@agentclientprotocol/claude-agent-acp 0.89.2-preview.9 → 0.90.0

package/dist/acp-agent.js

@@ -1,9 +1,9 @@
 import { agent as acpAgent, CreateElicitationResponse, methods, ndJsonStream, RequestError, } from "@agentclientprotocol/sdk";
-import { getSessionMessages, getSubagentMessages, listSessions, query, } from "@anthropic-ai/claude-agent-sdk";
+import { filterEscalatingDefaultMode, getSessionMessages, listSessions, query, resolveSettings, } from "@anthropic-ai/claude-agent-sdk";
 import { GOAL_ACTIONS, GOAL_CONTROL_METHOD, GOAL_EXTENSION_VERSION, goalUpdateFromPrompt, parseGoalRequest, toGoalSnapshot, } from "./goal-extension.js";
 import { sanitizeTitle, SessionTitles } from "./session-titles.js";
-import { AIR_NATIVE_SUBAGENT_SESSIONS_CAPABILITY, asSdkSessionNotification, clientSupportsSubagents, } from "./acp-subagents.js";
-import { isNativeSubagentControlTool, isNativeSubagentControlUpdate, NativeSubagentRuntime, nativeSubagentState, resumedNativeSubagentId, sendMessageResumePrompt, } from "./native-subagents.js";
+import { AIR_NATIVE_SUBAGENT_SESSIONS_CAPABILITY, asSdkSessionNotification, clientSupportsSubagents, subagentForm, } from "./acp-subagents.js";
+import { isNativeSubagentControlTool, isNativeSubagentControlUpdate, NativeSubagentRuntime, nativeSubagentState, resumedNativeSubagentId, sendMessageResume, sendMessageResumePrompt, } from "./native-subagents.js";
 import { AIR_ASYNC_TASKS_CAPABILITY, AIR_CUSTOM_INSTRUCTIONS_CAPABILITY, airCustomInstructions, AIR_DIFF_PATCH_CAPABILITY, AIR_PLAN_FILE_CAPABILITY, AIR_GOAL_KEY, AIR_KIND_KEY, AIR_RECOMMENDED_CONFIG_VALUE_CAPABILITY, AIR_SKILL_PATH_KEY, clientSupportsAirCapability, withAirMeta, } from "./air-extension.js";
 import * as sessionIndex from "./session-index/connection.js";
 import { AsyncTaskRuntime, backgroundBashTaskFromToolResult, backgroundedBashToolCallIds, clientSupportsAsyncTasks, } from "./async-tasks.js";
@@ -16,7 +16,8 @@ import { promisify } from "node:util";
 import packageJson from "../package.json" with { type: "json" };
 import { applyAskElicitationResponse, askUserQuestionsToCreateRequest, createElicitationResponseToElicitResult, extractAskUserQuestions, extractRefusalFallbackPrompt, mcpElicitationToCreateRequest, REFUSAL_FALLBACK_DIALOG_KIND, refusalFallbackResultFromResponse, refusalFallbackToCreateRequest, } from "./elicitation.js";
 import { forkSession } from "./fork-session.js";
-import { subagentHistory } from "./subagent-history.js";
+import { readSubagentMessages, subagentHistory } from "./subagent-history.js";
+import { RfdSubagentReplay, replaySubagentTerminalState, } from "./subagent-replay.js";
 import { readResumedSession, readResumedTail, } from "./resumed-session.js";
 import { SessionTiming } from "./session-timing.js";
 import { ALLOW_BYPASS } from "./permissions/modes.js";
@@ -32,14 +33,14 @@ import { ContextCompactionLifecycle, clientSupportsCompactionUpdates, contextCom
 import { clientSupportsNotices, MAX_NOTICE_TITLE_LENGTH, normalizeNoticeText, noticeOrTranscriptUpdate, sentenceCase, splitNoticeText, } from "./session-notices.js";
 import { applyTaskCreate, applyTaskList, applyTaskUpdate, clearHookCallbacks, completeHookCallback, createPostToolUseHook, hasHookCallback, createTaskHook, parseTaskCreateOutput, parseTaskListOutput, parseTaskUpdateOutput, planEntries, registerHookCallback, changedTaskPlanEntries, forgetPublishedTaskPlan, unregisterHookCallback, } from "./tools.js";
 import { previewPatchContent } from "./diff.js";
-import { backgroundedBashToolCall } from "./tool-calls/background.js";
+import { backgroundedBashToolCall, withRunningTerminal } from "./tool-calls/background.js";
 import { ChangedMetaFilter } from "./tool-calls/changed-meta-filter.js";
 import { ToolCallFieldTracker } from "./tool-calls/field-tracker.js";
 import { ClientCapabilities as ToolCallClientCapabilities } from "./tool-calls/client-capabilities.js";
 import { AcpToolCallRenderer, isFinalToolCallStatus, } from "./tool-calls/renderer.js";
 import { resolveSkillPath } from "./tool-calls/reporters/interaction.js";
 import { messageLoopYielder, nodeToWebReadable, nodeToWebWritable, Pushable, raceTimeoutAndAbort, unreachable, } from "./utils.js";
-import { acceptedPlanToolResult, ExitPlanCoordinator, isExitPlanInterruptionResult, observeExitPlanToolResults, } from "./exit-plan.js";
+import { acceptedPlanToolResult, approvedPlan, ExitPlanCoordinator, isExitPlanInterruptionResult, observeExitPlanToolResults, planModeUpdate, } from "./exit-plan.js";
 import { DEFAULT_AGENT_ID } from "./session-config-ids.js";
 import { parseToolResultMeta } from "./tool-result-meta.js";
 import { formatUsageResponse, isUsageCommandText, parseUsageResponse } from "./usage-markdown.js";
@@ -548,28 +549,6 @@ function subagentLaunchIds(content) {
         ? [block.id]
         : []);
 }
-function replaySubagentTerminalState(block) {
-    if (block.is_error !== true)
-        return "completed";
-    const text = replayContentText(block.content).toLowerCase();
-    return /\b(?:cancelled|canceled|interrupted|stopped|killed)\b/.test(text)
-        ? "cancelled"
-        : "failed";
-}
-function replayContentText(value, seen = new Set()) {
-    if (typeof value === "string")
-        return value;
-    if (typeof value !== "object" || value === null || seen.has(value))
-        return "";
-    seen.add(value);
-    if (Array.isArray(value))
-        return value.map((item) => replayContentText(item, seen)).join(" ");
-    const record = value;
-    return [record.text, record.content, record.message]
-        .map((item) => replayContentText(item, seen))
-        .filter(Boolean)
-        .join(" ");
-}
 function stripSubagentTextAndThinking(content) {
     if (!Array.isArray(content))
         return content;
@@ -1172,6 +1151,8 @@ export class ClaudeAcpAgent {
     /** Last auth identity reported to the client, connection-scoped like
      *  `authenticate`/`logout`. Undefined means "not determined yet". */
     currentAuthStatus;
+    authStatusSettings;
+    authStatusHelper;
     /** In-flight `claude auth status --json` probe, shared by every caller so
      *  a concurrent `initialize` and start-of-prompt read never spawn two CLI
      *  processes. */
@@ -1232,6 +1213,7 @@ export class ClaudeAcpAgent {
             },
             applyFastMode: (session, enabled) => this.applyFastMode(session, enabled),
             sessionUpdate: (notification) => this.client.sessionUpdate(notification),
+            supportsPlanOperations: () => this.clientCapabilities?.plan != null,
             ensureConsumer: (session, id) => this.ensureConsumer(session, id),
             logError: (message, error) => this.logger.error(message, error),
             destroyReplacement: (id, session) => {
@@ -1378,6 +1360,8 @@ export class ClaudeAcpAgent {
                 terminalAuthMethods.push(consoleLoginMethod);
             }
         }
+        // The subagents RFD has only the client capability. AIR's draft also had
+        // this agent capability, which AIR gets (`docs/air-extensions.md`).
         const sessionCapabilities = {
             additionalDirectories: {},
             close: {},
@@ -1385,7 +1369,7 @@ export class ClaudeAcpAgent {
             fork: {},
             list: {},
             resume: {},
-            subagents: {},
+            ...(this.toolCallCapabilities.air.client ? { subagents: {} } : {}),
         };
         return {
             protocolVersion: 1,
@@ -1506,14 +1490,30 @@ export class ClaudeAcpAgent {
             configOptions: response.configOptions,
         };
     }
+    /**
+     * Copies the session's transcript into a new session, then starts that
+     * session, so the client can prompt it as soon as the response arrives, as
+     * the schema requires of a fork. It starts like a resumed session: from the
+     * copied transcript, with the model and the permission mode it records. A
+     * later load or resume with the same settings reuses it.
+     */
     async unstable_forkSession(params) {
         if (this.providerUpdate)
             await this.providerUpdate;
-        return forkSession(params, {
+        const { sessionId } = await forkSession(params, {
             liveMessageIdToUuid: this.sessions[params.sessionId]?.messageIdToUuid,
             logger: this.logger,
             messageIdForGrouping,
         });
+        const { modes, configOptions } = await this.getOrCreateSession({
+            sessionId,
+            cwd: params.cwd,
+            mcpServers: params.mcpServers,
+            additionalDirectories: params.additionalDirectories,
+            _meta: params._meta,
+        });
+        this.afterSetupResponse(sessionId, params.mcpServers ?? []);
+        return { sessionId, modes, configOptions };
     }
     async resumeSession(params) {
         if (this.providerUpdate)
@@ -1682,7 +1682,22 @@ export class ClaudeAcpAgent {
      * under an apiKeyHelper) means "nothing to add", not "logged out" — keep
      * what the CLI probe already established instead of overwriting it.
      */
-    publishSessionAccountIdentity(account) {
+    useAuthStatusSettings(manager, settingsOverride, launchEnv) {
+        const helper = manager.getApiKeyHelper(settingsOverride);
+        const changed = manager.getCwd() !== (this.authStatusSettings?.manager.getCwd() ?? process.cwd()) ||
+            helper !== this.authStatusHelper ||
+            JSON.stringify(launchEnv) !== JSON.stringify(this.authStatusSettings?.env);
+        this.authStatusSettings = { manager, override: settingsOverride, env: launchEnv };
+        this.authStatusHelper = helper;
+        if (changed) {
+            // The epoch bump discards any probe that read the old context, and the
+            // session account may carry no identity signal (an apiKeyHelper), so
+            // only a probe in the new context can classify it.
+            this.authEpoch += 1;
+            void this.probeCliAuthStatus({ fresh: true });
+        }
+    }
+    publishSessionAccountIdentity(account, apiKeyHelper) {
         if (this.providerConfig) {
             if (!this.loggedOverriddenAccount) {
                 this.loggedOverriddenAccount = true;
@@ -1693,7 +1708,7 @@ export class ClaudeAcpAgent {
         if (this.gatewayAuthRequest) {
             return;
         }
-        const fromSession = fromAccountInfo(account);
+        const fromSession = fromAccountInfo(account, apiKeyHelper);
         if (fromSession) {
             this.setAuthStatus(fromSession);
         }
@@ -1726,6 +1741,8 @@ export class ClaudeAcpAgent {
         // auth-affecting event describes a world that no longer exists. Remember
         // which one this read belongs to and drop the answer if it moved on.
         const epoch = this.authEpoch;
+        const context = this.authStatusSettings;
+        const apiKeyHelper = context?.manager.getApiKeyHelper(context.override);
         // ACP gateway auth bypasses the CLI credential store entirely, so the
         // probe would report an identity that is not the one being used. A mere
         // client provider override (`providers/set`) does NOT skip the probe: it
@@ -1737,8 +1754,13 @@ export class ClaudeAcpAgent {
         let stdout;
         try {
             const cliPath = await claudeCliPath();
-            ({ stdout } = await execFileAsync(cliPath, ["auth", "status", "--json"], {
+            const args = ["auth", "status", "--json"];
+            if (context?.override)
+                args.push("--settings", JSON.stringify(context.override));
+            ({ stdout } = await execFileAsync(cliPath, args, {
                 timeout: AUTH_STATUS_PROBE_TIMEOUT_MS,
+                cwd: context?.manager.getCwd() ?? process.cwd(),
+                env: context?.env ? { ...process.env, ...context.env } : process.env,
             }));
         }
         catch (error) {
@@ -1761,7 +1783,16 @@ export class ClaudeAcpAgent {
             }
             stdout = failed.stdout;
         }
-        const status = fromCliStatus(stdout);
+        let status = fromCliStatus(stdout, apiKeyHelper);
+        if (!context && status?.kind === "api_key" && status.detail === "API key helper") {
+            try {
+                const resolved = await resolveSettings({ cwd: process.cwd() });
+                status = fromCliStatus(stdout, filterEscalatingDefaultMode(resolved).apiKeyHelper);
+            }
+            catch {
+                this.logger.error("Could not resolve auth source settings");
+            }
+        }
         if (!status) {
             this.logger.error("claude auth status returned unparseable output");
             return undefined;
@@ -2027,6 +2058,7 @@ export class ClaudeAcpAgent {
         // that finds the new credential must not be the one the refusal skipped.
         // The guard itself consumes the result only at the next turn boundary (see
         // `markSessionsWhoseAccountKindChanged`).
+        this.useAuthStatusSettings(session.settingsManager, session.effortSettingsOverride, session.creationParams?._meta?.claudeCode?.options?.env);
         void this.probeCliAuthStatus();
         const signOutRespawn = this.respawnSignedOutSession(params.sessionId, session);
         if (signOutRespawn)
@@ -2245,7 +2277,7 @@ export class ClaudeAcpAgent {
             logger: this.logger,
             // The guard reads the account anyway; reuse that read to keep the
             // reported identity current, refusal or not.
-            onAccount: (account) => this.publishSessionAccountIdentity(account),
+            onAccount: (account) => this.publishSessionAccountIdentity(account, session.settingsManager.getApiKeyHelper(session.effortSettingsOverride)),
         });
     }
     async goal(params) {
@@ -2500,6 +2532,10 @@ export class ClaudeAcpAgent {
                 streamedBlocksByParent.set(key, (blocks = []));
             return blocks;
         };
+        // The streams, keyed like streamedBlocksByParent, that dropped a delta
+        // after a cancel since their record last reset, so the record no longer
+        // matches what the client got (see the stream_event case).
+        const droppedStreams = new Set();
         // A client gets the consolidated subagent text when it negotiated the
         // transcript extension or the `forwardSubagentText` session option. AIR
         // also gets it with native subagent sessions, and AIR gets no streamed
@@ -2528,7 +2564,7 @@ export class ClaudeAcpAgent {
          *  recognizable by the `parentToolUseId` meta that toAcpNotifications
          *  stamps from `parent_tool_use_id`, and never reach the top-level feed
          *  as the turn's answer. */
-        const subagents = (session.nativeSubagentRuntime ??= new NativeSubagentRuntime(clientSupportsSubagents(this.clientCapabilities), params.sessionId, session, async (notification) => this.client.sessionUpdate(asSdkSessionNotification(notification)), this.logger));
+        const subagents = (session.nativeSubagentRuntime ??= new NativeSubagentRuntime(subagentForm(this.clientCapabilities), params.sessionId, session, async (notification) => this.client.sessionUpdate(asSdkSessionNotification(notification)), this.logger));
         // Adapter-composed advisories (hook feedback, model fallbacks) are live
         // events, not something the model said. Clients on the notice contract get
         // them as `notice` updates; the rest keep the bold-label transcript line.
@@ -2563,6 +2599,19 @@ export class ClaudeAcpAgent {
             const eagerOwnerSessionId = toolCallId
                 ? session.eagerToolCallSessions?.get(toolCallId)
                 : undefined;
+            // Before routing, which can buffer or drop the update: a cancel still has
+            // to know the parent of a call that is open here. A later update can be
+            // the first to name it, for a call that a permission request emitted.
+            if (toolCallId &&
+                update.sessionUpdate === "tool_call_update" &&
+                isFinalToolCallStatus(update.status)) {
+                session.toolCallParents?.delete(toolCallId);
+            }
+            else if (toolCallId &&
+                claudeMeta?.parentToolUseId &&
+                session.emittedToolCalls.has(toolCallId)) {
+                recordToolCallParent(session, toolCallId, claudeMeta.parentToolUseId);
+            }
             const routedNotification = await subagents.route(notification, sendUpdate, eagerOwnerSessionId);
             if (!routedNotification) {
                 // Native Agent/Task control calls are intentionally not transcript
@@ -3011,6 +3060,29 @@ export class ClaudeAcpAgent {
             }
             this.syncAwaitingUser(params.sessionId, session);
         };
+        /** Ends the display terminal of a command that went to the background, once
+         *  its task ends (see `Session.backgroundTerminals`). Claude Code reports no
+         *  exit code for it, and `completed` does not mean 0: Claude Code accepts
+         *  some non-zero codes as a success, such as grep's 1. */
+        const endBackgroundTerminal = async (taskId) => {
+            const terminal = session.backgroundTerminals?.get(taskId);
+            if (!terminal)
+                return;
+            session.backgroundTerminals.delete(taskId);
+            await sendUpdate({
+                sessionId: params.sessionId,
+                update: {
+                    sessionUpdate: "tool_call_update",
+                    toolCallId: terminal.toolCallId,
+                    _meta: {
+                        ...(terminal.parentToolUseId
+                            ? { claudeCode: { parentToolUseId: terminal.parentToolUseId } }
+                            : {}),
+                        terminal_exit: { terminal_id: terminal.toolCallId, exit_code: null, signal: null },
+                    },
+                },
+            });
+        };
         /** Settles a task. Its request may still be open, and an agent without a
          *  record no longer blocks the foreground work, so that is checked again. */
         const settleLiveTask = (taskId) => {
@@ -3087,6 +3159,92 @@ export class ClaudeAcpAgent {
                 await settleActive(outcome);
             }
         };
+        /** Sends `report`, which ends the tool call `toolCallId` without its result
+         *  (see `AcpToolCallRenderer.unfinished`), and forgets the call. Forgetting
+         *  comes first, so that a late hook or a second close cannot overwrite the
+         *  report. */
+        const closeToolCall = async (toolCallId, report) => {
+            unregisterHookCallback(toolCallId);
+            session.emittedToolCalls.delete(toolCallId);
+            delete session.toolUseCache[toolCallId];
+            session.toolCallFields?.delete(toolCallId);
+            session.dispatchedToolCalls?.delete(toolCallId);
+            session.toolCallParents?.delete(toolCallId);
+            await sendUpdate({ sessionId: params.sessionId, update: report });
+        };
+        /** Whether the subagent that the Agent call `agentToolUseId` started runs in
+         *  the background and has not ended. */
+        const runsInBackground = (agentToolUseId) => [...session.liveBackgroundTasks.values()].some((task) => task.isSubagent &&
+            task.backgrounded === true &&
+            !task.endedPerLevel &&
+            task.parentToolUseId === agentToolUseId);
+        /** Closes the tool calls that the work a cancel stopped left open, as that
+         *  work ends. Claude Code's interrupt ends each running tool of the main
+         *  conversation with an error result, which `sendInterruptedToolResults`
+         *  delivers. What is still open here has no result to deliver:
+         *  - a tool of a subagent: Claude Code writes its interrupted result only to
+         *    the subagent's own transcript, not to the stream;
+         *  - a tool call that Claude abandoned before it ran;
+         *  - every tool call, when the stream gives no results at all, as when the
+         *    force-cancel backstop ends a wedged turn.
+         *  A foreground subagent ends with the work that waits on it. A background
+         *  subagent keeps its tool calls open until the SDK reports its end, which
+         *  Claude Code 2.1.293 does for the ones it stops, before the turn's result
+         *  (see `NativeSubagentRuntime.parentCancelled`).
+         *  Runs once per turn: a second call, from the other settling path, waits
+         *  for the first (see `Turn.closingCancelledToolCalls`). */
+        const closeCancelledToolCalls = (turn) => (turn.closingCancelledToolCalls ??= (async () => {
+            const renderer = new AcpToolCallRenderer(this.toolCallCapabilities);
+            for (const toolCallId of [...session.emittedToolCalls]) {
+                const parentToolUseId = session.toolCallParents?.get(toolCallId);
+                if (parentToolUseId !== undefined && runsInBackground(parentToolUseId))
+                    continue;
+                const report = renderer.unfinished({
+                    toolCallId,
+                    ran: session.dispatchedToolCalls?.has(toolCallId) === true,
+                    cancelled: true,
+                });
+                // Named as the call's other updates are: the subagent runtime routes the
+                // report with them, to the child session, or to none that has ended.
+                if (parentToolUseId !== undefined)
+                    stampParentToolUseId(report, parentToolUseId);
+                await closeToolCall(toolCallId, report);
+            }
+        })());
+        session.closeCancelledToolCalls = closeCancelledToolCalls;
+        /** Delivers the results that the work a cancel stopped sends for tool calls
+         *  that the client holds open. Claude Code's interrupt ends each running tool
+         *  of the main conversation with an error result, before the result that
+         *  ends the turn. The tool call gets that result like any other, so its
+         *  final status and `nonExecutionKind` reach the client. Nothing else of the
+         *  message is applied: the other effects of a tool result (async tasks, plan
+         *  state, the ExitPlanMode flow) belong to the stopped work, which stays
+         *  dropped. */
+        const sendInterruptedToolResults = async (message) => {
+            const content = message.message.content;
+            if (!Array.isArray(content))
+                return;
+            const results = content.filter((block) => block.type === "tool_result" && session.emittedToolCalls.has(block.tool_use_id));
+            if (results.length === 0)
+                return;
+            const resultCount = content.filter((block) => block.type === "tool_result").length;
+            for (const notification of toAcpNotifications(results, "user", params.sessionId, session.toolUseCache, routedNotificationClient, this.logger, {
+                clientCapabilities: this.clientCapabilities,
+                toolCallCapabilities: this.toolCallCapabilities,
+                parentToolUseId: message.parent_tool_use_id,
+                cwd: session.cwd,
+                taskState: session.taskState,
+                emittedToolCalls: session.emittedToolCalls,
+                toolCallFields: toolCallFieldsOf(session),
+                messageId: messageIdForGrouping(message),
+                // `tool_use_result` describes the one result of its message.
+                toolUseResult: results.length === resultCount ? message.tool_use_result : undefined,
+                toolResultMeta: message.tool_result_meta,
+                cancelled: true,
+            })) {
+                await sendUpdate(notification);
+            }
+        };
         /** At the actual turn boundary, preview its checkpoint, settle the active
          *  turn exactly once, disarm the force-cancel backstop, and drop it from
          *  the queue. Cancellation and provider failures skip checkpoint I/O. */
@@ -3112,16 +3270,7 @@ export class ClaudeAcpAgent {
                  * ended meanwhile.
                  */
                 const closeUnfinished = async (toolCallId, ran) => {
-                    // A late hook must not overwrite the report we are about to send.
-                    unregisterHookCallback(toolCallId);
-                    session.emittedToolCalls.delete(toolCallId);
-                    delete session.toolUseCache[toolCallId];
-                    session.toolCallFields?.delete(toolCallId);
-                    session.dispatchedToolCalls?.delete(toolCallId);
-                    await sendUpdate({
-                        sessionId: params.sessionId,
-                        update: renderer.unfinished({ toolCallId, ran }),
-                    });
+                    await closeToolCall(toolCallId, renderer.unfinished({ toolCallId, ran }));
                     // Cancellation can arrive while we await the client update.
                     if (turn.settled || session.activeTurn !== turn)
                         return false;
@@ -3154,6 +3303,15 @@ export class ClaudeAcpAgent {
                     return;
                 }
             }
+            // The client is told that the work a cancel stopped ended (the prompt
+            // response on v1, `idle` on v2) only after every tool call that work
+            // opened has ended.
+            if (result.stopReason === "cancelled" && session.cancelled) {
+                await closeCancelledToolCalls(turn);
+                // `cancelTurns` can settle the turn while the reports are in flight.
+                if (turn.settled || session.activeTurn !== turn)
+                    return;
+            }
             turn.settling = true;
             turn.settlingOutcome = result;
             if (reportReason === "notReported") {
@@ -4064,9 +4222,14 @@ export class ClaudeAcpAgent {
                                     this.logger.log(`Ignoring task_notification for task ${message.task_id} from earlier run ${message.run_id}`);
                                     break;
                                 }
+                                // In the RFD form, a resumed child runs under the call that
+                                // resumed it, and the end of an earlier delegation ends
+                                // nothing: the child and its live task belong to the new run.
+                                if (subagents.isStaleEnd(message.task_id, message.tool_use_id))
+                                    break;
                                 // The task settled — no further tool calls can originate
                                 // from it, so its registry entry can be dropped.
-                                await subagents.finishTask(message.task_id, message.status, sendUpdate, message.tool_use_id);
+                                await subagents.finishTask(message.task_id, message.status, sendUpdate, message.tool_use_id, { reason: message.reason });
                                 await asyncTasks.taskNotification({
                                     task_id: message.task_id,
                                     status: message.status,
@@ -4078,7 +4241,9 @@ export class ClaudeAcpAgent {
                                     subagents.discardPending(message.tool_use_id);
                                     // The subagent streams no more text under this parent.
                                     streamedBlocksByParent.delete(message.tool_use_id);
+                                    droppedStreams.delete(message.tool_use_id);
                                 }
+                                await endBackgroundTerminal(message.task_id);
                                 settleLiveTask(message.task_id);
                                 break;
                             case "task_updated":
@@ -4103,10 +4268,13 @@ export class ClaudeAcpAgent {
                                 if (message.patch.status === "completed" ||
                                     message.patch.status === "failed" ||
                                     message.patch.status === "killed") {
-                                    await subagents.finishTask(message.task_id, message.patch.status, sendUpdate);
+                                    await subagents.finishTask(message.task_id, message.patch.status, sendUpdate, undefined, { error: message.patch.status === "failed" ? message.patch.error : undefined });
                                     const parentToolUseId = session.liveBackgroundTasks.get(message.task_id)?.parentToolUseId;
-                                    if (parentToolUseId)
+                                    if (parentToolUseId) {
                                         streamedBlocksByParent.delete(parentToolUseId);
+                                        droppedStreams.delete(parentToolUseId);
+                                    }
+                                    await endBackgroundTerminal(message.task_id);
                                     settleLiveTask(message.task_id);
                                 }
                                 else if (message.patch.status === "running" ||
@@ -4930,43 +5098,14 @@ export class ClaudeAcpAgent {
                             // reset, and the synthetic-auth/system/local-command paths
                             // `break` early too. Block indices restart at 0 each message, so
                             // leftover entries would otherwise collide with this message's
-                            // blocks and re-emit (or truncate) already-streamed text. Gated on
-                            // `parent_tool_use_id === null` so a subagent stream can't clear
-                            // the top-level record. Fires once, before any of this message's
-                            // blocks, so it doesn't disturb the mid-message turn-activation
-                            // path the way resetting on turn activation would.
+                            // blocks and re-emit (or truncate) already-streamed text. Keyed by
+                            // the stream, so a subagent's message can't clear the top-level
+                            // record. Fires once, before any of this message's blocks, so it
+                            // doesn't disturb the mid-message turn-activation path the way
+                            // resetting on turn activation would. The record's drop latch
+                            // (see below) resets with it.
                             streamedBlocksOf(message.parent_tool_use_id).length = 0;
-                        }
-                        // Accumulate the text/thinking actually streamed live, so the
-                        // `assistant` case below can diff its assembled blocks against what
-                        // already reached the client as chunks and forward only the
-                        // remainder. Each stream (top level or one subagent) keeps its own
-                        // record, so a subagent cannot attribute content to another stream.
-                        // Contiguous deltas of the same block (same index and type) extend
-                        // the current entry; anything else opens a new one.
-                        if (message.event.type === "content_block_delta") {
-                            const delta = message.event.delta;
-                            const chunk = delta.type === "text_delta"
-                                ? { type: "text", text: delta.text }
-                                : delta.type === "thinking_delta"
-                                    ? { type: "thinking", text: delta.thinking }
-                                    : undefined;
-                            // Skip empty deltas (some gateways emit empty thinking chunks —
-                            // #793): appending "" is a no-op, but pushing a "" entry would
-                            // create a block the consolidated handler's `text.length > 0`
-                            // guard can never consume, stalling the diff cursor and
-                            // re-emitting the next block as a duplicate.
-                            if (chunk?.text) {
-                                const index = message.event.index;
-                                const streamedBlocks = streamedBlocksOf(message.parent_tool_use_id);
-                                const last = streamedBlocks[streamedBlocks.length - 1];
-                                if (last && last.index === index && last.type === chunk.type) {
-                                    last.text += chunk.text;
-                                }
-                                else {
-                                    streamedBlocks.push({ index, type: chunk.type, text: chunk.text });
-                                }
-                            }
+                            droppedStreams.delete(message.parent_tool_use_id ?? "");
                         }
                         if (message.parent_tool_use_id === null &&
                             (message.event.type === "message_start" || message.event.type === "message_delta")) {
@@ -5020,7 +5159,71 @@ export class ClaudeAcpAgent {
                                 });
                             }
                         }
-                        for (const notification of streamEventToAcpNotifications(message, params.sessionId, session.toolUseCache, this.client, this.logger, {
+                        // After a cancel, output streams to the client until the client is
+                        // told that the stopped work ended (see workEndReported), so what
+                        // the interrupt flushes before then still goes out, as both
+                        // protocol versions allow. After that, while the window after the
+                        // cancel is open, streamed text, thinking and tool calls are
+                        // dropped like the consolidated messages they belong to (see the
+                        // `cancelled` check in the user/assistant case). Otherwise the
+                        // answer to a prompt the cancel abandoned, which Claude Code had
+                        // already taken off its queue, would stream to the client after the
+                        // cancel was reported.
+                        //
+                        // Where the consolidated message delivers the text (the same
+                        // condition as in the user/assistant case), a stream that loses a
+                        // delta keeps dropping until the record below resets: at the next
+                        // message, or when a consolidated message consumes the record. If
+                        // the next prompt's echo ends the window mid-block, the record then
+                        // stays empty and the consolidated message delivers the block's
+                        // whole text once. A record holding only the block's tail is not a
+                        // prefix of the text, so the text would be sent again (see
+                        // unstreamedRemainder).
+                        const streamKey = message.parent_tool_use_id ?? "";
+                        if (session.cancelled && this.workEndReported(params.sessionId, session)) {
+                            if (message.parent_tool_use_id === null || forwardsSubagentText()) {
+                                droppedStreams.add(streamKey);
+                            }
+                            break;
+                        }
+                        if (droppedStreams.has(streamKey)) {
+                            break;
+                        }
+                        // Accumulate the text/thinking actually streamed live, so the
+                        // `assistant` case below can diff its assembled blocks against what
+                        // already reached the client as chunks and forward only the
+                        // remainder. Each stream (top level or one subagent) keeps its own
+                        // record, so a subagent cannot attribute content to another stream.
+                        // Contiguous deltas of the same block (same index and type) extend
+                        // the current entry; anything else opens a new one.
+                        if (message.event.type === "content_block_delta") {
+                            const delta = message.event.delta;
+                            const chunk = delta.type === "text_delta"
+                                ? { type: "text", text: delta.text }
+                                : delta.type === "thinking_delta"
+                                    ? { type: "thinking", text: delta.thinking }
+                                    : undefined;
+                            // Skip empty deltas (some gateways emit empty thinking chunks —
+                            // #793): appending "" is a no-op, but pushing a "" entry would
+                            // create a block the consolidated handler's `text.length > 0`
+                            // guard can never consume, stalling the diff cursor and
+                            // re-emitting the next block as a duplicate.
+                            if (chunk?.text) {
+                                const index = message.event.index;
+                                const streamedBlocks = streamedBlocksOf(message.parent_tool_use_id);
+                                const last = streamedBlocks[streamedBlocks.length - 1];
+                                if (last && last.index === index && last.type === chunk.type) {
+                                    last.text += chunk.text;
+                                }
+                                else {
+                                    streamedBlocks.push({ index, type: chunk.type, text: chunk.text });
+                                }
+                            }
+                        }
+                        // The stream sees a tool_use first, so the tool's PostToolUse hook
+                        // is registered here, and publishes through this client: a
+                        // subagent's hook update must reach the child session too.
+                        for (const notification of streamEventToAcpNotifications(message, params.sessionId, session.toolUseCache, routedNotificationClient, this.logger, {
                             clientCapabilities: this.clientCapabilities,
                             toolCallCapabilities: this.toolCallCapabilities,
                             cwd: session.cwd,
@@ -5153,6 +5356,13 @@ export class ClaudeAcpAgent {
                             }
                         }
                         if (session.cancelled) {
+                            // The work the cancel stopped ends its tools with error results.
+                            // Until the client is told that the work ended, they close the
+                            // tool calls it opened. Everything else that work sends is
+                            // dropped, and so is everything after that report.
+                            if (message.type === "user" && !this.workEndReported(params.sessionId, session)) {
+                                await sendInterruptedToolResults(message);
+                            }
                             break;
                         }
                         // Synthetic assistant frames carry the CLI's local-command output.
@@ -5284,6 +5494,7 @@ export class ClaudeAcpAgent {
                             const streamed = streamedBlocksOf(message.parent_tool_use_id);
                             content = unstreamedRemainder(message.message.content, streamed);
                             streamed.length = 0;
+                            droppedStreams.delete(message.parent_tool_use_id ?? "");
                         }
                         else if (message.type === "assistant") {
                             // Nested text/thinking stays internal for a client that does
@@ -5296,19 +5507,41 @@ export class ClaudeAcpAgent {
                         }
                         const acceptedPlanToolUseId = observeExitPlanToolResults(message, content, session);
                         let backgroundedToolCalls = new Set();
+                        let runningTerminal;
                         if (message.type === "user") {
                             rememberResolvedToolNames(session, content);
                             const backgroundBashTask = backgroundBashTaskFromToolResult(content, message.tool_use_result, session.toolUseCache);
                             if (backgroundBashTask)
                                 await asyncTasks.taskBackgrounded(backgroundBashTask);
+                            // The command's terminal runs until its task ends, unless the
+                            // task has ended already (a fast command can end before the tool
+                            // result comes).
+                            const terminalId = backgroundBashTask?.toolCallId;
+                            if (terminalId &&
+                                this.toolCallCapabilities.terminalOutput &&
+                                !this.toolCallCapabilities.air.client &&
+                                session.liveBackgroundTasks.has(backgroundBashTask.taskId)) {
+                                runningTerminal = terminalId;
+                                (session.backgroundTerminals ??= new Map()).set(backgroundBashTask.taskId, {
+                                    toolCallId: terminalId,
+                                    ...(message.parent_tool_use_id
+                                        ? { parentToolUseId: message.parent_tool_use_id }
+                                        : {}),
+                                });
+                            }
                             await asyncTasks.toolResults(content);
                             backgroundedToolCalls = backgroundedBashToolCallIds(content, session.toolUseCache, asyncTasks, backgroundBashTask);
                             const resumedAgentId = resumedNativeSubagentId(message.tool_use_result);
                             if (resumedAgentId) {
-                                resumeLiveTask(resumedAgentId);
-                                await subagents.taskResumed(resumedAgentId, sendUpdate, sendMessageResumePrompt(session.toolUseCache, resumedAgentId, Array.isArray(content)
+                                const resume = sendMessageResume(session.toolUseCache, resumedAgentId, Array.isArray(content)
                                     ? content.flatMap((block) => block.type === "tool_result" ? [block.tool_use_id] : [])
-                                    : []));
+                                    : []);
+                                // In the RFD form the result can arrive after the run it
+                                // started ended, and then resumes nothing.
+                                if (!subagents.isEndedDelegation(resumedAgentId, resume?.toolUseId)) {
+                                    resumeLiveTask(resumedAgentId);
+                                    await subagents.sendMessageResumed(resumedAgentId, sendUpdate, resume?.text, resume?.toolUseId);
+                                }
                             }
                         }
                         for (const notification of toAcpNotifications(content, message.message.role, params.sessionId, session.toolUseCache, routedNotificationClient, this.logger, {
@@ -5331,7 +5564,7 @@ export class ClaudeAcpAgent {
                             // filtered out of `content` above; blocks that do pass through
                             // (e.g. a subagent image) carry the stamped parentToolUseId
                             // meta and are excluded there.
-                            await sendUpdate(backgroundedBashToolCall(acceptedPlanToolResult(notification, acceptedPlanToolUseId), backgroundedToolCalls, asyncTasks.enabled));
+                            await sendUpdate(withRunningTerminal(backgroundedBashToolCall(acceptedPlanToolResult(notification, acceptedPlanToolUseId), backgroundedToolCalls, asyncTasks.enabled), runningTerminal));
                         }
                         break;
                     }
@@ -5355,10 +5588,14 @@ export class ClaudeAcpAgent {
                         if (toolCallId === null || !session.emittedToolCalls.has(toolCallId)) {
                             break;
                         }
-                        const subagentParentToolUseId = message.parent_tool_use_id
-                            ? [...session.liveBackgroundTasks.values()].some((task) => task.isSubagent && task.parentToolUseId === message.parent_tool_use_id)
-                                ? message.parent_tool_use_id
-                                : undefined
+                        // The beat is in the subagent whose Agent call is
+                        // `parent_tool_use_id`, unless it reports on that Agent call
+                        // itself: the Agent call's own heartbeat falls back to its id, and
+                        // a tool call is never its own parent.
+                        const subagentParentToolUseId = message.parent_tool_use_id &&
+                            message.parent_tool_use_id !== toolCallId &&
+                            [...session.liveBackgroundTasks.values()].some((task) => task.isSubagent && task.parentToolUseId === message.parent_tool_use_id)
+                            ? message.parent_tool_use_id
                             : undefined;
                         // `tool_name` names the tool that reports the beat. When the beat
                         // falls back to the parent call, AIR gets the name of that call,
@@ -5581,17 +5818,29 @@ export class ClaudeAcpAgent {
         // their compaction is running. Close it before ANY cancelled prompt
         // resolves, not just the active-turn idle/backstop paths.
         await session.contextCompaction?.interrupt();
+        // A cancel drops the state of each tool call (the session that a
+        // permission request emitted it in, the fields the client holds, the hook
+        // callbacks), even when publishing fails. AIR's draft ends every child
+        // here, so a later update of an ended child's tool call is then dropped
+        // instead of reaching that child's session. The RFD form keeps the state:
+        // a background subagent can keep running after a cancel
+        // (agentclientprotocol/agent-client-protocol#2308), and its tool call that
+        // a permission request emitted on the root before the child was announced
+        // must stay on the root, which the RFD requires. Each tool call drops its
+        // own state when it ends.
         try {
-            await session.nativeSubagentRuntime?.finishAll("cancelled", session.nativeSubagentDeliver ??
+            await session.nativeSubagentRuntime?.parentCancelled(session.nativeSubagentDeliver ??
                 (async (notification) => this.client.sessionUpdate(asSdkSessionNotification(notification))));
         }
         catch (error) {
             this.logger.error(`Session ${params.sessionId}: failed to publish cancelled subagent state`, error);
         }
         finally {
-            session.eagerToolCallSessions?.clear();
-            session.toolCallFields?.clear();
-            clearHookCallbacks(params.sessionId);
+            if (session.nativeSubagentRuntime?.form !== "rfd") {
+                session.eagerToolCallSessions?.clear();
+                session.toolCallFields?.clear();
+                clearHookCallbacks(params.sessionId);
+            }
         }
         // The user messages this cancel abandons while Claude Code may still have
         // them queued: they are dropped from its queue before the interrupt.
@@ -5705,7 +5954,8 @@ export class ClaudeAcpAgent {
         // permission request) is left to that cycle's interrupted result, like any
         // live turn, or to the idle when no result comes. The captured outcome
         // preserves usage and metadata (issue #844), while reporter state makes a
-        // late checkpoint response harmless.
+        // late checkpoint response harmless. The turn's open tool calls close
+        // before its response, as in the consumer's settle.
         // Since CLI 2.1.270, Claude Code reports `running` for as long as
         // background agents live, so the session state cannot tell a live
         // followup from a hold. With request markers, a followup is live when one
@@ -5718,7 +5968,10 @@ export class ClaudeAcpAgent {
             if (active &&
                 (active.settling || (isHeldOpen(active) && !followupLive)) &&
                 (active.deferredSettle ?? active.settlingOutcome)) {
+                const closingToolCalls = session.closeCancelledToolCalls?.(active);
                 session.fileChangeReporter?.finish(active.fileChangeReport, "cancelled");
+                // Settled before the reports are awaited, so that the consumer, which
+                // keeps running meanwhile, cannot settle the turn a second time.
                 active.settled = true;
                 // Mirror settleActive's invariants (it is consumer-scoped and
                 // unreachable from here): disarm the backstop — none should be
@@ -5750,7 +6003,15 @@ export class ClaudeAcpAgent {
                 if (session.lastSessionState !== "idle") {
                     session.owedTrailingIdles++;
                 }
-                active.resolve(cancelledOutcome(session, active));
+                try {
+                    await closingToolCalls;
+                }
+                catch (error) {
+                    this.logger.error(`Session ${params.sessionId}: failed to publish cancelled tool state`, error);
+                }
+                finally {
+                    active.resolve(cancelledOutcome(session, active));
+                }
             }
         }
         // A steered active turn (see Turn.steeredEchoes) settles "cancelled" in the
@@ -6053,7 +6314,12 @@ export class ClaudeAcpAgent {
         // A replay rebuilds the client view, so its plan goes out again.
         if (session?.taskState)
             forgetPublishedTaskPlan(session.taskState);
-        const forwardSubagentText = session?.forwardSubagentText ?? supportsSubagentTranscript(this.clientCapabilities);
+        // A subagent's text replays onto the root only for a client that gets it
+        // there live: one without native subagent sessions that asked for the
+        // flattened transcript. With native sessions the text goes to the child
+        // session, which AIR's replay restores and the RFD form leaves out for now.
+        const forwardSubagentText = !clientSupportsSubagents(this.clientCapabilities) &&
+            (session?.forwardSubagentText ?? supportsSubagentTranscript(this.clientCapabilities));
         const supportsTypedFailures = supportsAirSessionFailures(this.clientCapabilities);
         const activeUsageLimit = supportsTypedFailures ? activeUsageLimitMessage(messages) : undefined;
         const sessionFailures = session && supportsTypedFailures
@@ -6072,7 +6338,11 @@ export class ClaudeAcpAgent {
             })
             : undefined;
         let replayTurnId;
-        const nativeReplayEnabled = clientSupportsSubagents(this.clientCapabilities);
+        // AIR's draft replays each child under a replay id. A client on the RFD
+        // form gets each child under the session id it had live (see
+        // `RfdSubagentReplay`).
+        const form = subagentForm(this.clientCapabilities);
+        const nativeReplayEnabled = form === "air";
         const replayCompactionUpdates = clientSupportsCompactionUpdates(this.clientCapabilities);
         const replayTerminalStates = new Map();
         const replayChildren = new Map();
@@ -6175,8 +6445,17 @@ export class ClaudeAcpAgent {
         // Only a history with an Agent or Task launch has subagent transcripts to read.
         const subagents = nativeReplayEnabled && replayChildren.size > 0
             ? await subagentHistory(sessionId)
-            : { ids: new Map() };
+            : { agents: new Map() };
         const replayedSubagents = new Set();
+        const rfdHistory = form === "rfd" &&
+            messages.some((message) => subagentLaunchIds(message.message?.content)
+                .length > 0)
+            ? await subagentHistory(sessionId)
+            : { agents: new Map() };
+        const rfdReplay = form === "rfd"
+            ? new RfdSubagentReplay(rfdHistory, (notification) => this.client.sessionUpdate(asSdkSessionNotification(notification)))
+            : undefined;
+        rfdReplay?.scan(messages, sessionId);
         // History persists no task_started frame, so a background task gets its
         // spawn from the notification of its stop, with the tool call that
         // started it. A task still running at the end of the history gets no
@@ -6195,6 +6474,8 @@ export class ClaudeAcpAgent {
         });
         // The replay counterpart of the live `task_notification` frame.
         const restoreTaskNotification = async (notification) => {
+            if (rfdReplay?.taskNotification(notification.task_id, notification.status))
+                return;
             const toolUseId = notification.tool_use_id;
             if (!toolUseId)
                 return;
@@ -6221,7 +6502,8 @@ export class ClaudeAcpAgent {
             });
             await replayAsyncTasks.taskNotification(notification);
         };
-        const replayMessage = async (message) => {
+        /** Replays `message`, from the transcript of `child` when it is set (the RFD form). */
+        const replayMessage = async (message, child) => {
             // A long history is sent in order, but with event-loop turns in between,
             // so other sessions and incoming requests are not starved meanwhile.
             const pause = messageLoopYielder.maybeYield();
@@ -6230,6 +6512,10 @@ export class ClaudeAcpAgent {
             if (pending?.stopped || isReplayHiddenMetaMessage(message)) {
                 return;
             }
+            // In the RFD form a child's history comes from its own transcript, so a
+            // subagent message that the session transcript stores inline is skipped.
+            if (rfdReplay && !child && parentToolUseIdOf(message))
+                return;
             if (message.type === "user" &&
                 message.parent_tool_use_id === null &&
                 typeof message.uuid === "string" &&
@@ -6269,11 +6555,14 @@ export class ClaudeAcpAgent {
             // @ts-expect-error - untyped in SDK but we handle all of these
             let content = message.message.content;
             const parentToolUseId = parentToolUseIdOf(message);
-            const replayTargetSessionId = nativeReplayEnabled && parentToolUseId
-                ? await announceReplayChild(parentToolUseId)
-                : sessionId;
+            const replayTargetSessionId = child
+                ? child.sessionId
+                : nativeReplayEnabled && parentToolUseId
+                    ? await announceReplayChild(parentToolUseId)
+                    : sessionId;
             if (message.type === "assistant" &&
                 parentToolUseId &&
+                !child &&
                 !nativeReplayEnabled &&
                 !forwardSubagentText) {
                 content = stripSubagentTextAndThinking(content);
@@ -6287,6 +6576,9 @@ export class ClaudeAcpAgent {
                 }
                 // Live, the prompt loop skips this record and the SDK frame reports the stop.
                 content = isTaskNotificationRecord(message) ? null : stripLocalCommandMetadata(content);
+                if (content !== null && child && rfdReplay) {
+                    content = await rfdReplay.childContent(child, message, content);
+                }
                 if (content === null)
                     return;
             }
@@ -6358,32 +6650,37 @@ export class ClaudeAcpAgent {
             if (nativeReplayEnabled && message.type === "assistant") {
                 for (const toolUseId of subagentLaunchIds(content)) {
                     await announceReplayChild(toolUseId);
-                    const agentId = subagents.ids.get(toolUseId);
+                    const agentId = subagents.agents.get(toolUseId)?.agentId;
                     if (!agentId || replayedSubagents.has(agentId))
                         continue;
                     replayedSubagents.add(agentId);
-                    let childMessages = [];
-                    try {
-                        // With the project directory, the SDK skips its search of every project.
-                        // A session opened from another directory falls back to that search.
-                        if (subagents.dir) {
-                            childMessages = await getSubagentMessages(sessionId, agentId, { dir: subagents.dir });
-                        }
-                        if (childMessages.length === 0) {
-                            childMessages = await getSubagentMessages(sessionId, agentId);
-                        }
-                    }
-                    catch (error) {
-                        this.logger.error(`Failed to read the history of subagent ${agentId}:`, error);
-                    }
+                    const childMessages = await readSubagentMessages(sessionId, agentId, subagents, this.logger);
                     registerLaunches(childMessages);
                     for (const childMessage of childMessages)
                         await replayMessage(childMessage);
                 }
             }
+            // The RFD form announces a child right after its launch, then sends its
+            // own transcript to it.
+            if (rfdReplay && message.type === "assistant") {
+                for (const toolUseId of subagentLaunchIds(content)) {
+                    const launched = rfdReplay.childOfLaunch(toolUseId);
+                    if (!launched || launched.announced)
+                        continue;
+                    await rfdReplay.announce(launched);
+                    const childMessages = await readSubagentMessages(sessionId, launched.sessionId, rfdHistory, this.logger);
+                    rfdReplay.scan(childMessages, launched.sessionId);
+                    for (const childMessage of childMessages)
+                        await replayMessage(childMessage, launched);
+                    await rfdReplay.childReplayed(launched, childMessages);
+                }
+            }
         };
         for (const message of messages)
             await replayMessage(message);
+        if (rfdReplay && !pending?.stopped) {
+            await rfdReplay.finish(clientSupportsNotices(this.clientCapabilities), sessionId);
+        }
         if (nativeReplayEnabled && !pending?.stopped) {
             // Claude history persists sidechain messages and Agent/Task tool uses,
             // but not task_started/task_updated lifecycle frames. Recover terminal
@@ -6418,6 +6715,16 @@ export class ClaudeAcpAgent {
         const response = await this.client.writeTextFile(params);
         return response;
     }
+    /** Runs `request`, a request that `requestSessionId` sends for the session
+     *  `ownerSessionId`. When that is a subagent's child session, the child
+     *  reports that it awaits the user while the request is open (the RFD form,
+     *  see `NativeSubagentRuntime.awaitingUser`). */
+    withChildAwaitingUser(ownerSessionId, requestSessionId, request) {
+        const runtime = this.sessions[ownerSessionId]?.nativeSubagentRuntime;
+        return runtime && requestSessionId !== ownerSessionId
+            ? runtime.awaitingUser(requestSessionId, request)
+            : request();
+    }
     /** Mark a client request of the subagent `agentID` (absent for the main
      *  conversation) as awaiting user input for exactly the lifetime of its
      *  promise (see `Session.openUserInputs`). Steering consults the open
@@ -6512,6 +6819,13 @@ export class ClaudeAcpAgent {
             return;
         this.startForeground(sessionId, AUTONOMOUS_CYCLE);
     }
+    /** Whether the client has been told that the session's work ended: on v2 by
+     *  an idle state, so no foreground work is open, including a cycle that
+     *  Claude Code started on its own; on v1 by the response to the turn's
+     *  prompt, so no turn is active. */
+    workEndReported(sessionId, session) {
+        return this.foregroundEvents ? !this.foregroundWork.has(sessionId) : !session.activeTurn;
+    }
     /** End the session's model cycle that Claude Code started on its own, if one
      *  runs. */
     endAutonomousCycle(sessionId, end) {
@@ -6541,7 +6855,7 @@ export class ClaudeAcpAgent {
         // The request goes to a subagent's child session for a tool call of that
         // subagent, but it blocks the turn of the owner session.
         try {
-            return await this.withPendingUserInput(ownerSessionId, () => raceWithAbort(this.client.requestPermission(params, signal), signal), agentID);
+            return await this.withChildAwaitingUser(ownerSessionId, params.sessionId, () => this.withPendingUserInput(ownerSessionId, () => raceWithAbort(this.client.requestPermission(params, signal), signal), agentID));
         }
         catch (error) {
             if (signal.aborted) {
@@ -6581,6 +6895,8 @@ export class ClaudeAcpAgent {
             return;
         }
         session.emittedToolCalls.add(toolCallId);
+        if (parentToolUseId)
+            recordToolCallParent(session, toolCallId, parentToolUseId);
         // SandboxNetworkAccess is a permission-only callback, not an executing
         // tool: the SDK does not send a tool_result for its synthetic id.
         if (!parentToolUseId &&
@@ -6605,6 +6921,7 @@ export class ClaudeAcpAgent {
             session.emittedToolCalls.delete(toolCallId);
             session.eagerToolCallSessions?.delete(toolCallId);
             session.toolCallFields?.delete(toolCallId);
+            session.toolCallParents?.delete(toolCallId);
             throw error;
         }
     }
@@ -6879,7 +7196,7 @@ export class ClaudeAcpAgent {
         const createRequest = askUserQuestionsToCreateRequest(questions, requestSessionId, toolUseID, this.toolCallCapabilities.air.client);
         let response;
         try {
-            response = await this.withPendingUserInput(sessionId, () => this.client.createElicitation(createRequest, signal), agentID);
+            response = await this.withChildAwaitingUser(sessionId, requestSessionId, () => this.withPendingUserInput(sessionId, () => this.client.createElicitation(createRequest, signal), agentID));
         }
         catch (error) {
             // A cancellation we requested (signal aborted) settles as an aborted tool
@@ -7750,6 +8067,8 @@ export class ClaudeAcpAgent {
             prompt: input,
             options,
         });
+        this.useAuthStatusSettings(settingsManager, configuredSettingsObject, userProvidedOptions?.env);
+        const authSettingsEpoch = this.authEpoch;
         timing.phase("prepare-query");
         // `query()` spawns the CLI at once. Any throw between here and the
         // registration in `this.sessions` would leave that child process running
@@ -7772,7 +8091,9 @@ export class ClaudeAcpAgent {
             // Publish the identity BEFORE the guard can refuse this session. A
             // refusal is exactly when the client most needs to know which account it
             // was refused for.
-            this.publishSessionAccountIdentity(initializationResult.account);
+            if (authSettingsEpoch === this.authEpoch) {
+                this.publishSessionAccountIdentity(initializationResult.account, settingsManager.getApiKeyHelper(configuredSettingsObject));
+            }
             // Shared with the per-turn guard, so "warn once" spans the whole session.
             const claudeSubscriptionGuard = {};
             if (this.claudeSubscriptionGuardActive()) {
@@ -7974,7 +8295,7 @@ export class ClaudeAcpAgent {
                 messageIdToUuid: creationOpts.replayState?.messageIdToUuid ?? new Map(),
                 sessionFailureState: creationOpts.replayState?.sessionFailureState ?? createSessionFailureState(),
                 claudeSubscriptionGuard,
-                accountKind: fromAccountInfo(initializationResult.account)?.kind,
+                accountKind: fromAccountInfo(initializationResult.account, settingsManager.getApiKeyHelper(configuredSettingsObject))?.kind,
                 fileChangeReporter,
             };
             timing.phase("register");
@@ -8126,27 +8447,34 @@ function cancelledOutcome(session, turn) {
 }
 /** Whether the model request that `status` (a `status: requesting` frame)
  *  starts may belong to the work a cancel stopped. It may while:
- *  - a turn is unsettled: the stopped turn, whose result is still to come, or
- *    a queued prompt, which the cancel abandons (one that arrived while the
- *    cancel awaited is recorded only when the cancel sweeps the queue) or
- *    whose echo ends the cancel right after its request anyway;
+ *  - a turn in {@link Session.cancelledPrompts} is unsettled: the stopped
+ *    turn, whose result is still to come;
  *  - the orphan accounting still expects the result of an abandoned prompt
  *    that Claude Code may still run, which it can fold into its own
  *    follow-up after that follow-up's first request;
  *  - the request serves one of {@link Session.cancelledPrompts}, as an
  *    abandoned prompt's request does even when the interrupt receipt left it
- *    out of the orphan accounting. */
+ *    out of the orphan accounting;
+ *  - the request serves an unsettled prompt. One that arrived while the cancel
+ *    awaited is recorded only when the cancel sweeps the queue, and its echo
+ *    ends the cancel right after its request when the cancel does not.
+ *  A prompt that is merely queued does not make another request belong to
+ *  the stopped work: a follow-up that Claude Code runs before a prompt sent
+ *  after the cancel names no prompt. */
 function servesCancelledWork(session, status) {
     const cancelled = session.cancelledPrompts;
     if (!cancelled)
         return false;
-    if ((session.turnQueue ?? []).some((turn) => !turn.settled))
+    const unsettled = (session.turnQueue ?? []).filter((turn) => !turn.settled);
+    if (unsettled.some((turn) => cancelled.has(turn.promptUuid)))
         return true;
     if ((session.pendingOrphanResults ?? 0) > 0 || (session.orphanCommands?.size ?? 0) > 0) {
         return true;
     }
     const served = status.user_message_uuids;
-    return (Array.isArray(served) && served.some((uuid) => typeof uuid === "string" && cancelled.has(uuid)));
+    return (Array.isArray(served) &&
+        served.some((uuid) => typeof uuid === "string" &&
+            (cancelled.has(uuid) || unsettled.some((turn) => turn.promptUuid === uuid))));
 }
 /** `_meta.quota` for a prompt response: what the turn spent, shaped like
  *  codex-acp's (snake_case container keys, camelCase counters) so a client
@@ -8872,6 +9200,18 @@ function isTaskTool(toolName) {
 function shouldEmitToolCall(toolName) {
     return toolName !== "TodoWrite" && !isTaskTool(toolName);
 }
+const MAX_TOOL_CALL_PARENTS = 1000;
+/** Records the Agent/Task call that started the subagent making `toolCallId`. */
+function recordToolCallParent(session, toolCallId, parentToolUseId) {
+    const parents = (session.toolCallParents ??= new Map());
+    parents.delete(toolCallId);
+    parents.set(toolCallId, parentToolUseId);
+    if (parents.size > MAX_TOOL_CALL_PARENTS) {
+        const oldest = parents.keys().next().value;
+        if (oldest !== undefined)
+            parents.delete(oldest);
+    }
+}
 const MAX_DISPATCHED_TOOL_CALLS = 1000;
 /** Records a tool call that Claude Code sent to the tool runner. */
 function recordDispatchedToolCall(session, toolCallId) {
@@ -8984,6 +9324,8 @@ export function toAcpNotifications(content, role, sessionId, toolUseCache, clien
         let update = null;
         // The tool call that this chunk finishes, if it is a tool result.
         let finishedToolCallId;
+        // The plan that this chunk approves, if it is an ExitPlanMode result.
+        let approvedPlanUpdate;
         switch (chunk.type) {
             case "text":
             case "text_delta": {
@@ -9141,7 +9483,7 @@ export function toAcpNotifications(content, role, sessionId, toolUseCache, clien
                             update: {
                                 toolCallId: chunk.tool_use_id,
                                 sessionUpdate: "tool_call_update",
-                                status: renderer.resultStatus("is_error" in chunk && chunk.is_error === true, nonExecution),
+                                status: renderer.resultStatus("is_error" in chunk && chunk.is_error === true, nonExecution, { cancelled: options?.cancelled }),
                                 rawOutput: chunk.content,
                             },
                         });
@@ -9170,7 +9512,7 @@ export function toAcpNotifications(content, role, sessionId, toolUseCache, clien
                             },
                             toolCallId: chunk.tool_use_id,
                             sessionUpdate: "tool_call_update",
-                            status: renderer.resultStatus("is_error" in chunk && chunk.is_error === true, nonExecution),
+                            status: renderer.resultStatus("is_error" in chunk && chunk.is_error === true, nonExecution, { cancelled: options?.cancelled }),
                             rawOutput: chunk.content,
                         },
                     });
@@ -9222,6 +9564,7 @@ export function toAcpNotifications(content, role, sessionId, toolUseCache, clien
                         .result(toolUse, chunk, {
                         structured: toolUseResult,
                         nonExecution,
+                        cancelled: options?.cancelled,
                     })
                         .reverse();
                     for (const outputUpdate of rest.reverse()) {
@@ -9230,6 +9573,19 @@ export function toAcpNotifications(content, role, sessionId, toolUseCache, clien
                         }
                         output.push({ sessionId, update: outputUpdate });
                     }
+                    // An approved plan of the main conversation becomes the session's
+                    // markdown plan, after the tool call's result. An approval that
+                    // clears the context ends the tool with an error result instead, and
+                    // the restart into the fresh context publishes that plan (see
+                    // ExitPlanCoordinator.restart).
+                    if (toolUse.name === "ExitPlanMode" &&
+                        options?.clientCapabilities?.plan &&
+                        !options.parentToolUseId &&
+                        !("is_error" in chunk && chunk.is_error)) {
+                        const plan = approvedPlan(toolUse.input, toolUseResult);
+                        if (plan)
+                            approvedPlanUpdate = planModeUpdate(plan);
+                    }
                     update = finalUpdate;
                 }
                 // The tool_use is fully resolved now — drop it so a long session doesn't
@@ -9269,6 +9625,8 @@ export function toAcpNotifications(content, role, sessionId, toolUseCache, clien
                 output.push({ sessionId, update });
             }
         }
+        if (approvedPlanUpdate)
+            output.push({ sessionId, update: approvedPlanUpdate });
         if (finishedToolCallId !== undefined) {
             // The PostToolUse hook can still send the final diff, so the fields
             // stay tracked until its callback leaves the registry.