@agentclientprotocol/claude-agent-acp 0.90.1-preview.8 → 0.91.0

package/dist/acp-agent.js

@@ -47,7 +47,8 @@ import { formatUsageResponse, isUsageCommandText, parseUsageResponse } from "./u
 export { DEFAULT_AGENT_ID } from "./session-config-ids.js";
 import { MCP_AVAILABLE_COMMAND, parseMcpCommand, runMcpCommand } from "./mcp-command.js";
 import { MODE_CONFIG_ID, resolveInitialPermissionMode, SessionModeManager, } from "./session-mode.js";
-import { applyAvailableModelsAllowlist, buildModelConfigOption, getAvailableModels, MODEL_CONFIG_ID, resolveModelPreference, } from "./session-model.js";
+import { applyAvailableModelsAllowlist, buildModelConfigOption, getAvailableModels, MODEL_CONFIG_ID, narrowToGatewayModels, resolveModelPreference, } from "./session-model.js";
+import { GatewayListingError, listBedrockModels, listGatewayModels, PROVIDER_AUTH_TOKEN_PLACEHOLDER, selectBedrockRegion, } from "./gateway-models.js";
 import { buildEffortConfigOption, EFFORT_CONFIG_ID, effortFlagSettings, mergeEffortSettings, settingsEffortForModel, } from "./session-effort.js";
 export { EFFORT_CONFIG_ID, settingsEffortForModel } from "./session-effort.js";
 export { applyAvailableModelsAllowlist, matchResumedModel, MODEL_CONFIG_ID, resolveModelPreference, } from "./session-model.js";
@@ -1437,7 +1438,7 @@ export class ClaudeAcpAgent {
         };
     }
     async newSession(params) {
-        if (this.providerUpdate)
+        while (this.providerUpdate)
             await this.providerUpdate;
         const response = await this.createSession(params, {
             // Revisit these meta values once we support resume
@@ -1504,7 +1505,7 @@ export class ClaudeAcpAgent {
      * later load or resume with the same settings reuses it.
      */
     async unstable_forkSession(params) {
-        if (this.providerUpdate)
+        while (this.providerUpdate)
             await this.providerUpdate;
         const { sessionId } = await forkSession(params, {
             liveMessageIdToUuid: this.sessions[params.sessionId]?.messageIdToUuid,
@@ -1522,7 +1523,7 @@ export class ClaudeAcpAgent {
         return { sessionId, modes, configOptions };
     }
     async resumeSession(params) {
-        if (this.providerUpdate)
+        while (this.providerUpdate)
             await this.providerUpdate;
         const result = await this.getOrCreateSession(params);
         this.afterSetupResponse(params.sessionId, params.mcpServers ?? []);
@@ -1530,7 +1531,7 @@ export class ClaudeAcpAgent {
     }
     async loadSession(params) {
         const timing = new SessionTiming(this.logger, "load", params.sessionId);
-        if (this.providerUpdate)
+        while (this.providerUpdate)
             await this.providerUpdate;
         let result;
         if (this.sessions[params.sessionId]) {
@@ -1912,6 +1913,42 @@ export class ClaudeAcpAgent {
         // Unknown provider: idempotent success.
         return {};
     }
+    /**
+     * The model ids the gateway in `config` lists, read before `providers/set`
+     * returns so the sessions it recreates already offer only those, and for
+     * `bedrock` the region prefix picked from them. Setting the same gateway
+     * again reuses the previous listing. `vertex` gateways are not listed.
+     * Throws a {@link GatewayListingError} when the listing fails.
+     */
+    async listProviderModels(config) {
+        // Reuse needs the very same headers, so a rotated token lists again, and a
+        // failed listing then fails that `providers/set`. Deliberate: AIR keeps its
+        // proxy key for the IDE's lifetime and does not rotate it.
+        const current = this.providerConfig;
+        if (current?.listedModels &&
+            current.apiType === config.apiType &&
+            current.baseUrl === config.baseUrl &&
+            sameHeaders(current.headers, config.headers)) {
+            return {
+                listedModels: current.listedModels,
+                bedrockRegionPrefix: current.bedrockRegionPrefix,
+            };
+        }
+        if (config.apiType === "anthropic") {
+            return { listedModels: await listGatewayModels(config.baseUrl, config.headers, this.logger) };
+        }
+        if (config.apiType === "bedrock") {
+            const modelIds = await listBedrockModels(config.baseUrl, config.headers, this.logger);
+            if (!modelIds)
+                return {};
+            const region = selectBedrockRegion(modelIds);
+            if (region.modelIds.length < modelIds.length) {
+                this.logger.log(`[providers/set] Bedrock models span several region prefixes; using ${region.regionPrefix} and dropping ${modelIds.length - region.modelIds.length} id(s) of other prefixes`);
+            }
+            return { listedModels: region.modelIds, bedrockRegionPrefix: region.regionPrefix };
+        }
+        return {};
+    }
     resolveProviderConfig() {
         return this.providerConfig ?? gatewayRequestToProviderConfig(this.gatewayAuthRequest);
     }
@@ -1945,7 +1982,9 @@ export class ClaudeAcpAgent {
         // provider routing set via `providers/set`. Neither touches the on-disk
         // credential store, so dropping these references is the whole logout for
         // those paths.
-        const hadRoutingOverride = this.resolveProviderConfig() !== null;
+        // A queued `providers/set` may still be listing and apply after this point,
+        // so a busy queue counts as an override to clear.
+        const hadRoutingOverride = this.resolveProviderConfig() !== null || this.providerUpdate !== null;
         this.gatewayAuthRequest = undefined;
         this.providerConfig = undefined;
         // Any probe already running read the pre-logout world; the bump makes its
@@ -2050,7 +2089,7 @@ export class ClaudeAcpAgent {
      * before this resolves.
      */
     async startTurn(params, events) {
-        if (this.providerUpdate)
+        while (this.providerUpdate)
             await this.providerUpdate;
         let session = this.sessions[params.sessionId];
         if (!session) {
@@ -2227,34 +2266,13 @@ export class ClaudeAcpAgent {
         // husk that reached this by another route still releases its resources.
         this.closeQueryStream(session);
         try {
-            // `resume` names the Claude session, which shares the ACP session id, so
-            // the new query continues the same conversation under the same id.
-            await this.createSession(creationParams, {
-                resume: sessionId,
+            // The very first turn may be the one that signed out, so the CLI may
+            // never have written the conversation.
+            await this.recreateLiveSession(creationParams, sessionId, {
                 permissionMode: session.modes.currentModeId,
             });
         }
         catch (error) {
-            if (error instanceof RequestError && error.code === RequestError.resourceNotFound().code) {
-                // The CLI never wrote this conversation, because the very first turn
-                // was the one that signed out. Resuming it fails for ever, so start a
-                // fresh query under the same ACP session id: an empty history is a far
-                // better answer than a session the client can never use again.
-                this.logger.log(`session ${sessionId} was never persisted; starting a fresh query under the same id`);
-                try {
-                    await this.createSession(creationParams, {
-                        reuseSessionId: sessionId,
-                        permissionMode: session.modes.currentModeId,
-                    });
-                    return;
-                }
-                catch (fallbackError) {
-                    if (!this.sessions[sessionId]) {
-                        this.sessions[sessionId] = session;
-                    }
-                    throw fallbackError;
-                }
-            }
             // Keep the husk addressable: the client answers the refusal with its own
             // auth flow and then retries this session.
             if (!this.sessions[sessionId]) {
@@ -2263,6 +2281,31 @@ export class ClaudeAcpAgent {
             throw error;
         }
     }
+    /**
+     * Starts a new query for the session `sessionId`, which ran on this
+     * connection and whose query is gone: it resumes the stored conversation.
+     * `resume` names the Claude session, which shares the ACP session id, so the
+     * new query continues the same conversation under the same id. Claude Code
+     * writes the conversation at the first prompt, so resuming a session that was
+     * never prompted fails with `resourceNotFound`, and keeps failing. Such a
+     * session starts a fresh query under the same id instead: it has no history
+     * to lose, and the client keeps a session it can use.
+     */
+    async recreateLiveSession(params, sessionId, options) {
+        try {
+            return await this.createSession(params, { resume: sessionId, ...options });
+        }
+        catch (error) {
+            if (!(error instanceof RequestError && error.code === RequestError.resourceNotFound().code)) {
+                throw error;
+            }
+            this.logger.log(`session ${sessionId} was never persisted; starting a fresh query under the same id`);
+            return await this.createSession(params, {
+                reuseSessionId: sessionId,
+                permissionMode: options.permissionMode,
+            });
+        }
+    }
     /** Run the `--hide-claude-auth` guard before a turn starts. The returned
      *  promise rejects with the `authRequired` error when a claude.ai
      *  subscription would pay, or when the account holds no credential this
@@ -3055,6 +3098,7 @@ export class ClaudeAcpAgent {
             session.liveBackgroundTasks.set(taskId, {
                 parentToolUseId,
                 isSubagent,
+                ...(placement.taskType !== undefined ? { taskType: placement.taskType } : {}),
                 ...(placement.backgrounded !== undefined ? { backgrounded: placement.backgrounded } : {}),
                 ...(placement.parentTaskId !== undefined ? { parentTaskId: placement.parentTaskId } : {}),
             });
@@ -3190,6 +3234,16 @@ export class ClaudeAcpAgent {
             task.backgrounded === true &&
             !task.endedPerLevel &&
             task.parentToolUseId === agentToolUseId);
+        /** Whether output of the conversation `parentToolUseId` (null for the main
+         *  one) is a background subagent's that still runs. A cancel does not stop
+         *  such a subagent's work (agentclientprotocol/agent-client-protocol#2308):
+         *  the closing at the cancel leaves its tool calls open for their results
+         *  (`closedAtCancel`), and the window after the cancel lets its output
+         *  through (see the `session.cancelled` checks of the stream and the
+         *  user/assistant cases). Claude Code currently stops background subagents
+         *  at an interrupt, so this decides only the output that comes before the
+         *  SDK reports a subagent's end. */
+        const isRunningBackgroundSubagentOutput = (parentToolUseId) => parentToolUseId !== null && runsInBackground(parentToolUseId);
         /** Ends the open tool calls that `include` accepts, with the report of a call
          *  that a cancel stopped and sent no result for. `include` gets the Agent/Task
          *  call of the subagent that made the tool call, if a subagent did. */
@@ -3285,27 +3339,46 @@ export class ClaudeAcpAgent {
                 await sendUpdate(notification);
             }
         };
-        /** A cancel stopped the model cycle that Claude Code started on its own, and
-         *  its end is about to be reported: closes the tool calls that it left open
-         *  first. A cycle is foreground work that no turn settles, so
-         *  `closeCancelledToolCalls` does not run for it. Claude Code's interrupt
-         *  gives the tools of the main conversation results, which
-         *  `sendInterruptedToolResults` delivers while the cycle runs. What is still
-         *  open has none, such as the command of a foreground subagent. A turn that
-         *  took the cycle over closes its own calls, when it settles.
-         *  The follow-up of a turn that v1 holds for its background subagents is a
-         *  cycle too, and the cancel ends the held turn as well, possibly in
-         *  `cancelTurns` while these reports are in flight. So the cycle's calls
-         *  close with the held turn's closing, which each settle of the turn waits
-         *  for, and the response never comes before them. */
-        const closeCancelledCycleToolCalls = async () => {
-            if (!session.cancelled || !this.runsAutonomousCycle(params.sessionId))
+        /** The model cycle that Claude Code started on its own ends, and its end is
+         *  about to be reported: closes the tool calls that it left open first. A
+         *  cycle is foreground work that no turn settles, so neither
+         *  `closeCancelledToolCalls` nor the check of `settleActive` for unfinished
+         *  tools runs for it. A turn that took the cycle over closes its own calls,
+         *  when it settles.
+         *
+         *  After a cancel, Claude Code's interrupt gives the tools of the main
+         *  conversation results, which `sendInterruptedToolResults` delivers while
+         *  the cycle runs. What is still open has none, such as the command of a
+         *  foreground subagent. The follow-up of a turn that v1 holds for its
+         *  background subagents is a cycle too, and the cancel ends the held turn
+         *  as well, possibly in `cancelTurns` while these reports are in flight. So
+         *  the cycle's calls close with the held turn's closing, which each settle
+         *  of the turn waits for, and the response never comes before them.
+         *
+         *  At any other end, every call that ran has its result. What is open is a
+         *  call of the main conversation that Claude abandoned before it ran, such
+         *  as a streamed tool_use that never reached a complete message, which a
+         *  turn's end closes the same way (`closeUnfinished`). The calls of a
+         *  subagent are not the cycle's: a background subagent runs on. */
+        const closeCycleToolCalls = async () => {
+            if (!this.runsAutonomousCycle(params.sessionId))
+                return;
+            if (session.cancelled) {
+                const held = session.activeTurn;
+                if (held && !held.settled)
+                    await closeCancelledToolCalls(held);
+                else
+                    await closeOpenToolCalls(closedAtCancel);
                 return;
-            const held = session.activeTurn;
-            if (held && !held.settled)
-                await closeCancelledToolCalls(held);
-            else
-                await closeOpenToolCalls(closedAtCancel);
+            }
+            const renderer = new AcpToolCallRenderer(this.toolCallCapabilities);
+            for (const toolCallId of [...session.emittedToolCalls]) {
+                if (session.toolCallParents?.has(toolCallId))
+                    continue;
+                if (session.dispatchedToolCalls?.has(toolCallId))
+                    continue;
+                await closeToolCall(toolCallId, renderer.unfinished({ toolCallId, ran: false }));
+            }
         };
         /** At the actual turn boundary, preview its checkpoint, settle the active
          *  turn exactly once, disarm the force-cancel backstop, and drop it from
@@ -3956,7 +4029,7 @@ export class ClaudeAcpAgent {
                                     // here. An owed idle belongs to an earlier result: it can lag
                                     // past the cycle's first output.
                                     if (session.owedTrailingIdles === 0) {
-                                        await closeCancelledCycleToolCalls();
+                                        await closeCycleToolCalls();
                                         this.endAutonomousCycle(params.sessionId, {
                                             outcome: { stopReason: session.cancelled ? "cancelled" : "end_turn" },
                                         });
@@ -4261,6 +4334,7 @@ export class ClaudeAcpAgent {
                                 registerLiveTask(message.task_id, message.tool_use_id, !!message.subagent_type, {
                                     backgrounded: message.is_backgrounded,
                                     parentTaskId: message.parent_task_id,
+                                    taskType: message.task_type,
                                 });
                                 await subagents.taskStarted({
                                     taskId: message.task_id,
@@ -4779,7 +4853,7 @@ export class ClaudeAcpAgent {
                                 pendingExitPlanContextReset?.toolUseId ===
                                     pendingExitPlanModeInterruption?.toolUseId;
                             if (!continuesPlan && !(isAutonomousResult && message.num_turns === 0)) {
-                                await closeCancelledCycleToolCalls();
+                                await closeCycleToolCalls();
                                 this.endAutonomousCycle(params.sessionId, autonomousCycleEnd(message, resultModelUsage, session.cancelled || exitPlanInterruption || isAbortedResult(message)));
                             }
                             if (session.cancelled) {
@@ -5238,7 +5312,8 @@ export class ClaudeAcpAgent {
                         // `cancelled` check in the user/assistant case). Otherwise the
                         // answer to a prompt the cancel abandoned, which Claude Code had
                         // already taken off its queue, would stream to the client after the
-                        // cancel was reported.
+                        // cancel was reported. A background subagent that still runs is not
+                        // work the cancel stopped (see isRunningBackgroundSubagentOutput).
                         //
                         // Where the consolidated message delivers the text (the same
                         // condition as in the user/assistant case), a stream that loses a
@@ -5250,7 +5325,8 @@ export class ClaudeAcpAgent {
                         // prefix of the text, so the text would be sent again (see
                         // unstreamedRemainder).
                         const streamKey = message.parent_tool_use_id ?? "";
-                        const stoppedWorkOutput = this.dropsStoppedWorkOutput(params.sessionId, session);
+                        const stoppedWorkOutput = this.dropsStoppedWorkOutput(params.sessionId, session) &&
+                            !isRunningBackgroundSubagentOutput(message.parent_tool_use_id);
                         if (message.event.type === "content_block_start" &&
                             isToolUseBlock(message.event.content_block)) {
                             recordReachedToolUse(session, message.event.content_block.id, stoppedWorkOutput);
@@ -5329,7 +5405,8 @@ export class ClaudeAcpAgent {
                             recordDispatchedToolUses(session, message.message.content);
                             // A tool use that did not stream is reached here first.
                             const content = message.message.content;
-                            const stoppedWorkOutput = this.dropsStoppedWorkOutput(params.sessionId, session);
+                            const stoppedWorkOutput = this.dropsStoppedWorkOutput(params.sessionId, session) &&
+                                !isRunningBackgroundSubagentOutput(message.parent_tool_use_id);
                             for (const block of Array.isArray(content) ? content : []) {
                                 if (isToolUseBlock(block)) {
                                     recordReachedToolUse(session, block.id, stoppedWorkOutput);
@@ -5439,11 +5516,13 @@ export class ClaudeAcpAgent {
                                 break;
                             }
                         }
-                        if (session.cancelled) {
+                        if (session.cancelled &&
+                            !isRunningBackgroundSubagentOutput(message.parent_tool_use_id)) {
                             // The work the cancel stopped ends its tools with error results.
                             // Until the client is told that the work ended, they close the
                             // tool calls it opened. Everything else that work sends is
-                            // dropped, and so is everything after that report.
+                            // dropped, and so is everything after that report. A background
+                            // subagent that still runs is not that work: its messages go on.
                             if (message.type === "user" && !this.workEndReported(params.sessionId, session)) {
                                 await sendInterruptedToolResults(message);
                             }
@@ -5860,8 +5939,46 @@ export class ClaudeAcpAgent {
         }
     }
     async cancel(params) {
+        if (!this.sessions[params.sessionId] && (await this.cancelChildSession(params.sessionId))) {
+            return;
+        }
         await this.cancelTurns(params, { awaitInterrupt: true });
     }
+    /**
+     * Cancels the current work of the subagent child session `sessionId`, which
+     * its `cancel` capability permits on the subagents RFD form, without
+     * cancelling its parent (see `NativeSubagentRuntime.cancelChild`). Returns
+     * false when no session has such a child.
+     */
+    async cancelChildSession(sessionId) {
+        for (const [rootSessionId, session] of Object.entries(this.sessions)) {
+            const cancelled = await session.nativeSubagentRuntime?.cancelChild(sessionId, (taskId) => session.query.stopTask(taskId).catch((error) => {
+                this.logger.error(`Session ${rootSessionId}: failed to stop the task ${taskId} of subagent session ${sessionId}`, error);
+            }));
+            if (cancelled)
+                return true;
+        }
+        return false;
+    }
+    /**
+     * Stops each background workflow of the session that still runs, after the
+     * interrupt of a `session/cancel` spared it (see
+     * `Session.stopsWorkflowsOnCancel`). Claude Code reports each one
+     * `stopped`, along with the commands inside it, and starts no model cycle
+     * for it, as when the interrupt killed it. Every background workflow is
+     * stopped, whoever launched it, because the interrupt killed them all.
+     */
+    stopBackgroundWorkflows(sessionId, session) {
+        if (!session.stopsWorkflowsOnCancel)
+            return;
+        for (const [taskId, task] of session.liveBackgroundTasks) {
+            if (task.taskType !== "local_workflow")
+                continue;
+            session.query.stopTask(taskId).catch((error) => {
+                this.logger.error(`Session ${sessionId}: failed to stop the background workflow ${taskId}`, error);
+            });
+        }
+    }
     /** Cancel the session's turns and interrupt the SDK query. With
      *  `awaitInterrupt: false` the interrupt is sent, but its reply is not
      *  awaited. `teardownSession` uses that: it closes the query right after, and
@@ -5874,6 +5991,10 @@ export class ClaudeAcpAgent {
             return;
         }
         session.cancelled = true;
+        // The interrupt below makes Claude Code withdraw the requests that are open
+        // now (see `withPendingUserInput`).
+        for (const input of session.openUserInputs ?? [])
+            input.cancelled = true;
         // Before anything awaits, so a model request that the consumer reads in
         // the meantime is already judged against these prompts.
         session.cancelledPrompts ??= new Set();
@@ -6142,6 +6263,7 @@ export class ClaudeAcpAgent {
             Promise.resolve(interrupt).catch(() => { });
             return;
         }
+        this.stopBackgroundWorkflows(params.sessionId, session);
         const receipt = await interrupt;
         // On CLIs advertising `interrupt_receipt_v1`, the receipt's `still_queued`
         // lists exactly which queued messages survive the interrupt and will still
@@ -6814,8 +6936,17 @@ export class ClaudeAcpAgent {
      *  conversation) as awaiting user input for exactly the lifetime of its
      *  promise (see `Session.openUserInputs`). Steering consults the open
      *  requests synchronously, so a message arriving while any permission or
-     *  elicitation card is open uses non-interrupting SDK delivery. */
-    async withPendingUserInput(sessionId, request, agentID) {
+     *  elicitation card is open uses non-interrupting SDK delivery.
+     *
+     *  `signal` aborts when Claude Code withdraws the request, which is not an
+     *  answer. Example: the user cancels while a permission request is open.
+     *  Claude Code's interrupt withdraws it as it stops the work, and the work
+     *  ends `idle cancelled` right after. The end of the request then reports
+     *  no `running`: the client would see `requires_action`, `running`, `idle
+     *  cancelled`. A withdrawal without a cancel means that something else
+     *  answered the request in the user's place, such as a `PermissionRequest`
+     *  hook, and the work goes on, so the end reports `running`. */
+    async withPendingUserInput(sessionId, signal, request, agentID) {
         const session = this.sessions[sessionId];
         if (!session)
             return request();
@@ -6827,7 +6958,8 @@ export class ClaudeAcpAgent {
         }
         finally {
             session.openUserInputs.delete(input);
-            this.syncAwaitingUser(sessionId, session);
+            const withdrawnByCancel = signal.aborted && input.cancelled === true;
+            this.syncAwaitingUser(sessionId, session, withdrawnByCancel);
         }
     }
     /** Report whether the session's foreground work awaits the user: exactly
@@ -6836,8 +6968,13 @@ export class ClaudeAcpAgent {
      *  and Claude Code can ask for a queued prompt before the consumer activates
      *  it, so a request is not tied to the work that was running when it
      *  opened. Called when a request opens or closes, when a turn activates, and
-     *  when a task registers or moves to the background. */
-    syncAwaitingUser(sessionId, session) {
+     *  when a task registers or moves to the background.
+     *
+     *  When the last request ends, the work reports `running` again, unless a
+     *  cancel withdrew that request (`withdrawnByCancel`, see
+     *  {@link withPendingUserInput}): the work is being stopped, and reports its
+     *  end next. */
+    syncAwaitingUser(sessionId, session, withdrawnByCancel = false) {
         const work = this.foregroundWork.get(sessionId);
         if (!work)
             return;
@@ -6847,7 +6984,7 @@ export class ClaudeAcpAgent {
         work.awaitingUser = waiting;
         if (waiting)
             work.events.awaitingUser();
-        else
+        else if (!withdrawnByCancel)
             work.events.running();
     }
     /** Make `owner` the foreground work of the session `sessionId` (see
@@ -7002,7 +7139,7 @@ export class ClaudeAcpAgent {
         // The request goes to a subagent's child session for a tool call of that
         // subagent, but it blocks the turn of the owner session.
         try {
-            return await this.withChildAwaitingUser(ownerSessionId, params.sessionId, signal, () => this.withPendingUserInput(ownerSessionId, () => raceWithAbort(this.client.requestPermission(params, signal), signal), agentID));
+            return await this.withChildAwaitingUser(ownerSessionId, params.sessionId, signal, () => this.withPendingUserInput(ownerSessionId, signal, () => raceWithAbort(this.client.requestPermission(params, signal), signal), agentID));
         }
         catch (error) {
             if (signal.aborted) {
@@ -7334,7 +7471,7 @@ export class ClaudeAcpAgent {
                 return { action: "decline" };
             }
             try {
-                const response = await this.withPendingUserInput(sessionId, () => this.elicitFromClient(createRequest, signal));
+                const response = await this.withPendingUserInput(sessionId, signal, () => this.elicitFromClient(createRequest, signal));
                 if (signal.aborted) {
                     return { action: "cancel" };
                 }
@@ -7366,7 +7503,7 @@ export class ClaudeAcpAgent {
         const createRequest = askUserQuestionsToCreateRequest(questions, requestSessionId, toolUseID, this.toolCallCapabilities.air.client);
         let response;
         try {
-            response = await this.withChildAwaitingUser(sessionId, requestSessionId, signal, () => this.withPendingUserInput(sessionId, () => this.elicitFromClient(createRequest, signal), agentID));
+            response = await this.withChildAwaitingUser(sessionId, requestSessionId, signal, () => this.withPendingUserInput(sessionId, signal, () => this.elicitFromClient(createRequest, signal), agentID));
         }
         catch (error) {
             // A cancellation we requested (signal aborted) settles as an aborted tool
@@ -7406,7 +7543,7 @@ export class ClaudeAcpAgent {
             }
             let response;
             try {
-                response = await this.withPendingUserInput(sessionId, () => this.elicitFromClient(refusalFallbackToCreateRequest(prompt, sessionId), signal));
+                response = await this.withPendingUserInput(sessionId, signal, () => this.elicitFromClient(refusalFallbackToCreateRequest(prompt, sessionId), signal));
             }
             catch (error) {
                 // A cancellation we requested (signal aborted) is expected teardown;
@@ -7811,16 +7948,22 @@ export class ClaudeAcpAgent {
             // up the new values.
             await this.teardownSession(params.sessionId);
         }
-        const response = await this.createSession({
+        const sessionParams = {
             cwd: params.cwd,
             mcpServers: params.mcpServers ?? [],
             additionalDirectories: params.additionalDirectories,
             _meta: params._meta,
-        }, {
-            resume: params.sessionId,
+        };
+        const creation = {
             permissionMode: livePermissionMode,
             ...(resumedSession ? { resumedModelHint: resumedSession.model } : {}),
-        });
+        };
+        // A live session may never have been prompted, so it may have no stored
+        // conversation to resume (see `recreateLiveSession`). For a session that
+        // is not loaded here, a missing conversation means an unknown session.
+        const response = existingSession
+            ? await this.recreateLiveSession(sessionParams, params.sessionId, creation)
+            : await this.createSession(sessionParams, { resume: params.sessionId, ...creation });
         return {
             sessionId: response.sessionId,
             modes: response.modes,
@@ -8066,6 +8209,17 @@ export class ClaudeAcpAgent {
             systemPrompt,
             settingSources: ["user", "project", "local"],
             ...(thinking !== undefined && { thinking }),
+            // A client on the subagents RFD form can stop one subagent with
+            // `session/cancel` on its child session (see
+            // `NativeSubagentRuntime.cancelChild`). Declaring that makes Claude
+            // Code's interrupt spare background subagents, so they keep running
+            // after a parent cancel, as the RFD prescribes
+            // (agentclientprotocol/agent-client-protocol#2308). Without it, the
+            // interrupt kills them. It spares background workflows too, which
+            // `stopBackgroundWorkflows` stops instead. Background commands survive an
+            // interrupt either way. Before `userProvidedOptions`, so a client's own
+            // `perTaskStopAffordance` wins.
+            ...(subagentForm(this.clientCapabilities) === "rfd" ? { perTaskStopAffordance: true } : {}),
             ...userProvidedOptions,
             // Claude Code uses the same checkpoint store for /rewind. Enable it only
             // for clients that negotiated per-turn file-change reports; this avoids
@@ -8296,10 +8450,14 @@ export class ClaudeAcpAgent {
             // configured. Managed `deniedModels` drops entries the CLI would refuse.
             const settingsAvailableModels = settingsManager.getSettings().availableModels;
             const settingsModelOverrides = settingsManager.getSettings().modelOverrides;
-            const allowedModels = Array.isArray(settingsAvailableModels)
+            const settingsAllowedModels = Array.isArray(settingsAvailableModels)
                 ? applyAvailableModelsAllowlist(initializationResult.models, settingsAvailableModels, settingsModelOverrides, settingsManager.getManagedDeniedModels())
                 : initializationResult.models;
-            const models = await getAvailableModels(q, allowedModels, initializationResult.models, settingsManager, this.logger, creationOpts.resume !== undefined, sessionId, await resumedModelHint);
+            // Then keep only the models the `providers/set` gateway listed.
+            const allowedModels = resolvedProvider?.listedModels
+                ? narrowToGatewayModels(settingsAllowedModels, resolvedProvider.listedModels, resolvedProvider.bedrockRegionPrefix)
+                : settingsAllowedModels;
+            const models = await getAvailableModels(q, allowedModels, initializationResult.models, settingsManager, this.logger, creationOpts.resume !== undefined, sessionId, await resumedModelHint, resolvedProvider?.listedModels !== undefined);
             timing.phase("models");
             // Resolve the current model's capabilities separately from the stable
             // permission-mode catalog advertised to ACP clients.
@@ -8457,6 +8615,8 @@ export class ClaudeAcpAgent {
                 emittedToolCalls: new Set(),
                 eagerToolCallSessions: new Map(),
                 liveBackgroundTasks: new Map(),
+                stopsWorkflowsOnCancel: options.perTaskStopAffordance === true &&
+                    !clientSupportsAsyncTasks(this.clientCapabilities),
                 nativeSubagentsByTaskId: new Map(),
                 nativeSubagentTaskIdByToolUseId: new Map(),
                 nativeSubagentParentByToolUseId: new Map(),
@@ -8489,6 +8649,21 @@ export class ClaudeAcpAgent {
     async enqueueProviderUpdate(config) {
         const previous = this.providerUpdate?.catch(() => undefined) ?? Promise.resolve();
         const update = previous.then(async () => {
+            // The listing runs in the queue, so `providers/set`, `providers/disable`
+            // and logout apply in the order they arrived. A failed listing fails this
+            // `providers/set` before the provider replaces the current one.
+            if (config) {
+                try {
+                    Object.assign(config, await this.listProviderModels(config));
+                }
+                catch (error) {
+                    if (error instanceof GatewayListingError) {
+                        throw RequestError.internalError({ providerId: PROVIDER_ID, apiType: config.apiType, baseUrl: config.baseUrl }, `Model discovery for provider "${PROVIDER_ID}" failed: ${error.message}`);
+                    }
+                    throw error;
+                }
+                this.logger.log(`[providers/set] listedModels=${config.listedModels?.length ?? "none"} bedrockRegionPrefix=${config.bedrockRegionPrefix ?? "none"}`);
+            }
             const sessions = Object.entries(this.sessions);
             const activeTurns = sessions.flatMap(([, session]) => (session.turnQueue ?? []).flatMap((turn) => (turn.completion ? [turn.completion] : [])));
             if (activeTurns.length > 0) {
@@ -8933,9 +9108,12 @@ function createEnvForProvider(config) {
         return {
             ...resetRouting,
             CLAUDE_CODE_USE_BEDROCK: "1",
-            AWS_BEARER_TOKEN_BEDROCK: "acp-proxy", // Bypass local AWS credential checks
+            AWS_BEARER_TOKEN_BEDROCK: PROVIDER_AUTH_TOKEN_PLACEHOLDER, // Bypass local AWS credential checks
             ANTHROPIC_BEDROCK_BASE_URL: config.baseUrl,
             ANTHROPIC_CUSTOM_HEADERS: customHeaders,
+            ...(config.bedrockRegionPrefix
+                ? { ANTHROPIC_BEDROCK_REGION_PREFIX: config.bedrockRegionPrefix }
+                : {}),
         };
     }
     if (config.apiType === "vertex") {
@@ -8960,9 +9138,13 @@ function createEnvForProvider(config) {
         ...resetRouting,
         ANTHROPIC_BASE_URL: config.baseUrl,
         ANTHROPIC_CUSTOM_HEADERS: customHeaders,
-        ANTHROPIC_AUTH_TOKEN: "acp-proxy", // Bypass local Claude login checks
+        ANTHROPIC_AUTH_TOKEN: PROVIDER_AUTH_TOKEN_PLACEHOLDER, // Bypass local Claude login checks
     };
 }
+function sameHeaders(a, b) {
+    const aKeys = Object.keys(a);
+    return aKeys.length === Object.keys(b).length && aKeys.every((key) => b[key] === a[key]);
+}
 /**
  * Validate a provider base URL: must be a non-empty absolute http(s) URL.
  */
@@ -9118,10 +9300,12 @@ export function resolveFastModeEnabled(params) {
     throw new Error(`Invalid value for config option ${FAST_MODE_CONFIG_ID}: ${value}`);
 }
 export function buildConfigOptions(modes, models, modelInfos, currentEffortLevel, agents = [], currentAgent = DEFAULT_AGENT_ID, fastMode, presentation) {
-    const options = [
-        SessionModeManager.configOption(modes),
-        buildModelConfigOption(models, modelInfos, presentation?.useRecommendedValue === true),
-    ];
+    const options = [SessionModeManager.configOption(modes)];
+    // A gateway that lists none of the SDK's models leaves no model to offer, so
+    // there is no model option at all.
+    if (models.availableModels.length > 0) {
+        options.push(buildModelConfigOption(models, modelInfos, presentation?.useRecommendedValue === true));
+    }
     const effort = buildEffortConfigOption(modelInfos, models.currentModelId, currentEffortLevel, presentation?.useRecommendedValue === true);
     if (effort)
         options.push(effort);

package/dist/air-extension.d.ts

@@ -34,6 +34,12 @@ export declare const AIR_SESSION_RENAME_CAPABILITY = "sessionRename";
  * {@link AIR_SESSION_INDEX_CAPABILITY} is; the client does not declare it.
  */
 export declare const AIR_SESSION_LIST_SUBSCRIBE_CAPABILITY = "sessionListSubscribe";
+/**
+ * Session index rows carry `agentWorktree: true` when the session runs in a
+ * linked git worktree that Claude Code made for it. Advertised exactly when
+ * {@link AIR_SESSION_INDEX_CAPABILITY} is; the client does not declare it.
+ */
+export declare const AIR_SESSION_WORKTREES_CAPABILITY = "sessionWorktrees";
 /** The `_meta.jetbrains.air` keys that the ACP tool call contract defines. */
 export declare const AIR_COMMAND_TITLE_KEY = "commandTitle";
 export declare const AIR_SUBAGENT_KEY = "subagent";