@agentclientprotocol/claude-agent-acp 0.89.2-preview.2 → 0.89.2-preview.21

package/dist/acp-agent.js

@@ -1,9 +1,9 @@
 import { agent as acpAgent, CreateElicitationResponse, methods, ndJsonStream, RequestError, } from "@agentclientprotocol/sdk";
-import { getSessionMessages, getSubagentMessages, listSessions, query, } from "@anthropic-ai/claude-agent-sdk";
+import { filterEscalatingDefaultMode, getSessionMessages, listSessions, query, resolveSettings, } from "@anthropic-ai/claude-agent-sdk";
 import { GOAL_ACTIONS, GOAL_CONTROL_METHOD, GOAL_EXTENSION_VERSION, goalUpdateFromPrompt, parseGoalRequest, toGoalSnapshot, } from "./goal-extension.js";
 import { sanitizeTitle, SessionTitles } from "./session-titles.js";
-import { AIR_NATIVE_SUBAGENT_SESSIONS_CAPABILITY, asSdkSessionNotification, clientSupportsSubagents, } from "./acp-subagents.js";
-import { isNativeSubagentControlTool, isNativeSubagentControlUpdate, NativeSubagentRuntime, nativeSubagentState, resumedNativeSubagentId, sendMessageResumePrompt, } from "./native-subagents.js";
+import { AIR_NATIVE_SUBAGENT_SESSIONS_CAPABILITY, asSdkSessionNotification, clientSupportsSubagents, subagentForm, } from "./acp-subagents.js";
+import { isNativeSubagentControlTool, isNativeSubagentControlUpdate, NativeSubagentRuntime, nativeSubagentState, resumedNativeSubagentId, sendMessageResume, sendMessageResumePrompt, } from "./native-subagents.js";
 import { AIR_ASYNC_TASKS_CAPABILITY, AIR_CUSTOM_INSTRUCTIONS_CAPABILITY, airCustomInstructions, AIR_DIFF_PATCH_CAPABILITY, AIR_PLAN_FILE_CAPABILITY, AIR_GOAL_KEY, AIR_KIND_KEY, AIR_RECOMMENDED_CONFIG_VALUE_CAPABILITY, AIR_SKILL_PATH_KEY, clientSupportsAirCapability, withAirMeta, } from "./air-extension.js";
 import * as sessionIndex from "./session-index/connection.js";
 import { AsyncTaskRuntime, backgroundBashTaskFromToolResult, backgroundedBashToolCallIds, clientSupportsAsyncTasks, } from "./async-tasks.js";
@@ -16,7 +16,8 @@ import { promisify } from "node:util";
 import packageJson from "../package.json" with { type: "json" };
 import { applyAskElicitationResponse, askUserQuestionsToCreateRequest, createElicitationResponseToElicitResult, extractAskUserQuestions, extractRefusalFallbackPrompt, mcpElicitationToCreateRequest, REFUSAL_FALLBACK_DIALOG_KIND, refusalFallbackResultFromResponse, refusalFallbackToCreateRequest, } from "./elicitation.js";
 import { forkSession } from "./fork-session.js";
-import { subagentHistory } from "./subagent-history.js";
+import { readSubagentMessages, subagentHistory } from "./subagent-history.js";
+import { RfdSubagentReplay, replaySubagentTerminalState, } from "./subagent-replay.js";
 import { readResumedSession, readResumedTail, } from "./resumed-session.js";
 import { SessionTiming } from "./session-timing.js";
 import { ALLOW_BYPASS } from "./permissions/modes.js";
@@ -32,14 +33,14 @@ import { ContextCompactionLifecycle, clientSupportsCompactionUpdates, contextCom
 import { clientSupportsNotices, MAX_NOTICE_TITLE_LENGTH, normalizeNoticeText, noticeOrTranscriptUpdate, sentenceCase, splitNoticeText, } from "./session-notices.js";
 import { applyTaskCreate, applyTaskList, applyTaskUpdate, clearHookCallbacks, completeHookCallback, createPostToolUseHook, hasHookCallback, createTaskHook, parseTaskCreateOutput, parseTaskListOutput, parseTaskUpdateOutput, planEntries, registerHookCallback, changedTaskPlanEntries, forgetPublishedTaskPlan, unregisterHookCallback, } from "./tools.js";
 import { previewPatchContent } from "./diff.js";
-import { backgroundedBashToolCall } from "./tool-calls/background.js";
+import { backgroundedBashToolCall, withRunningTerminal } from "./tool-calls/background.js";
 import { ChangedMetaFilter } from "./tool-calls/changed-meta-filter.js";
 import { ToolCallFieldTracker } from "./tool-calls/field-tracker.js";
 import { ClientCapabilities as ToolCallClientCapabilities } from "./tool-calls/client-capabilities.js";
 import { AcpToolCallRenderer, isFinalToolCallStatus, } from "./tool-calls/renderer.js";
 import { resolveSkillPath } from "./tool-calls/reporters/interaction.js";
 import { messageLoopYielder, nodeToWebReadable, nodeToWebWritable, Pushable, raceTimeoutAndAbort, unreachable, } from "./utils.js";
-import { acceptedPlanToolResult, ExitPlanCoordinator, isExitPlanInterruptionResult, observeExitPlanToolResults, } from "./exit-plan.js";
+import { acceptedPlanToolResult, approvedPlan, ExitPlanCoordinator, isExitPlanInterruptionResult, observeExitPlanToolResults, planModeUpdate, } from "./exit-plan.js";
 import { DEFAULT_AGENT_ID } from "./session-config-ids.js";
 import { parseToolResultMeta } from "./tool-result-meta.js";
 import { formatUsageResponse, isUsageCommandText, parseUsageResponse } from "./usage-markdown.js";
@@ -280,6 +281,10 @@ const AUTONOMOUS_RESULT_ORIGINS = new Set([
     "observer",
     "observer-activity",
 ]);
+/** The foreground work of a session (see ForegroundEvents): a prompt's turn,
+ *  or a model cycle that Claude Code started on its own. At most one cycle
+ *  runs at a time, so a constant names it. */
+const AUTONOMOUS_CYCLE = "autonomous-cycle";
 /** Whether this turn's terminal result arrived but its settlement is being
  *  held for background subagents it spawned (see Turn.deferredSettle). The
  *  single spelling of the hold predicate, shared by the consumer's settle
@@ -544,28 +549,6 @@ function subagentLaunchIds(content) {
         ? [block.id]
         : []);
 }
-function replaySubagentTerminalState(block) {
-    if (block.is_error !== true)
-        return "completed";
-    const text = replayContentText(block.content).toLowerCase();
-    return /\b(?:cancelled|canceled|interrupted|stopped|killed)\b/.test(text)
-        ? "cancelled"
-        : "failed";
-}
-function replayContentText(value, seen = new Set()) {
-    if (typeof value === "string")
-        return value;
-    if (typeof value !== "object" || value === null || seen.has(value))
-        return "";
-    seen.add(value);
-    if (Array.isArray(value))
-        return value.map((item) => replayContentText(item, seen)).join(" ");
-    const record = value;
-    return [record.text, record.content, record.message]
-        .map((item) => replayContentText(item, seen))
-        .filter(Boolean)
-        .join(" ");
-}
 function stripSubagentTextAndThinking(content) {
     if (!Array.isArray(content))
         return content;
@@ -1168,6 +1151,8 @@ export class ClaudeAcpAgent {
     /** Last auth identity reported to the client, connection-scoped like
      *  `authenticate`/`logout`. Undefined means "not determined yet". */
     currentAuthStatus;
+    authStatusSettings;
+    authStatusHelper;
     /** In-flight `claude auth status --json` probe, shared by every caller so
      *  a concurrent `initialize` and start-of-prompt read never spawn two CLI
      *  processes. */
@@ -1194,6 +1179,15 @@ export class ClaudeAcpAgent {
      * express: see {@link ToolCallClientCapabilities.v2}.
      */
     v2;
+    /** See the `foreground` constructor option. */
+    foregroundEvents;
+    /**
+     * The foreground work of each session while it runs, by the session id that
+     * the client knows. A clear-context restart replaces the Claude Code session
+     * behind that id and moves the running turn to it, so the work belongs to the
+     * id, not to a {@link Session}.
+     */
+    foregroundWork = new Map();
     /** The session index (docs/air-extensions.md, "Session index"). */
     sessionIndex = new sessionIndex.SessionIndexConnection({
         agent: this,
@@ -1203,6 +1197,7 @@ export class ClaudeAcpAgent {
     });
     constructor(client, logger, options = {}) {
         this.v2 = options.v2 ?? false;
+        this.foregroundEvents = options.foreground;
         this.sessions = {};
         this.client = new ChangedMetaClient(client, () => this.toolCallCapabilities.air.client);
         this.logger = logger ?? console;
@@ -1218,6 +1213,7 @@ export class ClaudeAcpAgent {
             },
             applyFastMode: (session, enabled) => this.applyFastMode(session, enabled),
             sessionUpdate: (notification) => this.client.sessionUpdate(notification),
+            supportsPlanOperations: () => this.clientCapabilities?.plan != null,
             ensureConsumer: (session, id) => this.ensureConsumer(session, id),
             logError: (message, error) => this.logger.error(message, error),
             destroyReplacement: (id, session) => {
@@ -1364,6 +1360,8 @@ export class ClaudeAcpAgent {
                 terminalAuthMethods.push(consoleLoginMethod);
             }
         }
+        // The subagents RFD has only the client capability. AIR's draft also had
+        // this agent capability, which AIR gets (`docs/air-extensions.md`).
         const sessionCapabilities = {
             additionalDirectories: {},
             close: {},
@@ -1371,7 +1369,7 @@ export class ClaudeAcpAgent {
             fork: {},
             list: {},
             resume: {},
-            subagents: {},
+            ...(this.toolCallCapabilities.air.client ? { subagents: {} } : {}),
         };
         return {
             protocolVersion: 1,
@@ -1492,14 +1490,30 @@ export class ClaudeAcpAgent {
             configOptions: response.configOptions,
         };
     }
+    /**
+     * Copies the session's transcript into a new session, then starts that
+     * session, so the client can prompt it as soon as the response arrives, as
+     * the schema requires of a fork. It starts like a resumed session: from the
+     * copied transcript, with the model and the permission mode it records. A
+     * later load or resume with the same settings reuses it.
+     */
     async unstable_forkSession(params) {
         if (this.providerUpdate)
             await this.providerUpdate;
-        return forkSession(params, {
+        const { sessionId } = await forkSession(params, {
             liveMessageIdToUuid: this.sessions[params.sessionId]?.messageIdToUuid,
             logger: this.logger,
             messageIdForGrouping,
         });
+        const { modes, configOptions } = await this.getOrCreateSession({
+            sessionId,
+            cwd: params.cwd,
+            mcpServers: params.mcpServers,
+            additionalDirectories: params.additionalDirectories,
+            _meta: params._meta,
+        });
+        this.afterSetupResponse(sessionId, params.mcpServers ?? []);
+        return { sessionId, modes, configOptions };
     }
     async resumeSession(params) {
         if (this.providerUpdate)
@@ -1668,7 +1682,22 @@ export class ClaudeAcpAgent {
      * under an apiKeyHelper) means "nothing to add", not "logged out" — keep
      * what the CLI probe already established instead of overwriting it.
      */
-    publishSessionAccountIdentity(account) {
+    useAuthStatusSettings(manager, settingsOverride, launchEnv) {
+        const helper = manager.getApiKeyHelper(settingsOverride);
+        const changed = manager.getCwd() !== (this.authStatusSettings?.manager.getCwd() ?? process.cwd()) ||
+            helper !== this.authStatusHelper ||
+            JSON.stringify(launchEnv) !== JSON.stringify(this.authStatusSettings?.env);
+        this.authStatusSettings = { manager, override: settingsOverride, env: launchEnv };
+        this.authStatusHelper = helper;
+        if (changed) {
+            // The epoch bump discards any probe that read the old context, and the
+            // session account may carry no identity signal (an apiKeyHelper), so
+            // only a probe in the new context can classify it.
+            this.authEpoch += 1;
+            void this.probeCliAuthStatus({ fresh: true });
+        }
+    }
+    publishSessionAccountIdentity(account, apiKeyHelper) {
         if (this.providerConfig) {
             if (!this.loggedOverriddenAccount) {
                 this.loggedOverriddenAccount = true;
@@ -1679,7 +1708,7 @@ export class ClaudeAcpAgent {
         if (this.gatewayAuthRequest) {
             return;
         }
-        const fromSession = fromAccountInfo(account);
+        const fromSession = fromAccountInfo(account, apiKeyHelper);
         if (fromSession) {
             this.setAuthStatus(fromSession);
         }
@@ -1712,6 +1741,8 @@ export class ClaudeAcpAgent {
         // auth-affecting event describes a world that no longer exists. Remember
         // which one this read belongs to and drop the answer if it moved on.
         const epoch = this.authEpoch;
+        const context = this.authStatusSettings;
+        const apiKeyHelper = context?.manager.getApiKeyHelper(context.override);
         // ACP gateway auth bypasses the CLI credential store entirely, so the
         // probe would report an identity that is not the one being used. A mere
         // client provider override (`providers/set`) does NOT skip the probe: it
@@ -1723,8 +1754,13 @@ export class ClaudeAcpAgent {
         let stdout;
         try {
             const cliPath = await claudeCliPath();
-            ({ stdout } = await execFileAsync(cliPath, ["auth", "status", "--json"], {
+            const args = ["auth", "status", "--json"];
+            if (context?.override)
+                args.push("--settings", JSON.stringify(context.override));
+            ({ stdout } = await execFileAsync(cliPath, args, {
                 timeout: AUTH_STATUS_PROBE_TIMEOUT_MS,
+                cwd: context?.manager.getCwd() ?? process.cwd(),
+                env: context?.env ? { ...process.env, ...context.env } : process.env,
             }));
         }
         catch (error) {
@@ -1747,7 +1783,16 @@ export class ClaudeAcpAgent {
             }
             stdout = failed.stdout;
         }
-        const status = fromCliStatus(stdout);
+        let status = fromCliStatus(stdout, apiKeyHelper);
+        if (!context && status?.kind === "api_key" && status.detail === "API key helper") {
+            try {
+                const resolved = await resolveSettings({ cwd: process.cwd() });
+                status = fromCliStatus(stdout, filterEscalatingDefaultMode(resolved).apiKeyHelper);
+            }
+            catch {
+                this.logger.error("Could not resolve auth source settings");
+            }
+        }
         if (!status) {
             this.logger.error("claude auth status returned unparseable output");
             return undefined;
@@ -1987,13 +2032,7 @@ export class ClaudeAcpAgent {
     async prompt(params) {
         let events;
         const outcome = new Promise((resolve, reject) => {
-            events = {
-                inserted() { },
-                awaitingUser() { },
-                resumed() { },
-                ended: resolve,
-                failed: reject,
-            };
+            events = { inserted() { }, ended: resolve, failed: reject };
         });
         await this.startTurn(params, events);
         return outcome;
@@ -2019,6 +2058,7 @@ export class ClaudeAcpAgent {
         // that finds the new credential must not be the one the refusal skipped.
         // The guard itself consumes the result only at the next turn boundary (see
         // `markSessionsWhoseAccountKindChanged`).
+        this.useAuthStatusSettings(session.settingsManager, session.effortSettingsOverride, session.creationParams?._meta?.claudeCode?.options?.env);
         void this.probeCliAuthStatus();
         const signOutRespawn = this.respawnSignedOutSession(params.sessionId, session);
         if (signOutRespawn)
@@ -2066,10 +2106,12 @@ export class ClaudeAcpAgent {
                 completeTurn = resolve;
             }),
             resolve: (outcome) => {
+                this.endForeground(params.sessionId, turn, { outcome });
                 events.ended(outcome);
                 completeTurn();
             },
             reject: (error) => {
+                this.endForeground(params.sessionId, turn, { error });
                 events.failed(error);
                 completeTurn();
             },
@@ -2235,7 +2277,7 @@ export class ClaudeAcpAgent {
             logger: this.logger,
             // The guard reads the account anyway; reuse that read to keep the
             // reported identity current, refusal or not.
-            onAccount: (account) => this.publishSessionAccountIdentity(account),
+            onAccount: (account) => this.publishSessionAccountIdentity(account, session.settingsManager.getApiKeyHelper(session.effortSettingsOverride)),
         });
     }
     async goal(params) {
@@ -2387,7 +2429,7 @@ export class ClaudeAcpAgent {
         // Deliver into the running turn rather than queuing behind it as a fresh
         // prompt would.
         userMessage.priority =
-            (session.pendingUserInputCount ?? 0) > 0 ? STEER_PRIORITY_LATER : STEER_PRIORITY_NOW;
+            (session.openUserInputs?.size ?? 0) > 0 ? STEER_PRIORITY_LATER : STEER_PRIORITY_NOW;
         // Mark before the push and in the same synchronous section as the in-flight
         // check: the interrupt can have the CLI finalizing the aborted cycle by the
         // time the consumer next runs, and an unmarked result would settle the turn
@@ -2400,6 +2442,8 @@ export class ClaudeAcpAgent {
         if (turnInFlight.deferredSettle !== undefined) {
             turnInFlight.steeredSettle = turnInFlight.deferredSettle;
             turnInFlight.deferredSettle = undefined;
+            // The held turn's work had ended at its result; the steer resumes it.
+            this.startForeground(sessionId, turnInFlight);
         }
         session.input.push(userMessage);
         const firstText = params.prompt[0]?.type === "text" ? params.prompt[0].text : "";
@@ -2488,6 +2532,10 @@ export class ClaudeAcpAgent {
                 streamedBlocksByParent.set(key, (blocks = []));
             return blocks;
         };
+        // The streams, keyed like streamedBlocksByParent, that dropped a delta
+        // after a cancel since their record last reset, so the record no longer
+        // matches what the client got (see the stream_event case).
+        const droppedStreams = new Set();
         // A client gets the consolidated subagent text when it negotiated the
         // transcript extension or the `forwardSubagentText` session option. AIR
         // also gets it with native subagent sessions, and AIR gets no streamed
@@ -2516,7 +2564,7 @@ export class ClaudeAcpAgent {
          *  recognizable by the `parentToolUseId` meta that toAcpNotifications
          *  stamps from `parent_tool_use_id`, and never reach the top-level feed
          *  as the turn's answer. */
-        const subagents = (session.nativeSubagentRuntime ??= new NativeSubagentRuntime(clientSupportsSubagents(this.clientCapabilities), params.sessionId, session, async (notification) => this.client.sessionUpdate(asSdkSessionNotification(notification)), this.logger));
+        const subagents = (session.nativeSubagentRuntime ??= new NativeSubagentRuntime(subagentForm(this.clientCapabilities), params.sessionId, session, async (notification) => this.client.sessionUpdate(asSdkSessionNotification(notification)), this.logger));
         // Adapter-composed advisories (hook feedback, model fallbacks) are live
         // events, not something the model said. Clients on the notice contract get
         // them as `notice` updates; the rest keep the bold-label transcript line.
@@ -2551,6 +2599,19 @@ export class ClaudeAcpAgent {
             const eagerOwnerSessionId = toolCallId
                 ? session.eagerToolCallSessions?.get(toolCallId)
                 : undefined;
+            // Before routing, which can buffer or drop the update: a cancel still has
+            // to know the parent of a call that is open here. A later update can be
+            // the first to name it, for a call that a permission request emitted.
+            if (toolCallId &&
+                update.sessionUpdate === "tool_call_update" &&
+                isFinalToolCallStatus(update.status)) {
+                session.toolCallParents?.delete(toolCallId);
+            }
+            else if (toolCallId &&
+                claudeMeta?.parentToolUseId &&
+                session.emittedToolCalls.has(toolCallId)) {
+                recordToolCallParent(session, toolCallId, claudeMeta.parentToolUseId);
+            }
             const routedNotification = await subagents.route(notification, sendUpdate, eagerOwnerSessionId);
             if (!routedNotification) {
                 // Native Agent/Task control calls are intentionally not transcript
@@ -2706,6 +2767,7 @@ export class ClaudeAcpAgent {
         const activateTurn = (turn) => {
             session.activeTurn = turn;
             session.cancelled = false;
+            session.cancelledPrompts = undefined;
             compaction.resume();
             if (turn.localCommand?.startsAtActivation)
                 ensureLocalCommandMarkdown(turn);
@@ -2742,7 +2804,7 @@ export class ClaudeAcpAgent {
             reportInserted(turn);
             // A request can already be open: Claude Code asks for a queued prompt
             // before the consumer reaches its echo.
-            this.syncAwaitingUser(session);
+            this.syncAwaitingUser(params.sessionId, session);
         };
         /** Report that Claude Code took the turn's prompt in, once. A turn can be
          *  settled by now: an echo hand-off awaits settling the previous turn, and
@@ -2752,6 +2814,7 @@ export class ClaudeAcpAgent {
                 return;
             turn.insertedReported = true;
             turn.events.inserted(turn.promptUuid);
+            this.startForeground(params.sessionId, turn);
         };
         /** Ensure there is an active turn before a user-turn result that carries no
          *  echo to activate it, by promoting the queue head. Most turns are
@@ -2776,7 +2839,7 @@ export class ClaudeAcpAgent {
          *  a stamp naming an orphaned command consumes the result outright, and a
          *  stamp naming anything else positively refutes "this is a dead turn's
          *  result", so the dup-over-loss one-skip must not eat it. */
-        const ensureActiveTurn = async (resultUserMessageUuid) => {
+        const ensureActiveTurn = async (resultUserMessageUuid, resultUserMessageUuids) => {
             if (session.activeTurn) {
                 if (!isHeldOpen(session.activeTurn)) {
                     return;
@@ -2802,8 +2865,8 @@ export class ClaudeAcpAgent {
             }
             // Orphan accounting runs BEFORE the head check: an orphan's echo-less
             // result can arrive with an EMPTY queue (the common post-cancel
-            // timeline — the active turn settled at the interrupt's idle and the
-            // user hasn't typed yet), and it must still be consumed here. Skipping
+            // timeline — the cancelled turn settled at its interrupted result and
+            // the user hasn't typed yet), and it must still be consumed here. Skipping
             // the bookkeeping when there is nothing to promote would leave a
             // phantom entry/count that swallows the next live echo-less result
             // (e.g. /compact) instead.
@@ -2872,6 +2935,14 @@ export class ClaudeAcpAgent {
                     }
                 }
             }
+            // A result that names a prompt a cancel stopped is that prompt's, even
+            // when the orphan accounting above lost track of it: the interrupt
+            // receipt leaves out a prompt that Claude Code had already taken off its
+            // queue. It must not settle the prompt sent after the cancel.
+            const stamps = resultUserMessageUuids ??
+                (resultUserMessageUuid !== undefined ? [resultUserMessageUuid] : []);
+            if (stamps.some((uuid) => session.cancelledPrompts?.has(uuid)))
+                return;
             const head = firstUnsettledQueuedTurn();
             if (!head) {
                 return;
@@ -2971,17 +3042,53 @@ export class ClaudeAcpAgent {
         };
         /** Registers a live background task (see `liveBackgroundTasks`). A
          *  subagent is also recorded on the active turn, so that turn holds until
-         *  the subagent settles (see `Turn.spawnedTaskIds`). */
-        const registerLiveTask = (taskId, parentToolUseId, isSubagent) => {
-            session.liveBackgroundTasks.set(taskId, { parentToolUseId, isSubagent });
+         *  the subagent settles (see `Turn.spawnedTaskIds`). Its requests may
+         *  already be open, and where it runs decides whether they block the
+         *  foreground work, so that is checked again. */
+        const registerLiveTask = (taskId, parentToolUseId, isSubagent, placement = {}) => {
+            session.liveBackgroundTasks.set(taskId, {
+                parentToolUseId,
+                isSubagent,
+                ...(placement.backgrounded !== undefined ? { backgrounded: placement.backgrounded } : {}),
+                ...(placement.parentTaskId !== undefined ? { parentTaskId: placement.parentTaskId } : {}),
+            });
             if (parentToolUseId)
                 forgetForegroundToolCall(session, parentToolUseId);
             session.resumableSubagents?.delete(taskId);
             if (isSubagent && session.activeTurn && !session.activeTurn.settled) {
                 (session.activeTurn.spawnedTaskIds ??= new Set()).add(taskId);
             }
+            this.syncAwaitingUser(params.sessionId, session);
+        };
+        /** Ends the display terminal of a command that went to the background, once
+         *  its task ends (see `Session.backgroundTerminals`). Claude Code reports no
+         *  exit code for it, and `completed` does not mean 0: Claude Code accepts
+         *  some non-zero codes as a success, such as grep's 1. */
+        const endBackgroundTerminal = async (taskId) => {
+            const terminal = session.backgroundTerminals?.get(taskId);
+            if (!terminal)
+                return;
+            session.backgroundTerminals.delete(taskId);
+            await sendUpdate({
+                sessionId: params.sessionId,
+                update: {
+                    sessionUpdate: "tool_call_update",
+                    toolCallId: terminal.toolCallId,
+                    _meta: {
+                        ...(terminal.parentToolUseId
+                            ? { claudeCode: { parentToolUseId: terminal.parentToolUseId } }
+                            : {}),
+                        terminal_exit: { terminal_id: terminal.toolCallId, exit_code: null, signal: null },
+                    },
+                },
+            });
+        };
+        /** Settles a task. Its request may still be open, and an agent without a
+         *  record no longer blocks the foreground work, so that is checked again. */
+        const settleLiveTask = (taskId) => {
+            settleLiveBackgroundTask(session, taskId);
+            this.syncAwaitingUser(params.sessionId, session);
         };
-        const settleLiveTask = (taskId) => settleLiveBackgroundTask(session, taskId);
         /** Registers a settled subagent again when the SDK resumes it without a
          *  new `task_started`. The active turn is the one that resumed it, so it
          *  holds until the subagent settles again. A repeated resume signal finds
@@ -2990,8 +3097,9 @@ export class ClaudeAcpAgent {
             if (session.liveBackgroundTasks.has(taskId))
                 return;
             const settled = session.resumableSubagents?.get(taskId);
+            // Claude Code always resumes a subagent in the background.
             if (settled)
-                registerLiveTask(taskId, settled.parentToolUseId, true);
+                registerLiveTask(taskId, settled.parentToolUseId, true, { backgrounded: true });
         };
         /** Whether any background subagent this turn spawned is still live —
          *  while true, the turn's settlement stays deferred so the subagent's
@@ -3044,11 +3152,100 @@ export class ClaudeAcpAgent {
                 !session.activeTurn.settled &&
                 turnAwaitingSubagents(session.activeTurn)) {
                 session.activeTurn.deferredSettle = outcome;
+                // The hold delays v1's answer; the turn's work ended at its result.
+                this.endForeground(params.sessionId, session.activeTurn, { outcome });
             }
             else {
                 await settleActive(outcome);
             }
         };
+        /** Sends `report`, which ends the tool call `toolCallId` without its result
+         *  (see `AcpToolCallRenderer.unfinished`), and forgets the call. Forgetting
+         *  comes first, so that a late hook or a second close cannot overwrite the
+         *  report. */
+        const closeToolCall = async (toolCallId, report) => {
+            unregisterHookCallback(toolCallId);
+            session.emittedToolCalls.delete(toolCallId);
+            delete session.toolUseCache[toolCallId];
+            session.toolCallFields?.delete(toolCallId);
+            session.dispatchedToolCalls?.delete(toolCallId);
+            session.toolCallParents?.delete(toolCallId);
+            await sendUpdate({ sessionId: params.sessionId, update: report });
+        };
+        /** Whether the subagent that the Agent call `agentToolUseId` started runs in
+         *  the background and has not ended. */
+        const runsInBackground = (agentToolUseId) => [...session.liveBackgroundTasks.values()].some((task) => task.isSubagent &&
+            task.backgrounded === true &&
+            !task.endedPerLevel &&
+            task.parentToolUseId === agentToolUseId);
+        /** Closes the tool calls that the work a cancel stopped left open, as that
+         *  work ends. Claude Code's interrupt ends each running tool of the main
+         *  conversation with an error result, which `sendInterruptedToolResults`
+         *  delivers. What is still open here has no result to deliver:
+         *  - a tool of a subagent: Claude Code writes its interrupted result only to
+         *    the subagent's own transcript, not to the stream;
+         *  - a tool call that Claude abandoned before it ran;
+         *  - every tool call, when the stream gives no results at all, as when the
+         *    force-cancel backstop ends a wedged turn.
+         *  A foreground subagent ends with the work that waits on it. A background
+         *  subagent keeps its tool calls open until the SDK reports its end, which
+         *  Claude Code 2.1.293 does for the ones it stops, before the turn's result
+         *  (see `NativeSubagentRuntime.parentCancelled`).
+         *  Returns false when the turn ended meanwhile. */
+        const closeCancelledToolCalls = async (turn) => {
+            const renderer = new AcpToolCallRenderer(this.toolCallCapabilities);
+            for (const toolCallId of [...session.emittedToolCalls]) {
+                const parentToolUseId = session.toolCallParents?.get(toolCallId);
+                if (parentToolUseId !== undefined && runsInBackground(parentToolUseId))
+                    continue;
+                const report = renderer.unfinished({
+                    toolCallId,
+                    ran: session.dispatchedToolCalls?.has(toolCallId) === true,
+                    cancelled: true,
+                });
+                // Named as the call's other updates are: the subagent runtime routes the
+                // report with them, to the child session, or to none that has ended.
+                if (parentToolUseId !== undefined)
+                    stampParentToolUseId(report, parentToolUseId);
+                await closeToolCall(toolCallId, report);
+                if (turn.settled || session.activeTurn !== turn)
+                    return false;
+            }
+            return true;
+        };
+        /** Delivers the results that the work a cancel stopped sends for tool calls
+         *  that the client holds open. Claude Code's interrupt ends each running tool
+         *  of the main conversation with an error result, before the result that
+         *  ends the turn. The tool call gets that result like any other, so its
+         *  final status and `nonExecutionKind` reach the client. Nothing else of the
+         *  message is applied: the other effects of a tool result (async tasks, plan
+         *  state, the ExitPlanMode flow) belong to the stopped work, which stays
+         *  dropped. */
+        const sendInterruptedToolResults = async (message) => {
+            const content = message.message.content;
+            if (!Array.isArray(content))
+                return;
+            const results = content.filter((block) => block.type === "tool_result" && session.emittedToolCalls.has(block.tool_use_id));
+            if (results.length === 0)
+                return;
+            const resultCount = content.filter((block) => block.type === "tool_result").length;
+            for (const notification of toAcpNotifications(results, "user", params.sessionId, session.toolUseCache, routedNotificationClient, this.logger, {
+                clientCapabilities: this.clientCapabilities,
+                toolCallCapabilities: this.toolCallCapabilities,
+                parentToolUseId: message.parent_tool_use_id,
+                cwd: session.cwd,
+                taskState: session.taskState,
+                emittedToolCalls: session.emittedToolCalls,
+                toolCallFields: toolCallFieldsOf(session),
+                messageId: messageIdForGrouping(message),
+                // `tool_use_result` describes the one result of its message.
+                toolUseResult: results.length === resultCount ? message.tool_use_result : undefined,
+                toolResultMeta: message.tool_result_meta,
+                cancelled: true,
+            })) {
+                await sendUpdate(notification);
+            }
+        };
         /** At the actual turn boundary, preview its checkpoint, settle the active
          *  turn exactly once, disarm the force-cancel backstop, and drop it from
          *  the queue. Cancellation and provider failures skip checkpoint I/O. */
@@ -3074,16 +3271,7 @@ export class ClaudeAcpAgent {
                  * ended meanwhile.
                  */
                 const closeUnfinished = async (toolCallId, ran) => {
-                    // A late hook must not overwrite the report we are about to send.
-                    unregisterHookCallback(toolCallId);
-                    session.emittedToolCalls.delete(toolCallId);
-                    delete session.toolUseCache[toolCallId];
-                    session.toolCallFields?.delete(toolCallId);
-                    session.dispatchedToolCalls?.delete(toolCallId);
-                    await sendUpdate({
-                        sessionId: params.sessionId,
-                        update: renderer.unfinished({ toolCallId, ran }),
-                    });
+                    await closeToolCall(toolCallId, renderer.unfinished({ toolCallId, ran }));
                     // Cancellation can arrive while we await the client update.
                     if (turn.settled || session.activeTurn !== turn)
                         return false;
@@ -3116,6 +3304,13 @@ export class ClaudeAcpAgent {
                     return;
                 }
             }
+            // The client is told that the work a cancel stopped ended (the prompt
+            // response on v1, `idle` on v2) only after every tool call that work
+            // opened has ended.
+            if (result.stopReason === "cancelled" && session.cancelled) {
+                if (!(await closeCancelledToolCalls(turn)))
+                    return;
+            }
             turn.settling = true;
             turn.settlingOutcome = result;
             if (reportReason === "notReported") {
@@ -3220,6 +3415,7 @@ export class ClaudeAcpAgent {
         /** Reject every in-flight turn — used when the stream dies. */
         const failAllTurns = (error) => {
             disarmForceCancel(session);
+            this.endAutonomousCycle(params.sessionId, { error });
             const turns = session.activeTurn
                 ? [session.activeTurn, ...(session.turnQueue ?? []).filter((t) => t !== session.activeTurn)]
                 : [...(session.turnQueue ?? [])];
@@ -3317,9 +3513,9 @@ export class ClaudeAcpAgent {
                             }
                         }
                         else if (active.commandResultSeen) {
-                            // Its result was already consumed (dropped at the cancelled
-                            // guard); only the terminal frame is outstanding, which no-ops
-                            // with no entry. Nothing to track.
+                            // Its result was already consumed (at the cancelled guard);
+                            // only the terminal frame is outstanding, which no-ops with no
+                            // entry. Nothing to track.
                         }
                         else {
                             // The wedged turn WAS dispatched (it's active), so track it
@@ -3386,6 +3582,9 @@ export class ClaudeAcpAgent {
                     // it), but the stored one is the authoritative source.
                     const inFlight = session.activeTurn;
                     await finishLifecycle(session.cancelled ? "cancelled" : "failed", session.cancelled ? "stopped" : "failed", "at end of stream");
+                    this.endAutonomousCycle(params.sessionId, session.cancelled
+                        ? { outcome: { stopReason: "cancelled" } }
+                        : { error: RequestError.internalError(undefined, SESSION_ENDED_MESSAGE) });
                     await settleActive(session.cancelled
                         ? cancelledOutcome(session, inFlight)
                         : (inFlight?.deferredSettle ?? turnOutcome(session, stopReason)));
@@ -3528,6 +3727,7 @@ export class ClaudeAcpAgent {
                     await this.publishRuntimeGoal(params.sessionId, toGoalSnapshot(activeGoal));
                     continue;
                 }
+                this.startAutonomousCycle(params.sessionId, session, message);
                 switch (message.type) {
                     case "system":
                         switch (message.subtype) {
@@ -3539,6 +3739,9 @@ export class ClaudeAcpAgent {
                                 if (message.capabilities?.includes("msg_lifecycle_v1")) {
                                     session.msgLifecycleV1 = true;
                                 }
+                                if (message.capabilities?.includes("request_marker_lists_v1")) {
+                                    session.requestMarkerListsV1 = true;
+                                }
                                 // A fresh `system`/init (e.g. after reinitialize) can carry an
                                 // updated Fast mode state; reconcile it with what we seeded at
                                 // session creation.
@@ -3574,6 +3777,24 @@ export class ClaudeAcpAgent {
                                 }
                                 break;
                             case "status": {
+                                // A model request that serves none of the prompts a cancel
+                                // stopped is new work, such as Claude Code's follow-up after a
+                                // background command finished. It comes after the stopped
+                                // work's result: Claude Code ends the interrupted turn first,
+                                // then runs any prompt it had already taken off its queue (its
+                                // request names it, so the cancel still drops it), then its own
+                                // follow-ups, whose requests name no prompt.
+                                if (message.status === "requesting" &&
+                                    session.cancelled &&
+                                    session.requestMarkerListsV1 &&
+                                    !servesCancelledWork(session, message)) {
+                                    session.cancelled = false;
+                                    session.cancelledPrompts = undefined;
+                                    // The stopped work's tail has drained, as at activation.
+                                    compaction.resume();
+                                }
+                                if (message.status === "requesting")
+                                    session.modelRequestSinceResult = true;
                                 if (message.status === "compacting") {
                                     await compaction.start(message.uuid);
                                 }
@@ -3665,6 +3886,17 @@ export class ClaudeAcpAgent {
                                     session.owedTrailingIdles = 0;
                                 }
                                 if (message.state === "idle") {
+                                    // A model cycle that Claude Code started on its own normally
+                                    // ends at its result. An idle that no earlier result owes
+                                    // means that result will not come (the stream dropped
+                                    // mid-cycle, as for a turn in issue #825), so the cycle ends
+                                    // here. An owed idle belongs to an earlier result: it can lag
+                                    // past the cycle's first output.
+                                    if (session.owedTrailingIdles === 0) {
+                                        this.endAutonomousCycle(params.sessionId, {
+                                            outcome: { stopReason: session.cancelled ? "cancelled" : "end_turn" },
+                                        });
+                                    }
                                     // A non-cancelled turn normally settled at its terminal
                                     // `result` already (issue #773), and that result recorded an
                                     // owed trailing idle — absorbed here via the decrement. We
@@ -3674,9 +3906,9 @@ export class ClaudeAcpAgent {
                                     // the time it arrives the SDK may have echoed the NEXT turn
                                     // and activated it — settling now would resolve that new
                                     // turn prematurely with end_turn and ~zero usage, dropping
-                                    // its real result. A cancelled turn relies on `idle`: its
-                                    // `result` is dropped at the `session.cancelled` guard, so
-                                    // it never settles at a result and must settle here.
+                                    // its real result. A cancelled turn settles at its
+                                    // interrupted result (at the `session.cancelled` guard); one
+                                    // whose result never came settles here.
                                     //
                                     // An idle that is NOT owed while the active turn is still
                                     // unsettled is the issue #825 signature: `idle` is the SDK's
@@ -3688,12 +3920,9 @@ export class ClaudeAcpAgent {
                                     // the turn NOW so its session/prompt gets a terminal
                                     // response, instead of leaving it hanging until the next
                                     // prompt drains the wreckage.
-                                    // A cancelled turn still consumed tokens: its dropped result
-                                    // already fed the accumulator (the usage tally at the result
-                                    // handler runs before the `session.cancelled` guard), so
-                                    // report it — clients metering spend would otherwise lose
-                                    // the interrupted turn's tokens entirely (issue #844). Zero
-                                    // when the cancel pre-empted the result (wedge/force-cancel).
+                                    // A cancelled turn reaches this with no result of its own,
+                                    // so its usage is zero (wedge/force-cancel), or, for a held
+                                    // turn, the usage its result recorded (issue #844).
                                     if (session.cancelled && session.activeTurn && !session.activeTurn.settled) {
                                         // A held turn's result passed long ago; this idle is the
                                         // trailer of the followup cycle the cancel interrupted,
@@ -3746,8 +3975,11 @@ export class ClaudeAcpAgent {
                                         // Via the subagent gate, not settleActive: a steered turn
                                         // can also have spawned background subagents, which own it
                                         // from here (settles now if none is live, holds otherwise).
+                                        const outcome = session.activeTurn.steeredSettle;
                                         const steered = session.activeTurn;
-                                        steered.deferredSettle = steered.steeredSettle;
+                                        steered.deferredSettle = outcome;
+                                        // A hold delays v1's answer; the turn's work ends here.
+                                        this.endForeground(params.sessionId, steered, { outcome });
                                         leaveSteerLane(steered);
                                         await settleDeferredIfDrained();
                                     }
@@ -3962,7 +4194,10 @@ export class ClaudeAcpAgent {
                                 // turn: a turn only ever waits on its own subagents, and a
                                 // spawn during a held-open drain window (an agent chain)
                                 // extends that turn's hold.
-                                registerLiveTask(message.task_id, message.tool_use_id, !!message.subagent_type);
+                                registerLiveTask(message.task_id, message.tool_use_id, !!message.subagent_type, {
+                                    backgrounded: message.is_backgrounded,
+                                    parentTaskId: message.parent_task_id,
+                                });
                                 await subagents.taskStarted({
                                     taskId: message.task_id,
                                     toolUseId: message.tool_use_id,
@@ -3986,9 +4221,14 @@ export class ClaudeAcpAgent {
                                     this.logger.log(`Ignoring task_notification for task ${message.task_id} from earlier run ${message.run_id}`);
                                     break;
                                 }
+                                // In the RFD form, a resumed child runs under the call that
+                                // resumed it, and the end of an earlier delegation ends
+                                // nothing: the child and its live task belong to the new run.
+                                if (subagents.isStaleEnd(message.task_id, message.tool_use_id))
+                                    break;
                                 // The task settled — no further tool calls can originate
                                 // from it, so its registry entry can be dropped.
-                                await subagents.finishTask(message.task_id, message.status, sendUpdate, message.tool_use_id);
+                                await subagents.finishTask(message.task_id, message.status, sendUpdate, message.tool_use_id, { reason: message.reason });
                                 await asyncTasks.taskNotification({
                                     task_id: message.task_id,
                                     status: message.status,
@@ -4000,7 +4240,9 @@ export class ClaudeAcpAgent {
                                     subagents.discardPending(message.tool_use_id);
                                     // The subagent streams no more text under this parent.
                                     streamedBlocksByParent.delete(message.tool_use_id);
+                                    droppedStreams.delete(message.tool_use_id);
                                 }
+                                await endBackgroundTerminal(message.task_id);
                                 settleLiveTask(message.task_id);
                                 break;
                             case "task_updated":
@@ -4009,6 +4251,14 @@ export class ClaudeAcpAgent {
                                     break;
                                 }
                                 await asyncTasks.taskUpdated(message.task_id, message.patch);
+                                // A task moved to the background no longer blocks the tool
+                                // call that spawned it, nor its requests the foreground work.
+                                if (message.patch.is_backgrounded !== undefined) {
+                                    const task = session.liveBackgroundTasks.get(message.task_id);
+                                    if (task)
+                                        task.backgrounded = message.patch.is_backgrounded;
+                                    this.syncAwaitingUser(params.sessionId, session);
+                                }
                                 // terminal-status task_updated patch and a (deduplicated)
                                 // task_notification when a task settles, but only the patch is
                                 // guaranteed per transition — prune on it too so the registry
@@ -4017,10 +4267,13 @@ export class ClaudeAcpAgent {
                                 if (message.patch.status === "completed" ||
                                     message.patch.status === "failed" ||
                                     message.patch.status === "killed") {
-                                    await subagents.finishTask(message.task_id, message.patch.status, sendUpdate);
+                                    await subagents.finishTask(message.task_id, message.patch.status, sendUpdate, undefined, { error: message.patch.status === "failed" ? message.patch.error : undefined });
                                     const parentToolUseId = session.liveBackgroundTasks.get(message.task_id)?.parentToolUseId;
-                                    if (parentToolUseId)
+                                    if (parentToolUseId) {
                                         streamedBlocksByParent.delete(parentToolUseId);
+                                        droppedStreams.delete(parentToolUseId);
+                                    }
+                                    await endBackgroundTerminal(message.task_id);
                                     settleLiveTask(message.task_id);
                                 }
                                 else if (message.patch.status === "running" ||
@@ -4230,6 +4483,7 @@ export class ClaudeAcpAgent {
                         }
                         break;
                     case "result": {
+                        session.modelRequestSinceResult = false;
                         // The result ends the model turn. A background task that still
                         // waits for its tool call id gets its spawn now, without the id.
                         await asyncTasks.releaseHeld();
@@ -4264,7 +4518,7 @@ export class ClaudeAcpAgent {
                             // the map in that case).
                             if (!isAutonomousResult) {
                                 recordResultForOrphanCommands();
-                                await ensureActiveTurn(message.user_message_uuid);
+                                await ensureActiveTurn(message.user_message_uuid, message.user_message_uuids);
                                 // A result that names a steer consumed it (see
                                 // Turn.steeredEchoes), so the steered work is done: retire
                                 // its echo — the CLI may never have replayed it — and, with
@@ -4325,13 +4579,10 @@ export class ClaudeAcpAgent {
                             // orphan skip) and the SDK follows it with a trailing
                             // `session_state_changed: idle` — record the debt so the idle
                             // handler absorbs that idle rather than reading it as a turn the
-                            // SDK abandoned (issue #825). One exclusion: the cancelled ACTIVE
-                            // turn's own result. It is dropped at the `session.cancelled`
-                            // guard, and either the idle itself settles the turn (consuming
-                            // the trailer) or the next echo's hand-off does (which records
-                            // the debt there instead) — counting here too would double it.
-                            // Results skipped while cancelled with NO active turn — orphaned
-                            // queued turns the SDK still ran, or a force-cancelled turn's
+                            // SDK abandoned (issue #825). That includes the result of a
+                            // cancelled turn, which settles it at the `session.cancelled`
+                            // guard below. Results skipped while cancelled with NO active
+                            // turn — orphaned queued turns the SDK still ran, or a force-cancelled turn's
                             // late result after the backstop settled it — get no such settle,
                             // so their trailers must be counted here or they'd later be read
                             // as the next healthy turn being abandoned and false-fail it.
@@ -4344,20 +4595,17 @@ export class ClaudeAcpAgent {
                             // but a held turn settling AT a followup result unblocks the
                             // client at exactly that point, making the race the common
                             // case.
-                            // The cancelled-ACTIVE-turn exclusion applies only to that
-                            // turn's OWN result — a followup result arriving inside the
-                            // cancel window still gets its own trailer and must be counted,
-                            // or that idle would later false-fail the next prompt.
-                            // A second exclusion: a steered turn's own results (see
+                            // One exclusion: a steered turn's own results (see
                             // Turn.steeredEchoes). One idle covers the whole interrupted +
                             // steered sequence and that idle settles the turn, so counting
                             // either result would leave a debt that swallows it. Autonomous
                             // results inside a steered turn keep their own trailers, and so
                             // does a result that named the steer: it took the turn out of the
-                            // steer lane above and settles at the result, not the idle.
-                            const owesTrailingIdle = isAutonomousResult || !isSteering(session.activeTurn);
-                            if (owesTrailingIdle &&
-                                (isAutonomousResult || !session.cancelled || !session.activeTurn)) {
+                            // steer lane above and settles at the result, not the idle. So
+                            // does a cancelled steered turn's result, which settles it at the
+                            // `session.cancelled` guard below.
+                            const owesTrailingIdle = isAutonomousResult || !isSteering(session.activeTurn) || session.cancelled;
+                            if (owesTrailingIdle) {
                                 session.owedTrailingIdles++;
                             }
                             // Accumulate usage into the user turn's tally. Skip autonomous
@@ -4443,6 +4691,26 @@ export class ClaudeAcpAgent {
                                     }),
                                 });
                             }
+                            // A model cycle that Claude Code started on its own ends at its
+                            // result, after its usage, also after a cancel. A turn that
+                            // Claude Code takes in takes the cycle over, so a cycle that
+                            // still runs owns this result, whatever its origin says. A
+                            // placeholder result (`num_turns: 0`, see the autonomous lane
+                            // below) comes before the shared followup runs, so it ends
+                            // nothing. The diagnostic of an ExitPlanMode answer that
+                            // interrupted the cycle ends it `cancelled`, as it ends a turn,
+                            // unless a held turn continues the accepted plan in a fresh
+                            // context: that turn takes the cycle over (see the autonomous
+                            // lane below).
+                            const exitPlanInterruption = pendingExitPlanModeInterruption !== undefined &&
+                                isExitPlanInterruptionResult(message, pendingExitPlanModeInterruption);
+                            const continuesPlan = exitPlanInterruption &&
+                                isHeldOpen(session.activeTurn) &&
+                                pendingExitPlanContextReset?.toolUseId ===
+                                    pendingExitPlanModeInterruption?.toolUseId;
+                            if (!continuesPlan && !(isAutonomousResult && message.num_turns === 0)) {
+                                this.endAutonomousCycle(params.sessionId, autonomousCycleEnd(message, resultModelUsage, session.cancelled || exitPlanInterruption || isAbortedResult(message)));
+                            }
                             if (session.cancelled) {
                                 session.pendingExitPlanModeInterruption = undefined;
                                 session.pendingExitPlanContextReset = undefined;
@@ -4450,6 +4718,21 @@ export class ClaudeAcpAgent {
                                     await clearFailuresFromEarlierTurns();
                                     stopReason = "cancelled";
                                 }
+                                // The cancelled turn ends at the result of the work the
+                                // interrupt stopped: its own result, or for a turn held open
+                                // for its subagents (see Turn.deferredSettle), its follow-up's
+                                // aborted one. A follow-up result that is not aborted, such as
+                                // a placeholder or one that ended before the interrupt landed,
+                                // belongs to other work. Claude Code ends the stopped work
+                                // first, then goes on with its queue, so the idle can come
+                                // much later, after a follow-up. That idle, the next echo's
+                                // hand-off, and the force-cancel backstop settle a turn whose
+                                // result never comes.
+                                const active = session.activeTurn;
+                                const stoppedWork = !isAutonomousResult || (isHeldOpen(active) && isAbortedResult(message));
+                                if (active && !active.settled && stoppedWork) {
+                                    await settleActive(cancelledOutcome(session, active));
+                                }
                                 break;
                             }
                             // A held turn (see Turn.deferredSettle) settles at its
@@ -4486,8 +4769,11 @@ export class ClaudeAcpAgent {
                                             pendingExitPlanModeInterruption.toolUseId) {
                                         // The fresh query has none of this one's background
                                         // tasks, so the hold can never drain there: drop it, and
-                                        // let the continuation's own result settle the turn.
+                                        // let the continuation's own result settle the turn. The
+                                        // continuation is the turn's work again, which takes
+                                        // over the follow-up cycle that planned it.
                                         heldTurn.deferredSettle = undefined;
+                                        this.startForeground(params.sessionId, heldTurn);
                                         await this.exitPlan.restart(params.sessionId, session, pendingExitPlanContextReset);
                                         return;
                                     }
@@ -4754,9 +5040,10 @@ export class ClaudeAcpAgent {
                             // subagent never holds the prompt hostage.
                             //
                             // is_error/auth already settled via failActive (activeTurn is null
-                            // then, so both branches no-op); cancellation is left to the
-                            // idle/abort path. settleActive is idempotent, so a duplicate
-                            // idle is a no-op.
+                            // then, so both branches no-op); a cancelled turn settles at
+                            // the `session.cancelled` guard above, or on the idle/abort
+                            // path when its result never comes. settleActive is idempotent,
+                            // so a duplicate idle is a no-op.
                             //
                             // A result also closes this compaction lifecycle — before the
                             // settle, so a `cancelled` terminal for an entity the runtime
@@ -4810,43 +5097,14 @@ export class ClaudeAcpAgent {
                             // reset, and the synthetic-auth/system/local-command paths
                             // `break` early too. Block indices restart at 0 each message, so
                             // leftover entries would otherwise collide with this message's
-                            // blocks and re-emit (or truncate) already-streamed text. Gated on
-                            // `parent_tool_use_id === null` so a subagent stream can't clear
-                            // the top-level record. Fires once, before any of this message's
-                            // blocks, so it doesn't disturb the mid-message turn-activation
-                            // path the way resetting on turn activation would.
+                            // blocks and re-emit (or truncate) already-streamed text. Keyed by
+                            // the stream, so a subagent's message can't clear the top-level
+                            // record. Fires once, before any of this message's blocks, so it
+                            // doesn't disturb the mid-message turn-activation path the way
+                            // resetting on turn activation would. The record's drop latch
+                            // (see below) resets with it.
                             streamedBlocksOf(message.parent_tool_use_id).length = 0;
-                        }
-                        // Accumulate the text/thinking actually streamed live, so the
-                        // `assistant` case below can diff its assembled blocks against what
-                        // already reached the client as chunks and forward only the
-                        // remainder. Each stream (top level or one subagent) keeps its own
-                        // record, so a subagent cannot attribute content to another stream.
-                        // Contiguous deltas of the same block (same index and type) extend
-                        // the current entry; anything else opens a new one.
-                        if (message.event.type === "content_block_delta") {
-                            const delta = message.event.delta;
-                            const chunk = delta.type === "text_delta"
-                                ? { type: "text", text: delta.text }
-                                : delta.type === "thinking_delta"
-                                    ? { type: "thinking", text: delta.thinking }
-                                    : undefined;
-                            // Skip empty deltas (some gateways emit empty thinking chunks —
-                            // #793): appending "" is a no-op, but pushing a "" entry would
-                            // create a block the consolidated handler's `text.length > 0`
-                            // guard can never consume, stalling the diff cursor and
-                            // re-emitting the next block as a duplicate.
-                            if (chunk?.text) {
-                                const index = message.event.index;
-                                const streamedBlocks = streamedBlocksOf(message.parent_tool_use_id);
-                                const last = streamedBlocks[streamedBlocks.length - 1];
-                                if (last && last.index === index && last.type === chunk.type) {
-                                    last.text += chunk.text;
-                                }
-                                else {
-                                    streamedBlocks.push({ index, type: chunk.type, text: chunk.text });
-                                }
-                            }
+                            droppedStreams.delete(message.parent_tool_use_id ?? "");
                         }
                         if (message.parent_tool_use_id === null &&
                             (message.event.type === "message_start" || message.event.type === "message_delta")) {
@@ -4900,7 +5158,71 @@ export class ClaudeAcpAgent {
                                 });
                             }
                         }
-                        for (const notification of streamEventToAcpNotifications(message, params.sessionId, session.toolUseCache, this.client, this.logger, {
+                        // After a cancel, output streams to the client until the client is
+                        // told that the stopped work ended (see workEndReported), so what
+                        // the interrupt flushes before then still goes out, as both
+                        // protocol versions allow. After that, while the window after the
+                        // cancel is open, streamed text, thinking and tool calls are
+                        // dropped like the consolidated messages they belong to (see the
+                        // `cancelled` check in the user/assistant case). Otherwise the
+                        // answer to a prompt the cancel abandoned, which Claude Code had
+                        // already taken off its queue, would stream to the client after the
+                        // cancel was reported.
+                        //
+                        // Where the consolidated message delivers the text (the same
+                        // condition as in the user/assistant case), a stream that loses a
+                        // delta keeps dropping until the record below resets: at the next
+                        // message, or when a consolidated message consumes the record. If
+                        // the next prompt's echo ends the window mid-block, the record then
+                        // stays empty and the consolidated message delivers the block's
+                        // whole text once. A record holding only the block's tail is not a
+                        // prefix of the text, so the text would be sent again (see
+                        // unstreamedRemainder).
+                        const streamKey = message.parent_tool_use_id ?? "";
+                        if (session.cancelled && this.workEndReported(params.sessionId, session)) {
+                            if (message.parent_tool_use_id === null || forwardsSubagentText()) {
+                                droppedStreams.add(streamKey);
+                            }
+                            break;
+                        }
+                        if (droppedStreams.has(streamKey)) {
+                            break;
+                        }
+                        // Accumulate the text/thinking actually streamed live, so the
+                        // `assistant` case below can diff its assembled blocks against what
+                        // already reached the client as chunks and forward only the
+                        // remainder. Each stream (top level or one subagent) keeps its own
+                        // record, so a subagent cannot attribute content to another stream.
+                        // Contiguous deltas of the same block (same index and type) extend
+                        // the current entry; anything else opens a new one.
+                        if (message.event.type === "content_block_delta") {
+                            const delta = message.event.delta;
+                            const chunk = delta.type === "text_delta"
+                                ? { type: "text", text: delta.text }
+                                : delta.type === "thinking_delta"
+                                    ? { type: "thinking", text: delta.thinking }
+                                    : undefined;
+                            // Skip empty deltas (some gateways emit empty thinking chunks —
+                            // #793): appending "" is a no-op, but pushing a "" entry would
+                            // create a block the consolidated handler's `text.length > 0`
+                            // guard can never consume, stalling the diff cursor and
+                            // re-emitting the next block as a duplicate.
+                            if (chunk?.text) {
+                                const index = message.event.index;
+                                const streamedBlocks = streamedBlocksOf(message.parent_tool_use_id);
+                                const last = streamedBlocks[streamedBlocks.length - 1];
+                                if (last && last.index === index && last.type === chunk.type) {
+                                    last.text += chunk.text;
+                                }
+                                else {
+                                    streamedBlocks.push({ index, type: chunk.type, text: chunk.text });
+                                }
+                            }
+                        }
+                        // The stream sees a tool_use first, so the tool's PostToolUse hook
+                        // is registered here, and publishes through this client: a
+                        // subagent's hook update must reach the child session too.
+                        for (const notification of streamEventToAcpNotifications(message, params.sessionId, session.toolUseCache, routedNotificationClient, this.logger, {
                             clientCapabilities: this.clientCapabilities,
                             toolCallCapabilities: this.toolCallCapabilities,
                             cwd: session.cwd,
@@ -4955,7 +5277,7 @@ export class ClaudeAcpAgent {
                                 if (session.activeTurn !== queued) {
                                     if (session.activeTurn) {
                                         // Hand off the previous turn. If a cancel is pending for it
-                                        // (its trailing idle hasn't arrived yet), settle it
+                                        // (neither its result nor its idle has arrived), settle it
                                         // "cancelled" per the ACP contract rather than "end_turn" —
                                         // otherwise a cancel followed quickly by the next prompt
                                         // would report the cancelled turn as a normal completion.
@@ -5033,6 +5355,13 @@ export class ClaudeAcpAgent {
                             }
                         }
                         if (session.cancelled) {
+                            // The work the cancel stopped ends its tools with error results.
+                            // Until the client is told that the work ended, they close the
+                            // tool calls it opened. Everything else that work sends is
+                            // dropped, and so is everything after that report.
+                            if (message.type === "user" && !this.workEndReported(params.sessionId, session)) {
+                                await sendInterruptedToolResults(message);
+                            }
                             break;
                         }
                         // Synthetic assistant frames carry the CLI's local-command output.
@@ -5164,6 +5493,7 @@ export class ClaudeAcpAgent {
                             const streamed = streamedBlocksOf(message.parent_tool_use_id);
                             content = unstreamedRemainder(message.message.content, streamed);
                             streamed.length = 0;
+                            droppedStreams.delete(message.parent_tool_use_id ?? "");
                         }
                         else if (message.type === "assistant") {
                             // Nested text/thinking stays internal for a client that does
@@ -5176,19 +5506,41 @@ export class ClaudeAcpAgent {
                         }
                         const acceptedPlanToolUseId = observeExitPlanToolResults(message, content, session);
                         let backgroundedToolCalls = new Set();
+                        let runningTerminal;
                         if (message.type === "user") {
                             rememberResolvedToolNames(session, content);
                             const backgroundBashTask = backgroundBashTaskFromToolResult(content, message.tool_use_result, session.toolUseCache);
                             if (backgroundBashTask)
                                 await asyncTasks.taskBackgrounded(backgroundBashTask);
+                            // The command's terminal runs until its task ends, unless the
+                            // task has ended already (a fast command can end before the tool
+                            // result comes).
+                            const terminalId = backgroundBashTask?.toolCallId;
+                            if (terminalId &&
+                                this.toolCallCapabilities.terminalOutput &&
+                                !this.toolCallCapabilities.air.client &&
+                                session.liveBackgroundTasks.has(backgroundBashTask.taskId)) {
+                                runningTerminal = terminalId;
+                                (session.backgroundTerminals ??= new Map()).set(backgroundBashTask.taskId, {
+                                    toolCallId: terminalId,
+                                    ...(message.parent_tool_use_id
+                                        ? { parentToolUseId: message.parent_tool_use_id }
+                                        : {}),
+                                });
+                            }
                             await asyncTasks.toolResults(content);
                             backgroundedToolCalls = backgroundedBashToolCallIds(content, session.toolUseCache, asyncTasks, backgroundBashTask);
                             const resumedAgentId = resumedNativeSubagentId(message.tool_use_result);
                             if (resumedAgentId) {
-                                resumeLiveTask(resumedAgentId);
-                                await subagents.taskResumed(resumedAgentId, sendUpdate, sendMessageResumePrompt(session.toolUseCache, resumedAgentId, Array.isArray(content)
+                                const resume = sendMessageResume(session.toolUseCache, resumedAgentId, Array.isArray(content)
                                     ? content.flatMap((block) => block.type === "tool_result" ? [block.tool_use_id] : [])
-                                    : []));
+                                    : []);
+                                // In the RFD form the result can arrive after the run it
+                                // started ended, and then resumes nothing.
+                                if (!subagents.isEndedDelegation(resumedAgentId, resume?.toolUseId)) {
+                                    resumeLiveTask(resumedAgentId);
+                                    await subagents.sendMessageResumed(resumedAgentId, sendUpdate, resume?.text, resume?.toolUseId);
+                                }
                             }
                         }
                         for (const notification of toAcpNotifications(content, message.message.role, params.sessionId, session.toolUseCache, routedNotificationClient, this.logger, {
@@ -5211,7 +5563,7 @@ export class ClaudeAcpAgent {
                             // filtered out of `content` above; blocks that do pass through
                             // (e.g. a subagent image) carry the stamped parentToolUseId
                             // meta and are excluded there.
-                            await sendUpdate(backgroundedBashToolCall(acceptedPlanToolResult(notification, acceptedPlanToolUseId), backgroundedToolCalls, asyncTasks.enabled));
+                            await sendUpdate(withRunningTerminal(backgroundedBashToolCall(acceptedPlanToolResult(notification, acceptedPlanToolUseId), backgroundedToolCalls, asyncTasks.enabled), runningTerminal));
                         }
                         break;
                     }
@@ -5235,10 +5587,14 @@ export class ClaudeAcpAgent {
                         if (toolCallId === null || !session.emittedToolCalls.has(toolCallId)) {
                             break;
                         }
-                        const subagentParentToolUseId = message.parent_tool_use_id
-                            ? [...session.liveBackgroundTasks.values()].some((task) => task.isSubagent && task.parentToolUseId === message.parent_tool_use_id)
-                                ? message.parent_tool_use_id
-                                : undefined
+                        // The beat is in the subagent whose Agent call is
+                        // `parent_tool_use_id`, unless it reports on that Agent call
+                        // itself: the Agent call's own heartbeat falls back to its id, and
+                        // a tool call is never its own parent.
+                        const subagentParentToolUseId = message.parent_tool_use_id &&
+                            message.parent_tool_use_id !== toolCallId &&
+                            [...session.liveBackgroundTasks.values()].some((task) => task.isSubagent && task.parentToolUseId === message.parent_tool_use_id)
+                            ? message.parent_tool_use_id
                             : undefined;
                         // `tool_name` names the tool that reports the beat. When the beat
                         // falls back to the parent call, AIR gets the name of that call,
@@ -5433,6 +5789,16 @@ export class ClaudeAcpAgent {
             return;
         }
         session.cancelled = true;
+        // Before anything awaits, so a model request that the consumer reads in
+        // the meantime is already judged against these prompts.
+        session.cancelledPrompts ??= new Set();
+        for (const turn of session.turnQueue ?? []) {
+            if (turn.settled)
+                continue;
+            session.cancelledPrompts.add(turn.promptUuid);
+            for (const uuid of turn.steeredUuids ?? [])
+                session.cancelledPrompts.add(uuid);
+        }
         for (const turn of session.turnQueue ?? [])
             turn.localCommandAbort?.abort();
         session.pendingExitPlanModeInterruption = undefined;
@@ -5451,17 +5817,29 @@ export class ClaudeAcpAgent {
         // their compaction is running. Close it before ANY cancelled prompt
         // resolves, not just the active-turn idle/backstop paths.
         await session.contextCompaction?.interrupt();
+        // A cancel drops the state of each tool call (the session that a
+        // permission request emitted it in, the fields the client holds, the hook
+        // callbacks), even when publishing fails. AIR's draft ends every child
+        // here, so a later update of an ended child's tool call is then dropped
+        // instead of reaching that child's session. The RFD form keeps the state:
+        // a background subagent can keep running after a cancel
+        // (agentclientprotocol/agent-client-protocol#2308), and its tool call that
+        // a permission request emitted on the root before the child was announced
+        // must stay on the root, which the RFD requires. Each tool call drops its
+        // own state when it ends.
         try {
-            await session.nativeSubagentRuntime?.finishAll("cancelled", session.nativeSubagentDeliver ??
+            await session.nativeSubagentRuntime?.parentCancelled(session.nativeSubagentDeliver ??
                 (async (notification) => this.client.sessionUpdate(asSdkSessionNotification(notification))));
         }
         catch (error) {
             this.logger.error(`Session ${params.sessionId}: failed to publish cancelled subagent state`, error);
         }
         finally {
-            session.eagerToolCallSessions?.clear();
-            session.toolCallFields?.clear();
-            clearHookCallbacks(params.sessionId);
+            if (session.nativeSubagentRuntime?.form !== "rfd") {
+                session.eagerToolCallSessions?.clear();
+                session.toolCallFields?.clear();
+                clearHookCallbacks(params.sessionId);
+            }
         }
         // The user messages this cancel abandons while Claude Code may still have
         // them queued: they are dropped from its queue before the interrupt.
@@ -5483,9 +5861,10 @@ export class ClaudeAcpAgent {
         // never decrements the count) to miss.
         const lifecycleLane = session.msgLifecycleV1 === true;
         // Settle queued turns that haven't started yet (no echo seen) right away —
-        // they have no in-flight SDK work to interrupt. The active turn is settled
-        // by the consumer when it observes the interrupt's trailing idle (or via the
-        // backstop below). Mirrors the old pendingMessages cancellation.
+        // they have no in-flight SDK work to interrupt. The consumer settles the
+        // active turn at its interrupted result, or at the idle when that never
+        // comes (or via the backstop below). Mirrors the old pendingMessages
+        // cancellation.
         const orphanedTurns = [];
         if (session.turnQueue) {
             for (const turn of session.turnQueue) {
@@ -5571,14 +5950,19 @@ export class ClaudeAcpAgent {
         // whose session sits idle gets no trailing idle (the interrupt emits
         // nothing; with no state events consumed yet, the same is assumed).
         // A held turn whose followup cycle is live (running, or blocked on a
-        // permission request) is left to that idle, like any live turn: the
-        // interrupt still flushes the cycle's output, which must reach the client
-        // before the turn ends cancelled. The captured outcome preserves usage and
-        // metadata (issue #844), while reporter state makes a late checkpoint
-        // response harmless.
+        // permission request) is left to that cycle's interrupted result, like any
+        // live turn, or to the idle when no result comes. The captured outcome
+        // preserves usage and metadata (issue #844), while reporter state makes a
+        // late checkpoint response harmless.
+        // Since CLI 2.1.270, Claude Code reports `running` for as long as
+        // background agents live, so the session state cannot tell a live
+        // followup from a hold. With request markers, a followup is live when one
+        // of its model requests started after the turn's result.
         {
             const active = session.activeTurn;
-            const followupLive = session.lastSessionState === "running" || session.lastSessionState === "requires_action";
+            const followupLive = session.requestMarkerListsV1
+                ? session.modelRequestSinceResult === true
+                : session.lastSessionState === "running" || session.lastSessionState === "requires_action";
             if (active &&
                 (active.settling || (isHeldOpen(active) && !followupLive)) &&
                 (active.deferredSettle ?? active.settlingOutcome)) {
@@ -5618,7 +6002,7 @@ export class ClaudeAcpAgent {
             }
         }
         // A steered active turn (see Turn.steeredEchoes) settles "cancelled" in the
-        // consumer at the interrupt's trailing idle, like any live turn. But the
+        // consumer at its interrupted result, or at the idle, like any live turn. But the
         // steer lane pays for its last result's trailer by settling on it, which
         // this cancel pre-empts, so count that trailer here or it arrives un-owed
         // against the next prompt and false-fails it (issue #825). Over-counting
@@ -5649,6 +6033,10 @@ export class ClaudeAcpAgent {
         }
         // Before the interrupt: once it stops the running turn, Claude Code starts
         // the next queued message right away.
+        // A prompt or steer that arrived while this cancel awaited is abandoned
+        // too, after the record above was taken.
+        for (const uuid of abandoned)
+            (session.cancelledPrompts ??= new Set()).add(uuid);
         this.dropQueuedMessages(params.sessionId, session.query, abandoned);
         const interrupt = session.query.interrupt();
         if (!options.awaitInterrupt) {
@@ -5769,6 +6157,9 @@ export class ClaudeAcpAgent {
         catch (error) {
             this.logger.error(`Session ${sessionId}: cancellation failed during teardown`, error);
         }
+        // The turns end before this returns; so does a model cycle that Claude
+        // Code started on its own, which no turn waits for.
+        this.endAutonomousCycle(sessionId, { outcome: { stopReason: "cancelled" } });
         // cancel() arms the force-cancel floor and interrupts gracefully, but a
         // wedged consumer only wakes when `cancelController` aborts — closeQueryStream
         // below doesn't touch it. Since we're tearing the session down anyway, wake
@@ -5910,7 +6301,12 @@ export class ClaudeAcpAgent {
         // A replay rebuilds the client view, so its plan goes out again.
         if (session?.taskState)
             forgetPublishedTaskPlan(session.taskState);
-        const forwardSubagentText = session?.forwardSubagentText ?? supportsSubagentTranscript(this.clientCapabilities);
+        // A subagent's text replays onto the root only for a client that gets it
+        // there live: one without native subagent sessions that asked for the
+        // flattened transcript. With native sessions the text goes to the child
+        // session, which AIR's replay restores and the RFD form leaves out for now.
+        const forwardSubagentText = !clientSupportsSubagents(this.clientCapabilities) &&
+            (session?.forwardSubagentText ?? supportsSubagentTranscript(this.clientCapabilities));
         const supportsTypedFailures = supportsAirSessionFailures(this.clientCapabilities);
         const activeUsageLimit = supportsTypedFailures ? activeUsageLimitMessage(messages) : undefined;
         const sessionFailures = session && supportsTypedFailures
@@ -5929,7 +6325,11 @@ export class ClaudeAcpAgent {
             })
             : undefined;
         let replayTurnId;
-        const nativeReplayEnabled = clientSupportsSubagents(this.clientCapabilities);
+        // AIR's draft replays each child under a replay id. A client on the RFD
+        // form gets each child under the session id it had live (see
+        // `RfdSubagentReplay`).
+        const form = subagentForm(this.clientCapabilities);
+        const nativeReplayEnabled = form === "air";
         const replayCompactionUpdates = clientSupportsCompactionUpdates(this.clientCapabilities);
         const replayTerminalStates = new Map();
         const replayChildren = new Map();
@@ -6032,8 +6432,17 @@ export class ClaudeAcpAgent {
         // Only a history with an Agent or Task launch has subagent transcripts to read.
         const subagents = nativeReplayEnabled && replayChildren.size > 0
             ? await subagentHistory(sessionId)
-            : { ids: new Map() };
+            : { agents: new Map() };
         const replayedSubagents = new Set();
+        const rfdHistory = form === "rfd" &&
+            messages.some((message) => subagentLaunchIds(message.message?.content)
+                .length > 0)
+            ? await subagentHistory(sessionId)
+            : { agents: new Map() };
+        const rfdReplay = form === "rfd"
+            ? new RfdSubagentReplay(rfdHistory, (notification) => this.client.sessionUpdate(asSdkSessionNotification(notification)))
+            : undefined;
+        rfdReplay?.scan(messages, sessionId);
         // History persists no task_started frame, so a background task gets its
         // spawn from the notification of its stop, with the tool call that
         // started it. A task still running at the end of the history gets no
@@ -6052,6 +6461,8 @@ export class ClaudeAcpAgent {
         });
         // The replay counterpart of the live `task_notification` frame.
         const restoreTaskNotification = async (notification) => {
+            if (rfdReplay?.taskNotification(notification.task_id, notification.status))
+                return;
             const toolUseId = notification.tool_use_id;
             if (!toolUseId)
                 return;
@@ -6078,7 +6489,8 @@ export class ClaudeAcpAgent {
             });
             await replayAsyncTasks.taskNotification(notification);
         };
-        const replayMessage = async (message) => {
+        /** Replays `message`, from the transcript of `child` when it is set (the RFD form). */
+        const replayMessage = async (message, child) => {
             // A long history is sent in order, but with event-loop turns in between,
             // so other sessions and incoming requests are not starved meanwhile.
             const pause = messageLoopYielder.maybeYield();
@@ -6087,6 +6499,10 @@ export class ClaudeAcpAgent {
             if (pending?.stopped || isReplayHiddenMetaMessage(message)) {
                 return;
             }
+            // In the RFD form a child's history comes from its own transcript, so a
+            // subagent message that the session transcript stores inline is skipped.
+            if (rfdReplay && !child && parentToolUseIdOf(message))
+                return;
             if (message.type === "user" &&
                 message.parent_tool_use_id === null &&
                 typeof message.uuid === "string" &&
@@ -6126,11 +6542,14 @@ export class ClaudeAcpAgent {
             // @ts-expect-error - untyped in SDK but we handle all of these
             let content = message.message.content;
             const parentToolUseId = parentToolUseIdOf(message);
-            const replayTargetSessionId = nativeReplayEnabled && parentToolUseId
-                ? await announceReplayChild(parentToolUseId)
-                : sessionId;
+            const replayTargetSessionId = child
+                ? child.sessionId
+                : nativeReplayEnabled && parentToolUseId
+                    ? await announceReplayChild(parentToolUseId)
+                    : sessionId;
             if (message.type === "assistant" &&
                 parentToolUseId &&
+                !child &&
                 !nativeReplayEnabled &&
                 !forwardSubagentText) {
                 content = stripSubagentTextAndThinking(content);
@@ -6144,6 +6563,9 @@ export class ClaudeAcpAgent {
                 }
                 // Live, the prompt loop skips this record and the SDK frame reports the stop.
                 content = isTaskNotificationRecord(message) ? null : stripLocalCommandMetadata(content);
+                if (content !== null && child && rfdReplay) {
+                    content = await rfdReplay.childContent(child, message, content);
+                }
                 if (content === null)
                     return;
             }
@@ -6215,32 +6637,37 @@ export class ClaudeAcpAgent {
             if (nativeReplayEnabled && message.type === "assistant") {
                 for (const toolUseId of subagentLaunchIds(content)) {
                     await announceReplayChild(toolUseId);
-                    const agentId = subagents.ids.get(toolUseId);
+                    const agentId = subagents.agents.get(toolUseId)?.agentId;
                     if (!agentId || replayedSubagents.has(agentId))
                         continue;
                     replayedSubagents.add(agentId);
-                    let childMessages = [];
-                    try {
-                        // With the project directory, the SDK skips its search of every project.
-                        // A session opened from another directory falls back to that search.
-                        if (subagents.dir) {
-                            childMessages = await getSubagentMessages(sessionId, agentId, { dir: subagents.dir });
-                        }
-                        if (childMessages.length === 0) {
-                            childMessages = await getSubagentMessages(sessionId, agentId);
-                        }
-                    }
-                    catch (error) {
-                        this.logger.error(`Failed to read the history of subagent ${agentId}:`, error);
-                    }
+                    const childMessages = await readSubagentMessages(sessionId, agentId, subagents, this.logger);
                     registerLaunches(childMessages);
                     for (const childMessage of childMessages)
                         await replayMessage(childMessage);
                 }
             }
+            // The RFD form announces a child right after its launch, then sends its
+            // own transcript to it.
+            if (rfdReplay && message.type === "assistant") {
+                for (const toolUseId of subagentLaunchIds(content)) {
+                    const launched = rfdReplay.childOfLaunch(toolUseId);
+                    if (!launched || launched.announced)
+                        continue;
+                    await rfdReplay.announce(launched);
+                    const childMessages = await readSubagentMessages(sessionId, launched.sessionId, rfdHistory, this.logger);
+                    rfdReplay.scan(childMessages, launched.sessionId);
+                    for (const childMessage of childMessages)
+                        await replayMessage(childMessage, launched);
+                    await rfdReplay.childReplayed(launched, childMessages);
+                }
+            }
         };
         for (const message of messages)
             await replayMessage(message);
+        if (rfdReplay && !pending?.stopped) {
+            await rfdReplay.finish(clientSupportsNotices(this.clientCapabilities), sessionId);
+        }
         if (nativeReplayEnabled && !pending?.stopped) {
             // Claude history persists sidechain messages and Agent/Task tool uses,
             // but not task_started/task_updated lifecycle frames. Recover terminal
@@ -6275,43 +6702,121 @@ export class ClaudeAcpAgent {
         const response = await this.client.writeTextFile(params);
         return response;
     }
-    /** Mark a client request as blocking on user input for exactly the lifetime
-     *  of its promise. Steering consults this session-local count synchronously,
-     *  so a message arriving while any permission/elicitation card is open uses
-     *  non-interrupting SDK delivery. The active turn reports that it awaits the
-     *  user while any such request is open (see `syncAwaitingUser`). */
-    async withPendingUserInput(sessionId, request) {
+    /** Runs `request`, a request that `requestSessionId` sends for the session
+     *  `ownerSessionId`. When that is a subagent's child session, the child
+     *  reports that it awaits the user while the request is open (the RFD form,
+     *  see `NativeSubagentRuntime.awaitingUser`). */
+    withChildAwaitingUser(ownerSessionId, requestSessionId, request) {
+        const runtime = this.sessions[ownerSessionId]?.nativeSubagentRuntime;
+        return runtime && requestSessionId !== ownerSessionId
+            ? runtime.awaitingUser(requestSessionId, request)
+            : request();
+    }
+    /** Mark a client request of the subagent `agentID` (absent for the main
+     *  conversation) as awaiting user input for exactly the lifetime of its
+     *  promise (see `Session.openUserInputs`). Steering consults the open
+     *  requests synchronously, so a message arriving while any permission or
+     *  elicitation card is open uses non-interrupting SDK delivery. */
+    async withPendingUserInput(sessionId, request, agentID) {
         const session = this.sessions[sessionId];
         if (!session)
             return request();
-        session.pendingUserInputCount = (session.pendingUserInputCount ?? 0) + 1;
-        this.syncAwaitingUser(session);
+        const input = agentID !== undefined ? { agentID } : {};
+        (session.openUserInputs ??= new Set()).add(input);
+        this.syncAwaitingUser(sessionId, session);
         try {
             return await request();
         }
         finally {
-            session.pendingUserInputCount = Math.max(0, (session.pendingUserInputCount ?? 1) - 1);
-            this.syncAwaitingUser(session);
-        }
-    }
-    /** Report whether the session's active turn awaits the user: exactly while
-     *  a permission request or question is open in the session. A request does
-     *  not say which prompt it is for, and Claude Code can ask for a queued
-     *  prompt before the consumer activates it, so a request is not tied to the
-     *  turn that was active when it opened. Called when the count changes and
-     *  when a turn activates. */
-    syncAwaitingUser(session) {
-        const turn = session.activeTurn;
-        if (!turn || turn.settled || !turn.insertedReported)
+            session.openUserInputs.delete(input);
+            this.syncAwaitingUser(sessionId, session);
+        }
+    }
+    /** Report whether the session's foreground work awaits the user: exactly
+     *  while a permission request or question that blocks it is open (see
+     *  {@link blocksForeground}). A request does not say which prompt it is for,
+     *  and Claude Code can ask for a queued prompt before the consumer activates
+     *  it, so a request is not tied to the work that was running when it
+     *  opened. Called when a request opens or closes, when a turn activates, and
+     *  when a task registers or moves to the background. */
+    syncAwaitingUser(sessionId, session) {
+        const work = this.foregroundWork.get(sessionId);
+        if (!work)
             return;
-        const waiting = (session.pendingUserInputCount ?? 0) > 0;
-        if (waiting === (turn.awaitingUser ?? false))
+        const waiting = [...(session.openUserInputs ?? [])].some((input) => blocksForeground(session, input.agentID));
+        if (waiting === work.awaitingUser)
             return;
-        turn.awaitingUser = waiting;
+        work.awaitingUser = waiting;
         if (waiting)
-            turn.events.awaitingUser();
+            work.events.awaitingUser();
+        else
+            work.events.running();
+    }
+    /** Make `owner` the foreground work of the session `sessionId` (see
+     *  {@link ForegroundEvents}): it reports `running`, then waits at once if a
+     *  request is open. If work already runs, it goes on under `owner` and
+     *  reports nothing new: a turn takes over a cycle that Claude Code started on
+     *  its own, and only the owner's end ends the work. */
+    startForeground(sessionId, owner) {
+        if (!this.foregroundEvents)
+            return;
+        const current = this.foregroundWork.get(sessionId);
+        if (current) {
+            current.owner = owner;
+            return;
+        }
+        const events = this.foregroundEvents(sessionId);
+        this.foregroundWork.set(sessionId, { owner, events, awaitingUser: false });
+        events.running();
+        const session = this.sessions[sessionId];
+        if (session)
+            this.syncAwaitingUser(sessionId, session);
+    }
+    /** End the foreground work of the session `sessionId` with `outcome`, or as
+     *  failed with `error`, if `owner` is that work. */
+    endForeground(sessionId, owner, end) {
+        const work = this.foregroundWork.get(sessionId);
+        if (work?.owner !== owner)
+            return;
+        this.foregroundWork.delete(sessionId);
+        if ("outcome" in end)
+            work.events.ended(end.outcome);
         else
-            turn.events.resumed();
+            work.events.failed(end.error);
+    }
+    /** Start a model cycle that Claude Code started on its own as the foreground
+     *  work (see {@link ForegroundEvents}) when `message` is its first output:
+     *  model output of the main conversation (not a subagent's) while no work
+     *  runs. That includes a turn that v1 holds for its background subagents,
+     *  whose work ended at its result, so its follow-up is a cycle. Output of
+     *  the work a cancel stopped starts nothing (see Session.cancelled). */
+    startAutonomousCycle(sessionId, session, message) {
+        if (!this.foregroundEvents || this.foregroundWork.has(sessionId) || session.cancelled)
+            return;
+        if (message.type !== "assistant" && message.type !== "stream_event")
+            return;
+        if (message.parent_tool_use_id !== null)
+            return;
+        // A turn that Claude Code started is the foreground work already. Without
+        // lifecycle frames, a queued turn's output can come before its echo, so
+        // output while a turn is queued may be that turn's. With them, a turn that
+        // Claude Code has not started has no output yet.
+        const queued = (session.turnQueue ?? []).some((turn) => !turn.settled && turn !== session.activeTurn);
+        if (queued && !session.msgLifecycleV1)
+            return;
+        this.startForeground(sessionId, AUTONOMOUS_CYCLE);
+    }
+    /** Whether the client has been told that the session's work ended: on v2 by
+     *  an idle state, so no foreground work is open, including a cycle that
+     *  Claude Code started on its own; on v1 by the response to the turn's
+     *  prompt, so no turn is active. */
+    workEndReported(sessionId, session) {
+        return this.foregroundEvents ? !this.foregroundWork.has(sessionId) : !session.activeTurn;
+    }
+    /** End the session's model cycle that Claude Code started on its own, if one
+     *  runs. */
+    endAutonomousCycle(sessionId, end) {
+        this.endForeground(sessionId, AUTONOMOUS_CYCLE, end);
     }
     /** Forward a permission request to the client, wiring the tool call's
      *  `signal` through as a `cancellationSignal`. When the turn is cancelled
@@ -6319,7 +6824,7 @@ export class ClaudeAcpAgent {
      *  `$/cancel_request`, and our local abort race settles even if the client
      *  ignores it. A `cancelled` outcome, request rejection, and local abort all
      *  surface the same "Tool use aborted" the callers already expect. */
-    async requestPermissionFromClient(params, toolName, signal, parentToolUseId, ownerSessionId, toolInput, previewContent) {
+    async requestPermissionFromClient(params, toolName, signal, parentToolUseId, ownerSessionId, agentID, toolInput, previewContent) {
         if (signal.aborted)
             throw new Error("Tool use aborted");
         // The SDK may invoke `canUseTool` (and therefore this permission request)
@@ -6337,7 +6842,7 @@ export class ClaudeAcpAgent {
         // The request goes to a subagent's child session for a tool call of that
         // subagent, but it blocks the turn of the owner session.
         try {
-            return await this.withPendingUserInput(ownerSessionId, () => raceWithAbort(this.client.requestPermission(params, signal), signal));
+            return await this.withChildAwaitingUser(ownerSessionId, params.sessionId, () => this.withPendingUserInput(ownerSessionId, () => raceWithAbort(this.client.requestPermission(params, signal), signal), agentID));
         }
         catch (error) {
             if (signal.aborted) {
@@ -6377,6 +6882,8 @@ export class ClaudeAcpAgent {
             return;
         }
         session.emittedToolCalls.add(toolCallId);
+        if (parentToolUseId)
+            recordToolCallParent(session, toolCallId, parentToolUseId);
         // SandboxNetworkAccess is a permission-only callback, not an executing
         // tool: the SDK does not send a tool_result for its synthetic id.
         if (!parentToolUseId &&
@@ -6401,6 +6908,7 @@ export class ClaudeAcpAgent {
             session.emittedToolCalls.delete(toolCallId);
             session.eagerToolCallSessions?.delete(toolCallId);
             session.toolCallFields?.delete(toolCallId);
+            session.toolCallParents?.delete(toolCallId);
             throw error;
         }
     }
@@ -6510,7 +7018,7 @@ export class ClaudeAcpAgent {
                 // Like permission requests, the elicitation references this toolUseID, so
                 // make sure the tool_call has surfaced to the client before we send it.
                 await this.ensureToolCallEmitted(sessionId, toolName, toolUseID, toolInput, parentToolUseId, signal, permissionSessionId);
-                return this.handleAskUserQuestion(sessionId, permissionSessionId, toolInput, toolUseID, signal);
+                return this.handleAskUserQuestion(sessionId, permissionSessionId, toolInput, toolUseID, signal, agentID);
             }
             // Do not auto-allow here based on the session's advertised mode. Claude
             // Code applies bypassPermissions before invoking canUseTool; a request
@@ -6579,7 +7087,7 @@ export class ClaudeAcpAgent {
                 ...presentation,
                 options: permissionOptions,
                 sessionId: permissionSessionId,
-            }, toolName, signal, parentToolUseId, sessionId, toolInput, previewContent);
+            }, toolName, signal, parentToolUseId, sessionId, agentID, toolInput, previewContent);
             if (signal.aborted)
                 throw new Error("Tool use aborted");
             const decodedPermission = decodeClaudePermissionResponse(response, toolName, toolInput, toolUseID, permissionOptions, durableChangeSet);
@@ -6667,7 +7175,7 @@ export class ClaudeAcpAgent {
      * The elicitation goes to `requestSessionId`, a subagent's child session for
      * a question it asks, and blocks the turn of `sessionId`.
      */
-    async handleAskUserQuestion(sessionId, requestSessionId, toolInput, toolUseID, signal) {
+    async handleAskUserQuestion(sessionId, requestSessionId, toolInput, toolUseID, signal, agentID) {
         const questions = extractAskUserQuestions(toolInput);
         if (!questions) {
             return { behavior: "deny", message: "AskUserQuestion called with no valid questions." };
@@ -6675,7 +7183,7 @@ export class ClaudeAcpAgent {
         const createRequest = askUserQuestionsToCreateRequest(questions, requestSessionId, toolUseID, this.toolCallCapabilities.air.client);
         let response;
         try {
-            response = await this.withPendingUserInput(sessionId, () => this.client.createElicitation(createRequest, signal));
+            response = await this.withChildAwaitingUser(sessionId, requestSessionId, () => this.withPendingUserInput(sessionId, () => this.client.createElicitation(createRequest, signal), agentID));
         }
         catch (error) {
             // A cancellation we requested (signal aborted) settles as an aborted tool
@@ -7338,28 +7846,23 @@ export class ClaudeAcpAgent {
         // into the query.
         const resolvedProvider = this.resolveProviderConfig();
         const providerEnv = createEnvForProvider(resolvedProvider);
-        const configuredSettings = userProvidedOptions?.settings ??
-            (modelConfig
-                ? {
-                    ...(modelConfig.modelOverrides && { modelOverrides: modelConfig.modelOverrides }),
-                    ...(modelConfig.availableModels && { availableModels: modelConfig.availableModels }),
-                }
-                : undefined);
-        const configuredSettingsObject = typeof configuredSettings === "string"
-            ? JSON.parse(await fs.readFile(path.resolve(params.cwd, configuredSettings), "utf8"))
-            : configuredSettings;
+        const providedSettings = userProvidedOptions?.settings;
+        const providedSettingsObject = typeof providedSettings === "string"
+            ? JSON.parse(await fs.readFile(path.resolve(params.cwd, providedSettings), "utf8"))
+            : providedSettings;
+        const configuredSettingsObject = modelConfig
+            ? { ...modelConfig, ...providedSettingsObject }
+            : providedSettingsObject;
         // Claude Code applies env from settings.json after the subprocess env. Put
         // an active ACP route in the programmatic settings tier too so user/project
         // settings cannot silently restore a different ANTHROPIC_BASE_URL.
-        let settings = configuredSettings;
-        if (resolvedProvider) {
-            const baseSettings = configuredSettingsObject;
-            settings = {
-                ...baseSettings,
+        const settings = resolvedProvider
+            ? {
+                ...configuredSettingsObject,
                 apiKeyHelper: "",
-                env: { ...baseSettings?.env, ...providerEnv },
-            };
-        }
+                env: { ...configuredSettingsObject?.env, ...providerEnv },
+            }
+            : configuredSettingsObject;
         const env = {
             ...process.env,
             ...userProvidedOptions?.env,
@@ -7551,6 +8054,8 @@ export class ClaudeAcpAgent {
             prompt: input,
             options,
         });
+        this.useAuthStatusSettings(settingsManager, configuredSettingsObject, userProvidedOptions?.env);
+        const authSettingsEpoch = this.authEpoch;
         timing.phase("prepare-query");
         // `query()` spawns the CLI at once. Any throw between here and the
         // registration in `this.sessions` would leave that child process running
@@ -7573,7 +8078,9 @@ export class ClaudeAcpAgent {
             // Publish the identity BEFORE the guard can refuse this session. A
             // refusal is exactly when the client most needs to know which account it
             // was refused for.
-            this.publishSessionAccountIdentity(initializationResult.account);
+            if (authSettingsEpoch === this.authEpoch) {
+                this.publishSessionAccountIdentity(initializationResult.account, settingsManager.getApiKeyHelper(configuredSettingsObject));
+            }
             // Shared with the per-turn guard, so "warn once" spans the whole session.
             const claudeSubscriptionGuard = {};
             if (this.claudeSubscriptionGuardActive()) {
@@ -7775,7 +8282,7 @@ export class ClaudeAcpAgent {
                 messageIdToUuid: creationOpts.replayState?.messageIdToUuid ?? new Map(),
                 sessionFailureState: creationOpts.replayState?.sessionFailureState ?? createSessionFailureState(),
                 claudeSubscriptionGuard,
-                accountKind: fromAccountInfo(initializationResult.account)?.kind,
+                accountKind: fromAccountInfo(initializationResult.account, settingsManager.getApiKeyHelper(configuredSettingsObject))?.kind,
                 fileChangeReporter,
             };
             timing.phase("register");
@@ -7925,6 +8432,37 @@ function cancelledOutcome(session, turn) {
         ...(recorded._meta ? { _meta: recorded._meta } : {}),
     };
 }
+/** Whether the model request that `status` (a `status: requesting` frame)
+ *  starts may belong to the work a cancel stopped. It may while:
+ *  - a turn in {@link Session.cancelledPrompts} is unsettled: the stopped
+ *    turn, whose result is still to come;
+ *  - the orphan accounting still expects the result of an abandoned prompt
+ *    that Claude Code may still run, which it can fold into its own
+ *    follow-up after that follow-up's first request;
+ *  - the request serves one of {@link Session.cancelledPrompts}, as an
+ *    abandoned prompt's request does even when the interrupt receipt left it
+ *    out of the orphan accounting;
+ *  - the request serves an unsettled prompt. One that arrived while the cancel
+ *    awaited is recorded only when the cancel sweeps the queue, and its echo
+ *    ends the cancel right after its request when the cancel does not.
+ *  A prompt that is merely queued does not make another request belong to
+ *  the stopped work: a follow-up that Claude Code runs before a prompt sent
+ *  after the cancel names no prompt. */
+function servesCancelledWork(session, status) {
+    const cancelled = session.cancelledPrompts;
+    if (!cancelled)
+        return false;
+    const unsettled = (session.turnQueue ?? []).filter((turn) => !turn.settled);
+    if (unsettled.some((turn) => cancelled.has(turn.promptUuid)))
+        return true;
+    if ((session.pendingOrphanResults ?? 0) > 0 || (session.orphanCommands?.size ?? 0) > 0) {
+        return true;
+    }
+    const served = status.user_message_uuids;
+    return (Array.isArray(served) &&
+        served.some((uuid) => typeof uuid === "string" &&
+            (cancelled.has(uuid) || unsettled.some((turn) => turn.promptUuid === uuid))));
+}
 /** `_meta.quota` for a prompt response: what the turn spent, shaped like
  *  codex-acp's (snake_case container keys, camelCase counters) so a client
  *  reads one shape from either agent.
@@ -7937,16 +8475,88 @@ function cancelledOutcome(session, turn) {
  *  so the rows can total more than `token_count`. They are the fuller picture,
  *  not a decomposition of it. */
 function turnQuotaMeta(session) {
+    return quotaMeta(session.accumulatedUsage, session.accumulatedModelUsage);
+}
+/** `_meta.quota` for work that spent `usage` in its main agent loop and
+ *  `modelUsage` by model (see {@link turnQuotaMeta}). */
+function quotaMeta(usage, modelUsage) {
     return {
         quota: {
-            token_count: quotaTokenCount(session.accumulatedUsage),
-            model_usage: Object.entries(session.accumulatedModelUsage ?? {}).map(([model, usage]) => ({
+            token_count: quotaTokenCount(usage),
+            model_usage: Object.entries(modelUsage ?? {}).map(([model, usage]) => ({
                 model,
                 token_count: quotaTokenCount(usage),
             })),
         },
     };
 }
+/** Whether a request that awaits the user for the subagent `agentID` (absent
+ *  for the main conversation) blocks the session's foreground work. The main
+ *  conversation's requests do. So do those of a subagent that runs in the
+ *  foreground of the main conversation, since the tool call that spawned it
+ *  waits on it, and so on up a chain of such subagents. A request of a
+ *  subagent in the background, or nested inside one, does not: the main
+ *  conversation goes on without it. Nor does one of an agent without a
+ *  record: a teammate, a settled subagent, or one that Claude Code left out
+ *  of its background tasks and the consumer pruned, which only happens to a
+ *  subagent nested in a background one. A subagent that the main
+ *  conversation waits on has a record by the time it asks, as its
+ *  `task_started` comes first; when the consumer reads the request first, the
+ *  `task_started` checks again. */
+function blocksForeground(session, agentID) {
+    const seen = new Set();
+    for (let id = agentID; id !== undefined && !seen.has(id);) {
+        seen.add(id);
+        const task = session.liveBackgroundTasks.get(id);
+        if (!task)
+            return false;
+        if (task.backgrounded)
+            return false;
+        id = task.parentTaskId;
+    }
+    return true;
+}
+/** Whether Claude Code ended the work of `result` because an interrupt
+ *  stopped it, while the model streamed or while a tool ran. */
+function isAbortedResult(result) {
+    return (result.terminal_reason === "aborted_streaming" || result.terminal_reason === "aborted_tools");
+}
+/** How a model cycle that Claude Code started on its own ended, read from its
+ *  result as a turn's is: a refusal, the token limit, and the turn and budget
+ *  limits are their stop reasons, an error result fails the cycle, and a
+ *  cancel ends it `cancelled`. The usage and `_meta.quota` are the result's
+ *  own, `modelUsage` its increment by model, since autonomous results stay out
+ *  of the turn tally. */
+function autonomousCycleEnd(result, modelUsage, cancelled) {
+    // Typed non-null, but third-party backends have been observed omitting
+    // usage token fields (see snapshotFromUsage).
+    const tally = {
+        inputTokens: result.usage.input_tokens ?? 0,
+        outputTokens: result.usage.output_tokens ?? 0,
+        cachedReadTokens: result.usage.cache_read_input_tokens ?? 0,
+        cachedWriteTokens: result.usage.cache_creation_input_tokens ?? 0,
+    };
+    const ended = (stopReason) => ({
+        outcome: {
+            stopReason,
+            usage: { ...tally, totalTokens: tallyTotal(tally) },
+            _meta: quotaMeta(tally, modelUsage),
+        },
+    });
+    if (cancelled)
+        return ended("cancelled");
+    if (result.stop_reason === "refusal")
+        return ended("refusal");
+    if (result.stop_reason === "max_tokens")
+        return ended("max_tokens");
+    if (result.is_error) {
+        const text = result.subtype === "success" ? result.result : result.errors.join(", ") || result.subtype;
+        return { error: RequestError.internalError(undefined, text) };
+    }
+    return ended(result.subtype === "success" || result.subtype === "error_during_execution"
+        ? "end_turn"
+        : "max_turn_requests");
+}
 /** One `token_count` object. `cachedInputTokens` is cache reads, matching
  *  codex's field; Claude also reports cache writes, which codex has no slot
  *  for, so those ride along in an extra sibling (the same name the ACP `usage`
@@ -8577,6 +9187,18 @@ function isTaskTool(toolName) {
 function shouldEmitToolCall(toolName) {
     return toolName !== "TodoWrite" && !isTaskTool(toolName);
 }
+const MAX_TOOL_CALL_PARENTS = 1000;
+/** Records the Agent/Task call that started the subagent making `toolCallId`. */
+function recordToolCallParent(session, toolCallId, parentToolUseId) {
+    const parents = (session.toolCallParents ??= new Map());
+    parents.delete(toolCallId);
+    parents.set(toolCallId, parentToolUseId);
+    if (parents.size > MAX_TOOL_CALL_PARENTS) {
+        const oldest = parents.keys().next().value;
+        if (oldest !== undefined)
+            parents.delete(oldest);
+    }
+}
 const MAX_DISPATCHED_TOOL_CALLS = 1000;
 /** Records a tool call that Claude Code sent to the tool runner. */
 function recordDispatchedToolCall(session, toolCallId) {
@@ -8689,6 +9311,8 @@ export function toAcpNotifications(content, role, sessionId, toolUseCache, clien
         let update = null;
         // The tool call that this chunk finishes, if it is a tool result.
         let finishedToolCallId;
+        // The plan that this chunk approves, if it is an ExitPlanMode result.
+        let approvedPlanUpdate;
         switch (chunk.type) {
             case "text":
             case "text_delta": {
@@ -8846,7 +9470,7 @@ export function toAcpNotifications(content, role, sessionId, toolUseCache, clien
                             update: {
                                 toolCallId: chunk.tool_use_id,
                                 sessionUpdate: "tool_call_update",
-                                status: renderer.resultStatus("is_error" in chunk && chunk.is_error === true, nonExecution),
+                                status: renderer.resultStatus("is_error" in chunk && chunk.is_error === true, nonExecution, { cancelled: options?.cancelled }),
                                 rawOutput: chunk.content,
                             },
                         });
@@ -8875,7 +9499,7 @@ export function toAcpNotifications(content, role, sessionId, toolUseCache, clien
                             },
                             toolCallId: chunk.tool_use_id,
                             sessionUpdate: "tool_call_update",
-                            status: renderer.resultStatus("is_error" in chunk && chunk.is_error === true, nonExecution),
+                            status: renderer.resultStatus("is_error" in chunk && chunk.is_error === true, nonExecution, { cancelled: options?.cancelled }),
                             rawOutput: chunk.content,
                         },
                     });
@@ -8927,6 +9551,7 @@ export function toAcpNotifications(content, role, sessionId, toolUseCache, clien
                         .result(toolUse, chunk, {
                         structured: toolUseResult,
                         nonExecution,
+                        cancelled: options?.cancelled,
                     })
                         .reverse();
                     for (const outputUpdate of rest.reverse()) {
@@ -8935,6 +9560,19 @@ export function toAcpNotifications(content, role, sessionId, toolUseCache, clien
                         }
                         output.push({ sessionId, update: outputUpdate });
                     }
+                    // An approved plan of the main conversation becomes the session's
+                    // markdown plan, after the tool call's result. An approval that
+                    // clears the context ends the tool with an error result instead, and
+                    // the restart into the fresh context publishes that plan (see
+                    // ExitPlanCoordinator.restart).
+                    if (toolUse.name === "ExitPlanMode" &&
+                        options?.clientCapabilities?.plan &&
+                        !options.parentToolUseId &&
+                        !("is_error" in chunk && chunk.is_error)) {
+                        const plan = approvedPlan(toolUse.input, toolUseResult);
+                        if (plan)
+                            approvedPlanUpdate = planModeUpdate(plan);
+                    }
                     update = finalUpdate;
                 }
                 // The tool_use is fully resolved now — drop it so a long session doesn't
@@ -8974,6 +9612,8 @@ export function toAcpNotifications(content, role, sessionId, toolUseCache, clien
                 output.push({ sessionId, update });
             }
         }
+        if (approvedPlanUpdate)
+            output.push({ sessionId, update: approvedPlanUpdate });
         if (finishedToolCallId !== undefined) {
             // The PostToolUse hook can still send the final diff, so the fields
             // stay tracked until its callback leaves the registry.