@longshot-harness/longshot-linux-x64 0.1.0-beta.1 → 0.1.0-beta.2

package/sidecars/claude/session.py

@@ -1,855 +0,0 @@
-"""The one live Claude session this sidecar serves.
-
-Builds ClaudeAgentOptions and drives ClaudeSDKClient for the four
-session-lifecycle operations main.py dispatches here: session.start,
-session.resume, session.read, session.close. session.start and
-session.resume connect the client and answer from what they already hold,
-never from a `query()`; the one `query()` in this module is submit's, below.
-What T17-S01 adds is the one persistent
-receive_messages() task events.py owns: start() and resume() launch it right
-after connect() succeeds, and disconnect() stops it before the client itself
-disconnects (_start_stream, _stop_stream below) — this is the exact one point
-T17-S01's allowed zone grants in this file.
-"""
-
-from __future__ import annotations
-
-import asyncio
-import contextlib
-import sys
-import uuid
-from collections.abc import Callable
-from typing import Any
-
-from claude_agent_sdk import ClaudeAgentOptions, ClaudeSDKClient, get_session_messages
-
-from events import StreamState, begin_turn, run_stream, session_ready
-from history import serialize_message
-from mcpserver import CallTool, build_longshot_server
-from permissions import make_can_use_tool
-from protocol import Code, Emit, fail_pending, request, write_frame
-
-# The one permission_mode value both sides of the sidecar channel refuse: it
-# is the mode of an unattended, isolated run with nobody to answer a
-# permission prompt (internal/runners/claude/claude.go:119) and must never
-# reach the coordinator's own session (I08).
-FORBIDDEN_PERMISSION_MODE = "bypassPermissions"
-
-# Copied verbatim from internal/backend/claude/testdata/error_forbiddenValue.json
-# (T15-S02, step 4, "Пустое и запрещённое значение"): T16 and T21 quote this
-# sentence rather than invent their own.
-_FORBIDDEN_PERMISSION_MODE_MESSAGE = (
-    'permission_mode "{mode}" is forbidden on the coordinator session: it is '
-    "the mode of a worker in an isolated working directory and is not "
-    "carried over to the coordinator"
-)
-
-# The permission_mode vocabulary of the vendor CLI this sidecar drives, and
-# the one place it is written down: the wire carries Claude's own spelling,
-# not a Longshot file-access level (docs/claude-sidecar.md, "session.start"),
-# so a mode that never went through the adapter's level->mode table
-# (internal/backend/claude/permissions.go) reaches the CLI verbatim and kills
-# it - `claude --permission-mode read-only` exits with "argument 'read-only'
-# is invalid". Refusing it here turns that dead channel into one refused
-# request.
-#
-# The first six are the choices the CLI itself names in that error message.
-# "default" is the seventh: the CLI accepts it (verified against
-# `claude --permission-mode default --version`, CLI 2.1.263) and the SDK's
-# own PermissionMode literal lists it, it is simply absent from the error's
-# choice list. bypassPermissions is a member because this is the CLI's
-# vocabulary, not Longshot's policy - check_permission_mode refuses it above
-# this check, for its own reason.
-ALLOWED_PERMISSION_MODES = (
-    "acceptEdits",
-    "auto",
-    "bypassPermissions",
-    "manual",
-    "dontAsk",
-    "plan",
-    "default",
-)
-
-# The two input.submit modes this sidecar serves. Both map to the same
-# `query()` call: the distinction is for logs and refusal, not a different
-# operation (docs/claude-sidecar.md, "input.submit"). Which of the two is
-# legal against a session with a turn already running is the adapter's
-# question, not this module's — internal/backend/claude/submit.go refuses
-# mode turn against an active session with ErrSessionBusy, and a second copy
-# of that guard here would be a second place to keep it right.
-SERVED_SUBMIT_MODES = ("turn", "steer")
-
-# The two modes the wire declares and this sidecar refuses, each with the
-# reason it is refused. Kept as data, one entry per mode, so a refusal names
-# why rather than only what: a mode this side merely has not been taught
-# reads the same as one it must never serve, and these two must never serve.
-_UNSERVED_SUBMIT_MODES = {
-    "next-turn": (
-        "next-turn is served by Longshot's own mailbox, not by this sidecar; accepting it "
-        "here would mean holding a queue of pending input, which is state this side must "
-        "not hold (I12)"
-    ),
-    "external-wake": (
-        "external-wake needs a channel notification, which this vendor accepts but never "
-        "delivers into the session (F01, measured-constraints.md section 4), so there is "
-        "nothing this side could serve honestly"
-    ),
-}
-
-
-class Refusal(Exception):
-    """A protocol refusal raised by this module. main.py's dispatcher turns
-    it into a `{code, message}` response; nothing in this module writes to
-    the wire directly, so it stays testable without a codec or a socket."""
-
-    def __init__(self, code: str, message: str) -> None:
-        super().__init__(message)
-        self.code = code
-        self.message = message
-
-
-def make_call_tool(
-    emit: Emit,
-    session_id: str,
-    turn_id_of: Callable[[], str],
-    tool_id_of: Callable[[str], str],
-) -> CallTool:
-    """Builds the `call_tool` this build hands to build_longshot_server.
-
-    A real round trip now: one `tool.call` request out, and the awaited
-    result of the matching `kind: "response"` back, over the one
-    correlation registry protocol.py owns and permission.request shares.
-    Nothing is translated on the way back — the wire's result is
-    `{content, is_error}` and that is exactly what mcpserver._forward
-    reads, so a Longshot-side tool failure arrives as a tool result the
-    model can read (`is_error: true` with the failure text as `content`)
-    rather than as an exception (docs/claude-sidecar.md, "tool.call").
-
-    A factory rather than a module-level function, for the same reason
-    make_can_use_tool is one: the frame names the session and the turn, and
-    those belong to a Session instance. turn_id_of and tool_id_of are
-    called fresh per call, never captured once, so a second turn's call
-    never carries the first turn's ids.
-    """
-
-    async def call_tool(tool_name: str, arguments: dict) -> dict:
-        return await request(
-            emit,
-            "tool.call",
-            {
-                "session_id": session_id,
-                "turn_id": turn_id_of(),
-                "tool_id": tool_id_of(tool_name),
-                "tool_name": tool_name,
-                "arguments": arguments,
-            },
-        )
-
-    return call_tool
-
-
-def check_permission_mode(mode: str) -> None:
-    """Enforces I08 for any frame that carries permission_mode:
-    session.start, session.resume and permission.set (T15's three points).
-    Two different facts, two different codes
-    (docs/claude-sidecar.md, "Empty versus forbidden value"): an empty mode
-    is a required member left unfilled, not a default; bypassPermissions is
-    a well-formed, meaningful value this side refuses by policy, not a value
-    it fails to understand.
-
-    A third fact, and a third code: a mode outside the vendor CLI's own
-    vocabulary (ALLOWED_PERMISSION_MODES) is `unsupportedMode` - "this side
-    cannot", which is exactly the reading the pair of codes above is reserved
-    against (docs/claude-sidecar.md, "Empty versus forbidden value":
-    bypassPermissions is refused because the sidecar can and must not).
-    Passing such a mode through instead reaches the CLI verbatim and ends the
-    process, and a dead channel says less than a refusal naming the value.
-
-    One guard in one place, not three copies at three call sites: T21 calls
-    this unchanged when it adds the permission.set handler.
-    """
-    if not mode:
-        raise Refusal(
-            Code.MALFORMED_REQUEST,
-            "a non-empty permission_mode is required; the frame carried none",
-        )
-    if mode == FORBIDDEN_PERMISSION_MODE:
-        raise Refusal(
-            Code.FORBIDDEN_VALUE, _FORBIDDEN_PERMISSION_MODE_MESSAGE.format(mode=mode)
-        )
-    if mode not in ALLOWED_PERMISSION_MODES:
-        raise Refusal(
-            Code.UNSUPPORTED_MODE,
-            f"permission_mode {mode!r} is not a mode the Claude CLI accepts; it accepts "
-            f"one of {', '.join(ALLOWED_PERMISSION_MODES)}",
-        )
-
-
-def build_options(
-    params: dict,
-    resume_native_id: str | None = None,
-    session_id: str | None = None,
-    **extra: Any,
-) -> ClaudeAgentOptions:
-    """Builds ClaudeAgentOptions from session.start/session.resume params.
-
-    - The partial-messages flag is set unconditionally, True, on every call.
-      Nothing in T16 reads it, and that is not prematurity: the flag belongs
-      to how the session is constructed, not to how it is read, and adding
-      it later would mean reopening a session T17 is already serving.
-    - `resume=resume_native_id` only when resume_native_id is given, never
-      as an empty-string default.
-    - `session_id=session_id` only on session.start, and never together with
-      `resume`: it is the CLI's `--session-id`, which names the session being
-      created, while `--resume` names one that already exists.
-    - The settings-sources option is set to an empty list, cutting off the
-      operator's own hooks, permissions and MCP servers
-      (`~/.claude/settings.json`): the SDK's equivalent of the runner's
-      `--setting-sources ""` (internal/runners/claude/claude.go:231-235).
-      Those sources are not the coordinator's to inherit.
-    - The tool-projection and permission-callback options are not hardcoded
-      in the kwargs dict below: T20 and T21 layer them in through **extra
-      from the call site instead, because both are session-specific (a
-      can_use_tool bound to one session's id and emit function, an mcp
-      endpoint per session) and this function is the one place
-      session.start and session.resume already agree on for what every
-      session needs regardless of which one it is.
-    - This module never turns session persistence off, in any form: without
-      a persisted session there is no native_id, and without native_id
-      there is no session.resume.
-    """
-    permission_mode = params.get("permission_mode") or ""
-    check_permission_mode(permission_mode)
-
-    kwargs: dict = {
-        "cwd": params.get("cwd") or None,
-        "model": params.get("model") or None,
-        "effort": params.get("effort") or None,
-        "system_prompt": params.get("system_prompt") or None,
-        "permission_mode": permission_mode,
-        "include_partial_messages": True,
-        "setting_sources": [],
-        # withheld_tools becomes disallowed_tools (claude_agent_sdk 0.2.160:
-        # --disallowedTools). Read here rather than via **extra: it is a plain
-        # session parameter like model and system_prompt, not a closure bound
-        # to one session, and session.start and session.resume both need it.
-        "disallowed_tools": list(params.get("withheld_tools") or []),
-        **extra,
-    }
-    if resume_native_id:
-        kwargs["resume"] = resume_native_id
-    elif session_id:
-        kwargs["session_id"] = session_id
-    return ClaudeAgentOptions(**kwargs)
-
-
-async def _connect(client: ClaudeSDKClient) -> None:
-    """Opens the vendor session, and turns any failure to open it into a
-    refusal of the request rather than the end of the channel.
-
-    main.py's dispatcher catches Refusal and nothing else, on purpose: the
-    refusal code is per-operation, and a bare `except Exception` there would
-    swallow a genuine bug in every handler. So the translation happens here,
-    at the one place a vendor session is opened - and both session.start and
-    session.resume open one, so both go through this function rather than
-    each growing its own copy of the same guard.
-
-    Everything that can go wrong in this environment goes wrong precisely
-    here: an expired or absent credential, a CLI the SDK cannot launch, a
-    permission_mode the CLI rejects (check_permission_mode catches the modes
-    we know of, not a future CLI's change of vocabulary). Every one of those
-    used to print a Python traceback and exit mid-channel, leaving Longshot
-    with a dead sidecar instead of a sentence naming the cause.
-
-    `internal` is the code, from docs/claude-sidecar.md's refusal table: "the
-    side refused for its own reason; the reason is in `message`". It is the
-    same code this build already answers with for an operation it cannot
-    serve in this environment.
-
-    Nothing needs cleaning up on the way out: the SDK's own connect() wraps
-    its work in `except BaseException: await self.disconnect(); raise`
-    (claude_agent_sdk/client.py), so a subprocess that did spawn before the
-    failure is already gone. Nor is any of this session's state touched -
-    every self._* assignment in start()/resume() happens after connect()
-    returns, so a refused open leaves the Session untouched and a second
-    start() on it opens normally.
-
-    `except Exception`, not BaseException: asyncio.CancelledError is not a
-    failure to open a session, and turning a cancellation into a refusal
-    would answer a frame the loop is being torn down under.
-    """
-    try:
-        await client.connect()
-    except Exception as exc:
-        raise Refusal(
-            Code.INTERNAL,
-            f"the Claude session could not be opened in this environment: "
-            f"{type(exc).__name__}: {exc}",
-        ) from exc
-
-
-async def _one_stdin_message(message: dict):
-    """Wraps one stdin message as the AsyncIterable[dict] form of
-    ClaudeSDKClient.query().
-
-    The string form of query() builds the message itself
-    (claude_agent_sdk/client.py) and leaves no way to set its `uuid`; the
-    async-iterable form writes each dict through as given, setting only
-    `session_id` on it when the dict carries none. That `uuid` is the whole
-    reason this form is used: it is the one field a client can set that
-    round-trips as the carrier (measured-constraints.md section 2 — a custom
-    field name is stripped).
-    """
-    yield message
-
-
-def _emit_frame(frame: dict) -> None:
-    """Writes one event frame to the real frame stream.
-
-    sys.__stdout__, not sys.stdout: main.py's preamble captures the real
-    stream as `_frames` and then points sys.stdout at sys.stderr, so that an
-    accidental print() lands in diagnostics instead of corrupting the frame
-    stream. sys.__stdout__ is set once by the interpreter at start-up and is
-    untouched by that reassignment (reconfigure() mutates the object in
-    place, it does not replace it), so it is this module's own way to reach
-    the same stream without importing main.py — this module has no other
-    handle to it, and T17-S01's allowed zone is this file alone.
-    """
-    write_frame(sys.__stdout__, frame)
-
-
-def mint_native_id() -> str:
-    """Mints the backend-native session id session.start will open with.
-
-    Longshot needs native_id in session.start's result (docs/claude-sidecar.md,
-    "session.start": required), and it needs it without a turn: T16 opens and
-    closes a session while spending no inference. The SDK gives no way to
-    observe a CLI-assigned session id at that point — connect() returns the
-    initialize control response, which carries no session id, and the
-    `system`/`init` message that does carry one is only emitted once a turn
-    starts, on the receive_messages() stream T17 owns.
-
-    So the id is supplied rather than observed: ClaudeAgentOptions.session_id
-    becomes the CLI's `--session-id`, and the session the CLI opens *is* that
-    id, which is also the id `--resume` takes back on session.resume. A uuid4
-    is what the CLI expects that flag to carry.
-    """
-    return str(uuid.uuid4())
-
-
-class Session:
-    """The one live Claude session this sidecar serves. It holds nothing
-    durable: every field arrived from Longshot and arrives again on resume
-    (invariant I12)."""
-
-    def __init__(self) -> None:
-        self._client: ClaudeSDKClient | None = None
-        self._session_id: str | None = None
-        self._native_id: str = ""
-        self._cwd: str = ""
-        self._model: str = ""
-        self._effort: str = ""
-        self._permission_mode: str = ""
-        # The one persistent receive_messages() task T17-S01 owns: started
-        # the moment a session opens (start/resume, right after connect()
-        # succeeds) and stopped the moment it closes (disconnect(), which
-        # both close() and main.py's EOF finally block already call
-        # unconditionally). This is the one point T17-S01's allowed zone
-        # grants in this file; events.py owns everything the task does
-        # while it runs.
-        self._stream_task: asyncio.Task | None = None
-        # The read loop's own StreamState, kept so can_use_tool's turn_id_of
-        # accessor (permissions.py) can read the turn actually in flight
-        # instead of a second, separately-updated copy of the same fact
-        # (I11). None before _start_stream runs.
-        self._stream_state: StreamState | None = None
-
-    def _current_turn_id(self) -> str:
-        """The turn in flight right now, per the read loop's own state.
-        Empty before a turn starts or before the stream is wired up at all -
-        both are legal, and a permission.request minted in either window
-        carries an empty turn_id rather than a guessed one."""
-        return (
-            self._stream_state.current_turn_id if self._stream_state else None
-        ) or ""
-
-    def _tool_id_for(self, tool_name: str) -> str:
-        """The tool-call id a `tool.call` for tool_name carries.
-
-        docs/claude-sidecar.md requires it to correlate with the
-        `tool.started` this side already emitted, and that event carries the
-        SDK's own ToolUseBlock id (events.py, _map_assistant). The MCP
-        handler is never told that id, so it is looked up instead: the read
-        loop's tool_names map holds every started-but-not-completed call as
-        tool_use_id -> tool_name, and the entry for this name is that call.
-        A minted id is the fallback, so the required member is never empty,
-        for the window where the assistant message has not been mapped yet.
-        """
-        # First match by name, and two calls to the same tool outstanding
-        # at once could therefore get each other's id. Correlating exactly
-        # needs the id at the MCP seam, which this vendor does not hand the
-        # handler, so the upgrade is a vendor change, not a better lookup.
-        names = self._stream_state.tool_names if self._stream_state else {}
-        for tool_use_id, started_name in names.items():
-            if started_name == tool_name:
-                return tool_use_id
-        return str(uuid.uuid4())
-
-    def _require_unopened(self) -> None:
-        """One sidecar serves one session (I03). Opening a second one over a
-        live client would orphan that client's `claude` process and leave the
-        first session's next request refused as someone else's, so the
-        second open is refused instead; Longshot spawns a sidecar per session
-        (internal/backend/claude/pool.go)."""
-        if self._client is not None:
-            raise Refusal(
-                Code.INTERNAL,
-                f"this sidecar already serves session {self._session_id!r}; "
-                "a second session needs a sidecar of its own",
-            )
-
-    def _require_serving(self, session_id: str) -> None:
-        served = self._session_id or ""
-        if session_id != served:
-            raise Refusal(
-                Code.UNKNOWN_SESSION,
-                f"this sidecar is serving {served!r}, not {session_id!r}",
-            )
-
-    def ready_event(self) -> dict:
-        """The session.ready frame for the session this sidecar now serves.
-
-        Built here rather than emitted here: the frame must reach stdout
-        *after* session.start's own result frame, because that result is how
-        the caller learns the session id this event names. main.py's
-        dispatcher owns both writes and is therefore the only place that can
-        guarantee the order (see its _READY_AFTER).
-        """
-        return session_ready(self._session_id or "", self._native_id, self._model)
-
-    def _start_result(self) -> dict:
-        return {
-            "session_id": self._session_id,
-            "native_id": self._native_id,
-            "model": self._model,
-            "effort": self._effort,
-            "permission_mode": self._permission_mode,
-        }
-
-    async def start(self, params: dict) -> dict:
-        check_permission_mode(params.get("permission_mode") or "")
-        self._require_unopened()
-        if params.get("mcp_endpoint"):
-            # mcp_endpoint is T20's: accepting and ignoring it would silently
-            # drop the session's tool set rather than say so.
-            raise Refusal(
-                Code.INTERNAL, "mcp_endpoint is served by T20, not by this build"
-            )
-
-        native_id = mint_native_id()
-        # Minted before the session is open, not after: can_use_tool needs
-        # this session's Longshot-facing id at construction time, and a
-        # session that fails to connect never gets to self._session_id at
-        # all - the local variable carries it in the meantime.
-        session_id = str(uuid.uuid4())
-        options = build_options(
-            params,
-            session_id=native_id,
-            can_use_tool=make_can_use_tool(
-                _emit_frame, session_id, self._current_turn_id
-            ),
-        )
-        # mcp_servers is set here, not inside build_options: T20 adds it on
-        # top of that function, not inside it (build_options's own
-        # docstring). tool_definitions is session.start's own additive
-        # `tools` field (T20-S01), which session.resume carries identically -
-        # resume() below builds the same projection the same way, so a
-        # change to one is a change to both; an absent or empty list is a
-        # normal outcome and yields a server that declares no tools.
-        #
-        # It composes with can_use_tool above rather than replacing it: a
-        # projected mcp__longshot__* tool is still routed through the same
-        # approval hook every other tool is, and Longshot's own decide()
-        # answers it (T21). Nothing here disables that hook - that is what
-        # bypassPermissions would have done, and it is never sent.
-        tool_definitions = params.get("tools") or []
-        options.mcp_servers = {
-            "longshot": build_longshot_server(
-                tool_definitions,
-                make_call_tool(
-                    _emit_frame, session_id, self._current_turn_id, self._tool_id_for
-                ),
-            )
-        }
-        client = ClaudeSDKClient(options)
-        await _connect(client)
-
-        self._client = client
-        # The Longshot-facing session_id: this sidecar mints it because
-        # session.start's params carry no session_id for it to echo (T15's
-        # frozen params table). One sidecar serves one session (I03), so
-        # whatever id is minted here is the session's id from now on.
-        self._session_id = session_id
-        self._native_id = native_id
-        self._cwd = params.get("cwd", "")
-        self._model = params.get("model", "")
-        self._effort = params.get("effort", "")
-        self._permission_mode = params["permission_mode"]
-        self._start_stream(client)
-        return self._start_result()
-
-    async def resume(self, params: dict) -> dict:
-        check_permission_mode(params.get("permission_mode") or "")
-        self._require_unopened()
-
-        native_id = params.get("native_id") or ""
-        if not native_id:
-            raise Refusal(
-                Code.MALFORMED_REQUEST,
-                "session.resume requires a non-empty native_id; the frame carried none",
-            )
-
-        session_id = params["session_id"]
-        options = build_options(
-            params,
-            resume_native_id=native_id,
-            can_use_tool=make_can_use_tool(
-                _emit_frame, session_id, self._current_turn_id
-            ),
-        )
-        # The same projection start() builds, from session.resume's own
-        # additive `tools` field: the tool surface belongs to the session,
-        # and a resumed session is the same session. Without this a resumed
-        # coordinator sees no Longshot tools at all and silently loses its
-        # ability to delegate. Nothing is remembered from a previous
-        # session here on purpose - one sidecar serves one session (I03) and
-        # a resume may arrive at a fresh process, so the surface has to
-        # travel on this frame; an absent or empty list is a normal outcome
-        # and yields a server that declares no tools, exactly as in start().
-        tool_definitions = params.get("tools") or []
-        options.mcp_servers = {
-            "longshot": build_longshot_server(
-                tool_definitions,
-                make_call_tool(
-                    _emit_frame, session_id, self._current_turn_id, self._tool_id_for
-                ),
-            )
-        }
-        client = ClaudeSDKClient(options)
-        await _connect(client)
-
-        # The resumed session keeps its id: fork_session is left off, so the
-        # CLI continues `--resume=<native_id>` under that same id rather than
-        # branching a new one. There is nothing to observe back and compare
-        # (see mint_native_id): the SDK exposes no session id at connect.
-
-        self._client = client
-        self._session_id = session_id
-        self._native_id = native_id
-        self._cwd = params.get("cwd", "")
-        self._model = params.get("model", "")
-        self._effort = params.get("effort", "")
-        self._permission_mode = params["permission_mode"]
-        self._start_stream(client)
-        return self._start_result()
-
-    def _start_stream(self, client: ClaudeSDKClient) -> None:
-        """Starts the one persistent receive_messages() task for this
-        session, as a background asyncio.Task on the process's single event
-        loop (main.py's `_loop`, already running by the time this is
-        called). T17-S01's whole allowed edit here: launch on open, stop on
-        close (_stop_stream, called from disconnect()); events.py's
-        run_stream owns the loop shape and the mapping."""
-        state = StreamState(session_id=self._session_id or "")
-        self._stream_state = state
-        self._stream_task = asyncio.ensure_future(
-            run_stream(client, state, _emit_frame)
-        )
-
-    async def _stop_stream(self) -> None:
-        """Cancels the persistent read task and waits for it to actually
-        stop, so disconnect() never returns while it is still running
-        against a client that is about to go away."""
-        task, self._stream_task = self._stream_task, None
-        if task is None:
-            return
-        task.cancel()
-        with contextlib.suppress(asyncio.CancelledError):
-            await task
-
-    def read(self, session_id: str) -> dict:
-        """Returns what the live session holds, and changes nothing: no
-        reconnect, no SDK call. Holding session_id, native_id, cwd, model,
-        effort and permission_mode in memory does not break I12 — the set
-        arrived from Longshot and arrives again on session.resume."""
-        self._require_serving(session_id)
-        return {
-            "session_id": self._session_id,
-            "native_id": self._native_id,
-            "cwd": self._cwd,
-            "model": self._model,
-        }
-
-    def _require_live_client(self, session_id: str) -> ClaudeSDKClient:
-        """The live client for a session this sidecar serves, or a refusal.
-
-        _require_serving answers "is this my session"; this answers "is it
-        still connected", which is a different fact with the same code: a
-        session that was closed keeps its id (close() clears only the
-        client), so every operation that needs a client of its own has to
-        ask both.
-        """
-        self._require_serving(session_id)
-        if self._client is None:
-            raise Refusal(
-                Code.UNKNOWN_SESSION,
-                f"session {session_id!r} is not connected; there is no live client to serve this request",
-            )
-        return self._client
-
-    async def submit(self, params: dict) -> dict:
-        """T18's input.submit: one message into the live session.
-
-        Sent through the async-iterable form of query() (_one_stdin_message
-        above) rather than the string form, for one reason: `uuid`. Longshot
-        mints a carrier per delivery and this side sets it as the stdin
-        message's `uuid`, the one field measured to round-trip
-        (measured-constraints.md section 2). No carrier means no `uuid` key
-        at all, not an empty one - the CLI mints its own then, and an empty
-        string would be a value this side invented.
-
-        Both served modes make the same call. `turn` against a session with
-        a turn already running is refused by the adapter
-        (internal/backend/claude/submit.go, ErrSessionBusy) and not here:
-        query() folds rather than queueing (measured-constraints.md section
-        1), so the guard belongs where the observed turn state lives, and
-        one copy of it is the whole point.
-
-        turn.started is not built here. events.begin_turn is the one place a
-        turn id is minted (I11); this path calls it with the carrier and
-        writes back whatever it returns, which is exactly one frame for a
-        `turn` and nothing at all for a `steer` that folded into a turn
-        already running.
-        """
-        session_id = params.get("session_id") or ""
-        client = self._require_live_client(session_id)
-
-        mode = params.get("mode") or ""
-        if mode not in SERVED_SUBMIT_MODES:
-            reason = _UNSERVED_SUBMIT_MODES.get(
-                mode,
-                "this sidecar serves mode "
-                + " and ".join(SERVED_SUBMIT_MODES)
-                + f", and knows no mode {mode!r}",
-            )
-            raise Refusal(
-                Code.UNSUPPORTED_MODE,
-                f"input.submit mode {mode!r} is not served: {reason}",
-            )
-
-        text = params.get("text") or ""
-        if not text:
-            raise Refusal(
-                Code.MALFORMED_REQUEST,
-                "input.submit requires a non-empty text; the frame carried none",
-            )
-
-        carrier = params.get("carrier") or ""
-        message: dict = {
-            "type": "user",
-            "message": {"role": "user", "content": text},
-            "parent_tool_use_id": None,
-        }
-        if carrier:
-            message["uuid"] = carrier
-        await client.query(_one_stdin_message(message))
-
-        # After the write, not before: the CLI cannot have produced a single
-        # frame of this turn until the message reaches it, so nothing of
-        # this turn can precede turn.started on the wire - while a
-        # turn.started emitted ahead of a write that then failed would
-        # announce a turn that never started.
-        frames: list = (
-            begin_turn(self._stream_state, carrier)
-            if self._stream_state is not None
-            else []
-        )
-        for frame in frames:
-            _emit_frame(frame)
-
-        result: dict = {"accepted": True}
-        if carrier:
-            # Echoed because this side actually set it as the message's
-            # uuid, not because it was received: an echo is a claim, and
-            # what is not set is not claimed.
-            result["carrier"] = carrier
-        if frames:
-            # The turn id is set only when this call actually started a turn:
-            # a steer folded into a running turn returns no id, because begin_turn
-            # returned [] and made no claim. Same "what is not set is not claimed"
-            # rule as carrier above. The Go adapter uses this id to close the
-            # admission gate before turn.started arrives, eliminating the N24 race
-            # window on the step-carrier path.
-            result["turn_id"] = self._stream_state.current_turn_id
-        return result
-
-    async def interrupt(self, session_id: str) -> dict:
-        """T18's turn.interrupt: stop the turn in flight.
-
-        The active turn comes from the read loop's own StreamState, the same
-        cursor every event's turn_id is taken from (I11) - this method keeps
-        no second record of it and names no turn on the wire, because
-        client.interrupt() takes neither a session nor a turn argument.
-
-        `interrupted: true` means the interrupt reached the CLI and the CLI
-        accepted it: interrupt() sends a control request and waits for the
-        CLI's control response (claude_agent_sdk Query._send_control_request),
-        raising on an error or a timeout. It does not wait for the turn to
-        end - the turn's own end is observed as turn.completed, from the
-        ResultMessage on the stream, which is the one turn boundary there
-        is. So a true here is not a claim that the turn has already stopped,
-        and the adapter treats false and a refusal alike as an error rather
-        than reading either as "stopped anyway"
-        (internal/backend/claude/interrupt.go).
-        """
-        client = self._require_live_client(session_id)
-        if not self._current_turn_id():
-            raise Refusal(
-                Code.NO_ACTIVE_TURN,
-                f"session {session_id!r} has no turn in flight to interrupt",
-            )
-        await client.interrupt()
-        return {"interrupted": True}
-
-    async def set_model(self, params: dict) -> dict:
-        """T18's model.set: the model of a live session, changed and
-        confirmed.
-
-        A non-empty effort is refused rather than dropped. This vendor
-        exposes no reasoning-effort control on a live session at all:
-        ClaudeAgentOptions carries `effort` for the session it opens, and
-        ClaudeSDKClient has set_model and set_permission_mode but no
-        equivalent for effort (SDK 0.2.152). Applying the model and staying
-        silent about the effort would be a silent semantic substitution -
-        the caller asked for two changes and would be told both happened -
-        which is the same trade internal/backend/claude/submit.go already
-        refuses for mode: one retry costs less than a lie.
-
-        The remembered model is updated after the SDK call, not before, so a
-        change that failed does not read back as applied through
-        session.read (the order ApplyFileAccess keeps on the Go side, T11).
-        """
-        session_id = params.get("session_id") or ""
-        client = self._require_live_client(session_id)
-
-        model = params.get("model") or ""
-        if not model:
-            raise Refusal(
-                Code.MALFORMED_REQUEST,
-                "model.set requires a non-empty model; the frame carried none",
-            )
-        effort = params.get("effort") or ""
-        if effort:
-            raise Refusal(
-                Code.UNSUPPORTED_MODE,
-                f"effort {effort!r} cannot be applied: this vendor exposes no reasoning-effort "
-                "control on a live session, and applying the model alone would report a change "
-                "to effort that never happened. Send model.set with an empty effort to change "
-                "the model only",
-            )
-
-        await client.set_model(model)
-        self._model = model
-        # effort is reported empty, the wire's "none reported": this side
-        # changed none and observes none, and the session's own remembered
-        # effort is what it opened with, not something this call confirmed.
-        return {"model": self._model, "effort": ""}
-
-    async def set_permission_mode(self, session_id: str, permission_mode: str) -> dict:
-        """T21's live half of permission.set. The guard already ran in
-        main.py's dispatcher (check_permission_mode, ahead of this call), so
-        this only carries a mode Longshot already vetted to the SDK and then
-        remembers it - in that order, so a call that fails against the SDK
-        does not get remembered as applied, matching ApplyFileAccess's own
-        rule on the Go side (T11)."""
-        self._require_serving(session_id)
-        if self._client is None:
-            raise Refusal(
-                Code.UNKNOWN_SESSION,
-                f"session {session_id!r} is not connected; there is no live client to change the mode of",
-            )
-        await self._client.set_permission_mode(permission_mode)
-        self._permission_mode = permission_mode
-        return {"permission_mode": permission_mode}
-
-    async def history(self, params: dict) -> dict:
-        """Answers session.history: one page of the persisted transcript,
-        oldest to newest, cursor addressing a message position rather than a
-        page (T22-S01, docs/claude-sidecar.md "session.history"). Grouping
-        the messages into turns, assigning a turn status and renaming an
-        item type all happen in Longshot's adapter
-        (internal/backend/claude/history.go), never here: this sidecar
-        reports content, the adapter decides meaning (I12).
-
-        cursor is the index of the first message this page starts at, and
-        next_cursor is the index the following page would start at - the
-        same "position, not page" contract session.history promises. limit
-        <= 0 means "the sidecar's own default", which this build reads as
-        "the whole transcript in one page": Claude's own limit is expressed
-        as a message count, not a byte budget, and there is no public
-        get_session_messages() paging of its own to defer to.
-        """
-        session_id = params.get("session_id") or ""
-        self._require_serving(session_id)
-
-        cursor = params.get("cursor") or ""
-        limit = params.get("limit") or 0
-        start = int(cursor) if cursor else 0
-
-        messages = await get_session_messages(self._native_id, directory=self._cwd)
-        items = [serialize_message(m) for m in messages]
-
-        end = len(items) if limit <= 0 else min(start + limit, len(items))
-        has_more = end < len(items)
-        return {
-            "items": items[start:end],
-            "next_cursor": str(end) if has_more else "",
-            "has_more": has_more,
-        }
-
-    async def close(self, session_id: str) -> dict:
-        """Disconnects and returns {}. Idempotent: a second close on the
-        same session_id disconnects nothing (there is nothing left to
-        disconnect) and still answers {}, because self._session_id is never
-        cleared here — only self._client is."""
-        self._require_serving(session_id)
-        await self.disconnect()
-        return {}
-
-    async def disconnect(self) -> None:
-        """Disconnects the live ClaudeSDKClient, if one is connected. Called
-        from close() and unconditionally from main.py's finally block on
-        EOF, so it must be safe to call when nothing is connected — that is
-        the mechanism behind T16's "no orphan `claude` process".
-
-        The stream task is stopped first, before the client itself
-        disconnects: it is reading that client's receive_messages(), and
-        stopping the reader before the reader's source is the order that
-        does not depend on how the client behaves once it is gone.
-
-        Every request this side still has outstanding is failed before any
-        of that, because this is the moment the channel those requests are
-        waiting on goes away: an awaited tool.call would otherwise hold the
-        SDK's own tool handler forever, and client.disconnect() below waits
-        on it. Failing first means the waiter is already resolving while the
-        loop turns inside the awaits that follow.
-        """
-        fail_pending(
-            "the session was closed while the tool call was still outstanding; "
-            f"session {self._session_id or ''!r} is gone and its calls cannot be answered"
-        )
-        await self._stop_stream()
-        if self._client is None:
-            return
-        client, self._client = self._client, None
-        await client.disconnect()