#29003 acpmux: _acpmux/queue_get reads a held prompt whole for the owner (carries #26855)

Carry of #26855 (its owner session is gone). The two commits are cherry-picked from it with their authorship kept. Until #28859 lands, the commits below the last two are #28859's.

Leo (2026-10-28), on T3 Code's "Share with guest": "we want to be having, be able to do this kind of flow for CMux multiplayer ... we can work on the agent chat multiplayer." In that flow each message a guest sends waits for the owner, who approves or declines it. Before approving, the owner's pane needs the whole prompt: its words, its images and files, and the revision the approval names. This PR adds that read. Plan: manaflow-ai/cmuxterm-hq#4766.

What it does

• New method. _acpmux/queue_get {sessionId, promptId} returns {sessionId, promptId, turnId, revision, text, prompt, inlineParts, author, provenance, awaitingOwner} for a prompt that is still in the queue:
  • prompt is the full content blocks as the prompt would run now, including the author's edits: images with their data, resource links, audio and files.
  • revision is the value _acpmux/queue_approve expects.
• Once the prompt has left the queue (approved and run, declined or removed): queue.not_found (-32002), with data.decided set the same way queue_approve sets it.
• Caller rules, the same as queue_approve: owner only (a caller with an author gets queue.owner_only); a Web caller has to pass the Web-control check; the Full-access hold applies.
• Peer forwarding: forwarded only to a peer that lists the new feature queueGet, on the link that listed it (Peer::lists_on). Otherwise queue.approval_unsupported and nothing is forwarded.
• New capability: queue-get-v1. initialize advertises it outside its json! (the macro's recursion limit).
• Updated: docs/acpmux-schema.json, the README method list, spec/acpmux-protocol.json, and the regenerated TS types.
• What a peer gets: the prompt unmasked, matching the queued and queue_updated records peers already receive.

Risk

risk:low. A new read-only method behind the same checks as queue_approve. Nothing that exists changes behavior.

Tests

• hub_integration prompt_approval::the_owner_reads_a_held_prompt_whole_at_its_revision: after the guest edits a held prompt with an image and a file link, queue_get returns the new text, the kept blocks, revision 1, author and provenance; a caller with an author gets queue.owner_only; after a decline, queue.not_found with decided: "declined".
• peer_queue_approval: a peer without queueApproval refuses get/approve/decline; a peer listing queueApproval but not queueGet refuses get and nothing is forwarded; a peer listing queueGet is forwarded the get.

Changelog

none

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds _acpmux/queue_get, a read-only method that lets a chat's owner read a held guest's prompt in full before approving it. Carry of #26855 (its owner session is gone); holds until #28859 merges.

In the Share-with-guest flow, each guest message waits for the owner to approve or decline it. Before approving, the owner needs the whole prompt — its words, images, files, and the revision the approval names. _acpmux/queue_get {sessionId, promptId} returns the full prompt exactly as it would run now, with images named by their sources.

• Returns {promptId, turnId, revision, text, prompt, inlineParts, author, provenance, awaitingOwner}; once the prompt left the queue it returns queue.not_found with decided set as queue_approve sets it.
• Same caller rules as queue_approve: owner only (queue.owner_only), the Web-control check, the Full-access hold.
• Forwarded only to a peer that lists the new queueGet feature, on the link that listed it; otherwise queue.approval_unsupported.
• New capability queue-get-v1; initialize advertises it outside its json! (the macro's recursion limit), and docs, schema, README, and generated TS types are updated.
• Tests cover reading a guest-edited prompt with an image and file link, owner-only refusal, post-decline decided, and feature-gated peer forwarding.

Risk: low. New read-only method behind the same checks as queue_approve; nothing existing changes behavior.