@agentclientprotocol/claude-agent-acp 0.90.1-preview.1 → 0.90.1-preview.11

package/dist/acp-agent.js

@@ -47,7 +47,8 @@ import { formatUsageResponse, isUsageCommandText, parseUsageResponse } from "./u
 export { DEFAULT_AGENT_ID } from "./session-config-ids.js";
 import { MCP_AVAILABLE_COMMAND, parseMcpCommand, runMcpCommand } from "./mcp-command.js";
 import { MODE_CONFIG_ID, resolveInitialPermissionMode, SessionModeManager, } from "./session-mode.js";
-import { applyAvailableModelsAllowlist, buildModelConfigOption, getAvailableModels, MODEL_CONFIG_ID, resolveModelPreference, } from "./session-model.js";
+import { applyAvailableModelsAllowlist, buildModelConfigOption, getAvailableModels, MODEL_CONFIG_ID, narrowToGatewayModels, resolveModelPreference, } from "./session-model.js";
+import { GatewayListingError, listBedrockModels, listGatewayModels, PROVIDER_AUTH_TOKEN_PLACEHOLDER, selectBedrockRegion, } from "./gateway-models.js";
 import { buildEffortConfigOption, EFFORT_CONFIG_ID, effortFlagSettings, mergeEffortSettings, settingsEffortForModel, } from "./session-effort.js";
 export { EFFORT_CONFIG_ID, settingsEffortForModel } from "./session-effort.js";
 export { applyAvailableModelsAllowlist, matchResumedModel, MODEL_CONFIG_ID, resolveModelPreference, } from "./session-model.js";
@@ -87,6 +88,11 @@ const STRUCTURED_USAGE_TIMEOUT_MS = 5_000;
  *  The teardown wakes the consumer itself, so they end within a few ticks
  *  unless the consumer is wedged. */
 const TEARDOWN_TURN_END_TIMEOUT_MS = 5_000;
+/** How long `canUseTool` or a hook waits, while a cancel's window may be
+ *  open, for the consumer to reach a tool use in the stream. Claude Code
+ *  streams the tool use before it asks, so the consumer is usually there
+ *  within a few ticks. */
+const TOOL_USE_WAIT_MS = 2_000;
 /** The number of settled subagents whose parent tool call a session keeps for
  *  a later resume (see `resumableSubagents`). */
 const MAX_RESUMABLE_SUBAGENTS = 256;
@@ -285,6 +291,15 @@ const AUTONOMOUS_RESULT_ORIGINS = new Set([
  *  or a model cycle that Claude Code started on its own. At most one cycle
  *  runs at a time, so a constant names it. */
 const AUTONOMOUS_CYCLE = "autonomous-cycle";
+/** The events of a connection that reports no foreground work: v1, whose
+ *  client has no session state. The agent still tracks the work, which
+ *  decides what the window after a cancel drops (see `workEndReported`). */
+const UNREPORTED_FOREGROUND = {
+    running: () => { },
+    awaitingUser: () => { },
+    ended: () => { },
+    failed: () => { },
+};
 /** Whether this turn's terminal result arrived but its settlement is being
  *  held for background subagents it spawned (see Turn.deferredSettle). The
  *  single spelling of the hold predicate, shared by the consumer's settle
@@ -1161,6 +1176,9 @@ export class ClaudeAcpAgent {
      *  return "cancelled". See {@link DEFAULT_FORCE_CANCEL_GRACE_MS}. Mutable so
      *  tests can shrink it. */
     forceCancelGraceMs = DEFAULT_FORCE_CANCEL_GRACE_MS;
+    /** How long `canUseTool` or a hook waits for the consumer to reach a tool
+     *  use (see `isStoppedWorkToolUse`). Mutable so tests can shrink it. */
+    toolUseWaitMs = TOOL_USE_WAIT_MS;
     /**
      * The connection serves ACP v2 (`src/v2/`). The agent still speaks v1
      * types, except for the tool call content that v2 needs and v1 cannot
@@ -1171,7 +1189,8 @@ export class ClaudeAcpAgent {
     foregroundEvents;
     /**
      * The foreground work of each session while it runs, by the session id that
-     * the client knows. A clear-context restart replaces the Claude Code session
+     * the client knows, on every connection: only the `foreground` option
+     * reports it. A clear-context restart replaces the Claude Code session
      * behind that id and moves the running turn to it, so the work belongs to the
      * id, not to a {@link Session}.
      */
@@ -1419,7 +1438,7 @@ export class ClaudeAcpAgent {
         };
     }
     async newSession(params) {
-        if (this.providerUpdate)
+        while (this.providerUpdate)
             await this.providerUpdate;
         const response = await this.createSession(params, {
             // Revisit these meta values once we support resume
@@ -1486,7 +1505,7 @@ export class ClaudeAcpAgent {
      * later load or resume with the same settings reuses it.
      */
     async unstable_forkSession(params) {
-        if (this.providerUpdate)
+        while (this.providerUpdate)
             await this.providerUpdate;
         const { sessionId } = await forkSession(params, {
             liveMessageIdToUuid: this.sessions[params.sessionId]?.messageIdToUuid,
@@ -1504,7 +1523,7 @@ export class ClaudeAcpAgent {
         return { sessionId, modes, configOptions };
     }
     async resumeSession(params) {
-        if (this.providerUpdate)
+        while (this.providerUpdate)
             await this.providerUpdate;
         const result = await this.getOrCreateSession(params);
         this.afterSetupResponse(params.sessionId, params.mcpServers ?? []);
@@ -1512,7 +1531,7 @@ export class ClaudeAcpAgent {
     }
     async loadSession(params) {
         const timing = new SessionTiming(this.logger, "load", params.sessionId);
-        if (this.providerUpdate)
+        while (this.providerUpdate)
             await this.providerUpdate;
         let result;
         if (this.sessions[params.sessionId]) {
@@ -1894,6 +1913,42 @@ export class ClaudeAcpAgent {
         // Unknown provider: idempotent success.
         return {};
     }
+    /**
+     * The model ids the gateway in `config` lists, read before `providers/set`
+     * returns so the sessions it recreates already offer only those, and for
+     * `bedrock` the region prefix picked from them. Setting the same gateway
+     * again reuses the previous listing. `vertex` gateways are not listed.
+     * Throws a {@link GatewayListingError} when the listing fails.
+     */
+    async listProviderModels(config) {
+        // Reuse needs the very same headers, so a rotated token lists again, and a
+        // failed listing then fails that `providers/set`. Deliberate: AIR keeps its
+        // proxy key for the IDE's lifetime and does not rotate it.
+        const current = this.providerConfig;
+        if (current?.listedModels &&
+            current.apiType === config.apiType &&
+            current.baseUrl === config.baseUrl &&
+            sameHeaders(current.headers, config.headers)) {
+            return {
+                listedModels: current.listedModels,
+                bedrockRegionPrefix: current.bedrockRegionPrefix,
+            };
+        }
+        if (config.apiType === "anthropic") {
+            return { listedModels: await listGatewayModels(config.baseUrl, config.headers, this.logger) };
+        }
+        if (config.apiType === "bedrock") {
+            const modelIds = await listBedrockModels(config.baseUrl, config.headers, this.logger);
+            if (!modelIds)
+                return {};
+            const region = selectBedrockRegion(modelIds);
+            if (region.modelIds.length < modelIds.length) {
+                this.logger.log(`[providers/set] Bedrock models span several region prefixes; using ${region.regionPrefix} and dropping ${modelIds.length - region.modelIds.length} id(s) of other prefixes`);
+            }
+            return { listedModels: region.modelIds, bedrockRegionPrefix: region.regionPrefix };
+        }
+        return {};
+    }
     resolveProviderConfig() {
         return this.providerConfig ?? gatewayRequestToProviderConfig(this.gatewayAuthRequest);
     }
@@ -1927,7 +1982,9 @@ export class ClaudeAcpAgent {
         // provider routing set via `providers/set`. Neither touches the on-disk
         // credential store, so dropping these references is the whole logout for
         // those paths.
-        const hadRoutingOverride = this.resolveProviderConfig() !== null;
+        // A queued `providers/set` may still be listing and apply after this point,
+        // so a busy queue counts as an override to clear.
+        const hadRoutingOverride = this.resolveProviderConfig() !== null || this.providerUpdate !== null;
         this.gatewayAuthRequest = undefined;
         this.providerConfig = undefined;
         // Any probe already running read the pre-logout world; the bump makes its
@@ -2032,7 +2089,7 @@ export class ClaudeAcpAgent {
      * before this resolves.
      */
     async startTurn(params, events) {
-        if (this.providerUpdate)
+        while (this.providerUpdate)
             await this.providerUpdate;
         let session = this.sessions[params.sessionId];
         if (!session) {
@@ -3150,8 +3207,14 @@ export class ClaudeAcpAgent {
         /** Sends `report`, which ends the tool call `toolCallId` without its result
          *  (see `AcpToolCallRenderer.unfinished`), and forgets the call. Forgetting
          *  comes first, so that a late hook or a second close cannot overwrite the
-         *  report. */
+         *  report. A command has a display terminal on a client that renders them,
+         *  and no result will end it, so the report ends it too. */
         const closeToolCall = async (toolCallId, report) => {
+            // Read before the cache entry goes: it names the tool.
+            const toolUse = session.toolUseCache[toolCallId];
+            const terminalExit = toolUse && new AcpToolCallRenderer(this.toolCallCapabilities).terminalExit(toolUse);
+            if (terminalExit)
+                report._meta = { ...report._meta, ...terminalExit };
             unregisterHookCallback(toolCallId);
             session.emittedToolCalls.delete(toolCallId);
             delete session.toolUseCache[toolCallId];
@@ -3166,26 +3229,24 @@ export class ClaudeAcpAgent {
             task.backgrounded === true &&
             !task.endedPerLevel &&
             task.parentToolUseId === agentToolUseId);
-        /** Closes the tool calls that the work a cancel stopped left open, as that
-         *  work ends. Claude Code's interrupt ends each running tool of the main
-         *  conversation with an error result, which `sendInterruptedToolResults`
-         *  delivers. What is still open here has no result to deliver:
-         *  - a tool of a subagent: Claude Code writes its interrupted result only to
-         *    the subagent's own transcript, not to the stream;
-         *  - a tool call that Claude abandoned before it ran;
-         *  - every tool call, when the stream gives no results at all, as when the
-         *    force-cancel backstop ends a wedged turn.
-         *  A foreground subagent ends with the work that waits on it. A background
-         *  subagent keeps its tool calls open until the SDK reports its end, which
-         *  Claude Code 2.1.293 does for the ones it stops, before the turn's result
-         *  (see `NativeSubagentRuntime.parentCancelled`).
-         *  Runs once per turn: a second call, from the other settling path, waits
-         *  for the first (see `Turn.closingCancelledToolCalls`). */
-        const closeCancelledToolCalls = (turn) => (turn.closingCancelledToolCalls ??= (async () => {
+        /** Whether output of the conversation `parentToolUseId` (null for the main
+         *  one) is a background subagent's that still runs. A cancel does not stop
+         *  such a subagent's work (agentclientprotocol/agent-client-protocol#2308):
+         *  the closing at the cancel leaves its tool calls open for their results
+         *  (`closedAtCancel`), and the window after the cancel lets its output
+         *  through (see the `session.cancelled` checks of the stream and the
+         *  user/assistant cases). Claude Code currently stops background subagents
+         *  at an interrupt, so this decides only the output that comes before the
+         *  SDK reports a subagent's end. */
+        const isRunningBackgroundSubagentOutput = (parentToolUseId) => parentToolUseId !== null && runsInBackground(parentToolUseId);
+        /** Ends the open tool calls that `include` accepts, with the report of a call
+         *  that a cancel stopped and sent no result for. `include` gets the Agent/Task
+         *  call of the subagent that made the tool call, if a subagent did. */
+        const closeOpenToolCalls = async (include) => {
             const renderer = new AcpToolCallRenderer(this.toolCallCapabilities);
             for (const toolCallId of [...session.emittedToolCalls]) {
                 const parentToolUseId = session.toolCallParents?.get(toolCallId);
-                if (parentToolUseId !== undefined && runsInBackground(parentToolUseId))
+                if (!include(parentToolUseId))
                     continue;
                 const report = renderer.unfinished({
                     toolCallId,
@@ -3198,8 +3259,48 @@ export class ClaudeAcpAgent {
                     stampParentToolUseId(report, parentToolUseId);
                 await closeToolCall(toolCallId, report);
             }
-        })());
+        };
+        /** Whether the closing at the end of the work a cancel stopped takes a tool
+         *  call that the subagent started by the Agent call `parentToolUseId` made
+         *  (undefined for a call of the main conversation): not one of a running
+         *  background subagent, which the cancel may not have stopped. */
+        const closedAtCancel = (parentToolUseId) => parentToolUseId === undefined || !runsInBackground(parentToolUseId);
+        /** Closes the tool calls that the work a cancel stopped left open, as that
+         *  work ends. Claude Code's interrupt ends each running tool of the main
+         *  conversation with an error result, which `sendInterruptedToolResults`
+         *  delivers. What is still open here has no result to deliver:
+         *  - a tool of a subagent: Claude Code writes its interrupted result only to
+         *    the subagent's own transcript, not to the stream;
+         *  - a tool call that Claude abandoned before it ran;
+         *  - every tool call, when the stream gives no results at all, as when the
+         *    force-cancel backstop ends a wedged turn.
+         *  A foreground subagent ends with the work that waits on it. A background
+         *  subagent keeps its tool calls open until the SDK reports its end, which
+         *  Claude Code 2.1.293 does for the ones it stops, before the turn's result
+         *  (see `NativeSubagentRuntime.parentCancelled`). When the SDK reports it
+         *  only after the work ended, `closeStoppedSubagentToolCalls` closes them.
+         *  Runs once per turn: a second call, from the other settling path, waits
+         *  for the first (see `Turn.closingCancelledToolCalls`). */
+        const closeCancelledToolCalls = (turn) => (turn.closingCancelledToolCalls ??= closeOpenToolCalls(closedAtCancel));
         session.closeCancelledToolCalls = closeCancelledToolCalls;
+        /** Closes the tool calls of the subagent that the Agent call `agentToolUseId`
+         *  started, once the SDK reports the subagent stopped, if a cancel stopped it
+         *  after the work that waited on it ended. Nothing else ends them then.
+         *  Example: the cancel settles a turn that v1 holds for a background
+         *  subagent, so `closeCancelledToolCalls` leaves the subagent's command
+         *  open, since the subagent runs. Claude Code's interrupt then stops the
+         *  subagent. Claude Code 2.1.296 sends the command's interrupted result
+         *  after that, but the result is dropped like all output after the work's
+         *  end (see the `session.cancelled` check of the user/assistant case).
+         *  While the work still runs, the calls of a stopped subagent get Claude
+         *  Code's result, or `closeCancelledToolCalls` at the work's end. */
+        const closeStoppedSubagentToolCalls = async (agentToolUseId) => {
+            if (!agentToolUseId || !session.cancelled)
+                return;
+            if (!this.workEndReported(params.sessionId, session))
+                return;
+            await closeOpenToolCalls((parentToolUseId) => parentToolUseId === agentToolUseId);
+        };
         /** Delivers the results that the work a cancel stopped sends for tool calls
          *  that the client holds open. Claude Code's interrupt ends each running tool
          *  of the main conversation with an error result, before the result that
@@ -3233,6 +3334,47 @@ export class ClaudeAcpAgent {
                 await sendUpdate(notification);
             }
         };
+        /** The model cycle that Claude Code started on its own ends, and its end is
+         *  about to be reported: closes the tool calls that it left open first. A
+         *  cycle is foreground work that no turn settles, so neither
+         *  `closeCancelledToolCalls` nor the check of `settleActive` for unfinished
+         *  tools runs for it. A turn that took the cycle over closes its own calls,
+         *  when it settles.
+         *
+         *  After a cancel, Claude Code's interrupt gives the tools of the main
+         *  conversation results, which `sendInterruptedToolResults` delivers while
+         *  the cycle runs. What is still open has none, such as the command of a
+         *  foreground subagent. The follow-up of a turn that v1 holds for its
+         *  background subagents is a cycle too, and the cancel ends the held turn
+         *  as well, possibly in `cancelTurns` while these reports are in flight. So
+         *  the cycle's calls close with the held turn's closing, which each settle
+         *  of the turn waits for, and the response never comes before them.
+         *
+         *  At any other end, every call that ran has its result. What is open is a
+         *  call of the main conversation that Claude abandoned before it ran, such
+         *  as a streamed tool_use that never reached a complete message, which a
+         *  turn's end closes the same way (`closeUnfinished`). The calls of a
+         *  subagent are not the cycle's: a background subagent runs on. */
+        const closeCycleToolCalls = async () => {
+            if (!this.runsAutonomousCycle(params.sessionId))
+                return;
+            if (session.cancelled) {
+                const held = session.activeTurn;
+                if (held && !held.settled)
+                    await closeCancelledToolCalls(held);
+                else
+                    await closeOpenToolCalls(closedAtCancel);
+                return;
+            }
+            const renderer = new AcpToolCallRenderer(this.toolCallCapabilities);
+            for (const toolCallId of [...session.emittedToolCalls]) {
+                if (session.toolCallParents?.has(toolCallId))
+                    continue;
+                if (session.dispatchedToolCalls?.has(toolCallId))
+                    continue;
+                await closeToolCall(toolCallId, renderer.unfinished({ toolCallId, ran: false }));
+            }
+        };
         /** At the actual turn boundary, preview its checkpoint, settle the active
          *  turn exactly once, disarm the force-cancel backstop, and drop it from
          *  the queue. Cancellation and provider failures skip checkpoint I/O. */
@@ -3882,6 +4024,7 @@ export class ClaudeAcpAgent {
                                     // here. An owed idle belongs to an earlier result: it can lag
                                     // past the cycle's first output.
                                     if (session.owedTrailingIdles === 0) {
+                                        await closeCycleToolCalls();
                                         this.endAutonomousCycle(params.sessionId, {
                                             outcome: { stopReason: session.cancelled ? "cancelled" : "end_turn" },
                                         });
@@ -4232,6 +4375,9 @@ export class ClaudeAcpAgent {
                                     droppedStreams.delete(message.tool_use_id);
                                 }
                                 await endBackgroundTerminal(message.task_id);
+                                if (message.status === "stopped") {
+                                    await closeStoppedSubagentToolCalls(message.tool_use_id);
+                                }
                                 settleLiveTask(message.task_id);
                                 break;
                             case "task_updated":
@@ -4263,6 +4409,9 @@ export class ClaudeAcpAgent {
                                         droppedStreams.delete(parentToolUseId);
                                     }
                                     await endBackgroundTerminal(message.task_id);
+                                    if (message.patch.status === "killed") {
+                                        await closeStoppedSubagentToolCalls(parentToolUseId);
+                                    }
                                     settleLiveTask(message.task_id);
                                 }
                                 else if (message.patch.status === "running" ||
@@ -4698,6 +4847,7 @@ export class ClaudeAcpAgent {
                                 pendingExitPlanContextReset?.toolUseId ===
                                     pendingExitPlanModeInterruption?.toolUseId;
                             if (!continuesPlan && !(isAutonomousResult && message.num_turns === 0)) {
+                                await closeCycleToolCalls();
                                 this.endAutonomousCycle(params.sessionId, autonomousCycleEnd(message, resultModelUsage, session.cancelled || exitPlanInterruption || isAbortedResult(message)));
                             }
                             if (session.cancelled) {
@@ -5156,7 +5306,8 @@ export class ClaudeAcpAgent {
                         // `cancelled` check in the user/assistant case). Otherwise the
                         // answer to a prompt the cancel abandoned, which Claude Code had
                         // already taken off its queue, would stream to the client after the
-                        // cancel was reported.
+                        // cancel was reported. A background subagent that still runs is not
+                        // work the cancel stopped (see isRunningBackgroundSubagentOutput).
                         //
                         // Where the consolidated message delivers the text (the same
                         // condition as in the user/assistant case), a stream that loses a
@@ -5168,7 +5319,13 @@ export class ClaudeAcpAgent {
                         // prefix of the text, so the text would be sent again (see
                         // unstreamedRemainder).
                         const streamKey = message.parent_tool_use_id ?? "";
-                        if (session.cancelled && this.workEndReported(params.sessionId, session)) {
+                        const stoppedWorkOutput = this.dropsStoppedWorkOutput(params.sessionId, session) &&
+                            !isRunningBackgroundSubagentOutput(message.parent_tool_use_id);
+                        if (message.event.type === "content_block_start" &&
+                            isToolUseBlock(message.event.content_block)) {
+                            recordReachedToolUse(session, message.event.content_block.id, stoppedWorkOutput);
+                        }
+                        if (stoppedWorkOutput) {
                             if (message.parent_tool_use_id === null || forwardsSubagentText()) {
                                 droppedStreams.add(streamKey);
                             }
@@ -5238,8 +5395,18 @@ export class ClaudeAcpAgent {
                     }
                     case "user":
                     case "assistant": {
-                        if (message.type === "assistant")
+                        if (message.type === "assistant") {
                             recordDispatchedToolUses(session, message.message.content);
+                            // A tool use that did not stream is reached here first.
+                            const content = message.message.content;
+                            const stoppedWorkOutput = this.dropsStoppedWorkOutput(params.sessionId, session) &&
+                                !isRunningBackgroundSubagentOutput(message.parent_tool_use_id);
+                            for (const block of Array.isArray(content) ? content : []) {
+                                if (isToolUseBlock(block)) {
+                                    recordReachedToolUse(session, block.id, stoppedWorkOutput);
+                                }
+                            }
+                        }
                         // Record the ACP messageId -> SDK uuid mapping for this message
                         // (including replays). The consolidated message carries both ids, so
                         // this is where we learn the uuid the SDK's rewind/resume APIs key on
@@ -5343,11 +5510,13 @@ export class ClaudeAcpAgent {
                                 break;
                             }
                         }
-                        if (session.cancelled) {
+                        if (session.cancelled &&
+                            !isRunningBackgroundSubagentOutput(message.parent_tool_use_id)) {
                             // The work the cancel stopped ends its tools with error results.
                             // Until the client is told that the work ended, they close the
                             // tool calls it opened. Everything else that work sends is
-                            // dropped, and so is everything after that report.
+                            // dropped, and so is everything after that report. A background
+                            // subagent that still runs is not that work: its messages go on.
                             if (message.type === "user" && !this.workEndReported(params.sessionId, session)) {
                                 await sendInterruptedToolResults(message);
                             }
@@ -5778,6 +5947,10 @@ export class ClaudeAcpAgent {
             return;
         }
         session.cancelled = true;
+        // The interrupt below makes Claude Code withdraw the requests that are open
+        // now (see `withPendingUserInput`).
+        for (const input of session.openUserInputs ?? [])
+            input.cancelled = true;
         // Before anything awaits, so a model request that the consumer reads in
         // the meantime is already judged against these prompts.
         session.cancelledPrompts ??= new Set();
@@ -6706,19 +6879,29 @@ export class ClaudeAcpAgent {
     /** Runs `request`, a request that `requestSessionId` sends for the session
      *  `ownerSessionId`. When that is a subagent's child session, the child
      *  reports that it awaits the user while the request is open (the RFD form,
-     *  see `NativeSubagentRuntime.awaitingUser`). */
-    withChildAwaitingUser(ownerSessionId, requestSessionId, request) {
+     *  see `NativeSubagentRuntime.awaitingUser`). `signal` aborts when Claude
+     *  Code withdraws the request. */
+    withChildAwaitingUser(ownerSessionId, requestSessionId, signal, request) {
         const runtime = this.sessions[ownerSessionId]?.nativeSubagentRuntime;
         return runtime && requestSessionId !== ownerSessionId
-            ? runtime.awaitingUser(requestSessionId, request)
+            ? runtime.awaitingUser(requestSessionId, request, signal)
             : request();
     }
     /** Mark a client request of the subagent `agentID` (absent for the main
      *  conversation) as awaiting user input for exactly the lifetime of its
      *  promise (see `Session.openUserInputs`). Steering consults the open
      *  requests synchronously, so a message arriving while any permission or
-     *  elicitation card is open uses non-interrupting SDK delivery. */
-    async withPendingUserInput(sessionId, request, agentID) {
+     *  elicitation card is open uses non-interrupting SDK delivery.
+     *
+     *  `signal` aborts when Claude Code withdraws the request, which is not an
+     *  answer. Example: the user cancels while a permission request is open.
+     *  Claude Code's interrupt withdraws it as it stops the work, and the work
+     *  ends `idle cancelled` right after. The end of the request then reports
+     *  no `running`: the client would see `requires_action`, `running`, `idle
+     *  cancelled`. A withdrawal without a cancel means that something else
+     *  answered the request in the user's place, such as a `PermissionRequest`
+     *  hook, and the work goes on, so the end reports `running`. */
+    async withPendingUserInput(sessionId, signal, request, agentID) {
         const session = this.sessions[sessionId];
         if (!session)
             return request();
@@ -6730,7 +6913,8 @@ export class ClaudeAcpAgent {
         }
         finally {
             session.openUserInputs.delete(input);
-            this.syncAwaitingUser(sessionId, session);
+            const withdrawnByCancel = signal.aborted && input.cancelled === true;
+            this.syncAwaitingUser(sessionId, session, withdrawnByCancel);
         }
     }
     /** Report whether the session's foreground work awaits the user: exactly
@@ -6739,8 +6923,13 @@ export class ClaudeAcpAgent {
      *  and Claude Code can ask for a queued prompt before the consumer activates
      *  it, so a request is not tied to the work that was running when it
      *  opened. Called when a request opens or closes, when a turn activates, and
-     *  when a task registers or moves to the background. */
-    syncAwaitingUser(sessionId, session) {
+     *  when a task registers or moves to the background.
+     *
+     *  When the last request ends, the work reports `running` again, unless a
+     *  cancel withdrew that request (`withdrawnByCancel`, see
+     *  {@link withPendingUserInput}): the work is being stopped, and reports its
+     *  end next. */
+    syncAwaitingUser(sessionId, session, withdrawnByCancel = false) {
         const work = this.foregroundWork.get(sessionId);
         if (!work)
             return;
@@ -6750,7 +6939,7 @@ export class ClaudeAcpAgent {
         work.awaitingUser = waiting;
         if (waiting)
             work.events.awaitingUser();
-        else
+        else if (!withdrawnByCancel)
             work.events.running();
     }
     /** Make `owner` the foreground work of the session `sessionId` (see
@@ -6759,14 +6948,12 @@ export class ClaudeAcpAgent {
      *  reports nothing new: a turn takes over a cycle that Claude Code started on
      *  its own, and only the owner's end ends the work. */
     startForeground(sessionId, owner) {
-        if (!this.foregroundEvents)
-            return;
         const current = this.foregroundWork.get(sessionId);
         if (current) {
             current.owner = owner;
             return;
         }
-        const events = this.foregroundEvents(sessionId);
+        const events = this.foregroundEvents?.(sessionId) ?? UNREPORTED_FOREGROUND;
         this.foregroundWork.set(sessionId, { owner, events, awaitingUser: false });
         events.running();
         const session = this.sessions[sessionId];
@@ -6792,7 +6979,7 @@ export class ClaudeAcpAgent {
      *  whose work ended at its result, so its follow-up is a cycle. Output of
      *  the work a cancel stopped starts nothing (see Session.cancelled). */
     startAutonomousCycle(sessionId, session, message) {
-        if (!this.foregroundEvents || this.foregroundWork.has(sessionId) || session.cancelled)
+        if (this.foregroundWork.has(sessionId) || session.cancelled)
             return;
         if (message.type !== "assistant" && message.type !== "stream_event")
             return;
@@ -6810,15 +6997,79 @@ export class ClaudeAcpAgent {
     /** Whether the client has been told that the session's work ended: on v2 by
      *  an idle state, so no foreground work is open, including a cycle that
      *  Claude Code started on its own; on v1 by the response to the turn's
-     *  prompt, so no turn is active. */
+     *  prompt, so no turn is active. v1 reports nothing for a cycle, so its end
+     *  is its result or idle: until then, Claude Code's results for the cycle's
+     *  tool calls still reach the client after a cancel. */
     workEndReported(sessionId, session) {
-        return this.foregroundEvents ? !this.foregroundWork.has(sessionId) : !session.activeTurn;
+        return this.foregroundEvents
+            ? !this.foregroundWork.has(sessionId)
+            : !session.activeTurn && !this.runsAutonomousCycle(sessionId);
+    }
+    /** Whether the consumer drops what it reaches now as output of the work a
+     *  cancel stopped: the client has been told that the work ended, and the
+     *  window after the cancel is still open (see Session.cancelled). */
+    dropsStoppedWorkOutput(sessionId, session) {
+        return session.cancelled && this.workEndReported(sessionId, session);
+    }
+    /**
+     * Whether the tool use `toolUseId`, which reaches `canUseTool` or a hook, is
+     * output of the work a cancel stopped that the consumer dropped (see
+     * `dropsStoppedWorkOutput`). Example: Claude Code runs a prompt that the
+     * cancel abandoned, and it asks to run a command. The consumer drops the
+     * tool use and its result, so a tool call shown for it would never end, and
+     * the client would keep it open (issue #1061).
+     *
+     * Claude Code calls `canUseTool` and hooks on its control channel, after it
+     * streamed the tool use, and the consumer can lag behind. So the session can
+     * still look cancelled while the consumer has the next prompt's echo, which
+     * ends the window, still ahead of the tool use. While a cancel's window may
+     * be open, this waits until the consumer reaches the tool use, for at most
+     * {@link toolUseWaitMs} or until `signal` aborts: the stream never shows
+     * some tool uses, such as SandboxNetworkAccess's. Without a cancel nothing
+     * is dropped, so it answers at once. It returns a promise only when it
+     * waits, so a permission request without a cancel goes out as soon as
+     * before.
+     */
+    isStoppedWorkToolUse(session, toolUseId, signal) {
+        const reached = session.reachedToolUses?.get(toolUseId);
+        if (reached !== undefined)
+            return reached;
+        if (!session.cancelled || signal?.aborted)
+            return false;
+        return this.reachedInStream(session, toolUseId, signal);
+    }
+    /** Waits until the consumer reaches the tool use `toolUseId` (see
+     *  `isStoppedWorkToolUse`), then says whether it dropped it. */
+    async reachedInStream(session, toolUseId, signal) {
+        await new Promise((resolve) => {
+            const waiters = (session.toolUseWaiters ??= new Map());
+            let waiting = waiters.get(toolUseId);
+            if (!waiting)
+                waiters.set(toolUseId, (waiting = new Set()));
+            const done = () => {
+                clearTimeout(timer);
+                signal?.removeEventListener("abort", done);
+                waiting.delete(done);
+                if (waiting.size === 0 && waiters.get(toolUseId) === waiting)
+                    waiters.delete(toolUseId);
+                resolve();
+            };
+            const timer = setTimeout(done, this.toolUseWaitMs);
+            signal?.addEventListener("abort", done, { once: true });
+            waiting.add(done);
+        });
+        return session.reachedToolUses?.get(toolUseId) ?? false;
     }
     /** End the session's model cycle that Claude Code started on its own, if one
      *  runs. */
     endAutonomousCycle(sessionId, end) {
         this.endForeground(sessionId, AUTONOMOUS_CYCLE, end);
     }
+    /** Whether a model cycle that Claude Code started on its own is the session's
+     *  foreground work. A turn that took a cycle over owns the work from then on. */
+    runsAutonomousCycle(sessionId) {
+        return this.foregroundWork.get(sessionId)?.owner === AUTONOMOUS_CYCLE;
+    }
     /** Forward a permission request to the client, wiring the tool call's
      *  `signal` through as a `cancellationSignal`. When the turn is cancelled
      *  while the client's prompt is still open the signal aborts, the SDK sends
@@ -6843,7 +7094,7 @@ export class ClaudeAcpAgent {
         // The request goes to a subagent's child session for a tool call of that
         // subagent, but it blocks the turn of the owner session.
         try {
-            return await this.withChildAwaitingUser(ownerSessionId, params.sessionId, () => this.withPendingUserInput(ownerSessionId, () => raceWithAbort(this.client.requestPermission(params, signal), signal), agentID));
+            return await this.withChildAwaitingUser(ownerSessionId, params.sessionId, signal, () => this.withPendingUserInput(ownerSessionId, signal, () => raceWithAbort(this.client.requestPermission(params, signal), signal), agentID));
         }
         catch (error) {
             if (signal.aborted) {
@@ -6852,6 +7103,17 @@ export class ClaudeAcpAgent {
             throw error;
         }
     }
+    /** Send the client an elicitation for a callback of Claude Code. When the
+     *  callback's `signal` aborts, the SDK sends `$/cancel_request` and keeps
+     *  waiting for the client's reply, which a client that ignores the cancel
+     *  never sends. So the call also rejects at once on the abort, as
+     *  {@link requestPermissionFromClient} does for a permission request. Left
+     *  open, the request would stay in `openUserInputs` (see
+     *  {@link withPendingUserInput}), which keeps steering non-interrupting, and
+     *  a child's `openRequests` would not drop. */
+    elicitFromClient(request, signal) {
+        return raceWithAbort(this.client.createElicitation(request, signal), signal);
+    }
     /** Emit the `tool_call` a permission request references if it hasn't been sent
      *  yet, so the client has the tool call before being asked to approve it. The
      *  matching streamed tool_use chunk later refines it with a `tool_call_update`
@@ -6948,17 +7210,21 @@ export class ClaudeAcpAgent {
      * decision, and a failure only leaves the preview out.
      */
     fileChangePreviewHook(sessionId) {
-        return async (input, toolUseID) => {
+        return async (input, toolUseID, { signal }) => {
             if (input.hook_event_name === "PreToolUse" && toolUseID) {
-                await this.previewFileChange(sessionId, input, toolUseID).catch((error) => this.logger.error(`Session ${sessionId}: failed to preview ${toolUseID}: ${error}`));
+                await this.previewFileChange(sessionId, input, toolUseID, signal).catch((error) => this.logger.error(`Session ${sessionId}: failed to preview ${toolUseID}: ${error}`));
             }
             return { continue: true };
         };
     }
-    async previewFileChange(sessionId, input, toolUseID) {
+    async previewFileChange(sessionId, input, toolUseID, signal) {
         const session = this.sessions[sessionId];
         if (!session)
             return;
+        // As in `canUseTool`: the work a cancel stopped shows nothing.
+        const stopped = this.isStoppedWorkToolUse(session, toolUseID, signal);
+        if (stopped instanceof Promise ? await stopped : stopped)
+            return;
         const toolInput = (input.tool_input ?? {});
         const content = await previewPatchContent(input.tool_name, toolInput, session.cwd, "v2");
         if (!content)
@@ -7000,6 +7266,14 @@ export class ClaudeAcpAgent {
                     message: "Session not found",
                 };
             }
+            // The work a cancel stopped shows the client nothing after it was told
+            // that the work ended: neither a tool call nor a request. Its tool does
+            // not run.
+            const stopped = this.isStoppedWorkToolUse(session, toolUseID, signal);
+            if (stopped instanceof Promise ? await stopped : stopped) {
+                this.logger.log(`Session ${sessionId}: denied ${toolName} ${toolUseID}, which the cancelled work asked for`);
+                return { behavior: "deny", message: "The user cancelled this prompt." };
+            }
             const { parentToolUseId, toolCallSessionId: permissionSessionId } = this.toolUseOwner(session, sessionId, agentID);
             if (agentID && !parentToolUseId) {
                 // The attribution rests on task_started.task_id === canUseTool's
@@ -7152,7 +7426,7 @@ export class ClaudeAcpAgent {
                 return { action: "decline" };
             }
             try {
-                const response = await this.withPendingUserInput(sessionId, () => this.client.createElicitation(createRequest, signal));
+                const response = await this.withPendingUserInput(sessionId, signal, () => this.elicitFromClient(createRequest, signal));
                 if (signal.aborted) {
                     return { action: "cancel" };
                 }
@@ -7184,7 +7458,7 @@ export class ClaudeAcpAgent {
         const createRequest = askUserQuestionsToCreateRequest(questions, requestSessionId, toolUseID, this.toolCallCapabilities.air.client);
         let response;
         try {
-            response = await this.withChildAwaitingUser(sessionId, requestSessionId, () => this.withPendingUserInput(sessionId, () => this.client.createElicitation(createRequest, signal), agentID));
+            response = await this.withChildAwaitingUser(sessionId, requestSessionId, signal, () => this.withPendingUserInput(sessionId, signal, () => this.elicitFromClient(createRequest, signal), agentID));
         }
         catch (error) {
             // A cancellation we requested (signal aborted) settles as an aborted tool
@@ -7224,7 +7498,7 @@ export class ClaudeAcpAgent {
             }
             let response;
             try {
-                response = await this.withPendingUserInput(sessionId, () => this.client.createElicitation(refusalFallbackToCreateRequest(prompt, sessionId), signal));
+                response = await this.withPendingUserInput(sessionId, signal, () => this.elicitFromClient(refusalFallbackToCreateRequest(prompt, sessionId), signal));
             }
             catch (error) {
                 // A cancellation we requested (signal aborted) is expected teardown;
@@ -8114,10 +8388,14 @@ export class ClaudeAcpAgent {
             // configured. Managed `deniedModels` drops entries the CLI would refuse.
             const settingsAvailableModels = settingsManager.getSettings().availableModels;
             const settingsModelOverrides = settingsManager.getSettings().modelOverrides;
-            const allowedModels = Array.isArray(settingsAvailableModels)
+            const settingsAllowedModels = Array.isArray(settingsAvailableModels)
                 ? applyAvailableModelsAllowlist(initializationResult.models, settingsAvailableModels, settingsModelOverrides, settingsManager.getManagedDeniedModels())
                 : initializationResult.models;
-            const models = await getAvailableModels(q, allowedModels, initializationResult.models, settingsManager, this.logger, creationOpts.resume !== undefined, sessionId, await resumedModelHint);
+            // Then keep only the models the `providers/set` gateway listed.
+            const allowedModels = resolvedProvider?.listedModels
+                ? narrowToGatewayModels(settingsAllowedModels, resolvedProvider.listedModels, resolvedProvider.bedrockRegionPrefix)
+                : settingsAllowedModels;
+            const models = await getAvailableModels(q, allowedModels, initializationResult.models, settingsManager, this.logger, creationOpts.resume !== undefined, sessionId, await resumedModelHint, resolvedProvider?.listedModels !== undefined);
             timing.phase("models");
             // Resolve the current model's capabilities separately from the stable
             // permission-mode catalog advertised to ACP clients.
@@ -8307,6 +8585,21 @@ export class ClaudeAcpAgent {
     async enqueueProviderUpdate(config) {
         const previous = this.providerUpdate?.catch(() => undefined) ?? Promise.resolve();
         const update = previous.then(async () => {
+            // The listing runs in the queue, so `providers/set`, `providers/disable`
+            // and logout apply in the order they arrived. A failed listing fails this
+            // `providers/set` before the provider replaces the current one.
+            if (config) {
+                try {
+                    Object.assign(config, await this.listProviderModels(config));
+                }
+                catch (error) {
+                    if (error instanceof GatewayListingError) {
+                        throw RequestError.internalError({ providerId: PROVIDER_ID, apiType: config.apiType, baseUrl: config.baseUrl }, `Model discovery for provider "${PROVIDER_ID}" failed: ${error.message}`);
+                    }
+                    throw error;
+                }
+                this.logger.log(`[providers/set] listedModels=${config.listedModels?.length ?? "none"} bedrockRegionPrefix=${config.bedrockRegionPrefix ?? "none"}`);
+            }
             const sessions = Object.entries(this.sessions);
             const activeTurns = sessions.flatMap(([, session]) => (session.turnQueue ?? []).flatMap((turn) => (turn.completion ? [turn.completion] : [])));
             if (activeTurns.length > 0) {
@@ -8751,9 +9044,12 @@ function createEnvForProvider(config) {
         return {
             ...resetRouting,
             CLAUDE_CODE_USE_BEDROCK: "1",
-            AWS_BEARER_TOKEN_BEDROCK: "acp-proxy", // Bypass local AWS credential checks
+            AWS_BEARER_TOKEN_BEDROCK: PROVIDER_AUTH_TOKEN_PLACEHOLDER, // Bypass local AWS credential checks
             ANTHROPIC_BEDROCK_BASE_URL: config.baseUrl,
             ANTHROPIC_CUSTOM_HEADERS: customHeaders,
+            ...(config.bedrockRegionPrefix
+                ? { ANTHROPIC_BEDROCK_REGION_PREFIX: config.bedrockRegionPrefix }
+                : {}),
         };
     }
     if (config.apiType === "vertex") {
@@ -8778,9 +9074,13 @@ function createEnvForProvider(config) {
         ...resetRouting,
         ANTHROPIC_BASE_URL: config.baseUrl,
         ANTHROPIC_CUSTOM_HEADERS: customHeaders,
-        ANTHROPIC_AUTH_TOKEN: "acp-proxy", // Bypass local Claude login checks
+        ANTHROPIC_AUTH_TOKEN: PROVIDER_AUTH_TOKEN_PLACEHOLDER, // Bypass local Claude login checks
     };
 }
+function sameHeaders(a, b) {
+    const aKeys = Object.keys(a);
+    return aKeys.length === Object.keys(b).length && aKeys.every((key) => b[key] === a[key]);
+}
 /**
  * Validate a provider base URL: must be a non-empty absolute http(s) URL.
  */
@@ -8936,10 +9236,12 @@ export function resolveFastModeEnabled(params) {
     throw new Error(`Invalid value for config option ${FAST_MODE_CONFIG_ID}: ${value}`);
 }
 export function buildConfigOptions(modes, models, modelInfos, currentEffortLevel, agents = [], currentAgent = DEFAULT_AGENT_ID, fastMode, presentation) {
-    const options = [
-        SessionModeManager.configOption(modes),
-        buildModelConfigOption(models, modelInfos, presentation?.useRecommendedValue === true),
-    ];
+    const options = [SessionModeManager.configOption(modes)];
+    // A gateway that lists none of the SDK's models leaves no model to offer, so
+    // there is no model option at all.
+    if (models.availableModels.length > 0) {
+        options.push(buildModelConfigOption(models, modelInfos, presentation?.useRecommendedValue === true));
+    }
     const effort = buildEffortConfigOption(modelInfos, models.currentModelId, currentEffortLevel, presentation?.useRecommendedValue === true);
     if (effort)
         options.push(effort);
@@ -9217,14 +9519,38 @@ function recordDispatchedToolUses(session, content) {
     if (!Array.isArray(content))
         return;
     for (const block of content) {
-        if ((block?.type === "tool_use" ||
-            block?.type === "server_tool_use" ||
-            block?.type === "mcp_tool_use") &&
-            typeof block.id === "string") {
+        if (isToolUseBlock(block))
             recordDispatchedToolCall(session, block.id);
-        }
     }
 }
+function isToolUseBlock(block) {
+    const { type, id } = (block ?? {});
+    return ((type === "tool_use" || type === "server_tool_use" || type === "mcp_tool_use") &&
+        typeof id === "string");
+}
+const MAX_REACHED_TOOL_USES = 1000;
+/**
+ * Records that the consumer reached the tool use `toolUseId`, and whether it
+ * dropped it as output of the work a cancel stopped, then wakes what waits for
+ * it (see `isStoppedWorkToolUse`). The first record of a tool use stays.
+ */
+function recordReachedToolUse(session, toolUseId, dropped) {
+    const reached = (session.reachedToolUses ??= new Map());
+    if (reached.has(toolUseId))
+        return;
+    reached.set(toolUseId, dropped);
+    if (reached.size > MAX_REACHED_TOOL_USES) {
+        const oldest = reached.keys().next().value;
+        if (oldest !== undefined)
+            reached.delete(oldest);
+    }
+    const waiters = session.toolUseWaiters?.get(toolUseId);
+    if (!waiters)
+        return;
+    session.toolUseWaiters?.delete(toolUseId);
+    for (const wake of waiters)
+        wake();
+}
 /** Streamed and permission-surfaced tools can precede the SDK's user echo. */
 function recordForegroundToolCall(session, toolCallId) {
     const turn = session.activeTurn ?? session.turnQueue?.find((queued) => !queued.settled);