap();
-    let s = fx
-        .manager
-        .create(CreateSessionRequest {
-            cwd: cwd.path().to_path_buf(),
-            command: "sleep 30".into(),
-            env: HashMap::new(),
-            metadata: HashMap::new(),
-            worktree: None,
-        })
-        .await
-        .expect("create");
-
-    let boot_id_path = fx.state_dir.path().join("boot_id");
-    std::fs::write(&boot_id_path, "same-boot").unwrap();
-
-    let revived = revive_with_boot_id(&fx, boot_id_path, Some("same-boot"));
-    let adopted = revived.recover().await.expect("recover");
-    assert_eq!(adopted, 1);
-    let snap = revived.snapshot().await;
-    assert_eq!(snap[0].id, s.id);
-    assert_eq!(snap[0].status, SessionStatus::Running);
-}
-
-/// #164: no stored boot id (first run ever, or an older build that never
-/// wrote one) means there is nothing to compare against — falls back to
-/// today's probe-based recovery rather than assuming a reboot.
-#[tokio::test]
-async fn recover_falls_back_to_probe_when_no_stored_boot_id() {
-    let fx = DaemonFixture::new();
-    let cwd = TempDir::new().unwrap();
-    fx.manager
-        .create(CreateSessionRequest {
-            cwd: cwd.path().to_path_buf(),
-            command: "sleep 30".into(),
-            env: HashMap::new(),
-            metadata: HashMap::new(),
-            worktree: None,
-        })
-        .await
-        .expect("create");
-
-    let boot_id_path = fx.state_dir.path().join("boot_id");
-    assert!(!boot_id_path.exists());
-
-    let revived = revive_with_boot_id(&fx, boot_id_path.clone(), Some("current-boot"));
-    let adopted = revived.recover().await.expect("recover");
-    assert_eq!(adopted, 1, "no stored boot id; falls back to probing tmux");
-    assert_eq!(
-        std::fs::read_to_string(&boot_id_path).unwrap().trim(),
-        "current-boot"
-    );
-}
-
-/// #164: an unreadable current boot id (non-Linux, restricted `/proc`) falls
-/// back to today's behaviour rather than failing startup or assuming a
-/// reboot.
-#[tokio::test]
-async fn recover_falls_back_to_probe_when_boot_id_unreadable() {
-    let fx = DaemonFixture::new();
-    let cwd = TempDir::new().unwrap();
-    fx.manager
-        .create(CreateSessionRequest {
-            cwd: cwd.path().to_path_buf(),
-            command: "sleep 30".into(),
-            env: HashMap::new(),
-            metadata: HashMap::new(),
-            worktree: None,
-        })
-        .await
-        .expect("create");
-
-    let boot_id_path = fx.state_dir.path().join("boot_id");
-    std::fs::write(&boot_id_path, "stored-boot").unwrap();
-
-    let revived = revive_with_boot_id(&fx, boot_id_path, None);
-    let adopted = revived.recover().await.expect("recover");
-    assert_eq!(adopted, 1, "boot id unreadable; falls back to probing tmux");
-}
-
-/// #162: dismissing a dormant session is the one thing that can be done to it
-/// — no tmux call to fail, and the sidecar goes with it so the next recovery
-/// does not resurrect it.
-#[tokio::test]
-async fn dormant_session_can_be_dismissed() {
-    let fx = DaemonFixture::new();
-    let cwd = TempDir::new().unwrap();
-
-    let s = fx
-        .manager
-        .create(CreateSessionRequest {
-            cwd: cwd.path().to_path_buf(),
-            command: "sleep 30".into(),
-            env: HashMap::new(),
-            metadata: HashMap::new(),
-            worktree: None,
-        })
-        .await
-        .expect("create");
-    fx.tmux.tmux.kill_server().expect("kill tmux server");
-
-    let revived = revive(&fx);
-    revived.recover().await.expect("recover");
-    revived.kill(s.id, false).await.expect("dismiss");
-
-    assert!(!revived.has(s.id).await);
-    assert!(!fx.sidecar_dir().join(format!("{}.json", s.id)).exists());
-}
-
-/// A second `SessionManager` over the same dirs and the same tmux server —
-/// what a daemon restart looks like from inside a test.
-fn revive(fx: &DaemonFixture) -> maestro_daemon::SessionManager {
-    maestro_daemon::SessionManager::new(
-        Arc::new(fx.tmux.tmux.clone()),
-        maestro_daemon::sidecar::SidecarStore::new(fx.sidecar_dir()),
-        maestro_daemon::worktree::WorktreeManager::new(None),
-        fx.fifo_dir(),
-    )
-}
-
 /// Regression for NAP-253: the very first bytes a freshly-spawned command
 /// writes must reach the replay buffer. Before the fix, `pipe-pane` was a
 /// separate tmux invocation that ran after `new-session` + an async FIFO
@@ -504,6 +157,7 @@ async fn create_captures_initial_output_in_replay_buffer() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             // The shell prints the marker before doing anything else and
             // then sleeps so the session stays alive. Before NAP-253 this
@@ -551,6 +205,7 @@ async fn attach_replay_is_the_current_screen_not_the_byte_tail() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+        view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             // Print a line, then switch to the alternate screen the way a
             // full-screen program does on startup. Only the second marker is
@@ -609,6 +264,7 @@ async fn attach_replay_carries_the_panes_mouse_modes() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+        view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             // Alternate screen, then button-event tracking (?1002) with SGR
             // coordinates (?1006) — what tmux and agent TUIs actually request.
@@ -662,6 +318,7 @@ async fn recover_re_pipes_pane_so_output_reaches_subscribers() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             command: "bash --noprofile --norc".into(),
             env: HashMap::new(),
@@ -724,6 +381,7 @@ async fn pty_broadcast_delivers_bytes_to_subscribers() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             command: "bash --noprofile --norc".into(),
             env: HashMap::new(),
@@ -774,6 +432,7 @@ async fn liveness_watcher_marks_dead_sessions_and_keeps_them_until_dismissed() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -839,6 +498,7 @@ async fn watcher_refreshes_the_blocked_work_indicator() {
 
     fx.manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: repo.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -931,6 +591,7 @@ async fn kill_removes_worktree_even_when_spec_says_keep() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: repo.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -968,6 +629,7 @@ async fn killing_refuses_a_worktree_with_unsaved_work_and_keeps_the_session() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: repo.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -1031,6 +693,7 @@ async fn killing_refuses_until_the_branch_is_pushed() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: repo.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -1080,6 +743,7 @@ async fn force_killing_a_guarded_worktree_leaves_it_on_disk() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: repo.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -1125,6 +789,7 @@ async fn force_on_a_clear_worktree_removes_it_as_usual() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: repo.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -1165,6 +830,7 @@ async fn killing_an_ignored_only_worktree_succeeds() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: repo.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -1206,6 +872,7 @@ async fn natural_exit_of_a_guarded_worktree_leaves_it_on_disk() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: repo.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -1267,6 +934,7 @@ async fn natural_exit_of_a_pristine_worktree_removes_it() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: repo.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -1305,65 +973,6 @@ async fn natural_exit_of_a_pristine_worktree_removes_it() {
     );
 }
 
-/// #172: `mark_session_dead` clears the worktree off the in-memory record
-/// when a pristine tree settles, but the local `session` clone it writes to
-/// the sidecar and broadcasts must be cleared the same way — otherwise the
-/// sidecar keeps naming a tree the daemon just removed, and a recovery from
-/// that sidecar advertises a branch and path that no longer exist.
-#[tokio::test]
-async fn natural_exit_of_a_pristine_worktree_clears_it_from_the_sidecar() {
-    let fx = DaemonFixture::new();
-    let repo = TempDir::new().unwrap();
-    init_repo(repo.path());
-    let wt_path = repo.path().join("worktrees").join("feat").join("sidecar");
-
-    let s = fx
-        .manager
-        .create(CreateSessionRequest {
-            cwd: repo.path().to_path_buf(),
-            command: "sleep 30".into(),
-            env: HashMap::new(),
-            metadata: HashMap::new(),
-            worktree: Some(WorktreeSpec {
-                base_repo: repo.path().to_path_buf(),
-                branch: "feat/sidecar".into(),
-                create_branch: true,
-            }),
-        })
-        .await
-        .expect("create");
-
-    // Push everything so the branch has no unpushed commits: fully pristine.
-    let origin = TempDir::new().unwrap();
-    init_bare_repo(origin.path());
-    push_all_to_origin(repo.path(), origin.path());
-
-    fx.tmux.tmux.kill_session(s.id).expect("kill tmux directly");
-    fx.manager.start_liveness_watcher(Duration::from_millis(50));
-    wait_for_async(Duration::from_secs(3), || async {
-        fx.manager.status(s.id).await == Some(SessionStatus::Dead)
-    })
-    .await;
-    wait_for_async(Duration::from_secs(3), || async {
-        fx.manager.is_settled(s.id).await == Some(true)
-    })
-    .await;
-
-    assert!(
-        !wt_path.exists(),
-        "a pristine worktree leaves nothing behind"
-    );
-
-    let sidecar = SidecarStore::new(fx.sidecar_dir())
-        .read(s.id)
-        .expect("sidecar read")
-        .expect("sidecar exists");
-    assert!(
-        sidecar.worktree.is_none(),
-        "the sidecar must not keep naming a worktree the daemon already removed"
-    );
-}
-
 fn run_git_in(dir: &std::path::Path, args: &[&str]) {
     let out = Command::new("git")
         .arg("-C")
@@ -1386,6 +995,7 @@ async fn liveness_watcher_leaves_running_sessions_alone() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -1420,6 +1030,7 @@ async fn worktree_base_repo_records_the_main_checkout_not_the_request() {
     let first = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: repo.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -1437,6 +1048,7 @@ async fn worktree_base_repo_records_the_main_checkout_not_the_request() {
     let second = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: inner_worktree.clone(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -1475,6 +1087,7 @@ async fn spawned_sessions_export_maestro_session_id_and_url() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -1513,6 +1126,7 @@ async fn a_freshly_created_session_has_never_been_focused() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -1538,6 +1152,7 @@ async fn set_focused_true_stamps_last_focused_at() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),
@@ -1586,6 +1201,7 @@ async fn attaching_stamps_last_focused_at() {
     let s = fx
         .manager
         .create(CreateSessionRequest {
+            view: Default::default(),
             cwd: cwd.path().to_path_buf(),
             command: "sleep 30".into(),
             env: HashMap::new(),

crates/maestro-daemon/tests/sidecar.rs

@@ -7,7 +7,7 @@ use std::path::PathBuf;
 
 use chrono::{DateTime, Utc};
 use maestro_daemon::sidecar::SidecarStore;
-use maestro_protocol::{Session, SessionStatus};
+use maestro_protocol::{Session, SessionStatus, SessionView};
 use serde_json::Value;
 use tempfile::TempDir;
 use uuid::Uuid;
@@ -32,7 +32,8 @@ fn sample(id: Uuid) -> Session {
         current_cwd: Some(PathBuf::from("/tmp/work/crates")),
         blocked_work: None,
         last_focused_at: None,
-        agent_session_id: Some("conv-abc123".into()),
+        acp_session_id: None,
+        view: SessionView::Terminal,
     }
 }
 
@@ -104,6 +105,37 @@ fn load_all_returns_empty_when_directory_missing() {
     assert!(store.load_all().unwrap().is_empty());
 }
 
+#[test]
+fn sidecar_missing_view_key_reads_as_terminal() {
+    // A pre-#133 sidecar on disk has no `view` field at all.
+    let dir = TempDir::new().unwrap();
+    let store = SidecarStore::new(dir.path());
+    let id = Uuid::new_v4();
+
+    let mut value = serde_json::to_value(sample(id)).unwrap();
+    value.as_object_mut().unwrap().remove("view");
+    std::fs::write(store.path_for(id), serde_json::to_vec(&value).unwrap()).unwrap();
+
+    let loaded = store.read(id).expect("read").expect("present");
+    assert_eq!(loaded.view, SessionView::Terminal);
+}
+
+#[test]
+fn sidecar_structured_view_round_trips() {
+    let dir = TempDir::new().unwrap();
+    let store = SidecarStore::new(dir.path());
+    let id = Uuid::new_v4();
+    let mut s = sample(id);
+    s.view = SessionView::Structured;
+
+    store.write(&s).expect("write");
+    let loaded = store.read(id).expect("read");
+    assert_eq!(
+        loaded.as_ref().map(|s| s.view),
+        Some(SessionView::Structured)
+    );
+}
+
 #[test]
 fn write_creates_parent_directory() {
     let dir = TempDir::new().unwrap();

crates/maestro-daemon/tests/worktree.rs

@@ -405,8 +405,10 @@ fn run_git(dir: &std::path::Path, args: &[&str]) {
     );
 }
 
+/// 49ab7e9: a new-branch add onto a name that already exists suffixes the
+/// branch (and so the directory) instead of failing, per docs/WORKTREES.md.
 #[test]
-fn add_fails_when_branch_already_exists() {
+fn add_new_suffixes_when_branch_already_exists() {
     let repo_dir = TempDir::new().unwrap();
     let repo = repo_dir.path().to_path_buf();
     init_repo(&repo);
@@ -423,9 +425,9 @@ fn add_fails_when_branch_already_exists() {
     let wt_root = TempDir::new().unwrap();
     let mgr = WorktreeManager::new(Some(wt_root.path().to_path_buf()));
 
-    let err = mgr.add_new(&repo, "feat/dup").unwrap_err();
-    let msg = format!("{err}");
-    assert!(msg.contains("git exited"), "{msg}");
+    let path = mgr.add_new(&repo, "feat/dup").unwrap();
+    assert!(path.ends_with("feat/dup-2"), "{}", path.display());
+    assert!(path.is_dir());
 }
 
 /// The project picker lists linked worktrees as pickable rows, so `base_repo`

crates/maestro-e2e/tests/e2e.rs

@@ -27,6 +27,7 @@ async fn bring_up() -> (Daemon, TestClient) {
 
 fn create_req(cwd: &std::path::Path, command: &str) -> CreateSessionRequest {
     CreateSessionRequest {
+        view: Default::default(),
         cwd: cwd.to_path_buf(),
         command: command.into(),
         env: HashMap::new(),
@@ -49,6 +50,7 @@ fn worktree_spec(base_repo: &std::path::Path, branch: &str, create_branch: bool)
 /// Spawn request carrying a worktree spec against `base`.
 fn worktree_req(base: &std::path::Path, branch: &str, create_branch: bool) -> CreateSessionRequest {
     CreateSessionRequest {
+        view: Default::default(),
         cwd: base.to_path_buf(),
         command: "sleep 30".into(),
         env: HashMap::new(),
@@ -143,6 +145,7 @@ async fn kill_removes_clean_worktree() {
     init_repo(base.path());
 
     let req = CreateSessionRequest {
+        view: Default::default(),
         cwd: base.path().to_path_buf(),
         command: "sleep 30".into(),
         env: HashMap::new(),
@@ -196,6 +199,7 @@ async fn kill_refuses_worktree_with_uncommitted_changes() {
         .join("unsaved");
 
     let req = CreateSessionRequest {
+        view: Default::default(),
         cwd: base.path().to_path_buf(),
         command: "sleep 30".into(),
         env: HashMap::new(),
@@ -254,6 +258,7 @@ async fn spawn_on_existing_branch_checks_it_out() {
     run_git(&["branch", "feature/existing"], base.path());
 
     let req = CreateSessionRequest {
+        view: Default::default(),
         cwd: base.path().to_path_buf(),
         command: "sleep 30".into(),
         env: HashMap::new(),
@@ -323,8 +328,11 @@ async fn spawn_new_branch_creates_worktree_and_runs_in_it() {
     client.kill_session(s.id).await.expect("kill");
 }
 
-/// #66: a second spawn onto a branch that already has a worktree is rejected
-/// with a structured worktree error; the first worktree stays intact.
+/// #66: a second spawn onto an *existing* branch that already has a worktree
+/// is rejected with a structured worktree error; the first worktree stays
+/// intact. (A second `create_branch: true` spawn is a different case: 49ab7e9
+/// suffixes the new branch name instead, see
+/// `colliding_branch_name_gets_suffixed_too`.)
 #[tokio::test(flavor = "multi_thread")]
 async fn second_spawn_on_same_branch_is_rejected() {
     let (_daemon, client) = bring_up().await;
@@ -337,7 +345,7 @@ async fn second_spawn_on_same_branch_is_rejected() {
         .await
         .expect("first spawn");
     let dup = client
-        .spawn_session(&worktree_req(base.path(), "feature/dup", true))
+        .spawn_session(&worktree_req(base.path(), "feature/dup", false))
         .await;
     match dup {
         Err(maestro_e2e::ClientError::Api(maestro_protocol::ClientError::Api { info, .. })) => {
@@ -497,6 +505,57 @@ async fn occupied_path_gets_suffixed_directory_and_both_worktrees_work() {
     );
 }
 
+/// A random handle can reuse the name of a branch left behind by an earlier,
+/// already-removed worktree — `git worktree add -b` refuses outright in that
+/// case, even though the directory is free. The daemon suffixes the branch
+/// itself (not just the directory) and both land on `-2`.
+#[tokio::test(flavor = "multi_thread")]
+async fn colliding_branch_name_gets_suffixed_too() {
+    let (_daemon, client) = bring_up().await;
+
+    let base = TempDir::new().unwrap();
+    init_repo(base.path());
+
+    // No worktree directory in the way, but the branch already exists.
+    run_git(&["branch", "handle"], base.path());
+
+    let s = client
+        .spawn_session(&worktree_req(base.path(), "handle", true))
+        .await
+        .expect("spawn onto a taken branch name");
+
+    let suffixed = base.path().join("worktrees").join("handle-2");
+    assert_eq!(
+        s.cwd, suffixed,
+        "the directory must follow the suffixed branch name"
+    );
+    assert!(suffixed.is_dir());
+
+    let registrations = git_worktree_list(base.path());
+    assert!(
+        registrations.iter().any(|l| l.contains("handle-2")),
+        "the -2 branch's worktree must be registered: {registrations:?}"
+    );
+
+    let branches = String::from_utf8(
+        std::process::Command::new("git")
+            .arg("-C")
+            .arg(base.path())
+            .args(["branch", "--list"])
+            .output()
+            .unwrap()
+            .stdout,
+    )
+    .unwrap();
+    assert!(
+        branches.contains("handle-2"),
+        "the branch itself must be named handle-2: {branches}"
+    );
+
+    let _origin = throwaway_origin(base.path());
+    client.kill_session(s.id).await.expect("kill");
+}
+
 /// #77/#88: the target path holds a plain directory the daemon never made and
 /// git has never heard of. The daemon neither adopts it nor errors — it builds
 /// beside it and leaves every byte of it alone.
@@ -703,6 +762,7 @@ async fn natural_exit_settles_dirty_and_pristine_worktrees_differently() {
 
     let _dirty = client
         .spawn_session(&CreateSessionRequest {
+            view: Default::default(),
             cwd: dirty_repo.path().to_path_buf(),
             command: "sh -c 'echo unsaved > scratch.txt'".into(),
             env: HashMap::new(),
@@ -751,6 +811,7 @@ async fn natural_exit_settles_dirty_and_pristine_worktrees_differently() {
 
 fn create_req_cmd(cwd: &std::path::Path, command: &str, branch: &str) -> CreateSessionRequest {
     CreateSessionRequest {
+        view: Default::default(),
         cwd: cwd.to_path_buf(),
         command: command.into(),
         env: HashMap::new(),

crates/maestro-hooks/src/lib.rs

@@ -1,4 +1,4 @@
-//! Claude Code activity hook (#106).
+//! Agent activity hook (#106).
 //!
 //! Two halves, both shared by the `maestro hooks install` CLI subcommand and
 //! the daemon's first-start auto-install:
@@ -6,28 +6,40 @@
 //! * [`HOOK_SCRIPT`] — the hook itself, written to disk at install time. It
 //!   posts an [`ActivityState`](maestro-protocol) to
 //!   `$MAESTRO_URL/api/sessions/$MAESTRO_SESSION_ID/activity` (#105). The same
-//!   global hook runs in every Claude Code session on the machine, so it exits
+//!   global hook runs in every agent session on the machine, so it exits
 //!   0 and silently when either #103 env var is unset, and it never lets a
 //!   daemon failure escape (short curl timeout, status ignored).
-//! * [`install`] — idempotent registration of that script in
-//!   `~/.claude/settings.json`. Only entries maestro itself wrote (identified
-//!   by [`HOOK_MARKER`]) are touched; every other hook and every other field
-//!   in the file is preserved verbatim.
+//! * [`install`] — idempotent registration of that script in one [`Target`]'s
+//!   hook file. Only entries maestro itself wrote (identified by
+//!   [`HOOK_MARKER`]) are touched; every other hook and every other field in
+//!   the file is preserved verbatim.
+//!
+//! One script serves every [`Target`]: Claude Code and Codex read the same
+//! `{"hooks": {Event: [{"hooks": [{"type": "command", "command": …}]}]}}`
+//! shape and hand the hook the same JSON on stdin. Only the file's location
+//! and the event set differ.
 
 use std::path::Path;
 
 /// Marker substring every maestro-installed hook command carries. The
 /// installer rewrites or removes exactly these entries — nothing else in the
 /// user's settings file.
+///
+/// It still says `claude` although the script now serves every [`Target`]:
+/// the marker is how an install from an older maestro is recognised, and
+/// renaming it would orphan every entry already on disk.
 pub const HOOK_MARKER: &str = "maestro-claude-hook";
 
-/// File name of the installed script (carries [`HOOK_MARKER`]).
+/// File name of the installed script (carries [`HOOK_MARKER`]). One script
+/// for every [`Target`] — see the note on [`HOOK_MARKER`] for the name.
 pub const SCRIPT_FILE_NAME: &str = "maestro-claude-hook.sh";
 
-/// Hook events installed only with the `haiku-autoname` feature (#131).
-/// `UserPromptSubmit` carries the prompt the user just submitted; the script
-/// forwards the whole payload to `/api/sessions/:id/prompt`, which names a
-/// still-provisionally-named session after its first one.
+/// Hook events installed only with the `haiku-autoname` feature (#131), for
+/// every [`Target`] — Claude Code and Codex both spell the event
+/// `UserPromptSubmit` and both put the submitted text in the payload's
+/// `prompt`. The script forwards the whole payload to
+/// `/api/sessions/:id/prompt`, which names a still-provisionally-named
+/// session after its first one.
 #[cfg(feature = "haiku-autoname")]
 pub const PROMPT_EVENTS: [(&str, &str); 1] = [("UserPromptSubmit", "Prompt")];
 
@@ -43,7 +55,7 @@ pub const PROMPT_EVENTS: [(&str, &str); 0] = [];
 /// Claude Code's own name for "the turn ended on an API error"; there is no
 /// failure signal in `Stop` or `SessionEnd` payloads, so those never report
 /// `Error`.
-pub const HOOK_EVENTS: [(&str, &str); 5] = [
+pub const CLAUDE_EVENTS: [(&str, &str); 5] = [
     // Tool starting: the agent is demonstrably producing work, even if the
     // tool itself runs for minutes.
     ("PreToolUse", "Active"),
@@ -58,17 +70,86 @@ pub const HOOK_EVENTS: [(&str, &str); 5] = [
     ("StopFailure", "Error"),
 ];
 
+/// Codex hook event → `ActivityState` spelling posted to the daemon.
+///
+/// Codex's event set is close to Claude Code's but not identical: a pending
+/// approval arrives as `PermissionRequest` rather than `Notification`, and
+/// there is no `StopFailure`, so a codex session never reports `Error`.
+pub const CODEX_EVENTS: [(&str, &str); 4] = [
+    ("PreToolUse", "Active"),
+    ("PostToolUse", "Active"),
+    // Codex is blocked on the operator approving a tool call.
+    ("PermissionRequest", "AwaitingInput"),
+    ("Stop", "AwaitingInput"),
+];
+
+/// An agent whose hook file maestro writes into.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Target {
+    /// `~/.claude/settings.json`.
+    ClaudeCode,
+    /// `~/.codex/hooks.json`. Codex asks the operator to trust a hook it has
+    /// not seen before, so an install here does nothing until they approve it
+    /// once inside codex — maestro never writes that approval itself.
+    Codex,
+}
+
+impl Target {
+    /// Every target an install covers. Both files are written whether or not
+    /// the agent is on the machine: an unused hook file costs nothing, and
+    /// the alternative is a session spawned after the daemon started missing
+    /// the hook because its agent arrived later.
+    pub const ALL: [Target; 2] = [Target::ClaudeCode, Target::Codex];
+
+    /// How the target is named in logs and CLI output.
+    pub fn label(self) -> &'static str {
+        match self {
+            Target::ClaudeCode => "claude-code",
+            Target::Codex => "codex",
+        }
+    }
+
+    /// The file this target's hook entries are registered in, under `home`.
+    pub fn settings_path(self, home: &Path) -> std::path::PathBuf {
+        match self {
+            Target::ClaudeCode => home.join(".claude/settings.json"),
+            Target::Codex => home.join(".codex/hooks.json"),
+        }
+    }
+
+    /// The activity events this target emits.
+    pub fn activity_events(self) -> &'static [(&'static str, &'static str)] {
+        match self {
+            Target::ClaudeCode => &CLAUDE_EVENTS,
+            Target::Codex => &CODEX_EVENTS,
+        }
+    }
+
+    /// Every event installed for this target: its activity events plus, with
+    /// `haiku-autoname` on, the prompt event both agents spell the same way.
+    pub fn events(self) -> impl Iterator<Item = (&'static str, &'static str)> {
+        self.activity_events()
+            .iter()
+            .chain(PROMPT_EVENTS.iter())
+            .copied()
+    }
+}
+
 /// The shipped hook script. POSIX sh so any `/bin/sh` works.
 pub const HOOK_SCRIPT: &str = r#"#!/bin/sh
-# Installed by maestro (#106): report Claude Code activity to its daemon.
-# Exits silently unless running inside a session maestro spawned (#103 env).
+# Installed by maestro (#106): report agent activity to its daemon.
+# One script for every agent maestro installs hooks into; the state to post
+# is chosen by the caller, so the two event sets differ only in what is
+# registered where. Exits silently unless running inside a session maestro
+# spawned (#103 env).
 # Event -> ActivityState mapping:
-#   PreToolUse    -> Active         (tool started; agent is working)
-#   PostToolUse   -> Active         (tool finished)
-#   Notification  -> AwaitingInput  (permission / idle notice)
-#   Stop          -> AwaitingInput  (turn ended; waiting on the user)
-#   StopFailure   -> Error          (turn ended on an API error)
-#   Prompt        -> the payload is forwarded to the prompt route (#131)
+#   PreToolUse         -> Active         (tool started; agent is working)
+#   PostToolUse        -> Active         (tool finished)
+#   Notification       -> AwaitingInput  (claude code: permission / idle)
+#   PermissionRequest  -> AwaitingInput  (codex: waiting on an approval)
+#   Stop               -> AwaitingInput  (turn ended; waiting on the user)
+#   StopFailure        -> Error          (claude code: turn ended on an error)
+#   Prompt             -> the payload is forwarded to the prompt route (#131)
 state="$1"
 [ -n "$MAESTRO_SESSION_ID" ] || exit 0
 [ -n "$MAESTRO_URL" ] || exit 0
@@ -84,23 +165,15 @@ if [ "$state" = "Prompt" ]; then
         >/dev/null 2>&1 || true
     exit 0
 fi
-fields="\"state\":\"$state\""
+body="{\"state\":\"$state\"}"
 # StopFailure payloads carry the outcome in "error". Only a plain enum
 # spelling is reported as the detail — anything else (quotes, backslashes,
 # prose) would risk breaking the JSON body, and the spelling already names
 # the failure.
 detail=$(printf '%s' "$payload" | sed -n 's/.*"error"[[:space:]]*:[[:space:]]*"\([a-z_]*\)".*/\1/p')
 if [ -n "$detail" ]; then
-    fields="$fields,\"detail\":\"$detail\""
+    body="{\"state\":\"$state\",\"detail\":\"$detail\"}"
 fi
-# Every Claude Code hook payload carries its own conversation id (#161).
-# Constrained to a safe charset for the same reason as "detail" above: it is
-# spliced into the JSON body unescaped.
-session_id=$(printf '%s' "$payload" | sed -n 's/.*"session_id"[[:space:]]*:[[:space:]]*"\([A-Za-z0-9_-]*\)".*/\1/p')
-if [ -n "$session_id" ]; then
-    fields="$fields,\"session_id\":\"$session_id\""
-fi
-body="{$fields}"
 curl -fsS --connect-timeout 1 --max-time 2 \
     -H 'Content-Type: application/json' \
     -d "$body" \
@@ -123,34 +196,29 @@ pub fn script_path(home: &Path) -> std::path::PathBuf {
     home.join(".local/share/maestro").join(SCRIPT_FILE_NAME)
 }
 
-/// The user-level Claude Code settings file for a given home directory.
-pub fn settings_path(home: &Path) -> std::path::PathBuf {
-    home.join(".claude/settings.json")
-}
-
-/// Whether `settings_path` already carries a maestro hook (#106). Presence
-/// only: an install from an older release answers `true` even when it is
-/// missing events this build ships — see [`is_current`].
+/// Whether the file at `settings_path` already carries a maestro hook
+/// (#106). Presence only: an install from an older release answers `true`
+/// even when it is missing events this build ships — see [`is_current`].
 pub fn is_installed(settings_path: &Path) -> bool {
     settings_json(settings_path)
         .map(|root| find_maestro_commands(&root).next().is_some())
         .unwrap_or(false)
 }
 
-/// Whether what is on disk is what this build ships: the script at
-/// `script_path` byte-for-byte, and exactly one settings entry per event in
-/// [`HOOK_EVENTS`] and [`PROMPT_EVENTS`], pointing at that script.
+/// Whether what is on disk is what this build ships for `target`: the script
+/// at `script_path` byte-for-byte, and exactly one settings entry per one of
+/// the target's [`Target::events`], pointing at that script.
 ///
-/// This is the upgrade question. A maestro that gains an event — #131 added
-/// `UserPromptSubmit` long after #106 had installed itself — leaves every
-/// existing user with a present but incomplete install, which
-/// [`is_installed`] cannot tell apart from a current one.
-pub fn is_current(settings_path: &Path, script_path: &Path) -> bool {
+/// This is the upgrade question, asked per [`Target`]. A maestro that gains
+/// an event — #131 added `UserPromptSubmit` long after #106 had installed
+/// itself — leaves every existing user with a present but incomplete
+/// install, which [`is_installed`] cannot tell apart from a current one.
+pub fn is_current(target: Target, settings_path: &Path, script_path: &Path) -> bool {
     if std::fs::read_to_string(script_path).ok().as_deref() != Some(HOOK_SCRIPT) {
         return false;
     }
     settings_json(settings_path)
-        .map(|root| maestro_entries(&root) == expected_entries(script_path))
+        .map(|root| maestro_entries(&root) == expected_entries(target, script_path))
         .unwrap_or(false)
 }
 
@@ -181,14 +249,13 @@ fn maestro_entries(root: &serde_json::Value) -> Vec<(String, String)> {
     found
 }
 
-/// What [`install`] writes for `script_path`, in the same shape.
-fn expected_entries(script_path: &Path) -> Vec<(String, String)> {
-    let mut want: Vec<(String, String)> = HOOK_EVENTS
-        .iter()
-        .chain(PROMPT_EVENTS.iter())
+/// What [`install`] writes for `target` and `script_path`, in the same shape.
+fn expected_entries(target: Target, script_path: &Path) -> Vec<(String, String)> {
+    let mut want: Vec<(String, String)> = target
+        .events()
         .map(|(event, state)| {
             (
-                (*event).to_string(),
+                event.to_string(),
                 format!("{} {state}", script_path.display()),
             )
         })
@@ -215,28 +282,40 @@ pub fn write_script(path: &Path) -> Result<(), HooksError> {
     Ok(())
 }
 
-/// Install the full hook setup for `home`: write the script under
-/// `.local/share/maestro/` and register it in `.claude/settings.json`.
+/// Install the full hook setup for one target under `home`: write the script
+/// under `.local/share/maestro/` and register it in the target's hook file.
 /// Idempotent; returns whether anything changed on disk.
-pub fn install_for_home(home: &Path) -> Result<bool, HooksError> {
+pub fn install_target(target: Target, home: &Path) -> Result<bool, HooksError> {
     let script = script_path(home);
-    let settings = settings_path(home);
+    let settings = target.settings_path(home);
     // A script left over from an older release counts as a change even when
     // the settings entries pointing at it are already right.
-    let changed = !is_current(&settings, &script);
+    let changed = !is_current(target, &settings, &script);
     write_script(&script)?;
-    install(&settings, &script)?;
+    install(target, &settings, &script)?;
     Ok(changed)
 }
 
-/// Register the hook command for every event in [`HOOK_EVENTS`] in the
-/// settings file at `settings_path`. Idempotent: existing maestro entries are
-/// updated in place wherever they sit, stale ones removed, duplicates folded;
-/// every non-maestro entry and every unrelated top-level field survives.
+/// Install for every [`Target::ALL`], reporting each one separately. One
+/// target failing — an unwritable file, unparseable JSON — never stops the
+/// others: an agent whose hook could not be written is one agent without
+/// activity reporting, not a failed install.
+pub fn install_for_home(home: &Path) -> Vec<(Target, Result<bool, HooksError>)> {
+    Target::ALL
+        .iter()
+        .map(|&target| (target, install_target(target, home)))
+        .collect()
+}
+
+/// Register the hook command for every one of `target`'s [`Target::events`]
+/// in the settings file at `settings_path`. Idempotent: existing maestro
+/// entries are updated in place wherever they sit, stale ones removed,
+/// duplicates folded; every non-maestro entry and every unrelated top-level
+/// field survives.
 ///
 /// Never inspects or writes anywhere but `settings_path` — callers pass the
 /// user's real home or a temp one in tests, never a repository.
-pub fn install(settings_path: &Path, script_path: &Path) -> Result<(), HooksError> {
+pub fn install(target: Target, settings_path: &Path, script_path: &Path) -> Result<(), HooksError> {
     let mut root = settings_json(settings_path)?;
 
     // Strip every maestro entry wherever it currently sits, so an older
@@ -244,7 +323,7 @@ pub fn install(settings_path: &Path, script_path: &Path) -> Result<(), HooksErro
     strip_maestro_entries(&mut root);
 
     let hooks = ensure_object(&mut root, "hooks");
-    for (event, state) in HOOK_EVENTS.iter().chain(PROMPT_EVENTS.iter()).copied() {
+    for (event, state) in target.events() {
         let groups = ensure_array(hooks, event);
         let mut group = serde_json::Map::new();
         group.insert(

crates/maestro-hooks/src/tests.rs

@@ -1,15 +1,24 @@
 //! Tests for the shipped hook script (run as a real `/bin/sh` subprocess)
 //! and the settings-file installer. Everything happens under a temp `$HOME`;
-//! the developer's own `~/.claude/settings.json` is never touched.
+//! the developer's own `~/.claude/settings.json` and `~/.codex/hooks.json`
+//! are never touched.
 
 use std::io::{Read, Write};
 use std::process::{Command, Stdio};
 
 use super::*;
 
-/// How many commands one install writes: every activity event, plus the
-/// prompt event when `haiku-autoname` is on (#131).
-const INSTALLED_EVENTS: usize = HOOK_EVENTS.len() + PROMPT_EVENTS.len();
+/// How many commands one install writes for a target: its activity events,
+/// plus the prompt event when `haiku-autoname` is on (#131).
+fn installed_events(target: Target) -> usize {
+    target.events().count()
+}
+
+/// The Claude Code hook file under a temp home. Most installer tests only
+/// need one target, and this is the one they were written against.
+fn settings_path(home: &Path) -> std::path::PathBuf {
+    Target::ClaudeCode.settings_path(home)
+}
 
 fn sh(script: &str, args: &[&str], envs: &[(&str, &str)], payload: &[u8]) -> std::process::Output {
     let mut cmd = Command::new("/bin/sh");
@@ -70,7 +79,7 @@ fn owned_envs<'a>(envs: &'a [(&'static str, String)]) -> Vec<(&'static str, &'a
 /// exit 0, no output, stdin drained.
 #[test]
 fn script_exits_silently_without_maestro_env() {
-    for (event, _) in HOOK_EVENTS {
+    for (event, _) in CLAUDE_EVENTS {
         let out = sh(HOOK_SCRIPT, &[event], &[], br#"{"session_id":"x"}"#);
         assert!(out.status.success(), "{event:?}: {:?}", out.stderr);
         assert!(out.stdout.is_empty(), "{event:?}: {:?}", out.stdout);
@@ -103,7 +112,7 @@ fn script_posts_mapped_state_to_the_activity_endpoint() {
 /// Every event maps to the state the contract specifies.
 #[test]
 fn event_state_mapping_matches_the_contract() {
-    let map: std::collections::HashMap<&str, &str> = HOOK_EVENTS.into_iter().collect();
+    let map: std::collections::HashMap<&str, &str> = CLAUDE_EVENTS.into_iter().collect();
     assert_eq!(map["PreToolUse"], "Active");
     assert_eq!(map["PostToolUse"], "Active");
     assert_eq!(map["Notification"], "AwaitingInput");
@@ -128,41 +137,6 @@ fn script_reports_the_error_spelling_as_detail() {
     assert!(request.contains(r#""detail":"rate_limit""#), "{request}");
 }
 
-/// #161: the payload's own `session_id` — the agent's conversation id — is
-/// parsed out and forwarded in the activity body, so the daemon can persist
-/// it on the session.
-#[test]
-fn script_forwards_the_payloads_session_id_in_the_activity_body() {
-    let request = capture_request(|url| {
-        sh(
-            HOOK_SCRIPT,
-            &["Active"],
-            &owned_envs(&session_envs(&url)),
-            br#"{"session_id":"conv-abc123","hook_event_name":"PreToolUse"}"#,
-        )
-    });
-    assert!(request.contains(r#""state":"Active""#), "{request}");
-    assert!(
-        request.contains(r#""session_id":"conv-abc123""#),
-        "{request}"
-    );
-}
-
-/// A payload without a `session_id` (or one with an unexpected shape) must
-/// never produce a broken body — no `session_id` field is posted.
-#[test]
-fn script_posts_no_session_id_when_the_payload_has_none() {
-    let request = capture_request(|url| {
-        sh(
-            HOOK_SCRIPT,
-            &["AwaitingInput"],
-            &owned_envs(&session_envs(&url)),
-            br#"{"hook_event_name":"Stop","stop_hook_active":false}"#,
-        )
-    });
-    assert!(!request.contains("session_id"), "{request}");
-}
-
 /// An `error` value that is not a plain enum spelling (or a payload without
 /// one at all) must never produce a broken body — no detail is posted.
 #[test]
@@ -238,10 +212,10 @@ fn fresh_install_registers_every_event() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
     write_script(&script_path(home)).unwrap();
-    install(&settings_path(home), &script_path(home)).unwrap();
+    install(Target::ClaudeCode, &settings_path(home), &script_path(home)).unwrap();
 
     let cmds = installed_commands(&settings_path(home));
-    assert_eq!(cmds.len(), INSTALLED_EVENTS);
+    assert_eq!(cmds.len(), installed_events(Target::ClaudeCode));
     let joined = cmds.join("\n");
     assert_eq!(joined.matches("Active").count(), 2);
     assert!(joined.contains("Error"));
@@ -256,15 +230,15 @@ fn fresh_install_registers_every_event() {
 fn install_is_idempotent() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    install(&settings_path(home), &script_path(home)).unwrap();
+    install(Target::ClaudeCode, &settings_path(home), &script_path(home)).unwrap();
     let once = std::fs::read_to_string(settings_path(home)).unwrap();
 
-    install(&settings_path(home), &script_path(home)).unwrap();
+    install(Target::ClaudeCode, &settings_path(home), &script_path(home)).unwrap();
     let twice = std::fs::read_to_string(settings_path(home)).unwrap();
     assert_eq!(once, twice);
     assert_eq!(
         installed_commands(&settings_path(home)).len(),
-        INSTALLED_EVENTS
+        installed_events(Target::ClaudeCode)
     );
 }
 
@@ -292,12 +266,12 @@ fn install_updates_an_older_maestro_hook_in_place() {
         .path()
         .join(".local/share/maestro")
         .join(SCRIPT_FILE_NAME);
-    install(&settings, &new_script).unwrap();
+    install(Target::ClaudeCode, &settings, &new_script).unwrap();
 
     let cmds = installed_commands(&settings);
     assert_eq!(
         cmds.len(),
-        INSTALLED_EVENTS,
+        installed_events(Target::ClaudeCode),
         "old entry replaced, not kept: {cmds:?}"
     );
     assert!(!cmds.iter().any(|c| c == old_script));
@@ -333,7 +307,7 @@ fn install_preserves_foreign_hooks_and_removes_stale_maestro_ones() {
         .path()
         .join(".local/share/maestro")
         .join(SCRIPT_FILE_NAME);
-    install(&settings, &new_script).unwrap();
+    install(Target::ClaudeCode, &settings, &new_script).unwrap();
 
     let root: serde_json::Value =
         serde_json::from_str(&std::fs::read_to_string(&settings).unwrap()).unwrap();
@@ -346,7 +320,7 @@ fn install_preserves_foreign_hooks_and_removes_stale_maestro_ones() {
     let cmds = installed_commands(&settings);
     assert_eq!(
         cmds.iter().filter(|c| c.contains(HOOK_MARKER)).count(),
-        INSTALLED_EVENTS,
+        installed_events(Target::ClaudeCode),
         "{cmds:?}"
     );
 }
@@ -356,9 +330,15 @@ fn install_preserves_foreign_hooks_and_removes_stale_maestro_ones() {
 fn is_installed_tracks_reality() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    assert!(!is_installed(&settings_path(home)));
-    install_for_home(home).unwrap();
-    assert!(is_installed(&settings_path(home)));
+    for target in Target::ALL {
+        assert!(!is_installed(&target.settings_path(home)));
+    }
+    for (_, result) in install_for_home(home) {
+        result.unwrap();
+    }
+    for target in Target::ALL {
+        assert!(is_installed(&target.settings_path(home)));
+    }
 }
 
 /// The full home-level install leaves the script executable.
@@ -366,7 +346,9 @@ fn is_installed_tracks_reality() {
 fn install_for_home_writes_an_executable_script() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    install_for_home(home).unwrap();
+    for (_, result) in install_for_home(home) {
+        result.unwrap();
+    }
     #[cfg(unix)]
     {
         use std::os::unix::fs::PermissionsExt;
@@ -385,7 +367,7 @@ fn install_for_home_writes_an_executable_script() {
 fn install_registers_the_prompt_event() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    install(&settings_path(home), &script_path(home)).unwrap();
+    install(Target::ClaudeCode, &settings_path(home), &script_path(home)).unwrap();
 
     let root: serde_json::Value =
         serde_json::from_str(&std::fs::read_to_string(settings_path(home)).unwrap()).unwrap();
@@ -402,7 +384,7 @@ fn install_registers_the_prompt_event() {
 fn install_registers_no_prompt_event_without_the_feature() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    install(&settings_path(home), &script_path(home)).unwrap();
+    install(Target::ClaudeCode, &settings_path(home), &script_path(home)).unwrap();
 
     let root: serde_json::Value =
         serde_json::from_str(&std::fs::read_to_string(settings_path(home)).unwrap()).unwrap();
@@ -471,8 +453,12 @@ fn the_script_posts_a_prompt_payload_unchanged() {
 fn is_current_rejects_an_install_missing_an_event() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    install_for_home(home).unwrap();
-    assert!(is_current(&settings_path(home), &script_path(home)));
+    install_target(Target::ClaudeCode, home).unwrap();
+    assert!(is_current(
+        Target::ClaudeCode,
+        &settings_path(home),
+        &script_path(home)
+    ));
 
     // Drop one event, as an older install would have left the file.
     let mut root: serde_json::Value =
@@ -485,7 +471,11 @@ fn is_current_rejects_an_install_missing_an_event() {
     .unwrap();
 
     assert!(is_installed(&settings_path(home)));
-    assert!(!is_current(&settings_path(home), &script_path(home)));
+    assert!(!is_current(
+        Target::ClaudeCode,
+        &settings_path(home),
+        &script_path(home)
+    ));
 }
 
 /// A settings file that is complete but points at a script from an older
@@ -494,9 +484,13 @@ fn is_current_rejects_an_install_missing_an_event() {
 fn is_current_rejects_a_stale_script() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    install_for_home(home).unwrap();
+    install_target(Target::ClaudeCode, home).unwrap();
     std::fs::write(script_path(home), "#!/bin/sh\nexit 0\n").unwrap();
-    assert!(!is_current(&settings_path(home), &script_path(home)));
+    assert!(!is_current(
+        Target::ClaudeCode,
+        &settings_path(home),
+        &script_path(home)
+    ));
 }
 
 /// Nothing installed at all is not current.
@@ -504,18 +498,93 @@ fn is_current_rejects_a_stale_script() {
 fn is_current_rejects_a_missing_install() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    assert!(!is_current(&settings_path(home), &script_path(home)));
+    assert!(!is_current(
+        Target::ClaudeCode,
+        &settings_path(home),
+        &script_path(home)
+    ));
 }
 
-/// `install_for_home` reports a stale script as a change, even when the
+/// `install_target` reports a stale script as a change, even when the
 /// settings entries pointing at it already read correctly.
 #[test]
-fn install_for_home_reports_a_stale_script_as_a_change() {
+fn install_target_reports_a_stale_script_as_a_change() {
     let dir = tempfile::tempdir().unwrap();
     let home = dir.path();
-    assert!(install_for_home(home).unwrap());
-    assert!(!install_for_home(home).unwrap());
+    assert!(install_target(Target::ClaudeCode, home).unwrap());
+    assert!(!install_target(Target::ClaudeCode, home).unwrap());
 
     std::fs::write(script_path(home), "#!/bin/sh\nexit 0\n").unwrap();
-    assert!(install_for_home(home).unwrap());
+    assert!(install_target(Target::ClaudeCode, home).unwrap());
+}
+
+/// Codex is hooked in its own file, with its own event set: the two agents
+/// share the script but not the events, so neither file carries the other's
+/// spellings (#131 follow-up — a codex session was never named because
+/// nothing installed its `UserPromptSubmit` hook).
+#[test]
+fn each_target_gets_its_own_file_and_events() {
+    let dir = tempfile::tempdir().unwrap();
+    let home = dir.path();
+    for (_, result) in install_for_home(home) {
+        result.unwrap();
+    }
+
+    let claude = events_in(&Target::ClaudeCode.settings_path(home));
+    let codex = events_in(&Target::Codex.settings_path(home));
+    assert_eq!(
+        Target::Codex.settings_path(home),
+        home.join(".codex/hooks.json")
+    );
+
+    // Claude Code's failure signal has no codex equivalent, and codex's
+    // approval notice is spelled differently.
+    assert!(claude.contains(&"StopFailure".to_string()));
+    assert!(claude.contains(&"Notification".to_string()));
+    assert!(!codex.contains(&"StopFailure".to_string()));
+    assert!(!codex.contains(&"Notification".to_string()));
+    assert!(codex.contains(&"PermissionRequest".to_string()));
+
+    // Both report work and both report a finished turn.
+    for event in ["PreToolUse", "PostToolUse", "Stop"] {
+        assert!(claude.contains(&event.to_string()), "claude {event}");
+        assert!(codex.contains(&event.to_string()), "codex {event}");
+    }
+
+    assert_eq!(
+        installed_commands(&Target::Codex.settings_path(home)).len(),
+        installed_events(Target::Codex)
+    );
+}
+
+/// #131: a codex session names itself the same way a Claude Code one does —
+/// same event spelling, same script, same `Prompt` argument.
+#[cfg(feature = "haiku-autoname")]
+#[test]
+fn codex_reports_its_first_prompt_too() {
+    let dir = tempfile::tempdir().unwrap();
+    let home = dir.path();
+    install_target(Target::Codex, home).unwrap();
+
+    let root: serde_json::Value =
+        serde_json::from_str(&std::fs::read_to_string(Target::Codex.settings_path(home)).unwrap())
+            .unwrap();
+    let cmd = root["hooks"]["UserPromptSubmit"][0]["hooks"][0]["command"]
+        .as_str()
+        .unwrap()
+        .to_string();
+    assert!(cmd.ends_with(" Prompt"), "{cmd}");
+    assert!(cmd.contains(SCRIPT_FILE_NAME));
+}
+
+/// Every event name a settings file registers a maestro hook under.
+fn events_in(settings: &Path) -> Vec<String> {
+    serde_json::from_str::<serde_json::Value>(&std::fs::read_to_string(settings).unwrap())
+        .unwrap()
+        .get("hooks")
+        .and_then(|h| h.as_object())
+        .into_iter()
+        .flatten()
+        .map(|(event, _)| event.clone())
+        .collect()
 }

crates/maestro-protocol/src/display.rs

@@ -268,6 +268,7 @@ mod tests {
 
     fn session(cwd: &str) -> Session {
         Session {
+            view: Default::default(),
             id: Uuid::from_u128(1),
             cwd: PathBuf::from(cwd),
             command: "bash".into(),
@@ -284,7 +285,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: None,
-            agent_session_id: None,
+            acp_session_id: None,
         }
     }
 

crates/maestro-protocol/src/lib.rs

@@ -116,13 +116,33 @@ pub struct Session {
     /// sorts a never-focused session after every session that has one.
     #[serde(default)]
     pub last_focused_at: Option<DateTime<Utc>>,
-    /// The conversation id the agent running in this session reported for
-    /// itself (#161), parsed from a hook's `session_id` field. Written once,
-    /// from the first activity report that carries one, and left alone after
-    /// — an agent's own session id does not change mid-session. `None` for
-    /// sessions that never run an agent (plain shells) or predate the field.
+    /// Whether this session's process is a plain terminal (PTY bytes through
+    /// tmux) or a structured agent driven over ACP rows (#133). Fixed at
+    /// spawn time and never changes for the life of the session. Defaults to
+    /// `Terminal` on the wire so every existing client and payload from a
+    /// daemon that predates the field keeps working untouched.
+    #[serde(default)]
+    pub view: SessionView,
+    /// The ACP session id the `claude-code-acp` adapter handed back from
+    /// `session/new` (#134). Only a [`SessionView::Structured`] session has
+    /// one, and only once its handshake succeeded; a later respawn passes it
+    /// to `session/load` so the conversation continues (#135). Distinct from
+    /// the hook-reported Claude Code conversation id (#161): that one is what
+    /// `claude --resume` takes, this one is what the ACP adapter takes, and
+    /// the two are minted by different processes with different lifetimes.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub agent_session_id: Option<String>,
+    pub acp_session_id: Option<String>,
+}
+
+/// A session's process shape (#133): a plain terminal, or a structured agent
+/// driven over ACP rows. Chosen at spawn and immutable for the session's
+/// life. `Terminal` is the default — every sidecar and `CreateSessionRequest`
+/// written before this field existed meant a terminal session.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
+pub enum SessionView {
+    #[default]
+    Terminal,
+    Structured,
 }
 
 /// Default for [`Session::last_activity_at`] when an older payload omits it.
@@ -130,38 +150,10 @@ fn epoch() -> DateTime<Utc> {
     DateTime::from_timestamp(0, 0).expect("unix epoch is a valid timestamp")
 }
 
-/// Lifecycle of a session as the daemon knows it.
-///
-/// Deserializes leniently, like [`ActivityState`] (#162): an unknown spelling
-/// from a newer daemon reads as [`SessionStatus::Dead`] instead of failing the
-/// whole `Session`. `Dead` is the safe degrade — an unrecognised session is
-/// one this client must not treat as having a live pane to type into.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub enum SessionStatus {
     Running,
     Dead,
-    /// Known from its sidecar, with no tmux session behind it (#162). The
-    /// daemon registers these at recovery time for every sidecar tmux had
-    /// nothing to adopt — after a host reboot, that is every session there
-    /// was. There is no pane and no PTY bridge: a dormant session is a record
-    /// of what was running, listed so the operator still has it, and the only
-    /// thing that can be done to it is dismissing it.
-    Dormant,
-}
-
-impl<'de> Deserialize<'de> for SessionStatus {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: serde::Deserializer<'de>,
-    {
-        let s = String::deserialize(deserializer)?;
-        Ok(match s.as_str() {
-            "Running" => Self::Running,
-            "Dormant" => Self::Dormant,
-            // Known or not, any other spelling degrades to the inert variant.
-            _ => Self::Dead,
-        })
-    }
 }
 
 /// Inferred session activity, orthogonal to [`SessionStatus`] (NAP-340). The
@@ -219,11 +211,6 @@ pub struct ReportActivityRequest {
     /// The daemon caps its length server-side.
     #[serde(default)]
     pub detail: Option<String>,
-    /// The agent's own conversation id (#161), forwarded from the hook
-    /// payload's `session_id` field. `None` for hook events that don't carry
-    /// one, or hooks predating this field.
-    #[serde(default)]
-    pub session_id: Option<String>,
 }
 
 /// Reject an unknown [`ActivityState`] spelling instead of degrading it to
@@ -392,6 +379,11 @@ pub struct CreateSessionRequest {
     pub metadata: HashMap<String, Value>,
     #[serde(default)]
     pub worktree: Option<WorktreeSpec>,
+    /// The process shape to spawn (#133). Defaulted so every existing client
+    /// and `curl` against the API keeps requesting a `Terminal` session
+    /// untouched.
+    #[serde(default)]
+    pub view: SessionView,
 }
 
 /// Result of `GET /api/dirs`: the immediate subdirectories of one directory.
@@ -529,11 +521,8 @@ impl ApiError {
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct SpawnPreset {
     pub id: String,
-    #[serde(default)]
     pub label: String,
     pub command: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub resume_command: Option<String>,
 }
 
 /// Build provenance of the running daemon: the commit it was compiled
@@ -905,7 +894,8 @@ mod tests {
             current_cwd: Some(PathBuf::from("/home/naps62/projects/maestro/crates")),
             blocked_work: None,
             last_focused_at: None,
-            agent_session_id: None,
+            view: SessionView::Terminal,
+            acp_session_id: None,
         }
     }
 
@@ -1075,7 +1065,6 @@ mod tests {
         let full = ReportActivityRequest {
             state: ActivityState::AwaitingInput,
             detail: Some("waiting on permission".into()),
-            session_id: Some("conv-abc123".into()),
         };
         assert_eq!(full, round_trip(&full));
 
@@ -1104,33 +1093,6 @@ mod tests {
             serde_json::to_value(SessionStatus::Dead).unwrap(),
             serde_json::json!("Dead")
         );
-        assert_eq!(
-            serde_json::to_value(SessionStatus::Dormant).unwrap(),
-            serde_json::json!("Dormant")
-        );
-    }
-
-    // #162: a session with no tmux behind it still rides the wire whole.
-    #[test]
-    fn dormant_session_round_trips() {
-        let mut s = sample_session();
-        s.status = SessionStatus::Dormant;
-        assert_eq!(s, round_trip(&s));
-    }
-
-    // #162: a `SessionStatus` this client does not know must degrade to the
-    // inert variant, not fail the whole `Session` the way a derived
-    // `Deserialize` would.
-    #[test]
-    fn unknown_session_status_degrades_to_dead() {
-        assert_eq!(
-            serde_json::from_value::<SessionStatus>(serde_json::json!("Hibernating")).unwrap(),
-            SessionStatus::Dead
-        );
-        let mut value = serde_json::to_value(sample_session()).unwrap();
-        value["status"] = serde_json::json!("Hibernating");
-        let s: Session = serde_json::from_value(value).expect("session survives unknown status");
-        assert_eq!(s.status, SessionStatus::Dead);
     }
 
     #[test]
@@ -1145,6 +1107,7 @@ mod tests {
                 branch: "feat/foo".into(),
                 create_branch: true,
             }),
+            view: SessionView::Terminal,
         };
         assert_eq!(req, round_trip(&req));
     }
@@ -1159,6 +1122,49 @@ mod tests {
         assert!(req.worktree.is_none());
         assert!(req.env.is_empty());
         assert!(req.metadata.is_empty());
+        assert_eq!(req.view, SessionView::Terminal);
+    }
+
+    #[test]
+    fn session_view_defaults_to_terminal_on_legacy_payload() {
+        // A pre-#133 daemon or client omits `view`; it must deserialize to
+        // `Terminal` rather than failing, and `Structured` round-trips.
+        let json = serde_json::json!({
+            "id": Uuid::from_u128(1),
+            "cwd": "/tmp",
+            "command": "bash",
+            "status": "Running",
+            "created_at": "2026-05-24T12:00:00Z"
+        });
+        let s: Session = serde_json::from_value(json).unwrap();
+        assert_eq!(s.view, SessionView::Terminal);
+
+        let mut structured = sample_session();
+        structured.view = SessionView::Structured;
+        assert_eq!(structured, round_trip(&structured));
+    }
+
+    #[test]
+    fn acp_session_id_defaults_to_none_and_round_trips() {
+        // A payload from before #134 carries no `acp_session_id`; it must
+        // read as `None`, stay off the wire while unset, and round-trip
+        // once the adapter has handed one back.
+        let json = serde_json::json!({
+            "id": Uuid::from_u128(1),
+            "cwd": "/tmp",
+            "command": "bash",
+            "status": "Running",
+            "created_at": "2026-05-24T12:00:00Z"
+        });
+        let s: Session = serde_json::from_value(json).unwrap();
+        assert_eq!(s.acp_session_id, None);
+        let serialized = serde_json::to_value(&s).unwrap();
+        assert!(serialized.get("acp_session_id").is_none());
+
+        let mut structured = sample_session();
+        structured.view = SessionView::Structured;
+        structured.acp_session_id = Some("sess_01HZX".into());
+        assert_eq!(structured, round_trip(&structured));
     }
 
     /// A client that predates the new/existing discriminator sends no

crates/maestro-testing/src/lib.rs

@@ -31,6 +31,7 @@ use uuid::Uuid;
 /// Build a plausible `Session` for a test to hand to [`MockDaemon::add_session`].
 pub fn session(id: Uuid, cwd: &str, command: &str) -> Session {
     Session {
+        view: Default::default(),
         id,
         cwd: cwd.into(),
         command: command.into(),
@@ -47,7 +48,7 @@ pub fn session(id: Uuid, cwd: &str, command: &str) -> Session {
         current_cwd: None,
         blocked_work: None,
         last_focused_at: None,
-        agent_session_id: None,
+        acp_session_id: None,
     }
 }
 

crates/maestro-tui/src/app.rs

@@ -1882,6 +1882,7 @@ mod tests {
             sessions: ids
                 .iter()
                 .map(|id| Session {
+                    view: Default::default(),
                     id: *id,
                     command: "bash".into(),
                     cwd: std::path::PathBuf::from("/"),
@@ -1898,7 +1899,7 @@ mod tests {
                     current_cwd: None,
                     blocked_work: None,
                     last_focused_at: None,
-                    agent_session_id: None,
+                    acp_session_id: None,
                 })
                 .collect(),
         });
@@ -2064,6 +2065,7 @@ mod tests {
         let mut app = make_app();
         app.catalog.apply_event(CatalogEvent::Snapshot {
             sessions: vec![Session {
+                view: Default::default(),
                 id: sid,
                 command: "bash".into(),
                 cwd: std::path::PathBuf::from("/"),
@@ -2080,7 +2082,7 @@ mod tests {
                 current_cwd: None,
                 blocked_work: None,
                 last_focused_at: None,
-                agent_session_id: None,
+                acp_session_id: None,
             }],
         });
         app.dispatch(Action::SidebarNext);
@@ -2092,6 +2094,7 @@ mod tests {
         use chrono::Utc;
         use maestro_protocol::{Session, SessionStatus};
         Session {
+            view: Default::default(),
             id: sid,
             command: "bash".into(),
             cwd: cwd.into(),
@@ -2108,7 +2111,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: None,
-            agent_session_id: None,
+            acp_session_id: None,
         }
     }
 
@@ -2780,6 +2783,7 @@ mod tests {
         );
         app.dispatch(Action::OpenSpawnModal);
         let req = CreateSessionRequest {
+            view: Default::default(),
             cwd: std::path::PathBuf::from("/srv/work"),
             command: "bash".into(),
             env: Default::default(),
@@ -3198,6 +3202,7 @@ mod tests {
         use chrono::Utc;
         use maestro_protocol::{CatalogEvent, Session, SessionStatus};
         let make = |n: u128, name: &str, focused: Option<chrono::DateTime<Utc>>| Session {
+            view: Default::default(),
             id: Uuid::from_u128(n),
             command: "bash".into(),
             cwd: std::path::PathBuf::from("/"),
@@ -3217,7 +3222,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: focused,
-            agent_session_id: None,
+            acp_session_id: None,
         };
         let older = Utc::now() - chrono::Duration::seconds(60);
         app.catalog.apply_event(CatalogEvent::Snapshot {
@@ -3479,6 +3484,7 @@ mod tests {
         let sid = Uuid::from_u128(7);
         app.catalog.apply_event(CatalogEvent::Snapshot {
             sessions: vec![Session {
+                view: Default::default(),
                 id: sid,
                 command: "bash".into(),
                 cwd: std::path::PathBuf::from("/"),
@@ -3496,7 +3502,7 @@ mod tests {
                 current_cwd: None,
                 blocked_work: None,
                 last_focused_at: None,
-                agent_session_id: None,
+                acp_session_id: None,
             }],
         });
         app.dispatch(Action::KillHighlighted);
@@ -3516,6 +3522,7 @@ mod tests {
         };
         app.catalog.apply_event(CatalogEvent::Snapshot {
             sessions: vec![Session {
+                view: Default::default(),
                 id: sid,
                 command: "bash".into(),
                 cwd: std::path::PathBuf::from("/"),
@@ -3532,7 +3539,7 @@ mod tests {
                 current_cwd: None,
                 blocked_work: None,
                 last_focused_at: None,
-                agent_session_id: None,
+                acp_session_id: None,
             }],
         });
     }

crates/maestro-tui/src/catalog.rs

@@ -207,6 +207,7 @@ mod tests {
 
     fn session(id: u128, command: &str) -> Session {
         Session {
+            view: Default::default(),
             id: Uuid::from_u128(id),
             command: command.into(),
             cwd: std::path::PathBuf::from("/tmp"),
@@ -223,7 +224,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: None,
-            agent_session_id: None,
+            acp_session_id: None,
         }
     }
 

crates/maestro-tui/src/command_bar.rs

@@ -194,9 +194,7 @@ pub enum BarOutcome {
 pub fn order_sessions_for_bar(sessions: &[Session]) -> Vec<&Session> {
     let mut ordered: Vec<&Session> = sessions.iter().collect();
     ordered.sort_by(|a, b| {
-        // docs/COMMAND-BAR.md: anything with no live pane — dead or dormant
-        // (#162) — sorts after the sessions you could actually attach to.
-        let dead = |s: &Session| u8::from(s.status != SessionStatus::Running);
+        let dead = |s: &Session| u8::from(s.status == SessionStatus::Dead);
         dead(a)
             .cmp(&dead(b))
             .then_with(|| {
@@ -321,7 +319,7 @@ impl CommandBar {
             .map(|s| BarEntry {
                 candidate: MatchCandidate::Session(session_candidate(s, home_dir)),
                 target: BarTarget::Session(s.id),
-                dead: s.status != SessionStatus::Running,
+                dead: s.status == SessionStatus::Dead,
                 chords: Vec::new(),
             })
             .collect();
@@ -795,6 +793,7 @@ mod tests {
 
     fn session(n: u128, command: &str) -> Session {
         Session {
+            view: Default::default(),
             id: Uuid::from_u128(n),
             cwd: PathBuf::from("/home/me/dev/api"),
             command: command.to_string(),
@@ -811,7 +810,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: None,
-            agent_session_id: None,
+            acp_session_id: None,
         }
     }
 
@@ -892,23 +891,6 @@ mod tests {
         assert!(bar.rows()[1].dead);
     }
 
-    /// #162: docs/COMMAND-BAR.md ranks by whether you could attach, not by
-    /// which way the pane went away — a dormant session sorts with the dead.
-    #[test]
-    fn dormant_sessions_sort_after_live_ones_however_recent() {
-        let mut dormant = named(1, "dormant");
-        dormant.status = SessionStatus::Dormant;
-        dormant.last_focused_at = Some(at(99));
-        let live = named(2, "live");
-
-        let bar = CommandBar::new(&[dormant, live], &[], "/home/me");
-        assert_eq!(
-            ids(bar.rows()),
-            vec![Uuid::from_u128(2), Uuid::from_u128(1)]
-        );
-        assert!(bar.rows()[1].dead);
-    }
-
     #[test]
     fn typing_ranks_through_the_matcher_and_returns_ranges() {
         let mut bar = CommandBar::new(

crates/maestro-tui/src/draft.rs

@@ -694,6 +694,7 @@ impl DraftPane {
         }
         let worktree = self.build_worktree()?;
         Ok(CreateSessionRequest {
+            view: Default::default(),
             cwd,
             command: command.to_string(),
             env: Default::default(),
@@ -1705,7 +1706,6 @@ mod tests {
             id: "aider".into(),
             label: "Aider".into(),
             command: "aider".into(),
-            resume_command: None,
         }]);
         assert_eq!(
             draft.command(),
@@ -1728,13 +1728,11 @@ mod tests {
                 id: "claude".into(),
                 label: "Claude".into(),
                 command: "claude".into(),
-                resume_command: None,
             },
             SpawnPreset {
                 id: "aider".into(),
                 label: "Aider".into(),
                 command: "aider".into(),
-                resume_command: None,
             },
         ]);
         assert_eq!(draft.command(), "aider");
@@ -1754,7 +1752,6 @@ mod tests {
             id: "claude".into(),
             label: "Claude".into(),
             command: "claude".into(),
-            resume_command: None,
         }]);
         assert!(draft.is_custom());
         assert_eq!(draft.command(), "bash -l");

crates/maestro-tui/src/fast_forward.rs

@@ -108,6 +108,7 @@ impl FastForwardDefaults {
             return None;
         }
         Some(CreateSessionRequest {
+            view: Default::default(),
             cwd: project.path.clone(),
             command: command.to_string(),
             env: Default::default(),
@@ -183,7 +184,6 @@ mod tests {
             id: id.into(),
             label: id.into(),
             command: command.into(),
-            resume_command: None,
         }
     }
 

crates/maestro-tui/src/sidebar.rs

@@ -268,8 +268,6 @@ impl Sidebar {
     fn name_row(&self, s: &Session, width: usize, focused: bool) -> Vec<Span<'static>> {
         let glyph = match (s.status, self.attached.contains(&s.id)) {
             (SessionStatus::Dead, _) => "✗",
-            // #162: known from its sidecar, nothing running behind it.
-            (SessionStatus::Dormant, _) => "◌",
             (SessionStatus::Running, true) => "●",
             (SessionStatus::Running, false) => "○",
         };
@@ -324,7 +322,6 @@ impl Sidebar {
         // on line 1; the kill confirm names the specifics.
         let blocked = s.blocked_work.filter(|b| !b.is_clear());
         let dead = s.status == SessionStatus::Dead;
-        let dormant = s.status == SessionStatus::Dormant;
         let highlighted = self.highlight == Some(SidebarItem::Session(s.id));
         let fill = self.card_fill(s, focused);
         let base = card_base(fill, focused);
@@ -364,9 +361,6 @@ impl Sidebar {
         if dead {
             tail.push(Span::styled(" exited", muted));
         }
-        if dormant {
-            tail.push(Span::styled(" dormant", muted));
-        }
         // docs/SIDEBAR.md: the card names the program, never its arguments.
         let command = Span::styled(format!(" {}", command_program(&s.command)), muted);
 
@@ -490,6 +484,7 @@ mod tests {
         let mut metadata = HashMap::new();
         metadata.insert("name".into(), serde_json::Value::String(name.into()));
         Session {
+            view: Default::default(),
             id: Uuid::from_u128(id),
             command: "bash".into(),
             cwd: std::path::PathBuf::from("/tmp"),
@@ -506,7 +501,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: None,
-            agent_session_id: None,
+            acp_session_id: None,
         }
     }
 
@@ -1075,39 +1070,6 @@ mod tests {
         );
     }
 
-    /// #162, docs/SIDEBAR.md: a dormant session is known but not running —
-    /// its own glyph on line 1 and the muted `dormant` fragment on line 2, so
-    /// it never reads as something that exited.
-    #[test]
-    fn dormant_session_reads_as_known_but_not_running() {
-        let mut s = session_named(1, "claude");
-        s.status = SessionStatus::Dormant;
-        s.activity_since = Utc::now() - Duration::seconds(5);
-        let sb = Sidebar {
-            sessions: vec![s],
-            highlight: None,
-            attached: Default::default(),
-            pane_session: None,
-        };
-        let all = rows(&draw(&sb, 28, 8));
-        let idx = all.iter().position(|l| l.contains("claude")).unwrap();
-        assert!(
-            all[idx].contains('\u{25cc}'),
-            "expected the dormant glyph in: {:?}",
-            all[idx]
-        );
-        assert!(
-            all[idx + 1].contains("dormant"),
-            "expected dormant fragment in: {:?}",
-            all[idx + 1]
-        );
-        assert!(
-            !all[idx + 1].contains("exited"),
-            "a dormant session never reads as exited: {:?}",
-            all[idx + 1]
-        );
-    }
-
     /// docs/SIDEBAR.md: line 2 names the program, never its arguments.
     #[test]
     fn meta_line_drops_the_commands_arguments() {
@@ -1290,6 +1252,7 @@ mod tests {
     #[test]
     fn falls_back_to_command_when_name_metadata_is_absent() {
         let s = Session {
+            view: Default::default(),
             id: Uuid::from_u128(1),
             command: "vim".into(),
             cwd: std::path::PathBuf::from("/tmp"),
@@ -1306,7 +1269,7 @@ mod tests {
             current_cwd: None,
             blocked_work: None,
             last_focused_at: None,
-            agent_session_id: None,
+            acp_session_id: None,
         };
         let sb = Sidebar {
             sessions: vec![s],

docs/COMMAND-BAR.md

@@ -123,9 +123,9 @@ client opening `/api/attach/:id`, and a client reporting focus explicitly at
 `POST /api/sessions/:id/focus` when it refocuses a pane that is already open.
 
 **A session that has never been focused sorts after every session that has**,
-and among those, most recently created first. Sessions with no live pane —
-`Dead`, and `Dormant` (#162) — sort after live ones regardless of recency: a
-session you cannot attach to is not where you just were.
+and among those, most recently created first. Dead sessions sort after live
+ones regardless of recency: a session you cannot attach to is not where you
+just were.
 
 Under `>` an empty query lists every command in registry order. Under `~` it
 lists recent dirs, most recent first, then the project list.

docs/INSTALL.md

@@ -188,6 +188,29 @@ An unknown name is rejected as an `[tui].theme` configuration error.
 The full action vocabulary is the `Action` enum in
 `crates/maestro-tui/src/action.rs`.
 
+## Structured sessions: `claude-code-acp`
+
+A session spawned with `view: Structured` (#134) runs Claude Code as a child
+of the daemon over the Agent Client Protocol instead of in a tmux pane. The
+daemon resolves the adapter binary, `claude-code-acp`, on its `PATH` at spawn
+time. Install it once per host:
+
+```sh
+npm install -g --prefix ~/.local @zed-industries/claude-code-acp
+```
+
+That puts `claude-code-acp` in `~/.local/bin`, which must be on the daemon's
+`PATH` (a systemd user unit does not read your shell profile; set
+`Environment=PATH=…` in the unit or install somewhere already on it). The
+adapter needs a logged-in Claude Code (`claude /login`).
+
+When the adapter is missing the spawn still creates the session, marked dead
+with the install command above as its activity detail, so the sidebar says
+what to run. The adapter is a child of the daemon: it ends with a `DELETE
+/api/sessions/:id` (`session/cancel`, then `SIGTERM`) and with the daemon
+itself. Terminal sessions keep surviving restarts through tmux; structured
+ones do not yet.
+
 ## The browser UI
 
 The daemon serves the SPA off its own listener. Open

docs/RESTART.md

@@ -68,29 +68,6 @@ resolves, so a blocked client is never a trapped one. It clears itself the
 moment a probe succeeds — there is no "retry" button, because the client is
 already retrying.
 
-## What survives, and what comes back dormant
-
-A daemon restart leaves tmux alone, so recovery re-adopts every
-`maestro-<uuid>` session tmux still holds and the operator sees no change
-beyond the reconnect above.
-
-A **host reboot** is different: it kills the tmux server, so there is nothing
-to adopt while every session's sidecar is still on disk. Recovery makes a
-second pass over those sidecars and registers each as a `Dormant` session
-(#162) — id, name, cwd, command, worktree and `created_at` intact. A dormant
-session has no pane and no PTY bridge: it cannot be attached to, typed into or
-resized, and neither watcher pass touches it. It is a record of what was
-running, and the only thing left to do with one is dismiss it, which removes
-the sidecar so the next recovery does not bring it back.
-
-`SessionStatus` is a wire type, so from this build forward it deserializes
-leniently on both clients: a spelling the client does not know reads as `Dead`
-rather than failing the whole session. That leniency lives in the client's own
-binary, so it covers spellings added *after* this build, not this one — a CLI
-or TUI still running an older build fails to parse a `Dormant` session, and
-with it the whole session list, until it is upgraded. Clients render a dormant session as known-but-not-running —
-see `docs/SIDEBAR.md` for the card and `docs/COMMAND-BAR.md` for how it ranks.
-
 ## Timing
 
 - **Grace window** — 1200 ms between the socket dropping and the overlay

docs/SIDEBAR.md

@@ -56,7 +56,7 @@ itself is not.
 Line 2 reads left to right:
 
 ```
-[<duration>] [<detail>] <command> [<diff stat> | exited | dormant]
+[<duration>] [<detail>] <command> [<diff stat> | exited]
 ```
 
 Its minimum content is therefore just the command.
@@ -104,14 +104,8 @@ fragment; it no longer decides whether line 2 exists.
 while an agent-reported state is in force (see Precedence): when the report
 lapses at its TTL or is replaced, the detail goes with it. The detail
 truncates with `…` ahead of the trailing fragments — a long detail never
-pushes `<command>`, `<blocked work>`, `exited` or `dormant` off the line, and
-neither client ever lets it wrap.
-
-`dormant` (#162) is the counterpart of `exited` for a session the daemon knows
-only from its sidecar: recovery found no tmux session behind it, so it has no
-pane, no scrollback, and nothing to attach to. It is not an exit — nothing was
-observed ending — so the two fragments never both show. The TUI marks the same
-state on line 1 with `◌`, next to `✗` for exited and `●`/`○` for running.
+pushes `<command>`, `<blocked work>`, or `exited` off the line, and neither
+client ever lets it wrap.
 
 `<diff stat>` is the blocked-work breakdown (#83) in diff notation, replacing
 the spelled-out `⚠ 3 uncommitted files, 2 unpushed commits`. It renders only
@@ -215,7 +209,7 @@ the cursor's fill while the pane holds the keyboard, and the web's ring on a
 highlighted **folder** row — a folder previews nothing, so it has no fill to
 step up to.
 
-The duration text inherits its state's colour; the exited, dormant and command
+The duration text inherits its state's colour; the exited and command
 fragments use the surface's `muted` role, as do the diff stat's `~`, `?` and
 `↑` fragments. Only `+` and `-` step outside the surface's muted role, and they
 take the `active` and `error` roles of the same surface.
@@ -256,6 +250,10 @@ Two rulings specific to a reported `Error` (#114):
   process changes do not clear it — only the agent itself may withdraw what
   the agent itself reported. Re-reporting `Error` extends the TTL rather than
   stacking reports.
+- **Only Claude Code reports `Error`.** Codex has no counterpart to
+  `StopFailure` in its hook event set, so a codex turn that ends on an API
+  error reports `AwaitingInput` and its card carries no error mark. A card
+  without the mark means "nothing reported a failure", not "nothing failed".
 
 If a client receives an `ActivityState` variant it does not know, it must not
 fail rendering: treat it as `Idle` (neutral/dim, line-2 rules apply as usual)
@@ -309,9 +307,10 @@ lands on the first row it was hiding. A highlight parked on a skipped row —
 reachable by clicking a folder header — still steps to its neighbour rather
 than jumping to the end of the list.
 
-The web client needs a chord to reach the list at all (`Ctrl+Shift+H`, and the
-same chord back): an attached terminal owns every plain keystroke. The TUI uses
-`ctrl-w h`.
+The web client needs a chord to reach the list at all (leader-`h` — `Ctrl+A h`
+by default — and the same chord back): an attached terminal owns every plain
+keystroke, and Escape is left to reach the pane's shell/app instead. The TUI
+uses `ctrl-w h`.
 
 Everything else is the same key on both clients:
 

docs/WORKTREES.md

@@ -35,10 +35,18 @@ The branch name is used verbatim as a relative path, so `feature/login` becomes
 back to a short hash of the branch.
 
 If that path exists, the daemon appends `-2`, then `-3`, and so on until it finds
-a free one. The suffix names the **directory only**. The branch is whatever was
-requested; a second worktree of the same branch is not what happens here, because
-git refuses to check the same branch out twice and the branch picker already
-marks branches that are checked out elsewhere.
+a free one.
+
+For a *new* branch (`create_branch: true`), the suffix goes on the branch name
+itself, and the directory follows since it is derived from the branch — a
+random handle can otherwise reuse the name of a branch some earlier, already
+removed worktree left behind, and `git worktree add -b` refuses outright even
+though the directory is free.
+
+For an *existing* branch (`create_branch: false`) the name must stay exact, so
+only the directory is suffixed — a second worktree of the same branch is not
+what happens here, because git refuses to check the same branch out twice and
+the branch picker already marks branches that are checked out elsewhere.
 
 ### The `worktree_root` override
 

web/src/attach.ts

@@ -4,8 +4,6 @@ import { Terminal } from "@xterm/xterm";
 import "@xterm/xterm/css/xterm.css";
 
 import { attachWsUrl } from "./routes.js";
-import { FOCUS_SIDEBAR_EVENT } from "./catalog.js";
-import { CommandSet, defineCommands } from "./commands.js";
 import { escapeHtml } from "./html.js";
 import { INITIAL_RECONNECT_MS, MAX_RECONNECT_MS } from "./reconnect.js";
 import { applyModsToChar, cursorSeq, tildeSeq } from "./keys.js";
@@ -14,15 +12,6 @@ import { splitCommand, toolIconSvg } from "./toolIcon.js";
 import type { ClientControl, Uuid } from "./types.js";
 import { WebglPolicy } from "./webglRenderer.js";
 
-// The pane's half of the command registry (#148): plain Escape hands the
-// keyboard back to the session list, the pair to the list's Tab.
-const paneKeys = new CommandSet(
-  defineCommands({
-    "pane.focusList": () => document.dispatchEvent(new CustomEvent(FOCUS_SIDEBAR_EVENT)),
-  }),
-  { preventDefault: false },
-);
-
 /** One budget for the whole page — see webglRenderer.ts for why contexts are
  *  rationed rather than handed to every connection. */
 const webglPolicy = new WebglPolicy();
@@ -221,15 +210,6 @@ export function createAttachConnection(
     }
   }
 
-  // Plain Escape hands the keyboard back to the session list instead of the
-  // shell/app. `false` tells xterm to skip its own handling of this event —
-  // which is also why the set doesn't `preventDefault`: swallowing here is
-  // xterm's return value, not the browser's.
-  term.attachCustomKeyEventHandler((e) => {
-    if (e.type !== "keydown") return true;
-    return !paneKeys.handle(e);
-  });
-
   // Touch scrolling: xterm's built-in touch handling is jittery (drags crawl a
   // line at a time and stall), so map finger drags ourselves. Two routes:
   //   • normal buffer  → term.scrollLines walks the scrollback.
@@ -470,6 +450,12 @@ export function createAttachConnection(
   const resizeDisp = term.onResize(({ cols, rows }) => {
     sendControl({ type: "Resize", cols, rows });
   });
+  // xterm has no built-in copy-on-select; mirror the selection to the
+  // clipboard ourselves (best-effort — insecure contexts lack the API).
+  const selectionDisp = term.onSelectionChange(() => {
+    const text = term.getSelection();
+    if (text) void navigator.clipboard?.writeText(text).catch(() => {});
+  });
 
   window.addEventListener("resize", onResize);
   const visual = window.visualViewport ?? null;
@@ -525,6 +511,7 @@ export function createAttachConnection(
       visual?.removeEventListener("resize", onResize);
       dataDisp.dispose();
       resizeDisp.dispose();
+      selectionDisp.dispose();
       releaseWebgl();
       try {
         ws.close();

web/src/catalog.test.ts

@@ -414,19 +414,6 @@ describe("session cards (#107)", () => {
     expect(line2?.textContent).toContain("exited");
   });
 
-  // #162: a session recovered with no tmux behind it is known but not running,
-  // and never reads as something that exited.
-  it("shows dormant on line 2 for dormant sessions", () => {
-    const s = session({
-      id: "aaaaaaaa-0000-0000-0000-000000000118",
-      status: "Dormant",
-    });
-    const el = renderSidebar(storeWith([s])).el;
-    const line2 = rowFor(el, s.id)?.querySelector<HTMLElement>(".card-line2");
-    expect(line2?.textContent).toContain("dormant");
-    expect(line2?.textContent).not.toContain("exited");
-  });
-
   it("carries the state word only in tooltips and aria labels, never as text", () => {
     const s = session({
       id: "aaaaaaaa-0000-0000-0000-000000000019",

web/src/catalog.ts

@@ -53,10 +53,6 @@ export function requestOpenCommandBar(): void {
  *  connection pool. */
 export const FOCUS_PANE_EVENT = "catalog-focus-pane";
 
-/** Ask the shell to hand the keyboard back to the session list — what Escape
- *  does when the pane's terminal is focused. Handled in main.ts. */
-export const FOCUS_SIDEBAR_EVENT = "catalog-focus-sidebar";
-
 /** Ask the shell to open the spawn modal seeded from an existing session
  *  ("Spawn similar"). Detail is the session being cloned. */
 export const SPAWN_SIMILAR_EVENT = "catalog-spawn-similar";
@@ -113,9 +109,6 @@ function activityRailMarkup(slug: string, stateWord: string): string {
 
 function metaLine(s: Session, now: number): string {
   const dead = s.status === "Dead";
-  // #162: known from its sidecar with nothing running behind it — a distinct
-  // fragment, since it never exited.
-  const dormant = s.status === "Dormant";
   const blockers = sessionBlockers(s);
   const slug = activityColorSlug(s.activity ?? "Idle");
   const held = activityHeldMs(s.activity_since, now);
@@ -130,7 +123,6 @@ function metaLine(s: Session, now: number): string {
     commandFragment(s.command),
     blockers ? blockedFragment(blockers) : "",
     dead ? `<span class="card-flag">exited</span>` : "",
-    dormant ? `<span class="card-flag">dormant</span>` : "",
   ];
   return `<span class="card-line2" data-activity="${slug}">${fragments.join("")}</span>`;
 }

web/src/commandBar.test.ts

@@ -99,20 +99,6 @@ describe("empty-query ordering", () => {
     ]);
   });
 
-  // #162: docs/COMMAND-BAR.md ranks by whether you could attach, not by which
-  // way the pane went away.
-  it("sorts dormant sessions after live ones, like dead ones", () => {
-    const dormantRecent = session("dormant", {
-      status: "Dormant",
-      last_focused_at: "2026-06-01T00:00:00Z",
-    });
-    const liveStale = session("live", { last_focused_at: "2020-01-01T00:00:00Z" });
-    expect(orderSessionsForBar([dormantRecent, liveStale]).map((s) => s.id)).toEqual([
-      "live",
-      "dormant",
-    ]);
-  });
-
   it("treats a null last_focused_at as never focused", () => {
     const nulled = session("nulled", { last_focused_at: null });
     const stamped = session("stamped", { last_focused_at: "2020-01-01T00:00:00Z" });

web/src/commandBar.ts

@@ -142,10 +142,8 @@ function createdAt(s: Session): number {
  *  matcher's last tie-break preserves. */
 export function orderSessionsForBar(sessions: readonly Session[]): Session[] {
   return [...sessions].sort((a, b) => {
-    // docs/COMMAND-BAR.md: anything with no live pane — dead or dormant (#162)
-    // — sorts after the sessions you could actually attach to.
-    const deadA = a.status === "Running" ? 0 : 1;
-    const deadB = b.status === "Running" ? 0 : 1;
+    const deadA = a.status === "Dead" ? 1 : 0;
+    const deadB = b.status === "Dead" ? 1 : 0;
     if (deadA !== deadB) return deadA - deadB;
 
     const focusA = focusedAt(a);
@@ -352,7 +350,7 @@ function renderRow(result: BarResult, index: number): HTMLElement {
   row.dataset.kind = candidate.kind;
   if (candidate.kind === "session") {
     row.dataset.sessionId = candidate.session.id;
-    if (candidate.session.status !== "Running") row.classList.add("is-dead");
+    if (candidate.session.status === "Dead") row.classList.add("is-dead");
   } else if (isActionCandidate(candidate)) {
     row.dataset.actionId = candidate.action.id;
   } else if (candidate.kind === "command") {

web/src/commands.test.ts

@@ -133,31 +133,28 @@ describe("CommandSet", () => {
     expect(run).toHaveBeenCalledTimes(2);
   });
 
-  it("keeps plain keys deaf inside a form field, and chorded ones live", () => {
+  it("keeps plain keys deaf inside a form field, and leader chords live from the pane", () => {
     const plain = vi.fn();
     const chorded = vi.fn();
     const set = new CommandSet(
-      defineCommands({ "spawn.open": plain, "focus.toggle": chorded }),
+      defineCommands({ "spawn.open": plain, "focus.toggle": chorded }, DEFAULT_LEADER),
+      { leader: DEFAULT_LEADER },
     );
     const input = el("<input>");
     expect(pressOn(set, input, "n")).toBe(false);
     expect(plain).not.toHaveBeenCalled();
-    expect(pressOn(set, input, "H", { ctrlKey: true, shiftKey: true })).toBe(true);
+    // focus.toggle hangs off the leader (#166): a plain, unmodified Escape is
+    // left for the pane's shell/app instead.
+    const terminal = el('<textarea class="xterm-helper-textarea"></textarea>');
+    pressOn(set, terminal, "a", { ctrlKey: true });
+    expect(pressOn(set, terminal, "h")).toBe(true);
     expect(chorded).toHaveBeenCalledTimes(1);
   });
 
-  it("keeps pane commands live inside the terminal's textarea", () => {
-    const run = vi.fn();
-    const set = new CommandSet(defineCommands({ "pane.focusList": run }), {
-      preventDefault: false,
-    });
+  it("leaves a plain Escape for the pane instead of binding it", () => {
+    const set = new CommandSet(defineCommands({ "spawn.open": vi.fn() }));
     const textarea = el('<textarea class="xterm-helper-textarea"></textarea>');
-    const e = key("Escape");
-    Object.defineProperty(e, "target", { value: textarea });
-    expect(set.handle(e)).toBe(true);
-    expect(run).toHaveBeenCalledTimes(1);
-    // xterm is told to swallow by the return value, not by the browser default.
-    expect(e.defaultPrevented).toBe(false);
+    expect(pressOn(set, textarea, "Escape")).toBe(false);
   });
 });
 
@@ -173,6 +170,7 @@ describe("the leader", () => {
     const byId = new Map(commandSpecs("ctrl-b").map((s) => [s.id, s]));
     expect(byId.get("pane.literalCtrlK")?.keys).toEqual(["ctrl-b ctrl-k"]);
     expect(byId.get("pane.literalLeader")?.keys).toEqual(["ctrl-b ctrl-b"]);
+    expect(byId.get("focus.toggle")?.keys).toEqual(["ctrl-b h"]);
     // Commands that do not hang off the leader are untouched.
     expect(byId.get("bar.open")?.keys).toEqual(["ctrl-k"]);
   });

web/src/commands.ts

@@ -93,7 +93,8 @@ const SPECS: readonly SpecSource[] = [
     id: "focus.toggle",
     label: "Move the keyboard between the session list and the pane",
     group: "Session list",
-    keys: ["ctrl-shift-h"],
+    keys: [`${DEFAULT_LEADER} h`],
+    leaderKeys: (leader) => [`${leader} h`],
     scope: "global",
   },
   {
@@ -145,13 +146,6 @@ const SPECS: readonly SpecSource[] = [
     keys: ["tab"],
     scope: "list",
   },
-  {
-    id: "pane.focusList",
-    label: "Hand the keyboard back to the session list, from the pane",
-    group: "Session list",
-    keys: ["esc"],
-    scope: "pane",
-  },
   {
     id: "help.toggle",
     label: "Show or hide this help",

web/src/killDialog.test.ts

@@ -0,0 +1,33 @@
+// @vitest-environment happy-dom
+import { beforeEach, describe, expect, it } from "vitest";
+import {
+  closeForceKillDialog,
+  openForceKillDialog,
+  openKillConfirmDialog,
+} from "./killDialog.js";
+
+describe("kill dialogs", () => {
+  beforeEach(() => {
+    closeForceKillDialog();
+    document.body.innerHTML = "";
+  });
+
+  it("focuses the kill button, so Enter confirms", () => {
+    const el = openKillConfirmDialog({
+      name: "alpha",
+      blockers: null,
+      onKill: () => Promise.resolve(),
+    });
+    expect(document.activeElement).toBe(el.querySelector(".kill-dialog-kill"));
+  });
+
+  it("focuses the force button too", () => {
+    const el = openForceKillDialog({
+      name: "alpha",
+      blockers: null,
+      reason: "worktree is dirty.",
+      onForce: () => Promise.resolve(),
+    });
+    expect(document.activeElement).toBe(el.querySelector(".kill-dialog-force"));
+  });
+});

web/src/killDialog.ts

@@ -132,9 +132,9 @@ function mount(p: KillDialogSpec): HTMLElement {
   };
   window.addEventListener("keydown", onKeydown, true);
   open = { el, onKeydown };
-  // Cancel takes the focus in both prompts: a kill is never one keystroke
-  // away from whatever asked for the dialog.
-  cancel.focus();
+  // The acting button takes the focus in both prompts: the operator already
+  // asked for the kill, so Enter confirms it. Escape and the scrim cancel.
+  confirm.focus();
   return el;
 }
 

web/src/layout.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest";
 
 import {
   emptyLayout,
+  equalizeRatios,
   leaves,
   locateSession,
   openSessions,
@@ -44,6 +45,23 @@ describe("splitLeaf", () => {
   });
 });
 
+describe("equalizeRatios", () => {
+  it("resets nested splits to equal width, not just the newest one", () => {
+    const tab = tabWithOneLeaf("s1");
+    const first = leaves(tab.root)[0].id;
+    splitLeaf(tab, first, "s2", "row", true); // A|B, 0.5/0.5
+    const second = leaves(tab.root)[1].id;
+    splitLeaf(tab, second, "s3", "row", true); // A(0.5) | (B|C, 0.5/0.5) -> B,C at 0.25 each
+
+    equalizeRatios(tab.root);
+
+    const root = tab.root as Extract<typeof tab.root, { kind: "split" }>;
+    expect(root.ratio).toBeCloseTo(1 / 3);
+    const inner = root.b as Extract<typeof root.b, { kind: "split" }>;
+    expect(inner.ratio).toBeCloseTo(1 / 2);
+  });
+});
+
 describe("removeLeaf", () => {
   it("collapses the parent split into the surviving sibling", () => {
     const tab = tabWithOneLeaf("s1");

web/src/layout.ts

@@ -118,6 +118,17 @@ export function removeLeaf(tab: Tab, leafId: string): void {
   tab.root = tab.root ? rec(tab.root) : null;
 }
 
+/** Reset every split ratio under `node` so all leaves get equal width,
+ *  regardless of split direction or nesting order. Returns the leaf count. */
+export function equalizeRatios(node: Node | null): number {
+  if (!node) return 0;
+  if (node.kind === "leaf") return 1;
+  const na = equalizeRatios(node.a);
+  const nb = equalizeRatios(node.b);
+  node.ratio = na / (na + nb);
+  return na + nb;
+}
+
 export function addTab(layout: Layout): Tab {
   const tab: Tab = {
     id: freshId("t"),

web/src/main.ts

@@ -35,7 +35,6 @@ import { loadLayout, saveLayout } from "./persistence.js";
 import { createPreviewSchedule } from "./previewSchedule.js";
 import {
   FOCUS_PANE_EVENT,
-  FOCUS_SIDEBAR_EVENT,
   OPEN_COMMAND_BAR_EVENT,
   OPEN_SPAWN_EVENT,
   SESSION_SELECT_EVENT,
@@ -440,10 +439,11 @@ const spawnKeys = new CommandSet(
   }),
 );
 
-// Ctrl+Shift+H moves the keyboard between the session list and the pane, the
-// web counterpart of the TUI's `ctrl-w h`. It has to be a chord: an attached
-// terminal owns every plain keystroke, so nothing unmodified could ever get
-// the focus back out of it.
+// Leader-h moves the keyboard between the session list and the pane, the web
+// counterpart of the TUI's `ctrl-w h`. It has to be a chord behind the
+// leader: an attached terminal owns every plain keystroke, and Ctrl+Shift+H
+// is already claimed by the browser (history), so nothing unmodified — or
+// modified with a common browser chord — could get the focus back out of it.
 //
 // This set also owns the leader (`[tui].leader`, `ctrl-a` by default, served
 // on `/api/info`): it holds the key as a partial chord and takes select-all off
@@ -528,8 +528,8 @@ window.addEventListener(
 );
 
 
-// Tab in the session list hands the keyboard to the pane; Escape in the pane
-// hands it back — the pair the TUI gets from `tab` and `esc`.
+// Tab in the session list hands the keyboard to the pane; leader-h (focus.toggle,
+// above) hands it back the other way.
 document.addEventListener(FOCUS_PANE_EVENT, () => {
   // Handing the keyboard to a previewed pane is choosing it: the preview stops
   // being provisional rather than snapping back the moment the list blurs.
@@ -537,10 +537,6 @@ document.addEventListener(FOCUS_PANE_EVENT, () => {
   if (previewed) focusSession(previewed);
   pool.focusTerminal();
 });
-document.addEventListener(FOCUS_SIDEBAR_EVENT, () => {
-  drawer.open(); // no-op on desktop; on mobile the list is off-canvas
-  sidebar.focusList();
-});
 
 /** Open/focus a session and reflect it in the shell chrome. Shared by the
  *  hash router and the sidebar's click-driven path (#133), which can't rely

web/src/multiview.ts

@@ -10,6 +10,7 @@ import {
   activeTab,
   addTab,
   closeTab,
+  equalizeRatios,
   findLeaf,
   freshId,
   type Dir,
@@ -457,6 +458,7 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
     dropPreview();
     const tab = activeTab(layout);
     tab.focusedLeafId = splitLeaf(tab, leafId, null, dir, true);
+    equalizeRatios(tab.root);
     render();
   }
 
@@ -542,6 +544,7 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
       target.sessionId = sessionId;
     } else {
       tab.focusedLeafId = splitLeaf(tab, target.id, sessionId, "row", true);
+      equalizeRatios(tab.root);
     }
     render();
     opts.onOpenSessionsChange?.();
@@ -815,6 +818,7 @@ export function createMultiView(opts: MultiViewOptions): MultiView {
     if (source.kind === "pane" && self) removeLeaf(tab, self);
     else if (loc) removeLeaf(loc.tab, loc.leaf.id);
     tab.focusedLeafId = splitLeaf(tab, targetLeafId, sessionId, dir, after);
+    equalizeRatios(tab.root);
     render();
   }
 

web/src/types.ts

@@ -6,10 +6,7 @@ import { escapeHtml } from "./html.js";
 export type Uuid = string;
 export type IsoTimestamp = string;
 
-/** `Dormant` (#162) is a session the daemon knows only from its sidecar —
- * recovered after the tmux server died under it, so there is no pane behind it
- * and nothing to attach to. Listed, never live. */
-export type SessionStatus = "Running" | "Dead" | "Dormant";
+export type SessionStatus = "Running" | "Dead";
 
 /** Daemon-inferred activity dimension, orthogonal to `SessionStatus` (NAP-340).
  * Absent on payloads from daemons that predate the field. `Error` is only set
@@ -59,6 +56,10 @@ export interface Session {
    * how the command bar's empty query sorts a never-focused session after every
    * session that has one (`docs/COMMAND-BAR.md`). */
   last_focused_at?: IsoTimestamp | null;
+  /** The ACP session id the `claude-code-acp` adapter returned from
+   * `session/new` (#134). Only a `Structured` session whose handshake
+   * succeeded has one; a respawn passes it to `session/load` (#135). */
+  acp_session_id?: string | null;
 }
 
 /** A session's daemon-created worktree (`SessionWorktree` on the wire). */