@agentclientprotocol/claude-agent-acp 0.90.0 → 0.90.1-preview.10

package/dist/acp-agent.js

@@ -16,7 +16,7 @@ import { promisify } from "node:util";
 import packageJson from "../package.json" with { type: "json" };
 import { applyAskElicitationResponse, askUserQuestionsToCreateRequest, createElicitationResponseToElicitResult, extractAskUserQuestions, extractRefusalFallbackPrompt, mcpElicitationToCreateRequest, REFUSAL_FALLBACK_DIALOG_KIND, refusalFallbackResultFromResponse, refusalFallbackToCreateRequest, } from "./elicitation.js";
 import { forkSession } from "./fork-session.js";
-import { readSubagentMessages, subagentHistory } from "./subagent-history.js";
+import { readSubagentMessages, subagentHistory, subagentLaunchIds, subagentLineage, } from "./subagent-history.js";
 import { RfdSubagentReplay, replaySubagentTerminalState, } from "./subagent-replay.js";
 import { readResumedSession, readResumedTail, } from "./resumed-session.js";
 import { SessionTiming } from "./session-timing.js";
@@ -87,6 +87,11 @@ const STRUCTURED_USAGE_TIMEOUT_MS = 5_000;
  *  The teardown wakes the consumer itself, so they end within a few ticks
  *  unless the consumer is wedged. */
 const TEARDOWN_TURN_END_TIMEOUT_MS = 5_000;
+/** How long `canUseTool` or a hook waits, while a cancel's window may be
+ *  open, for the consumer to reach a tool use in the stream. Claude Code
+ *  streams the tool use before it asks, so the consumer is usually there
+ *  within a few ticks. */
+const TOOL_USE_WAIT_MS = 2_000;
 /** The number of settled subagents whose parent tool call a session keeps for
  *  a later resume (see `resumableSubagents`). */
 const MAX_RESUMABLE_SUBAGENTS = 256;
@@ -285,6 +290,15 @@ const AUTONOMOUS_RESULT_ORIGINS = new Set([
  *  or a model cycle that Claude Code started on its own. At most one cycle
  *  runs at a time, so a constant names it. */
 const AUTONOMOUS_CYCLE = "autonomous-cycle";
+/** The events of a connection that reports no foreground work: v1, whose
+ *  client has no session state. The agent still tracks the work, which
+ *  decides what the window after a cancel drops (see `workEndReported`). */
+const UNREPORTED_FOREGROUND = {
+    running: () => { },
+    awaitingUser: () => { },
+    ended: () => { },
+    failed: () => { },
+};
 /** Whether this turn's terminal result arrived but its settlement is being
  *  held for background subagents it spawned (see Turn.deferredSettle). The
  *  single spelling of the hold predicate, shared by the consumer's settle
@@ -537,18 +551,6 @@ function parentToolUseIdOf(message) {
         return null;
     return typeof message.parent_tool_use_id === "string" ? message.parent_tool_use_id : null;
 }
-/** The ids of the Agent and Task tool uses in the content of a message. */
-function subagentLaunchIds(content) {
-    if (!Array.isArray(content))
-        return [];
-    return content.flatMap((block) => typeof block === "object" &&
-        block !== null &&
-        block.type === "tool_use" &&
-        typeof block.id === "string" &&
-        isNativeSubagentControlTool(block.name)
-        ? [block.id]
-        : []);
-}
 function stripSubagentTextAndThinking(content) {
     if (!Array.isArray(content))
         return content;
@@ -1173,6 +1175,9 @@ export class ClaudeAcpAgent {
      *  return "cancelled". See {@link DEFAULT_FORCE_CANCEL_GRACE_MS}. Mutable so
      *  tests can shrink it. */
     forceCancelGraceMs = DEFAULT_FORCE_CANCEL_GRACE_MS;
+    /** How long `canUseTool` or a hook waits for the consumer to reach a tool
+     *  use (see `isStoppedWorkToolUse`). Mutable so tests can shrink it. */
+    toolUseWaitMs = TOOL_USE_WAIT_MS;
     /**
      * The connection serves ACP v2 (`src/v2/`). The agent still speaks v1
      * types, except for the tool call content that v2 needs and v1 cannot
@@ -1183,7 +1188,8 @@ export class ClaudeAcpAgent {
     foregroundEvents;
     /**
      * The foreground work of each session while it runs, by the session id that
-     * the client knows. A clear-context restart replaces the Claude Code session
+     * the client knows, on every connection: only the `foreground` option
+     * reports it. A clear-context restart replaces the Claude Code session
      * behind that id and moves the running turn to it, so the work belongs to the
      * id, not to a {@link Session}.
      */
@@ -2564,7 +2570,7 @@ export class ClaudeAcpAgent {
          *  recognizable by the `parentToolUseId` meta that toAcpNotifications
          *  stamps from `parent_tool_use_id`, and never reach the top-level feed
          *  as the turn's answer. */
-        const subagents = (session.nativeSubagentRuntime ??= new NativeSubagentRuntime(subagentForm(this.clientCapabilities), params.sessionId, session, async (notification) => this.client.sessionUpdate(asSdkSessionNotification(notification)), this.logger));
+        const subagents = (session.nativeSubagentRuntime ??= new NativeSubagentRuntime(subagentForm(this.clientCapabilities), params.sessionId, session, async (notification) => this.client.sessionUpdate(asSdkSessionNotification(notification)), this.logger, (agentId) => subagentLineage(params.sessionId, agentId, this.logger)));
         // Adapter-composed advisories (hook feedback, model fallbacks) are live
         // events, not something the model said. Clients on the notice contract get
         // them as `notice` updates; the rest keep the bold-label transcript line.
@@ -3162,8 +3168,14 @@ export class ClaudeAcpAgent {
         /** Sends `report`, which ends the tool call `toolCallId` without its result
          *  (see `AcpToolCallRenderer.unfinished`), and forgets the call. Forgetting
          *  comes first, so that a late hook or a second close cannot overwrite the
-         *  report. */
+         *  report. A command has a display terminal on a client that renders them,
+         *  and no result will end it, so the report ends it too. */
         const closeToolCall = async (toolCallId, report) => {
+            // Read before the cache entry goes: it names the tool.
+            const toolUse = session.toolUseCache[toolCallId];
+            const terminalExit = toolUse && new AcpToolCallRenderer(this.toolCallCapabilities).terminalExit(toolUse);
+            if (terminalExit)
+                report._meta = { ...report._meta, ...terminalExit };
             unregisterHookCallback(toolCallId);
             session.emittedToolCalls.delete(toolCallId);
             delete session.toolUseCache[toolCallId];
@@ -3178,26 +3190,24 @@ export class ClaudeAcpAgent {
             task.backgrounded === true &&
             !task.endedPerLevel &&
             task.parentToolUseId === agentToolUseId);
-        /** Closes the tool calls that the work a cancel stopped left open, as that
-         *  work ends. Claude Code's interrupt ends each running tool of the main
-         *  conversation with an error result, which `sendInterruptedToolResults`
-         *  delivers. What is still open here has no result to deliver:
-         *  - a tool of a subagent: Claude Code writes its interrupted result only to
-         *    the subagent's own transcript, not to the stream;
-         *  - a tool call that Claude abandoned before it ran;
-         *  - every tool call, when the stream gives no results at all, as when the
-         *    force-cancel backstop ends a wedged turn.
-         *  A foreground subagent ends with the work that waits on it. A background
-         *  subagent keeps its tool calls open until the SDK reports its end, which
-         *  Claude Code 2.1.293 does for the ones it stops, before the turn's result
-         *  (see `NativeSubagentRuntime.parentCancelled`).
-         *  Runs once per turn: a second call, from the other settling path, waits
-         *  for the first (see `Turn.closingCancelledToolCalls`). */
-        const closeCancelledToolCalls = (turn) => (turn.closingCancelledToolCalls ??= (async () => {
+        /** Whether output of the conversation `parentToolUseId` (null for the main
+         *  one) is a background subagent's that still runs. A cancel does not stop
+         *  such a subagent's work (agentclientprotocol/agent-client-protocol#2308):
+         *  the closing at the cancel leaves its tool calls open for their results
+         *  (`closedAtCancel`), and the window after the cancel lets its output
+         *  through (see the `session.cancelled` checks of the stream and the
+         *  user/assistant cases). Claude Code currently stops background subagents
+         *  at an interrupt, so this decides only the output that comes before the
+         *  SDK reports a subagent's end. */
+        const isRunningBackgroundSubagentOutput = (parentToolUseId) => parentToolUseId !== null && runsInBackground(parentToolUseId);
+        /** Ends the open tool calls that `include` accepts, with the report of a call
+         *  that a cancel stopped and sent no result for. `include` gets the Agent/Task
+         *  call of the subagent that made the tool call, if a subagent did. */
+        const closeOpenToolCalls = async (include) => {
             const renderer = new AcpToolCallRenderer(this.toolCallCapabilities);
             for (const toolCallId of [...session.emittedToolCalls]) {
                 const parentToolUseId = session.toolCallParents?.get(toolCallId);
-                if (parentToolUseId !== undefined && runsInBackground(parentToolUseId))
+                if (!include(parentToolUseId))
                     continue;
                 const report = renderer.unfinished({
                     toolCallId,
@@ -3210,8 +3220,48 @@ export class ClaudeAcpAgent {
                     stampParentToolUseId(report, parentToolUseId);
                 await closeToolCall(toolCallId, report);
             }
-        })());
+        };
+        /** Whether the closing at the end of the work a cancel stopped takes a tool
+         *  call that the subagent started by the Agent call `parentToolUseId` made
+         *  (undefined for a call of the main conversation): not one of a running
+         *  background subagent, which the cancel may not have stopped. */
+        const closedAtCancel = (parentToolUseId) => parentToolUseId === undefined || !runsInBackground(parentToolUseId);
+        /** Closes the tool calls that the work a cancel stopped left open, as that
+         *  work ends. Claude Code's interrupt ends each running tool of the main
+         *  conversation with an error result, which `sendInterruptedToolResults`
+         *  delivers. What is still open here has no result to deliver:
+         *  - a tool of a subagent: Claude Code writes its interrupted result only to
+         *    the subagent's own transcript, not to the stream;
+         *  - a tool call that Claude abandoned before it ran;
+         *  - every tool call, when the stream gives no results at all, as when the
+         *    force-cancel backstop ends a wedged turn.
+         *  A foreground subagent ends with the work that waits on it. A background
+         *  subagent keeps its tool calls open until the SDK reports its end, which
+         *  Claude Code 2.1.293 does for the ones it stops, before the turn's result
+         *  (see `NativeSubagentRuntime.parentCancelled`). When the SDK reports it
+         *  only after the work ended, `closeStoppedSubagentToolCalls` closes them.
+         *  Runs once per turn: a second call, from the other settling path, waits
+         *  for the first (see `Turn.closingCancelledToolCalls`). */
+        const closeCancelledToolCalls = (turn) => (turn.closingCancelledToolCalls ??= closeOpenToolCalls(closedAtCancel));
         session.closeCancelledToolCalls = closeCancelledToolCalls;
+        /** Closes the tool calls of the subagent that the Agent call `agentToolUseId`
+         *  started, once the SDK reports the subagent stopped, if a cancel stopped it
+         *  after the work that waited on it ended. Nothing else ends them then.
+         *  Example: the cancel settles a turn that v1 holds for a background
+         *  subagent, so `closeCancelledToolCalls` leaves the subagent's command
+         *  open, since the subagent runs. Claude Code's interrupt then stops the
+         *  subagent. Claude Code 2.1.296 sends the command's interrupted result
+         *  after that, but the result is dropped like all output after the work's
+         *  end (see the `session.cancelled` check of the user/assistant case).
+         *  While the work still runs, the calls of a stopped subagent get Claude
+         *  Code's result, or `closeCancelledToolCalls` at the work's end. */
+        const closeStoppedSubagentToolCalls = async (agentToolUseId) => {
+            if (!agentToolUseId || !session.cancelled)
+                return;
+            if (!this.workEndReported(params.sessionId, session))
+                return;
+            await closeOpenToolCalls((parentToolUseId) => parentToolUseId === agentToolUseId);
+        };
         /** Delivers the results that the work a cancel stopped sends for tool calls
          *  that the client holds open. Claude Code's interrupt ends each running tool
          *  of the main conversation with an error result, before the result that
@@ -3245,6 +3295,47 @@ export class ClaudeAcpAgent {
                 await sendUpdate(notification);
             }
         };
+        /** The model cycle that Claude Code started on its own ends, and its end is
+         *  about to be reported: closes the tool calls that it left open first. A
+         *  cycle is foreground work that no turn settles, so neither
+         *  `closeCancelledToolCalls` nor the check of `settleActive` for unfinished
+         *  tools runs for it. A turn that took the cycle over closes its own calls,
+         *  when it settles.
+         *
+         *  After a cancel, Claude Code's interrupt gives the tools of the main
+         *  conversation results, which `sendInterruptedToolResults` delivers while
+         *  the cycle runs. What is still open has none, such as the command of a
+         *  foreground subagent. The follow-up of a turn that v1 holds for its
+         *  background subagents is a cycle too, and the cancel ends the held turn
+         *  as well, possibly in `cancelTurns` while these reports are in flight. So
+         *  the cycle's calls close with the held turn's closing, which each settle
+         *  of the turn waits for, and the response never comes before them.
+         *
+         *  At any other end, every call that ran has its result. What is open is a
+         *  call of the main conversation that Claude abandoned before it ran, such
+         *  as a streamed tool_use that never reached a complete message, which a
+         *  turn's end closes the same way (`closeUnfinished`). The calls of a
+         *  subagent are not the cycle's: a background subagent runs on. */
+        const closeCycleToolCalls = async () => {
+            if (!this.runsAutonomousCycle(params.sessionId))
+                return;
+            if (session.cancelled) {
+                const held = session.activeTurn;
+                if (held && !held.settled)
+                    await closeCancelledToolCalls(held);
+                else
+                    await closeOpenToolCalls(closedAtCancel);
+                return;
+            }
+            const renderer = new AcpToolCallRenderer(this.toolCallCapabilities);
+            for (const toolCallId of [...session.emittedToolCalls]) {
+                if (session.toolCallParents?.has(toolCallId))
+                    continue;
+                if (session.dispatchedToolCalls?.has(toolCallId))
+                    continue;
+                await closeToolCall(toolCallId, renderer.unfinished({ toolCallId, ran: false }));
+            }
+        };
         /** At the actual turn boundary, preview its checkpoint, settle the active
          *  turn exactly once, disarm the force-cancel backstop, and drop it from
          *  the queue. Cancellation and provider failures skip checkpoint I/O. */
@@ -3894,6 +3985,7 @@ export class ClaudeAcpAgent {
                                     // here. An owed idle belongs to an earlier result: it can lag
                                     // past the cycle's first output.
                                     if (session.owedTrailingIdles === 0) {
+                                        await closeCycleToolCalls();
                                         this.endAutonomousCycle(params.sessionId, {
                                             outcome: { stopReason: session.cancelled ? "cancelled" : "end_turn" },
                                         });
@@ -4244,6 +4336,9 @@ export class ClaudeAcpAgent {
                                     droppedStreams.delete(message.tool_use_id);
                                 }
                                 await endBackgroundTerminal(message.task_id);
+                                if (message.status === "stopped") {
+                                    await closeStoppedSubagentToolCalls(message.tool_use_id);
+                                }
                                 settleLiveTask(message.task_id);
                                 break;
                             case "task_updated":
@@ -4275,6 +4370,9 @@ export class ClaudeAcpAgent {
                                         droppedStreams.delete(parentToolUseId);
                                     }
                                     await endBackgroundTerminal(message.task_id);
+                                    if (message.patch.status === "killed") {
+                                        await closeStoppedSubagentToolCalls(parentToolUseId);
+                                    }
                                     settleLiveTask(message.task_id);
                                 }
                                 else if (message.patch.status === "running" ||
@@ -4710,6 +4808,7 @@ export class ClaudeAcpAgent {
                                 pendingExitPlanContextReset?.toolUseId ===
                                     pendingExitPlanModeInterruption?.toolUseId;
                             if (!continuesPlan && !(isAutonomousResult && message.num_turns === 0)) {
+                                await closeCycleToolCalls();
                                 this.endAutonomousCycle(params.sessionId, autonomousCycleEnd(message, resultModelUsage, session.cancelled || exitPlanInterruption || isAbortedResult(message)));
                             }
                             if (session.cancelled) {
@@ -5168,7 +5267,8 @@ export class ClaudeAcpAgent {
                         // `cancelled` check in the user/assistant case). Otherwise the
                         // answer to a prompt the cancel abandoned, which Claude Code had
                         // already taken off its queue, would stream to the client after the
-                        // cancel was reported.
+                        // cancel was reported. A background subagent that still runs is not
+                        // work the cancel stopped (see isRunningBackgroundSubagentOutput).
                         //
                         // Where the consolidated message delivers the text (the same
                         // condition as in the user/assistant case), a stream that loses a
@@ -5180,7 +5280,13 @@ export class ClaudeAcpAgent {
                         // prefix of the text, so the text would be sent again (see
                         // unstreamedRemainder).
                         const streamKey = message.parent_tool_use_id ?? "";
-                        if (session.cancelled && this.workEndReported(params.sessionId, session)) {
+                        const stoppedWorkOutput = this.dropsStoppedWorkOutput(params.sessionId, session) &&
+                            !isRunningBackgroundSubagentOutput(message.parent_tool_use_id);
+                        if (message.event.type === "content_block_start" &&
+                            isToolUseBlock(message.event.content_block)) {
+                            recordReachedToolUse(session, message.event.content_block.id, stoppedWorkOutput);
+                        }
+                        if (stoppedWorkOutput) {
                             if (message.parent_tool_use_id === null || forwardsSubagentText()) {
                                 droppedStreams.add(streamKey);
                             }
@@ -5250,8 +5356,18 @@ export class ClaudeAcpAgent {
                     }
                     case "user":
                     case "assistant": {
-                        if (message.type === "assistant")
+                        if (message.type === "assistant") {
                             recordDispatchedToolUses(session, message.message.content);
+                            // A tool use that did not stream is reached here first.
+                            const content = message.message.content;
+                            const stoppedWorkOutput = this.dropsStoppedWorkOutput(params.sessionId, session) &&
+                                !isRunningBackgroundSubagentOutput(message.parent_tool_use_id);
+                            for (const block of Array.isArray(content) ? content : []) {
+                                if (isToolUseBlock(block)) {
+                                    recordReachedToolUse(session, block.id, stoppedWorkOutput);
+                                }
+                            }
+                        }
                         // Record the ACP messageId -> SDK uuid mapping for this message
                         // (including replays). The consolidated message carries both ids, so
                         // this is where we learn the uuid the SDK's rewind/resume APIs key on
@@ -5355,11 +5471,13 @@ export class ClaudeAcpAgent {
                                 break;
                             }
                         }
-                        if (session.cancelled) {
+                        if (session.cancelled &&
+                            !isRunningBackgroundSubagentOutput(message.parent_tool_use_id)) {
                             // The work the cancel stopped ends its tools with error results.
                             // Until the client is told that the work ended, they close the
                             // tool calls it opened. Everything else that work sends is
-                            // dropped, and so is everything after that report.
+                            // dropped, and so is everything after that report. A background
+                            // subagent that still runs is not that work: its messages go on.
                             if (message.type === "user" && !this.workEndReported(params.sessionId, session)) {
                                 await sendInterruptedToolResults(message);
                             }
@@ -5790,6 +5908,10 @@ export class ClaudeAcpAgent {
             return;
         }
         session.cancelled = true;
+        // The interrupt below makes Claude Code withdraw the requests that are open
+        // now (see `withPendingUserInput`).
+        for (const input of session.openUserInputs ?? [])
+            input.cancelled = true;
         // Before anything awaits, so a model request that the consumer reads in
         // the meantime is already judged against these prompts.
         session.cancelledPrompts ??= new Set();
@@ -6718,19 +6840,29 @@ export class ClaudeAcpAgent {
     /** Runs `request`, a request that `requestSessionId` sends for the session
      *  `ownerSessionId`. When that is a subagent's child session, the child
      *  reports that it awaits the user while the request is open (the RFD form,
-     *  see `NativeSubagentRuntime.awaitingUser`). */
-    withChildAwaitingUser(ownerSessionId, requestSessionId, request) {
+     *  see `NativeSubagentRuntime.awaitingUser`). `signal` aborts when Claude
+     *  Code withdraws the request. */
+    withChildAwaitingUser(ownerSessionId, requestSessionId, signal, request) {
         const runtime = this.sessions[ownerSessionId]?.nativeSubagentRuntime;
         return runtime && requestSessionId !== ownerSessionId
-            ? runtime.awaitingUser(requestSessionId, request)
+            ? runtime.awaitingUser(requestSessionId, request, signal)
             : request();
     }
     /** Mark a client request of the subagent `agentID` (absent for the main
      *  conversation) as awaiting user input for exactly the lifetime of its
      *  promise (see `Session.openUserInputs`). Steering consults the open
      *  requests synchronously, so a message arriving while any permission or
-     *  elicitation card is open uses non-interrupting SDK delivery. */
-    async withPendingUserInput(sessionId, request, agentID) {
+     *  elicitation card is open uses non-interrupting SDK delivery.
+     *
+     *  `signal` aborts when Claude Code withdraws the request, which is not an
+     *  answer. Example: the user cancels while a permission request is open.
+     *  Claude Code's interrupt withdraws it as it stops the work, and the work
+     *  ends `idle cancelled` right after. The end of the request then reports
+     *  no `running`: the client would see `requires_action`, `running`, `idle
+     *  cancelled`. A withdrawal without a cancel means that something else
+     *  answered the request in the user's place, such as a `PermissionRequest`
+     *  hook, and the work goes on, so the end reports `running`. */
+    async withPendingUserInput(sessionId, signal, request, agentID) {
         const session = this.sessions[sessionId];
         if (!session)
             return request();
@@ -6742,7 +6874,8 @@ export class ClaudeAcpAgent {
         }
         finally {
             session.openUserInputs.delete(input);
-            this.syncAwaitingUser(sessionId, session);
+            const withdrawnByCancel = signal.aborted && input.cancelled === true;
+            this.syncAwaitingUser(sessionId, session, withdrawnByCancel);
         }
     }
     /** Report whether the session's foreground work awaits the user: exactly
@@ -6751,8 +6884,13 @@ export class ClaudeAcpAgent {
      *  and Claude Code can ask for a queued prompt before the consumer activates
      *  it, so a request is not tied to the work that was running when it
      *  opened. Called when a request opens or closes, when a turn activates, and
-     *  when a task registers or moves to the background. */
-    syncAwaitingUser(sessionId, session) {
+     *  when a task registers or moves to the background.
+     *
+     *  When the last request ends, the work reports `running` again, unless a
+     *  cancel withdrew that request (`withdrawnByCancel`, see
+     *  {@link withPendingUserInput}): the work is being stopped, and reports its
+     *  end next. */
+    syncAwaitingUser(sessionId, session, withdrawnByCancel = false) {
         const work = this.foregroundWork.get(sessionId);
         if (!work)
             return;
@@ -6762,7 +6900,7 @@ export class ClaudeAcpAgent {
         work.awaitingUser = waiting;
         if (waiting)
             work.events.awaitingUser();
-        else
+        else if (!withdrawnByCancel)
             work.events.running();
     }
     /** Make `owner` the foreground work of the session `sessionId` (see
@@ -6771,14 +6909,12 @@ export class ClaudeAcpAgent {
      *  reports nothing new: a turn takes over a cycle that Claude Code started on
      *  its own, and only the owner's end ends the work. */
     startForeground(sessionId, owner) {
-        if (!this.foregroundEvents)
-            return;
         const current = this.foregroundWork.get(sessionId);
         if (current) {
             current.owner = owner;
             return;
         }
-        const events = this.foregroundEvents(sessionId);
+        const events = this.foregroundEvents?.(sessionId) ?? UNREPORTED_FOREGROUND;
         this.foregroundWork.set(sessionId, { owner, events, awaitingUser: false });
         events.running();
         const session = this.sessions[sessionId];
@@ -6804,7 +6940,7 @@ export class ClaudeAcpAgent {
      *  whose work ended at its result, so its follow-up is a cycle. Output of
      *  the work a cancel stopped starts nothing (see Session.cancelled). */
     startAutonomousCycle(sessionId, session, message) {
-        if (!this.foregroundEvents || this.foregroundWork.has(sessionId) || session.cancelled)
+        if (this.foregroundWork.has(sessionId) || session.cancelled)
             return;
         if (message.type !== "assistant" && message.type !== "stream_event")
             return;
@@ -6822,15 +6958,79 @@ export class ClaudeAcpAgent {
     /** Whether the client has been told that the session's work ended: on v2 by
      *  an idle state, so no foreground work is open, including a cycle that
      *  Claude Code started on its own; on v1 by the response to the turn's
-     *  prompt, so no turn is active. */
+     *  prompt, so no turn is active. v1 reports nothing for a cycle, so its end
+     *  is its result or idle: until then, Claude Code's results for the cycle's
+     *  tool calls still reach the client after a cancel. */
     workEndReported(sessionId, session) {
-        return this.foregroundEvents ? !this.foregroundWork.has(sessionId) : !session.activeTurn;
+        return this.foregroundEvents
+            ? !this.foregroundWork.has(sessionId)
+            : !session.activeTurn && !this.runsAutonomousCycle(sessionId);
+    }
+    /** Whether the consumer drops what it reaches now as output of the work a
+     *  cancel stopped: the client has been told that the work ended, and the
+     *  window after the cancel is still open (see Session.cancelled). */
+    dropsStoppedWorkOutput(sessionId, session) {
+        return session.cancelled && this.workEndReported(sessionId, session);
+    }
+    /**
+     * Whether the tool use `toolUseId`, which reaches `canUseTool` or a hook, is
+     * output of the work a cancel stopped that the consumer dropped (see
+     * `dropsStoppedWorkOutput`). Example: Claude Code runs a prompt that the
+     * cancel abandoned, and it asks to run a command. The consumer drops the
+     * tool use and its result, so a tool call shown for it would never end, and
+     * the client would keep it open (issue #1061).
+     *
+     * Claude Code calls `canUseTool` and hooks on its control channel, after it
+     * streamed the tool use, and the consumer can lag behind. So the session can
+     * still look cancelled while the consumer has the next prompt's echo, which
+     * ends the window, still ahead of the tool use. While a cancel's window may
+     * be open, this waits until the consumer reaches the tool use, for at most
+     * {@link toolUseWaitMs} or until `signal` aborts: the stream never shows
+     * some tool uses, such as SandboxNetworkAccess's. Without a cancel nothing
+     * is dropped, so it answers at once. It returns a promise only when it
+     * waits, so a permission request without a cancel goes out as soon as
+     * before.
+     */
+    isStoppedWorkToolUse(session, toolUseId, signal) {
+        const reached = session.reachedToolUses?.get(toolUseId);
+        if (reached !== undefined)
+            return reached;
+        if (!session.cancelled || signal?.aborted)
+            return false;
+        return this.reachedInStream(session, toolUseId, signal);
+    }
+    /** Waits until the consumer reaches the tool use `toolUseId` (see
+     *  `isStoppedWorkToolUse`), then says whether it dropped it. */
+    async reachedInStream(session, toolUseId, signal) {
+        await new Promise((resolve) => {
+            const waiters = (session.toolUseWaiters ??= new Map());
+            let waiting = waiters.get(toolUseId);
+            if (!waiting)
+                waiters.set(toolUseId, (waiting = new Set()));
+            const done = () => {
+                clearTimeout(timer);
+                signal?.removeEventListener("abort", done);
+                waiting.delete(done);
+                if (waiting.size === 0 && waiters.get(toolUseId) === waiting)
+                    waiters.delete(toolUseId);
+                resolve();
+            };
+            const timer = setTimeout(done, this.toolUseWaitMs);
+            signal?.addEventListener("abort", done, { once: true });
+            waiting.add(done);
+        });
+        return session.reachedToolUses?.get(toolUseId) ?? false;
     }
     /** End the session's model cycle that Claude Code started on its own, if one
      *  runs. */
     endAutonomousCycle(sessionId, end) {
         this.endForeground(sessionId, AUTONOMOUS_CYCLE, end);
     }
+    /** Whether a model cycle that Claude Code started on its own is the session's
+     *  foreground work. A turn that took a cycle over owns the work from then on. */
+    runsAutonomousCycle(sessionId) {
+        return this.foregroundWork.get(sessionId)?.owner === AUTONOMOUS_CYCLE;
+    }
     /** Forward a permission request to the client, wiring the tool call's
      *  `signal` through as a `cancellationSignal`. When the turn is cancelled
      *  while the client's prompt is still open the signal aborts, the SDK sends
@@ -6855,7 +7055,7 @@ export class ClaudeAcpAgent {
         // The request goes to a subagent's child session for a tool call of that
         // subagent, but it blocks the turn of the owner session.
         try {
-            return await this.withChildAwaitingUser(ownerSessionId, params.sessionId, () => this.withPendingUserInput(ownerSessionId, () => raceWithAbort(this.client.requestPermission(params, signal), signal), agentID));
+            return await this.withChildAwaitingUser(ownerSessionId, params.sessionId, signal, () => this.withPendingUserInput(ownerSessionId, signal, () => raceWithAbort(this.client.requestPermission(params, signal), signal), agentID));
         }
         catch (error) {
             if (signal.aborted) {
@@ -6864,6 +7064,17 @@ export class ClaudeAcpAgent {
             throw error;
         }
     }
+    /** Send the client an elicitation for a callback of Claude Code. When the
+     *  callback's `signal` aborts, the SDK sends `$/cancel_request` and keeps
+     *  waiting for the client's reply, which a client that ignores the cancel
+     *  never sends. So the call also rejects at once on the abort, as
+     *  {@link requestPermissionFromClient} does for a permission request. Left
+     *  open, the request would stay in `openUserInputs` (see
+     *  {@link withPendingUserInput}), which keeps steering non-interrupting, and
+     *  a child's `openRequests` would not drop. */
+    elicitFromClient(request, signal) {
+        return raceWithAbort(this.client.createElicitation(request, signal), signal);
+    }
     /** Emit the `tool_call` a permission request references if it hasn't been sent
      *  yet, so the client has the tool call before being asked to approve it. The
      *  matching streamed tool_use chunk later refines it with a `tool_call_update`
@@ -6960,17 +7171,21 @@ export class ClaudeAcpAgent {
      * decision, and a failure only leaves the preview out.
      */
     fileChangePreviewHook(sessionId) {
-        return async (input, toolUseID) => {
+        return async (input, toolUseID, { signal }) => {
             if (input.hook_event_name === "PreToolUse" && toolUseID) {
-                await this.previewFileChange(sessionId, input, toolUseID).catch((error) => this.logger.error(`Session ${sessionId}: failed to preview ${toolUseID}: ${error}`));
+                await this.previewFileChange(sessionId, input, toolUseID, signal).catch((error) => this.logger.error(`Session ${sessionId}: failed to preview ${toolUseID}: ${error}`));
             }
             return { continue: true };
         };
     }
-    async previewFileChange(sessionId, input, toolUseID) {
+    async previewFileChange(sessionId, input, toolUseID, signal) {
         const session = this.sessions[sessionId];
         if (!session)
             return;
+        // As in `canUseTool`: the work a cancel stopped shows nothing.
+        const stopped = this.isStoppedWorkToolUse(session, toolUseID, signal);
+        if (stopped instanceof Promise ? await stopped : stopped)
+            return;
         const toolInput = (input.tool_input ?? {});
         const content = await previewPatchContent(input.tool_name, toolInput, session.cwd, "v2");
         if (!content)
@@ -7012,6 +7227,14 @@ export class ClaudeAcpAgent {
                     message: "Session not found",
                 };
             }
+            // The work a cancel stopped shows the client nothing after it was told
+            // that the work ended: neither a tool call nor a request. Its tool does
+            // not run.
+            const stopped = this.isStoppedWorkToolUse(session, toolUseID, signal);
+            if (stopped instanceof Promise ? await stopped : stopped) {
+                this.logger.log(`Session ${sessionId}: denied ${toolName} ${toolUseID}, which the cancelled work asked for`);
+                return { behavior: "deny", message: "The user cancelled this prompt." };
+            }
             const { parentToolUseId, toolCallSessionId: permissionSessionId } = this.toolUseOwner(session, sessionId, agentID);
             if (agentID && !parentToolUseId) {
                 // The attribution rests on task_started.task_id === canUseTool's
@@ -7164,7 +7387,7 @@ export class ClaudeAcpAgent {
                 return { action: "decline" };
             }
             try {
-                const response = await this.withPendingUserInput(sessionId, () => this.client.createElicitation(createRequest, signal));
+                const response = await this.withPendingUserInput(sessionId, signal, () => this.elicitFromClient(createRequest, signal));
                 if (signal.aborted) {
                     return { action: "cancel" };
                 }
@@ -7196,7 +7419,7 @@ export class ClaudeAcpAgent {
         const createRequest = askUserQuestionsToCreateRequest(questions, requestSessionId, toolUseID, this.toolCallCapabilities.air.client);
         let response;
         try {
-            response = await this.withChildAwaitingUser(sessionId, requestSessionId, () => this.withPendingUserInput(sessionId, () => this.client.createElicitation(createRequest, signal), agentID));
+            response = await this.withChildAwaitingUser(sessionId, requestSessionId, signal, () => this.withPendingUserInput(sessionId, signal, () => this.elicitFromClient(createRequest, signal), agentID));
         }
         catch (error) {
             // A cancellation we requested (signal aborted) settles as an aborted tool
@@ -7236,7 +7459,7 @@ export class ClaudeAcpAgent {
             }
             let response;
             try {
-                response = await this.withPendingUserInput(sessionId, () => this.client.createElicitation(refusalFallbackToCreateRequest(prompt, sessionId), signal));
+                response = await this.withPendingUserInput(sessionId, signal, () => this.elicitFromClient(refusalFallbackToCreateRequest(prompt, sessionId), signal));
             }
             catch (error) {
                 // A cancellation we requested (signal aborted) is expected teardown;
@@ -9229,14 +9452,38 @@ function recordDispatchedToolUses(session, content) {
     if (!Array.isArray(content))
         return;
     for (const block of content) {
-        if ((block?.type === "tool_use" ||
-            block?.type === "server_tool_use" ||
-            block?.type === "mcp_tool_use") &&
-            typeof block.id === "string") {
+        if (isToolUseBlock(block))
             recordDispatchedToolCall(session, block.id);
-        }
     }
 }
+function isToolUseBlock(block) {
+    const { type, id } = (block ?? {});
+    return ((type === "tool_use" || type === "server_tool_use" || type === "mcp_tool_use") &&
+        typeof id === "string");
+}
+const MAX_REACHED_TOOL_USES = 1000;
+/**
+ * Records that the consumer reached the tool use `toolUseId`, and whether it
+ * dropped it as output of the work a cancel stopped, then wakes what waits for
+ * it (see `isStoppedWorkToolUse`). The first record of a tool use stays.
+ */
+function recordReachedToolUse(session, toolUseId, dropped) {
+    const reached = (session.reachedToolUses ??= new Map());
+    if (reached.has(toolUseId))
+        return;
+    reached.set(toolUseId, dropped);
+    if (reached.size > MAX_REACHED_TOOL_USES) {
+        const oldest = reached.keys().next().value;
+        if (oldest !== undefined)
+            reached.delete(oldest);
+    }
+    const waiters = session.toolUseWaiters?.get(toolUseId);
+    if (!waiters)
+        return;
+    session.toolUseWaiters?.delete(toolUseId);
+    for (const wake of waiters)
+        wake();
+}
 /** Streamed and permission-surfaced tools can precede the SDK's user echo. */
 function recordForegroundToolCall(session, toolCallId) {
     const turn = session.activeTurn ?? session.turnQueue?.find((queued) => !queued.settled);