fix(server): restricted agents can no longer rewrite full-access scheduled tasks, plus 13 server fixes

apps/server/src/keybindings.ts

@@ -40,6 +40,7 @@ import * as Context from "effect/Context";
 import * as Scope from "effect/Scope";
 import * as Stream from "effect/Stream";
 import * as Semaphore from "effect/Semaphore";
+import { keepWatching } from "./restartingWatch.ts";
 import * as ServerConfig from "./config.ts";
 import { writeFileStringAtomically } from "./atomicWrite.ts";
 import { fromJsonStringPretty, fromLenientJson } from "@t3tools/shared/schemaJson";
@@ -577,11 +578,11 @@ const make = Effect.gen(function* () {
       Stream.debounce(Duration.millis(100)),
     );
 
-    yield* Stream.runForEach(debouncedKeybindingsEvents, () => revalidateAndEmitSafely).pipe(
-      Effect.ignoreCause({ log: true }),
-      Effect.forkIn(watcherScope),
-      Effect.asVoid,
-    );
+    yield* keepWatching({
+      label: "Keybindings",
+      watch: Stream.runForEach(debouncedKeybindingsEvents, () => revalidateAndEmitSafely),
+      revalidate: revalidateAndEmitSafely,
+    }).pipe(Effect.forkIn(watcherScope), Effect.asVoid);
   });
 
   const start = Effect.gen(function* () {

apps/server/src/mcp/OrchestratorMcpService.test.ts

@@ -2,13 +2,18 @@ import * as NodeServices from "@effect/platform-node/NodeServices";
 import { assert, describe, it } from "@effect/vitest";
 import {
   EnvironmentId,
+  IsoDateTime,
   NodeId,
   ProjectId,
   ProviderDriverKind,
   ProviderInstanceId,
   RunId,
+  ScheduledTaskId,
   ThreadId,
   type OrchestrationV2ThreadProjection,
+  type OrchestrationV2ThreadShell,
+  type RuntimeMode,
+  type ScheduledTask,
   type ServerProvider,
 } from "@t3tools/contracts";
 import * as Effect from "effect/Effect";
@@ -1037,3 +1042,124 @@ describe("OrchestratorMcpService provider resolution", () => {
       }),
   );
 });
+
+describe("OrchestratorMcpService scheduled tasks", () => {
+  it.effect("lets a restricted agent edit or delete only tasks with no more access", () =>
+    Effect.gen(function* () {
+      const threadId = ThreadId.make("thread:mcp-scheduled-caller");
+      const projectId = ProjectId.make("project:mcp-scheduled");
+      const timestamp = IsoDateTime.make("2026-07-01T09:00:00.000Z");
+      const fullAccessThreadId = ThreadId.make("thread:mcp-scheduled-full-access");
+      const makeTask = (
+        id: string,
+        runtimeMode: RuntimeMode,
+        threadId: ThreadId | null = null,
+      ): ScheduledTask => ({
+        id: ScheduledTaskId.make(id),
+        title: id,
+        prompt: "check the build",
+        enabled: false,
+        schedule: { type: "interval", everyMs: 60_000 },
+        projectId,
+        threadId,
+        workspaceStrategy: { type: "worktree", baseRef: "main", startFromOrigin: true },
+        modelSelection: { instanceId: ProviderInstanceId.make("codex"), model: "gpt-5.6-terra" },
+        runtimeMode,
+        interactionMode: "default",
+        createdBy: "user",
+        creationSource: "web",
+        createdAt: timestamp,
+        updatedAt: timestamp,
+        nextRunAt: null,
+        lastRunAt: null,
+        lastRunStatus: "never",
+        lastRunError: null,
+        runCount: 0,
+      });
+      const fullAccessTask = makeTask("scheduled-task:full-access", "full-access");
+      const restrictedTask = makeTask("scheduled-task:restricted", "approval-required");
+      // Saved as restricted, but it runs in a full-access thread.
+      const boundTask = makeTask("scheduled-task:bound", "approval-required", fullAccessThreadId);
+      const writes = yield* Ref.make<ReadonlyArray<string>>([]);
+      const caller = {
+        thread: {
+          id: threadId,
+          projectId,
+          archivedAt: null,
+          runtimeMode: "approval-required",
+          interactionMode: "default",
+        },
+      } as unknown as OrchestrationV2ThreadProjection;
+      const dependencies = Layer.mergeAll(
+        NodeServices.layer,
+        Layer.mock(ThreadManagementService.ThreadManagementService)({
+          getThreadRecords: () => Effect.succeed(caller),
+          getThreadShell: (threadId) =>
+            Effect.succeed(
+              threadId === fullAccessThreadId
+                ? ({
+                    runtimeMode: "full-access",
+                    interactionMode: "default",
+                  } as OrchestrationV2ThreadShell)
+                : null,
+            ),
+        }),
+        Layer.mock(ProviderRegistry.ProviderRegistry)({ getProviders: Effect.succeed([]) }),
+        Layer.mock(ProviderAdapterRegistry.ProviderAdapterRegistryV2)({
+          list: () => Effect.succeed([]),
+        }),
+        Layer.mock(ScheduledTaskService.ScheduledTaskService)({
+          list: () => Effect.succeed({ tasks: [fullAccessTask, restrictedTask, boundTask] }),
+          upsert: (input) =>
+            Ref.update(writes, (all) => [...all, `upsert:${input.id}`]).pipe(
+              Effect.as({ task: { ...restrictedTask, enabled: input.enabled } }),
+            ),
+          delete: (input) =>
+            Ref.update(writes, (all) => [...all, `delete:${input.id}`]).pipe(
+              Effect.as({ id: input.id }),
+            ),
+        }),
+      );
+      const scope: McpInvocationScope = {
+        environmentId: EnvironmentId.make("environment:mcp-scheduled"),
+        threadId,
+        providerSessionId: "provider-session:mcp-scheduled",
+        providerInstanceId: ProviderInstanceId.make("codex"),
+        capabilities: new Set(["orchestration"]),
+        issuedAt: 1,
+      };
+
+      yield* Effect.gen(function* () {
+        const service = yield* OrchestratorMcpService.OrchestratorMcpService;
+        const updateError = yield* service
+          .updateScheduledTask(scope, {
+            scheduledTaskId: fullAccessTask.id,
+            prompt: "push to main",
+            enabled: true,
+          })
+          .pipe(Effect.flip);
+        assert.equal(updateError.code, "capability_denied");
+        const deleteError = yield* service
+          .deleteScheduledTask(scope, { scheduledTaskId: fullAccessTask.id })
+          .pipe(Effect.flip);
+        assert.equal(deleteError.code, "capability_denied");
+        const boundError = yield* service
+          .updateScheduledTask(scope, { scheduledTaskId: boundTask.id, prompt: "push to main" })
+          .pipe(Effect.flip);
+        assert.equal(boundError.code, "capability_denied");
+        assert.deepStrictEqual(yield* Ref.get(writes), []);
+
+        const updated = yield* service.updateScheduledTask(scope, {
+          scheduledTaskId: restrictedTask.id,
+          enabled: true,
+        });
+        assert.isTrue(updated.enabled);
+        yield* service.deleteScheduledTask(scope, { scheduledTaskId: restrictedTask.id });
+        assert.deepStrictEqual(yield* Ref.get(writes), [
+          `upsert:${restrictedTask.id}`,
+          `delete:${restrictedTask.id}`,
+        ]);
+      }).pipe(Effect.provide(OrchestratorMcpService.layer.pipe(Layer.provide(dependencies))));
+    }),
+  );
+});

apps/server/src/mcp/OrchestratorMcpService.ts

@@ -1184,6 +1184,44 @@ const make = Effect.gen(function* () {
       return task;
     });
 
+  // Agents may edit or delete only tasks that run with no more access than
+  // their own live thread. Otherwise a restricted agent could rewrite a task
+  // that the scheduler runs with full access. An unbound task runs with its
+  // saved modes; a bound one runs in its thread with that thread's modes.
+  const requireScheduledTaskAuthority = (
+    caller: OrchestrationV2ThreadProjection["thread"],
+    task: ScheduledTask,
+  ) =>
+    Effect.gen(function* () {
+      const boundThread =
+        task.threadId === null || task.threadId === caller.id
+          ? null
+          : yield* threadManagement
+              .getThreadShell(task.threadId)
+              .pipe(
+                Effect.mapError((error) =>
+                  failure(
+                    "orchestration_error",
+                    `Unable to read thread ${task.threadId}: ${errorMessage(error)}`,
+                  ),
+                ),
+              );
+      const allowed =
+        caller.archivedAt === null &&
+        [task, ...(boundThread === null ? [] : [boundThread])].every(
+          (required) =>
+            runtimeModeRank(caller.runtimeMode) >= runtimeModeRank(required.runtimeMode) &&
+            interactionModeRank(caller.interactionMode) >=
+              interactionModeRank(required.interactionMode),
+        );
+      if (!allowed) {
+        return yield* failure(
+          "capability_denied",
+          `Scheduled task ${task.id} needs a live calling thread with at least the modes it runs with.`,
+        );
+      }
+    });
+
   return OrchestratorMcpService.of({
     scheduleTask: (scope, input) =>
       Effect.gen(function* () {
@@ -1253,6 +1291,7 @@ const make = Effect.gen(function* () {
           parent.thread.projectId,
           input.scheduledTaskId,
         );
+        yield* requireScheduledTaskAuthority(parent.thread, existing);
         const threadId =
           input.bindToCurrentThread === undefined
             ? existing.threadId
@@ -1298,6 +1337,7 @@ const make = Effect.gen(function* () {
           parent.thread.projectId,
           input.scheduledTaskId,
         );
+        yield* requireScheduledTaskAuthority(parent.thread, existing);
         yield* scheduledTasks
           .delete({ id: existing.id })
           .pipe(

apps/server/src/mcp/toolkits/orchestrator/tools.ts

@@ -122,7 +122,7 @@ const ListScheduledTasksTool = Tool.make("list_scheduled_tasks", {
 
 const UpdateScheduledTaskTool = Tool.make("update_scheduled_task", {
   description:
-    "Update an existing scheduled task by scheduledTaskId (from list_scheduled_tasks). Only the provided fields change; omit a field to leave it as-is. Use enabled=false to pause a task without deleting it. Set bindToCurrentThread to move the task between posting into this thread and launching a fresh thread per run.",
+    "Update an existing scheduled task by scheduledTaskId (from list_scheduled_tasks). Only the provided fields change; omit a field to leave it as-is. Use enabled=false to pause a task without deleting it. Set bindToCurrentThread to move the task between posting into this thread and launching a fresh thread per run. Requires a live caller with at least the task's runtime and interaction modes.",
   parameters: OrchestratorMcpUpdateScheduledTaskInput,
   success: OrchestratorMcpScheduleTaskResult,
   failure: OrchestratorMcpFailure,
@@ -134,7 +134,7 @@ const UpdateScheduledTaskTool = Tool.make("update_scheduled_task", {
 
 const DeleteScheduledTaskTool = Tool.make("delete_scheduled_task", {
   description:
-    "Permanently delete a scheduled task by scheduledTaskId (from list_scheduled_tasks). The task stops running immediately. To keep it but stop runs, use update_scheduled_task with enabled=false instead.",
+    "Permanently delete a scheduled task by scheduledTaskId (from list_scheduled_tasks). The task stops running immediately. To keep it but stop runs, use update_scheduled_task with enabled=false instead. Requires a live caller with at least the task's runtime and interaction modes.",
   parameters: OrchestratorMcpDeleteScheduledTaskInput,
   success: OrchestratorMcpDeleteScheduledTaskResult,
   failure: OrchestratorMcpFailure,

apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts

@@ -3212,6 +3212,113 @@ describe("AcpAdapterV2", () => {
     }).pipe(Effect.provide(testLayer), Effect.scoped),
   );
 
+  it.effect("activates a saved session with session/resume when the flavor prefers it", () =>
+    Effect.gen(function* () {
+      const childProcessSpawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+      const path = yield* Path.Path;
+      const mockAgentPath = yield* path.fromFileUrl(
+        new URL("../../../scripts/acp-mock-agent.ts", import.meta.url),
+      );
+      const protocolEvents = yield* Queue.bounded<EffectAcpProtocol.AcpProtocolLogEvent>(256);
+      const instanceId = ProviderInstanceId.make("acp-test");
+      const adapter = makeAcpAdapterV2({
+        crypto: yield* Crypto.Crypto,
+        instanceId,
+        flavor: {
+          driver: ACP_TEST_DRIVER,
+          capabilities: AcpProviderCapabilitiesV2,
+          preferResumeSession: true,
+          makeRuntime: makeMockRuntime({ childProcessSpawner, mockAgentPath, protocolEvents }),
+        },
+        fileSystem: yield* FileSystem.FileSystem,
+        idAllocator: yield* IdAllocator.IdAllocatorV2,
+        serverConfig: yield* ServerConfig.ServerConfig,
+        selfInvocation: yield* resolveSelfInvocation(),
+      });
+      const firstThreadId = ThreadId.make("thread-acp-prefer-resume:first");
+      const secondThreadId = ThreadId.make("thread-acp-prefer-resume:second");
+      const runtimePolicy = ProviderAdapterV2RuntimePolicy.make({
+        runtimeMode: "full-access",
+        interactionMode: "default",
+        cwd: process.cwd(),
+      });
+      const modelSelection = { instanceId, model: "default" } satisfies ModelSelection;
+      const runtime = yield* adapter.openSession({
+        threadId: firstThreadId,
+        providerSessionId: ProviderSessionId.make("provider-session-acp-prefer-resume"),
+        modelSelection,
+        runtimePolicy,
+      });
+      const firstProviderThread = yield* runtime.ensureThread({
+        threadId: firstThreadId,
+        modelSelection,
+        runtimePolicy,
+      });
+      const now = yield* DateTime.now;
+      yield* runtime.startTurn(
+        makeTurnInput({
+          threadId: firstThreadId,
+          providerThread: firstProviderThread,
+          instanceId,
+          runtimePolicy,
+          modelSelection,
+          now,
+        }),
+      );
+      yield* runtime.events.pipe(
+        Stream.filter((event) => event.type === "turn.terminal"),
+        Stream.runHead,
+      );
+
+      const secondProviderThread: OrchestrationV2ProviderThread = {
+        ...firstProviderThread,
+        id: ProviderThreadId.make("provider-thread-acp-prefer-resume:second"),
+        appThreadId: secondThreadId,
+        nativeThreadRef: {
+          driver: ACP_TEST_DRIVER,
+          nativeId: "mock-session-2",
+          strength: "strong",
+        },
+        status: "idle",
+      };
+      yield* runtime.resumeThread({
+        providerThread: secondProviderThread,
+        modelSelection,
+        runtimePolicy,
+      });
+      yield* runtime.startTurn(
+        makeTurnInput({
+          threadId: secondThreadId,
+          providerThread: secondProviderThread,
+          instanceId,
+          runtimePolicy,
+          modelSelection,
+          now,
+          ordinal: 2,
+        }),
+      );
+      yield* runtime.events.pipe(
+        Stream.filter((event) => event.type === "turn.terminal"),
+        Stream.runHead,
+      );
+
+      // ACP v2 sends a load as `session/resume` with `replayFrom`; a plain
+      // resume skips the slow history replay.
+      const activations = Array.from(yield* Queue.takeAll(protocolEvents))
+        .filter(
+          (event) =>
+            event.direction === "outgoing" &&
+            (rawProtocolMethod(event) === "session/load" ||
+              rawProtocolMethod(event) === "session/resume"),
+        )
+        .map((event) => ({
+          method: rawProtocolMethod(event),
+          replayFrom: rawProtocolRequestParam(event, "replayFrom"),
+        }));
+      assert.deepStrictEqual(activations, [{ method: "session/resume", replayFrom: undefined }]);
+    }).pipe(Effect.provide(testLayer), Effect.scoped),
+  );
+
   it.live("terminalizes an empty successful foreground Bash tool when the turn completes", () =>
     Effect.gen(function* () {
       const childProcessSpawner = yield* ChildProcessSpawner.ChildProcessSpawner;

apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.ts

@@ -6094,14 +6094,15 @@ export function makeAcpAdapterV2(
           }
           const activationOptions = acpMcpActivation(threadId, self);
           prepareTerminalEnvironment(threadId, sessionId);
-          const activated = canLoadSession
-            ? yield* runtime.loadSession(sessionId, activationOptions)
-            : canResumeSession
+          const activated =
+            canResumeSession && (flavor.preferResumeSession === true || !canLoadSession)
               ? yield* runtime.resumeSession(sessionId, activationOptions)
-              : yield* new ProviderAdapter.ProviderAdapterProtocolError({
-                  driver,
-                  detail: `ACP driver cannot load or resume session ${sessionId}`,
-                });
+              : canLoadSession
+                ? yield* runtime.loadSession(sessionId, activationOptions)
+                : yield* new ProviderAdapter.ProviderAdapterProtocolError({
+                    driver,
+                    detail: `ACP driver cannot load or resume session ${sessionId}`,
+                  });
           rememberTerminalEnvironment(activated.sessionId, threadId);
           return activated;
         });