@lucascouts/claude-agent-acp-plus 0.23.6 → 0.25.0

package/dist/acp-agent.js

@@ -42,6 +42,8 @@ import { ACCOUNT_CONFIG_ID, accountForValue, accountInForce, createAccountConfig
 import { isUsageCommandText, structuredUsageMarkdown, syntheticLocalCommand, } from "./usage-markdown.js";
 export { DEFAULT_AGENT_ID, EFFORT_CONFIG_ID } from "./session-config-ids.js";
 import { MODE_CONFIG_ID, SessionModeManager } from "./session-mode.js";
+import { TASKS_META_KEY, TaskFeed, TaskFeedPublisher } from "./task-feed.js";
+import { EscalationRegistry, GrantStore, createAskOperator, createGrantPreToolUseHook, createPermissionDeniedHook, } from "./classifier-escalation.js";
 export const CLAUDE_CONFIG_DIR = process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude");
 const execFileAsync = promisify(execFile);
 const ZERO_USAGE = Object.freeze({
@@ -103,6 +105,10 @@ const STEER_PRIORITY_LATER = "later";
  *  reports in `background_tasks_changed`, so a client can tell an idle thread
  *  from one whose turn ended while a shell or subagent keeps running. */
 export const BACKGROUND_TASKS_META_KEY = "_claude/backgroundTasks";
+/** `session_info_update._meta` key carrying the task feed snapshot
+ *  (story 012) — see `task-feed.ts`. Published beside, never instead of,
+ *  {@link BACKGROUND_TASKS_META_KEY}. */
+export { TASKS_META_KEY };
 /** Validate raw JSON-RPC params into a {@link SteerRequest}. Kept minimal — the
  *  content blocks are handed to `promptToClaude`, which tolerates unknown block
  *  types — but `sessionId` and a non-empty `prompt` array are required. */
@@ -130,6 +136,48 @@ function parseSteerRequest(params) {
         _meta: _meta,
     };
 }
+/** Stop one of the agent's tasks (story 012, R2.1). Params
+ *  {@link TasksStopRequest}, result `{}`. */
+export const TASKS_STOP_METHOD = "_claude/tasks/stop";
+/** Move a foreground tool call's task to the background (story 012, R2.3).
+ *  Params {@link TasksBackgroundRequest}, result {@link TasksBackgroundResponse}. */
+export const TASKS_BACKGROUND_METHOD = "_claude/tasks/background";
+/** `agentCapabilities._meta` key advertising the task feed and its two
+ *  methods (R2.7). Zeo gates on this, never on the agent's name — the name is
+ *  `package.json`'s, and differs between this fork and the published mirror. */
+export const TASKS_CAPABILITY_KEY = TASKS_META_KEY;
+export const TASKS_CAPABILITY_VERSION = 1;
+/** The SDK's own text for a rejected control request, passed through to the
+ *  client as the internal error's message (R2.4). */
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** A value made safe for one `key=value` field: ids come from the client and
+ *  could otherwise carry a space, a newline or an `=` that forges a field. */
+function logValue(value) {
+    return value.replace(/[\s=]+/g, "_");
+}
+function requireIdField(params, method, field) {
+    const value = params && typeof params === "object" ? params[field] : undefined;
+    if (typeof value !== "string" || value.length === 0) {
+        throw RequestError.invalidParams(undefined, `${method} params require a non-empty ${field}`);
+    }
+    return value;
+}
+/** Validate raw JSON-RPC params into a {@link TasksStopRequest}. */
+export function parseTasksStopRequest(params) {
+    return {
+        sessionId: requireIdField(params, TASKS_STOP_METHOD, "sessionId"),
+        taskId: requireIdField(params, TASKS_STOP_METHOD, "taskId"),
+    };
+}
+/** Validate raw JSON-RPC params into a {@link TasksBackgroundRequest}. */
+export function parseTasksBackgroundRequest(params) {
+    return {
+        sessionId: requireIdField(params, TASKS_BACKGROUND_METHOD, "sessionId"),
+        toolCallId: requireIdField(params, TASKS_BACKGROUND_METHOD, "toolCallId"),
+    };
+}
 /** How often the account quota windows are refreshed while a session sits idle,
  *  in milliseconds; `0` disables polling entirely.
  *
@@ -144,6 +192,14 @@ function parseSteerRequest(params) {
  *  loop to show anything a 15-second one would miss. */
 const QUOTA_POLL_DEFAULT_MS = 60_000;
 const QUOTA_POLL_FLOOR_MS = 15_000;
+/** Whether sessions ask the SDK for progress summaries on subagent tasks
+ *  (`CLAUDE_ACP_PROGRESS_SUMMARIES`). Only `1` or `true` turn it on; anything
+ *  else — unset included — leaves it off, because each summary is a model
+ *  call the user pays for. */
+export function progressSummariesEnabled(raw = process.env.CLAUDE_ACP_PROGRESS_SUMMARIES) {
+    const value = raw?.trim().toLowerCase();
+    return value === "1" || value === "true";
+}
 /** Resolve the poll interval from the environment, clamped. An unparseable or
  *  negative value falls back to the default rather than disabling the refresh:
  *  a typo should not silently return the bars to the stale behaviour this
@@ -249,6 +305,15 @@ function stripSubagentTextAndThinking(content) {
         !("type" in item) ||
         (item.type !== "text" && item.type !== "thinking"));
 }
+/** A cached tool call's `description` input, when it is a string. */
+function toolDescriptionOf(cache, toolUseId) {
+    if (typeof toolUseId !== "string")
+        return undefined;
+    const input = cache[toolUseId]?.input;
+    if (typeof input !== "object" || input === null || !("description" in input))
+        return undefined;
+    return typeof input.description === "string" ? input.description : undefined;
+}
 /**
  * Advance the lexer state across the fragment appended since the last delta:
  * just enough JSON awareness (string/escape, nesting depth) to spot commas
@@ -664,13 +729,13 @@ export class ClaudeAcpAgent {
             },
             settleCancelledTurn: (original, session, turn) => {
                 disarmForceCancel(session);
-                this.finishFileChangeAudit(session, turn, "cancelled");
+                this.endTurnScope(session, turn, "cancelled");
                 turn.settled = true;
                 turn.resolve({ stopReason: "cancelled", usage: sessionUsage(original) });
             },
             settleFailedTurn: (session, turn, error) => {
                 disarmForceCancel(session);
-                this.finishFileChangeAudit(session, turn, "providerError");
+                this.endTurnScope(session, turn, "providerError");
                 turn.settled = true;
                 turn.reject(error);
             },
@@ -789,6 +854,7 @@ export class ClaudeAcpAgent {
                     claudeCode: {
                         promptQueueing: true,
                     },
+                    [TASKS_CAPABILITY_KEY]: { version: TASKS_CAPABILITY_VERSION },
                 },
                 promptCapabilities: {
                     image: true,
@@ -1438,6 +1504,59 @@ export class ClaudeAcpAgent {
      *  stays Host-owned so the Host can submit it through a standard
      *  `session/prompt`. Without the opt-in, the existing detached `prompt()` and
      *  `startedNewTurn` result are preserved for compatibility. */
+    /** `_claude/tasks/stop`: stop a task the feed holds as running (R2.1, R2.2). */
+    async stopTask(params) {
+        const { sessionId, taskId } = params;
+        return this.taskAction(TASKS_STOP_METHOD, sessionId, `taskId=${logValue(taskId)}`, async (session) => {
+            if (!session.taskFeed?.isRunning(taskId)) {
+                throw RequestError.invalidParams(undefined, `task ${taskId} is not running`);
+            }
+            try {
+                await session.query.stopTask(taskId);
+            }
+            catch (error) {
+                throw RequestError.internalError(undefined, errorMessage(error));
+            }
+            return {};
+        });
+    }
+    /** `_claude/tasks/background`: background the task a foreground tool call
+     *  started (R2.3, R2.4). `false` means the id matched no foreground task. */
+    async backgroundTask(params) {
+        const { sessionId, toolCallId } = params;
+        return this.taskAction(TASKS_BACKGROUND_METHOD, sessionId, `toolCallId=${logValue(toolCallId)}`, async (session) => {
+            try {
+                return { backgrounded: await session.query.backgroundTasks(toolCallId) };
+            }
+            catch (error) {
+                // Thrown when background tasks are disabled for the session.
+                throw RequestError.internalError(undefined, errorMessage(error));
+            }
+        });
+    }
+    /** Resolve the session, run the action, and write its one `[tasks/action]`
+     *  line (R2.6). The line carries ids and the outcome only — never a command
+     *  line, a description or a summary. */
+    async taskAction(method, sessionId, target, action) {
+        const log = (outcome, reason) => this.logger.log(`[tasks/action] method=${method} sessionId=${logValue(sessionId)} ${target} outcome=${outcome}` +
+            (reason ? ` reason=${logValue(reason)}` : ""));
+        try {
+            const session = this.sessions[sessionId];
+            if (!session) {
+                throw RequestError.invalidParams(undefined, `unknown session ${sessionId}`);
+            }
+            if (session.queryClosed) {
+                throw RequestError.internalError(undefined, SESSION_ENDED_MESSAGE);
+            }
+            const result = await action(session);
+            log("ok");
+            return result;
+        }
+        catch (error) {
+            log("error", error instanceof RequestError ? `code_${error.code}` : "unexpected");
+            throw error;
+        }
+    }
     async steer(params) {
         const sessionId = params.sessionId;
         const session = this.sessions[sessionId];
@@ -1500,6 +1619,14 @@ export class ClaudeAcpAgent {
         await this.publishGoalFromPrompt(sessionId, firstText, steeredUuid);
         return { outcome: "injected" };
     }
+    /** Everything scoped to one turn, released on every path that settles it
+     *  (result, cancel, failure, stream death): story 016's unused "Yes" grants
+     *  (R2.4), then the file-change audit terminal. Every turn-settle site calls
+     *  this right before flipping `settled`. */
+    endTurnScope(session, turn, reason) {
+        session.classifierGrants.clearOnce();
+        this.finishFileChangeAudit(session, turn, reason);
+    }
     /** Publish the audit terminal for every turn path that did not reach the
      *  report tool. The support flips the turn state synchronously before its
      *  transport await, so callers can stay fail-open and settle the ACP prompt
@@ -2068,7 +2195,7 @@ export class ClaudeAcpAgent {
             if (!turn || turn.settled) {
                 return;
             }
-            this.finishFileChangeAudit(session, turn, auditReason);
+            this.endTurnScope(session, turn, auditReason);
             // Captured before the settled flip below (isHeldOpen tests !settled).
             const wasHeld = isHeldOpen(turn);
             turn.settled = true;
@@ -2105,7 +2232,7 @@ export class ClaudeAcpAgent {
                 this.logger.error(`Session ${params.sessionId}: cannot fail active turn because no unsettled active turn exists: ${error}`);
                 return;
             }
-            this.finishFileChangeAudit(session, turn, "providerError");
+            this.endTurnScope(session, turn, "providerError");
             turn.settled = true;
             turn.usageMarkdownAbort?.abort();
             session.turnQueue = (session.turnQueue ?? []).filter((t) => t !== turn);
@@ -2157,7 +2284,7 @@ export class ClaudeAcpAgent {
             session.turnQueue = [];
             for (const turn of turns) {
                 if (!turn.settled) {
-                    this.finishFileChangeAudit(session, turn, "providerError");
+                    this.endTurnScope(session, turn, "providerError");
                     const wasHeld = isHeldOpen(turn);
                     turn.settled = true;
                     turn.usageMarkdownAbort?.abort();
@@ -2351,7 +2478,7 @@ export class ClaudeAcpAgent {
                     // still here was enqueued afterward and was not part of the cancel.)
                     for (const queued of [...(session.turnQueue ?? [])]) {
                         if (!queued.settled) {
-                            this.finishFileChangeAudit(session, queued, "providerError");
+                            this.endTurnScope(session, queued, "providerError");
                             queued.settled = true;
                             queued.reject(RequestError.internalError(undefined, SESSION_ENDED_MESSAGE));
                         }
@@ -2838,9 +2965,7 @@ export class ClaudeAcpAgent {
                                 // fallback in `toAcpNotifications` gates on `wasEmitted` for.
                                 // Drop the update rather than reference a tool call the client
                                 // was never given (see `ensureToolCallEmitted`, issue #851).
-                                if (!session.emittedToolCalls.has(message.tool_use_id)) {
-                                    break;
-                                }
+                                //
                                 // A denial inside a subagent identifies the subagent by
                                 // `agent_id` (as canUseTool does with `agentID`), never by the
                                 // Agent/Task call that spawned it. Resolve it the same way so
@@ -2851,6 +2976,37 @@ export class ClaudeAcpAgent {
                                     ? session.liveBackgroundTasks.get(message.agent_id)?.parentToolUseId
                                     : undefined;
                                 const reason = message.decision_reason ?? message.message;
+                                const meta = {
+                                    claudeCode: {
+                                        toolName: message.tool_name,
+                                        ...(parentToolUseId ? { parentToolUseId } : {}),
+                                        toolResponse: {
+                                            decisionReasonType: message.decision_reason_type,
+                                            decisionReason: message.decision_reason,
+                                            message: message.message,
+                                        },
+                                    },
+                                };
+                                // Story 016: every frame is noted first, whatever its reason
+                                // type — the `PermissionDenied` hook may be waiting on it to
+                                // learn whether this denial is the classifier's.
+                                session.escalations.noteFrame({
+                                    toolUseId: message.tool_use_id,
+                                    reasonType: message.decision_reason_type,
+                                    reason,
+                                    agentId: message.agent_id,
+                                    meta,
+                                    emitted: session.emittedToolCalls.has(message.tool_use_id),
+                                });
+                                // A classifier denial asks the operator instead of failing:
+                                // the call stays pending, and the registry sends its one final
+                                // update (approved, rejected with today's text, or cancelled).
+                                if (message.decision_reason_type === "classifier") {
+                                    break;
+                                }
+                                if (!session.emittedToolCalls.has(message.tool_use_id)) {
+                                    break;
+                                }
                                 await sendUpdate({
                                     sessionId: params.sessionId,
                                     update: {
@@ -2863,17 +3019,7 @@ export class ClaudeAcpAgent {
                                                 content: { type: "text", text: `Permission denied: ${reason}` },
                                             },
                                         ],
-                                        _meta: {
-                                            claudeCode: {
-                                                toolName: message.tool_name,
-                                                ...(parentToolUseId ? { parentToolUseId } : {}),
-                                                toolResponse: {
-                                                    decisionReasonType: message.decision_reason_type,
-                                                    decisionReason: message.decision_reason,
-                                                    message: message.message,
-                                                },
-                                            },
-                                        },
+                                        _meta: meta,
                                     },
                                 });
                                 break;
@@ -2928,7 +3074,9 @@ export class ClaudeAcpAgent {
                             case "hook_progress":
                             case "hook_response":
                             case "files_persisted":
+                                break;
                             case "task_progress":
+                                session.taskFeedPublisher?.notify(session.taskFeed.onProgress(message));
                                 break;
                             case "task_started":
                                 // For subagent tasks `task_id` is the subagent's agent id (the
@@ -2956,11 +3104,17 @@ export class ClaudeAcpAgent {
                                 if (message.subagent_type && session.activeTurn && !session.activeTurn.settled) {
                                     (session.activeTurn.spawnedTaskIds ??= new Set()).add(message.task_id);
                                 }
+                                // The spawning tool call's own `description` labels a shell
+                                // task instead of its command line. Read it now: the cache
+                                // entry is pruned at `tool_result`, which for a background
+                                // Bash arrives almost at once.
+                                session.taskFeedPublisher?.notify(session.taskFeed.onStarted(message, toolDescriptionOf(session.toolUseCache, message.tool_use_id)));
                                 break;
                             case "task_notification":
                                 // The task settled — no further tool calls can originate
                                 // from it, so its registry entry can be dropped.
                                 session.liveBackgroundTasks.delete(message.task_id);
+                                session.taskFeedPublisher?.notify(session.taskFeed.onNotification(message));
                                 break;
                             case "task_updated":
                                 // terminal-status task_updated patch and a (deduplicated)
@@ -2973,6 +3127,7 @@ export class ClaudeAcpAgent {
                                     message.patch.status === "killed") {
                                     session.liveBackgroundTasks.delete(message.task_id);
                                 }
+                                session.taskFeedPublisher?.notify(session.taskFeed.onUpdated(message));
                                 break;
                             case "worker_shutting_down":
                                 // Defer until stream end. The announcement is durable and may be
@@ -3165,6 +3320,7 @@ export class ClaudeAcpAgent {
                                 // (watchers, skip_transcript work) are excluded because the
                                 // SDK marks them as "not activity" for exactly this use.
                                 await publishBackgroundTasks(message.tasks.filter((task) => !task.ambient));
+                                session.taskFeedPublisher?.notify(session.taskFeed.onLevel(message.tasks));
                                 break;
                             default:
                                 unreachable(message, this.logger);
@@ -4107,6 +4263,15 @@ export class ClaudeAcpAgent {
                                 ? message.tool_result_meta
                                 : undefined,
                         })) {
+                            // Story 016 (R2.5): the CLI still sends an `is_error` result for
+                            // a classifier-denied call the operator approved after the hook
+                            // returns. The registry already finished that call with
+                            // "approved, will run again"; a failed update now would
+                            // contradict it, so it is not sent.
+                            if (notification.update.sessionUpdate === "tool_call_update" &&
+                                session.escalations.wasApproved(notification.update.toolCallId)) {
+                                continue;
+                            }
                             // sendUpdate records delivery. Subagent text/thinking is
                             // filtered out of `content` above; blocks that do pass through
                             // (e.g. a subagent image) carry the stamped parentToolUseId
@@ -4366,7 +4531,7 @@ export class ClaudeAcpAgent {
         if (session.turnQueue) {
             for (const turn of session.turnQueue) {
                 if (turn !== session.activeTurn && !turn.settled) {
-                    this.finishFileChangeAudit(session, turn, "cancelled");
+                    this.endTurnScope(session, turn, "cancelled");
                     turn.settled = true;
                     // Deliberately no `usage`: a queued turn never ran, so the session
                     // accumulator (the active turn's tally) is not its spend.
@@ -4432,7 +4597,7 @@ export class ClaudeAcpAgent {
         {
             const active = session.activeTurn;
             if (isHeldOpen(active)) {
-                this.finishFileChangeAudit(session, active, "cancelled");
+                this.endTurnScope(session, active, "cancelled");
                 active.settled = true;
                 // Mirror settleActive's invariants (it is consumer-scoped and
                 // unreachable from here): disarm the backstop — none should be
@@ -4585,6 +4750,40 @@ export class ClaudeAcpAgent {
         session.settingsManager.dispose();
         session.input.end();
         session.query.close();
+        this.retireTaskFeed(session);
+        // Story 016 (R3.2): grants and escalation records die with the stream —
+        // the same reason the quota timer is cleared here. A replacement under the
+        // same id (clear-context restart, provider update) starts with fresh ones.
+        session.classifierGrants.clear();
+        session.escalations.clear();
+    }
+    /** The session's CLI process is gone for good: whatever it was running did
+     *  not survive (R1.9), and the publisher must not outlive the session object
+     *  — a clear-context restart or a provider switch replaces that object under
+     *  the SAME id, and a stale timer would overwrite the new feed's level. The
+     *  query recreate is the one exit that keeps the feed, and does not come
+     *  through here. */
+    retireTaskFeed(session) {
+        const publisher = session.taskFeedPublisher;
+        if (!publisher)
+            return;
+        publisher.notify(session.taskFeed.onProcessRestart());
+        publisher.dispose({ flush: true });
+    }
+    /** One session's task feed and its publisher (story 012). The send goes
+     *  straight to the client rather than through a consumer's `sendUpdate`:
+     *  the publisher outlives consumers (a query recreate replaces them), and a
+     *  `session_info_update` is never subject to that chokepoint's filters. */
+    createTaskFeed(sessionId) {
+        const taskFeed = new TaskFeed(() => Date.now(), 
+        // Degraded but self-recovered: the Logger has no warn level, so the
+        // line carries it as a field rather than being raised to error.
+        { warn: (message) => this.logger.log(`${message} level=warn`) }, sessionId);
+        const taskFeedPublisher = new TaskFeedPublisher(taskFeed, (snapshot) => this.client.sessionUpdate({
+            sessionId,
+            update: { sessionUpdate: "session_info_update", _meta: { [TASKS_META_KEY]: snapshot } },
+        }), undefined, (error) => this.logger.error(`[tasks/feed] sessionId=${logValue(sessionId)} outcome=send_failed reason=${logValue(errorMessage(error))}`));
+        return { taskFeed, taskFeedPublisher };
     }
     /** Cleanly tear down a session: cancel in-flight work, release stream
      *  resources, and remove it from the session map. */
@@ -4614,6 +4813,9 @@ export class ClaudeAcpAgent {
         // here the client has asked us to close the session, so signalling abort is
         // appropriate; query.close() above has already torn the subprocess down.
         session.abortController.abort();
+        // A pending throttle, retry or reconcile timer must not send to a closed
+        // session.
+        session.taskFeedPublisher?.dispose();
         delete this.sessions[sessionId];
     }
     /** Tear down all active sessions. Called when the ACP connection closes. */
@@ -4944,7 +5146,10 @@ export class ClaudeAcpAgent {
      *  while the client's prompt is still open the signal aborts, the SDK sends
      *  `$/cancel_request`, and our local abort race settles even if the client
      *  ignores it. A `cancelled` outcome, request rejection, and local abort all
-     *  surface the same "Tool use aborted" the callers already expect. */
+     *  surface the same "Tool use aborted" the callers already expect.
+     *  Not private: the classifier-escalation question (story 016,
+     *  `createAskOperator`) goes through it too, for the same emitted tool call
+     *  and the same pending-user-input accounting. */
     async requestPermissionFromClient(params, toolName, signal, parentToolUseId) {
         if (signal.aborted)
             throw new Error("Tool use aborted");
@@ -5754,6 +5959,10 @@ export class ClaudeAcpAgent {
             // after the swap above is complete.
             oldInput.end();
             oldQuery.close();
+            // Whatever the old process was running did not survive it (R1.9). The
+            // feed and publisher are the session's, so the endings go out through
+            // the same throttle the replacement query keeps using.
+            session.taskFeedPublisher?.notify(session.taskFeed.onProcessRestart());
         }
         catch (error) {
             // Keep the OLD query fully usable and the pending flag set (the next
@@ -6016,6 +6225,24 @@ export class ClaudeAcpAgent {
         // below) so the TaskCreated/TaskCompleted hook callbacks can close over
         // the same Map that the streaming message handler will read from.
         const taskState = new Map();
+        // Story 016: the grant store and the escalation registry are built before
+        // the options for the same reason — the PermissionDenied and grant hooks
+        // close over them, and the session record below adopts these very objects.
+        const classifierGrants = new GrantStore();
+        const escalations = new EscalationRegistry({
+            sessionId,
+            // The final update carries the frame's own `_meta` (tool name, parent
+            // stamp resolved through `liveBackgroundTasks`), so it lands in the
+            // same transcript as today's failed update would.
+            emit: (_toolUseId, update) => {
+                // The same suppression the prompt-scoped `sendUpdate` applies.
+                if (isFileChangeAuditReportPhase(this.sessions[sessionId]?.activeTurn?.fileChangeAudit)) {
+                    return;
+                }
+                return this.client.sessionUpdate({ sessionId, update });
+            },
+            logger: this.logger,
+        });
         // Resolve every workspace root once. The hidden report tool uses this same
         // set for lexical path validation, and the SDK receives it below.
         const acpAdditionalDirectories = params.additionalDirectories ?? sessionMeta?.additionalRoots ?? [];
@@ -6131,6 +6358,10 @@ export class ClaudeAcpAgent {
             // (story 006, R3.3). Placed before the user spread so an explicit user
             // `enableFileCheckpointing` still wins.
             enableFileCheckpointing: true,
+            // Model-written one-line summaries on a subagent's `task_progress`
+            // (story 012, R3), opt-in because each costs tokens. Before the user
+            // spread, so an explicit `agentProgressSummaries` still wins.
+            agentProgressSummaries: progressSummariesEnabled(),
             ...userProvidedOptions,
             ...(settings && { settings }),
             env,
@@ -6178,14 +6409,14 @@ export class ClaudeAcpAgent {
             tools,
             hooks: {
                 ...userProvidedOptions?.hooks,
-                ...(fileChangeAuditSupport
-                    ? {
-                        PreToolUse: [
-                            ...(userProvidedOptions?.hooks?.PreToolUse || []),
-                            { hooks: [fileChangeAuditSupport.preToolUseHook] },
-                        ],
-                    }
-                    : {}),
+                // Story 016: the grant hook runs last, after the user's hooks and the
+                // file-change audit hook, so it can only add an allow for a call the
+                // operator approved — never pre-empt what comes before it.
+                PreToolUse: [
+                    ...(userProvidedOptions?.hooks?.PreToolUse || []),
+                    ...(fileChangeAuditSupport ? [{ hooks: [fileChangeAuditSupport.preToolUseHook] }] : []),
+                    { hooks: [createGrantPreToolUseHook({ sessionId, classifierGrants }, this.logger)] },
+                ],
                 PostToolUse: [
                     ...(userProvidedOptions?.hooks?.PostToolUse || []),
                     {
@@ -6229,6 +6460,25 @@ export class ClaudeAcpAgent {
                         ],
                     },
                 ],
+                // Story 016: a classifier denial becomes a question to the operator.
+                // `timeout` is in seconds: the CLI default is far shorter than a human
+                // answer, and the hook bounds itself at 590 s so the adapter decides.
+                // The operator is resolved by session id at ask time; a session gone
+                // by then fails the ask, and the hook grants nothing (fail closed).
+                PermissionDenied: [
+                    ...(userProvidedOptions?.hooks?.PermissionDenied || []),
+                    {
+                        hooks: [
+                            createPermissionDeniedHook({
+                                session: { sessionId, classifierGrants },
+                                logger: this.logger,
+                                escalations,
+                                askOperator: createAskOperator(this, sessionId),
+                            }),
+                        ],
+                        timeout: 600,
+                    },
+                ],
             },
             ...(creationOpts.resume !== undefined && { resume: creationOpts.resume }),
             ...(creationOpts.forkSession !== undefined && { forkSession: creationOpts.forkSession }),
@@ -6503,7 +6753,10 @@ export class ClaudeAcpAgent {
             taskState,
             toolUseCache: {},
             emittedToolCalls: new Set(),
+            escalations,
+            classifierGrants,
             liveBackgroundTasks: new Map(),
+            ...this.createTaskFeed(sessionId),
             emittedAssistantText: false,
             owedTrailingIdles: 0,
             messageIdToUuid: new Map(),
@@ -8392,6 +8645,8 @@ export function runAcp(logger) {
         .onRequest(methods.agent.session.prompt, (ctx) => runPromptWithCancellation(agent, ctx.params, ctx.signal))
         .onNotification(methods.agent.session.cancel, (ctx) => agent.cancel(ctx.params))
         .onRequest(STEER_METHOD, { parse: parseSteerRequest }, (ctx) => agent.steer(ctx.params))
+        .onRequest(TASKS_STOP_METHOD, { parse: parseTasksStopRequest }, (ctx) => agent.stopTask(ctx.params))
+        .onRequest(TASKS_BACKGROUND_METHOD, { parse: parseTasksBackgroundRequest }, (ctx) => agent.backgroundTask(ctx.params))
         .onRequest(GOAL_CONTROL_METHOD, { parse: parseGoalRequest }, (ctx) => agent.goal(ctx.params))
         .connect(stream);
     agent = new ClaudeAcpAgent(new ClientConnection(connection.client), logger);