@platless/axom-cli 0.1.0 → 0.3.13

package/dist/workstation/acp/terminalLogin.js

@@ -0,0 +1,197 @@
+/**
+ * Hosting an ACP `terminal` sign-in on the workstation, so the reader gets a link instead of an
+ * instruction to go find a terminal (spec 2026-09-24 D6, D7, D9).
+ *
+ * ## Which command
+ *
+ * `AuthMethodTerminal` (`@agentclientprotocol/sdk` 1.4.0, `types.gen.d.ts:2237`) says its `args`
+ * are appended to "the configured agent invocation". That is wrong for at least one agent in the
+ * wild: measured, appending `login` to a binary agent's `acp` launch fails with "unexpected extra
+ * argument", while the same agent's `_meta["terminal-auth"]` names the invocation that works. So a
+ * `_meta["terminal-auth"]` that carries a `command` is taken as the whole invocation, and only
+ * without one does the standard append rule apply. That key appears nowhere in the SDK; it is a
+ * convention agents use, and it is matched by **shape**, never by which agent sent it.
+ *
+ * Trusting the agent's own command adds nothing it could not already do: it is a program this
+ * daemon already runs, as the same user, on the same machine. Nothing here composes, quotes or
+ * guesses a command, and nothing goes through a shell.
+ *
+ * ## How it runs
+ *
+ * Pipes, not a terminal: this client cannot reproduce an interactive terminal, which is also why it
+ * does not declare `clientCapabilities.auth.terminal` (`:4399`). What it can host is the common
+ * shape — print a link, wait for the reader to approve it somewhere, exit 0 — and that is every
+ * device-code login. `PYTHONUNBUFFERED=1` is set because a Python-built CLI block-buffers a pipe
+ * and was measured holding its link back for over 40 seconds; it names no agent and is inert for
+ * everything else.
+ *
+ * Every exit ends the **process group**, not just the child. A single-file bundle runs its real work
+ * in a grandchild; killing only the bundle's bootstrap was measured leaving that grandchild alive
+ * for 23 minutes.
+ */
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { createAuthUrlScanner } from './authUrlSniffer.js';
+export class TerminalLoginFailedError extends Error {
+}
+export class TerminalLoginTimeoutError extends Error {
+}
+export class TerminalLoginCancelledError extends Error {
+}
+/** How many of the process's last output lines a failure quotes. */
+const FAILURE_TAIL_LINES = 20;
+const DEFAULT_KILL_GRACE_MS = 2_000;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function stringArray(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === 'string') ? [...value] : undefined;
+}
+function stringRecord(value) {
+    if (!isRecord(value))
+        return {};
+    return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === 'string'));
+}
+function metaTerminalAuth(method) {
+    if (!isRecord(method) || !isRecord(method._meta))
+        return undefined;
+    const entry = method._meta['terminal-auth'];
+    return isRecord(entry) ? entry : undefined;
+}
+/** The `args` a `_meta["terminal-auth"]` entry carries, for display where the top-level `args` is absent. */
+export function metaTerminalAuthArgs(method) {
+    return stringArray(metaTerminalAuth(method)?.args);
+}
+/**
+ * How to run this advertised method as a terminal login, or `undefined` when it is not one (spec
+ * D6: top-level `type: "terminal"`, or a `_meta["terminal-auth"]` object).
+ */
+export function terminalLoginSpecOf(method) {
+    if (!isRecord(method))
+        return undefined;
+    const meta = metaTerminalAuth(method);
+    if (meta && typeof meta.command === 'string' && meta.command.trim() !== '') {
+        return { kind: 'meta', command: meta.command, args: stringArray(meta.args) ?? [], env: stringRecord(meta.env) };
+    }
+    if (meta || method.type === 'terminal') {
+        return {
+            kind: 'append',
+            args: stringArray(method.args) ?? stringArray(meta?.args) ?? [],
+            env: { ...stringRecord(meta?.env), ...stringRecord(method.env) },
+        };
+    }
+    return undefined;
+}
+/**
+ * The concrete command line. `baseEnv` is the workstation's and the agent's configured environment
+ * (`AcpListSpec.env` then `.agentEnv`), layered the way `connectAgent` layers a session's; the
+ * method's own `env` goes last because ACP says it overrides the base launch configuration.
+ */
+export function terminalInvocationFor(spec, launch, baseEnv) {
+    const env = { ...launch.env, ...baseEnv, ...spec.env };
+    if (spec.kind === 'meta')
+        return { command: spec.command, args: [...spec.args], env };
+    return { command: launch.command, args: [...launch.args, ...spec.args], env };
+}
+function signalGroup(child, signal) {
+    if (child.pid === undefined)
+        return;
+    try {
+        // A negative pid addresses the whole group `detached: true` created. Windows has no process
+        // groups; there this reaches the direct child only.
+        process.kill(process.platform === 'win32' ? child.pid : -child.pid, signal);
+    }
+    catch {
+        // Best effort, and it must stay that way: this runs inside child-process event handlers, where
+        // a throw is an uncaught exception that takes the whole daemon down. ESRCH (the group is already
+        // gone) is the common case; anything else (EPERM) still leaves nothing this code could do.
+    }
+}
+/**
+ * Run one terminal sign-in to completion. Resolves on exit 0; rejects with
+ * {@link TerminalLoginFailedError} (non-zero exit, signal, or spawn failure — quoting the process's
+ * own last lines), {@link TerminalLoginTimeoutError} or {@link TerminalLoginCancelledError}. Every
+ * exit ends the process group first.
+ */
+export function runTerminalLogin(invocation, options) {
+    return new Promise((resolve, reject) => {
+        const killGraceMs = options.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
+        if (options.signal?.aborted) {
+            reject(new TerminalLoginCancelledError('Sign-in was cancelled before it started.'));
+            return;
+        }
+        const child = spawn(invocation.command, invocation.args, {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            detached: process.platform !== 'win32',
+            env: { ...process.env, ...invocation.env, PYTHONUNBUFFERED: '1' },
+        });
+        const scan = createAuthUrlScanner();
+        const presented = new Set();
+        const tail = [];
+        let ending;
+        let killTimer;
+        const onLine = (raw) => {
+            const line = raw.replace(/\r$/, '');
+            if (line.trim() !== '') {
+                // eslint-disable-next-line no-control-regex -- stripping the literal ESC (0x1b) is the point
+                tail.push(line.replace(/\x1b\[[0-9;]*[A-Za-z]/g, ''));
+                if (tail.length > FAILURE_TAIL_LINES)
+                    tail.shift();
+            }
+            const url = scan(line);
+            if (url && !presented.has(url)) {
+                presented.add(url);
+                options.present?.(`terminal-auth-url-${randomUUID()}`, url);
+            }
+        };
+        for (const stream of [child.stdout, child.stderr]) {
+            let buffer = '';
+            stream?.setEncoding('utf8');
+            stream?.on('data', (chunk) => {
+                buffer += chunk;
+                const lines = buffer.split('\n');
+                buffer = lines.pop() ?? '';
+                lines.forEach(onLine);
+            });
+            stream?.on('end', () => { if (buffer !== '')
+                onLine(buffer); buffer = ''; });
+        }
+        const end = (reason) => {
+            if (ending)
+                return;
+            ending = reason;
+            signalGroup(child, 'SIGTERM');
+            killTimer = setTimeout(() => signalGroup(child, 'SIGKILL'), killGraceMs);
+            killTimer.unref();
+        };
+        const deadline = setTimeout(() => end(new TerminalLoginTimeoutError(`Sign-in did not finish within ${Math.round(options.deadlineMs / 1000)} seconds.`)), options.deadlineMs);
+        const onAbort = () => end(new TerminalLoginCancelledError('Sign-in was cancelled.'));
+        options.signal?.addEventListener('abort', onAbort, { once: true });
+        const settle = (outcome) => {
+            clearTimeout(deadline);
+            if (killTimer)
+                clearTimeout(killTimer);
+            options.signal?.removeEventListener('abort', onAbort);
+            if (outcome)
+                reject(outcome);
+            else
+                resolve();
+        };
+        child.once('error', (error) => {
+            settle(new TerminalLoginFailedError(`Could not start the sign-in command: ${error.message}`));
+        });
+        child.once('exit', () => {
+            // Whatever the login left behind in its group must not outlive it — see the file comment.
+            signalGroup(child, 'SIGKILL');
+        });
+        child.once('close', (code, signal) => {
+            if (ending)
+                return settle(ending);
+            if (code === 0)
+                return settle(undefined);
+            const how = code !== null ? `exited with code ${code}` : `was ended by ${signal}`;
+            const said = tail.length > 0 ? `: ${tail.join('\n')}` : '';
+            return settle(new TerminalLoginFailedError(`The sign-in command ${how}${said}`));
+        });
+    });
+}

package/dist/workstation/acp/test/fakeAgent.js

@@ -72,7 +72,7 @@
 //                                               // before `.connect()`, since it only works if the
 //                                               // handler exists in time to answer this call
 //     pingResultSink?: string,
-//     requestPermissionDuringPrompt?: { toolCall: ToolCallUpdate, options: PermissionOption[] },
+//     requestPermissionDuringPrompt?: { sessionId?: string, toolCall: ToolCallUpdate, options: PermissionOption[] },
 //                                               // if set, session/prompt calls the client's
 //                                               // session/request_permission with this payload
 //                                               // before returning, and writes the raw response to
@@ -85,6 +85,24 @@
 //                                               // before returning, and writes the raw response to
 //                                               // createElicitationResultSink.
 //     createElicitationResultSink?: string,
+//     createElicitationsDuringPrompt?: object[],
+//                                               // the plural of the above: session/prompt calls the
+//                                               // client's elicitation/create once per element, IN
+//                                               // ORDER and ONE AT A TIME — each call is awaited
+//                                               // before the next is sent, so exactly one card is
+//                                               // ever open. That sequencing is the point: it is how
+//                                               // a real agent asks a follow-up question, and it is
+//                                               // the only way to observe one property kind's answer
+//                                               // without the others' cards confusing the timeline.
+//                                               // Each raw response is appended to the JSON array at
+//                                               // createElicitationResultsSink, which is REWRITTEN
+//                                               // after every answer rather than once at the end —
+//                                               // a driver (a test, or a human clicking through a
+//                                               // browser) has to be able to read the answer to card
+//                                               // N while card N+1 is still open, and a single
+//                                               // write at the end of the turn would only be
+//                                               // readable after the last card was answered.
+//     createElicitationResultsSink?: string,
 //     authenticateSink?: string,               // if set, a file this process writes (the raw JSON
 //                                               // `authenticate` params, i.e. `{ methodId }`) the
 //                                               // moment it receives that request — lets a test
@@ -124,6 +142,8 @@
 //                                               // stderr-only login shape (antigravity), and it
 //                                               // starts at spawn on purpose, which is exactly the
 //                                               // window `ConnectAgentOptions.present` warns about.
+//     newSessionDelayMs?: number,              // delays the session/new response
+//     hangOnSessionLoad?: boolean,             // session/load never resolves, for startup cleanup tests
 //     hangOnSessionNew?: boolean,              // if true, session/new never resolves — the agent
 //                                               // answered initialize and then went quiet on the
 //                                               // very next request. Distinct from hangOnInitialize:
@@ -145,14 +165,41 @@
 //                                               // 这么干的:setTimeout 0,见 acp-agent.js:756)。
 //                                               // 用数组的数组是因为「推几次」本身就是被测行为:
 //                                               // claude 会推两次(70 → 68),codex 只推一次。
+//     rejectLaterSessionNew?: string,           // p3-fix7c 3: a marker path; the first session/new (across
+//                                               // processes) succeeds and creates it, every later one throws —
+//                                               // a probe retry that fails.
+//     commandsBeforeLaterSessionReply?: { commands: AvailableCommand[], markerPath: string }, // p3-fix7b M-4:
+//                                               // like commandsBeforeNewSessionReply, but only from the second
+//                                               // session/new on (counted across processes through markerPath) —
+//                                               // a first probe that saw nothing, then a retry the table races.
+//     commandsBeforeNewSessionReply?: AvailableCommand[], // p3-fix7 N9: one available_commands_update
+//                                               // sent INSIDE the session/new handler, before its reply —
+//                                               // the order a fast Claude adapter produced in run 5, which
+//                                               // reached the client before it knew its own session id.
 //     newSessionCommandsDelayMs?: number,       // 每次推送之间的间隔,默认 0。让测试能把一条晚到的
 //                                               // 推送放在 settle 窗口的里面或外面。
+//     newSessionSink?: string,                  // if set, a file this process writes (the raw JSON
+//                                               // session/new params, including `_meta`) the moment
+//                                               // it receives that request — Task 5's proof that
+//                                               // `AcpSession.open` actually sent
+//                                               // `_meta.claudeCode.emitRawSDKMessages` (or did not,
+//                                               // for an agent that is not claude)
+//     extNotifications?: { method: string, params: unknown }[], // sent, in order, as raw
+//                                               // extNotification calls after session/new answers —
+//                                               // same "after the reply" timing as
+//                                               // `newSessionCommands` above. Task 5 uses this to
+//                                               // model claude-agent-acp's
+//                                               // `extNotification("_claude/sdkMessage", …)`.
+//     extNotificationDelayMs?: number,          // delay between each of the above; default 0.
 //     sessions?: SessionInfo[],                 // session/list's response `sessions` array; default []
 //     nextCursor?: string,                      // session/list's response `nextCursor`
 //     sessionListSink?: string,                 // if set, a file this process writes (the raw JSON
 //                                                // session/list params, i.e. `{cwd, cursor}`) the
 //                                                // moment it receives that request — Task 7's proof
 //                                                // that listNativeSessions really sent cwd/cursor
+//     deleteSessionSink?: string,               // if set, a file each session/delete request's params
+//                                                // are appended to as a JSON line
+//     deleteSessionFailures?: string[],         // session ids whose session/delete throws internalError
 //     loadUpdates?: SessionUpdate[],            // Task 7 (adoption.ts): sent as session/update
 //                                                // notifications during session/load, before it
 //                                                // returns — this is the replay mechanism ACP v1
@@ -172,6 +219,9 @@
 //                                                // the shape credentials expiring mid-conversation
 //                                                // actually takes, and the only failure the login
 //                                                // card may be drawn for
+//     exitOnPrompt?: boolean,                  // simulate transport loss after accepting a prompt
+//     promptRpcError?: { code: number, message: string }, // explicit remote JSON-RPC failure
+//     promptCallsSink?: string,                 // append-only request log for no-replay assertions
 //     promptSink?: string,                       // if set, a file this process overwrites with the raw
 //                                                // JSON session/prompt params on every prompt — the
 //                                                // only way to observe WHICH sessionId a prompt was
@@ -179,12 +229,18 @@
 //                                                // to a loaded session rather than opening a new one
 //     loadSessionResponse?: LoadSessionResponse, // session/load's response; default {}
 //     loadSessionSink?: string,                 // if set, a file this process writes (the raw JSON
-//                                                // session/load params) the moment it receives that
-//                                                // request — lets a test prove the right
-//                                                // sessionId/cwd were sent, and (by NOT configuring
-//                                                // this and asserting the file never appears) that
-//                                                // adoption.ts never calls session/load when the
-//                                                // capability isn't advertised
+//                                                // session/load params, including `_meta`) the
+//                                                // moment it receives that request — lets a test
+//                                                // prove the right sessionId/cwd/`_meta` were sent,
+//                                                // and (by NOT configuring this and asserting the
+//                                                // file never appears) that adoption.ts never calls
+//                                                // session/load when the capability isn't advertised
+//     loadExtNotifications?: { method: string, params: unknown }[], // Task 9's equivalent of
+//                                                // `extNotifications` above, but pushed after
+//                                                // session/load answers instead of session/new — the
+//                                                // shape claude-agent-acp's activity push actually
+//                                                // takes on the adoption/reconnect path, where no
+//                                                // session/new is ever sent
 //     resumeSessionResponse?: ResumeSessionResponse, // session/resume's response; default {}
 //     resumeSessionSink?: string,                // same idea as loadSessionSink, for session/resume
 //                                                // — Task 7's proof that adoption.ts NEVER calls
@@ -206,6 +262,16 @@
 //                                                // `promptRequired`, so seeing it back means the
 //                                                // agent ignored the opt-in we always send
 //     steerRejectsWith?: string,                 // if set, the handler throws with this message
+//     asyncTaskStopSink?: string,                // if set, a file this process writes (the raw JSON
+//                                                // `_session/async_task/stop` params) the moment it
+//                                                // receives that request. Also an EXTENSION, not ACP
+//                                                // (`claude-agent-acp` `acp-agent.js@0.79.0:165`),
+//                                                // routed by its literal method name for the same
+//                                                // reason `_session/steering` is
+//     asyncTaskStopStopped?: boolean,            // what `{ stopped }` the handler answers with;
+//                                                // default true. `false` is what the adapter answers
+//                                                // for an id it has no live task under
+//                                                // (`acp-agent.js@0.79.0:1788`)
 //     newSessionConfigOptions?: SessionConfigOption[], // returned verbatim on session/new (types.gen.d.ts:2546)
 //     newSessionModes?: SessionModeState,              // returned verbatim on session/new (:2542)
 //     setConfigOptionSink?: string,                    // file receiving the JSON params of each session/set_config_option
@@ -225,7 +291,7 @@
 // fixture that can prove "honour the advertised capability, not the router" end to end, not just
 // assert a boolean.
 async function main() {
-    const { writeFileSync } = require('node:fs');
+    const { writeFileSync, appendFileSync, existsSync } = require('node:fs');
     // Parsed and wired up before the (slow, cold-start) dynamic import below, so a caller that kills
     // this process almost immediately after spawning it (exercising connectAgent's initialize
     // timeout with a short deadline) still gets a SIGTERM handler in place. Registering this only
@@ -307,16 +373,56 @@ async function main() {
         return {};
     })
         .onRequest(methods.agent.session.new, async (ctx) => {
+        if (config.echoMcpAuthorizationToStderr) {
+            const authorization = ctx.params.mcpServers.find((server) => server.name === 'axom-delegation')?.headers?.[0]?.value;
+            process.stderr.write('adapter diagnostic: started\n');
+            process.stderr.write(`configured Authorization: ${authorization?.slice(0, 9) ?? ''}`);
+            await new Promise((resolve) => setTimeout(resolve, 20));
+            process.stderr.write(`${authorization?.slice(9) ?? ''}\n`);
+            process.stderr.write(`configured token: ${authorization?.slice(7) ?? ''}\n`);
+            process.stderr.write(`Open https://auth.example.test/device?token=${authorization?.slice(7) ?? ''} to continue\n`);
+            process.stderr.write('adapter diagnostic: finished\n');
+        }
         if (config.newSessionRejectsWith)
             throw new Error(config.newSessionRejectsWith);
         // Checked after the rejection so the two flags stay independently exercisable; a promise that
         // never settles is the only faithful way to model an agent that simply stops answering.
         if (config.hangOnSessionNew)
             return new Promise(() => { });
+        if (config.newSessionDelayMs)
+            await new Promise((resolve) => setTimeout(resolve, config.newSessionDelayMs));
+        if (config.newSessionSink)
+            writeFileSync(config.newSessionSink, JSON.stringify(ctx.params));
+        for (const { method, params } of config.beforeSessionReplyNotifications ?? []) {
+            await ctx.client.notify(method, params);
+        }
         // Pushed AFTER this handler returns, not before: the real adapter schedules its first
         // `available_commands_update` on a `setTimeout(…, 0)` that runs once `session/new` has been
         // answered (`acp-agent.js:752-757`). Sending them inline would let a client that only reads
         // updates *before* the reply still pass, which is the bug this fixture exists to catch.
+        if (config.rejectLaterSessionNew) {
+            if (existsSync(config.rejectLaterSessionNew))
+                throw new Error('second session refused');
+            writeFileSync(config.rejectLaterSessionNew, 'seen');
+        }
+        if (config.commandsBeforeLaterSessionReply) {
+            const { commands, markerPath } = config.commandsBeforeLaterSessionReply;
+            if (existsSync(markerPath)) {
+                await ctx.client.notify(methods.client.session.update, {
+                    sessionId,
+                    update: { sessionUpdate: 'available_commands_update', availableCommands: commands },
+                });
+            }
+            else {
+                writeFileSync(markerPath, 'seen');
+            }
+        }
+        if (config.commandsBeforeNewSessionReply) {
+            await ctx.client.notify(methods.client.session.update, {
+                sessionId,
+                update: { sessionUpdate: 'available_commands_update', availableCommands: config.commandsBeforeNewSessionReply },
+            });
+        }
         const pushes = config.newSessionCommands ?? [];
         if (pushes.length > 0) {
             void (async () => {
@@ -329,6 +435,18 @@ async function main() {
                 }
             })();
         }
+        // Same "after the reply, not before" reasoning as `newSessionCommands` above — Task 5
+        // (agent-reported activity) uses this to model claude-agent-acp's
+        // `extNotification("_claude/sdkMessage", …)`, which only ever arrives once a session exists.
+        const extNotifications = config.extNotifications ?? [];
+        if (extNotifications.length > 0) {
+            void (async () => {
+                for (const { method, params } of extNotifications) {
+                    await new Promise((r) => setTimeout(r, config.extNotificationDelayMs ?? 0));
+                    await ctx.client.notify(method, params);
+                }
+            })();
+        }
         return {
             sessionId,
             ...(config.newSessionConfigOptions ? { configOptions: config.newSessionConfigOptions } : {}),
@@ -339,20 +457,49 @@ async function main() {
         if (config.sessionListSink)
             writeFileSync(config.sessionListSink, JSON.stringify(ctx.params));
         return { sessions: config.sessions ?? [], ...(config.nextCursor ? { nextCursor: config.nextCursor } : {}) };
+    })
+        .onRequest(methods.agent.session.delete, (ctx) => {
+        if (config.deleteSessionSink)
+            appendFileSync(config.deleteSessionSink, JSON.stringify(ctx.params) + '\n');
+        if (config.deleteSessionFailures?.includes(ctx.params.sessionId))
+            throw RequestError.internalError(undefined, 'boom');
+        return {};
     })
         .onRequest(methods.agent.session.load, async (ctx) => {
         if (config.loadSessionSink)
             writeFileSync(config.loadSessionSink, JSON.stringify(ctx.params));
         if (config.loadSessionRejectsWith)
             throw new Error(config.loadSessionRejectsWith);
+        if (config.hangOnSessionLoad)
+            return new Promise(() => { });
+        for (const { method, params } of config.beforeSessionReplyNotifications ?? []) {
+            await ctx.client.notify(method, params);
+        }
+        for (const notification of config.scopedLoadUpdates ?? []) {
+            await ctx.client.notify(methods.client.session.update, notification);
+        }
         for (const update of config.loadUpdates ?? []) {
             await ctx.client.notify(methods.client.session.update, { sessionId: ctx.params.sessionId, update });
         }
+        // Same "after the reply, not before" reasoning as `extNotifications` on session/new above —
+        // Task 9 uses this to model claude-agent-acp's `extNotification("_claude/sdkMessage", …)`
+        // arriving on the session/load (adoption/reconnect) path, where no session/new is ever sent.
+        const loadExtNotifications = config.loadExtNotifications ?? [];
+        if (loadExtNotifications.length > 0) {
+            void (async () => {
+                for (const { method, params } of loadExtNotifications) {
+                    await new Promise((r) => setTimeout(r, config.extNotificationDelayMs ?? 0));
+                    await ctx.client.notify(method, params);
+                }
+            })();
+        }
         return config.loadSessionResponse ?? {};
     })
         .onRequest(methods.agent.session.resume, async (ctx) => {
         if (config.resumeSessionSink)
             writeFileSync(config.resumeSessionSink, JSON.stringify(ctx.params));
+        if (config.resumeSessionRejectsWith)
+            throw new Error(config.resumeSessionRejectsWith);
         return config.resumeSessionResponse ?? {};
     })
         .onRequest(methods.agent.session.setConfigOption, (ctx) => {
@@ -384,10 +531,21 @@ async function main() {
             throw new Error(config.steerRejectsWith);
         const outcome = config.steerOutcome ?? 'injected';
         return outcome === 'promptRequired' ? { outcome, reason: 'noRunningTurn' } : { outcome };
+    })
+        .onRequest('_session/async_task/stop', (params) => params, (ctx) => {
+        if (config.asyncTaskStopSink)
+            writeFileSync(config.asyncTaskStopSink, JSON.stringify(ctx.params));
+        return { stopped: config.asyncTaskStopStopped ?? true };
     })
         .onRequest(methods.agent.session.prompt, async (ctx) => {
+        if (config.promptCallsSink)
+            appendFileSync(config.promptCallsSink, JSON.stringify(ctx.params) + '\n');
         if (config.promptSink)
             writeFileSync(config.promptSink, JSON.stringify(ctx.params));
+        if (config.exitOnPrompt)
+            process.exit(1);
+        if (config.promptRpcError)
+            throw new RequestError(config.promptRpcError.code, config.promptRpcError.message);
         // A plain Error is masked by the SDK as JSON-RPC -32603; `RequestError.authRequired()` is
         // the real thing an agent whose credentials expired answers with (-32000). The two shapes are
         // what the login card has to tell apart, and only a real agent process on a real wire proves
@@ -396,6 +554,11 @@ async function main() {
             throw RequestError.authRequired();
         if (config.promptRejectsWith)
             throw new Error(config.promptRejectsWith);
+        if (config.foregroundWriteSink && ctx.params.prompt.some(block => block.type === 'text' && block.text === 'partial-write')) {
+            appendFileSync(config.foregroundWriteSink, 'partial\n');
+            await cancelled;
+            return { stopReason: 'cancelled' };
+        }
         for (const update of updates) {
             await ctx.client.notify(methods.client.session.update, { sessionId: ctx.params.sessionId, update });
         }
@@ -405,7 +568,7 @@ async function main() {
         // OS process speaking real ACP, not just callable in-process.
         if (config.requestPermissionDuringPrompt) {
             const result = await ctx.client.request(methods.client.session.requestPermission, {
-                sessionId: ctx.params.sessionId,
+                sessionId: config.requestPermissionDuringPrompt.sessionId ?? ctx.params.sessionId,
                 toolCall: config.requestPermissionDuringPrompt.toolCall,
                 options: config.requestPermissionDuringPrompt.options,
             });
@@ -416,6 +579,19 @@ async function main() {
             const result = await ctx.client.request(methods.client.elicitation.create, config.createElicitationDuringPrompt);
             writeFileSync(config.createElicitationResultSink, JSON.stringify(result));
         }
+        // The plural form. `await` inside the loop is load-bearing, not incidental: the whole point is
+        // that card N is answered before card N+1 is raised. The sink is rewritten on every iteration
+        // so the answer to card N is readable while card N+1 is still open.
+        if (Array.isArray(config.createElicitationsDuringPrompt)) {
+            const results = [];
+            for (const payload of config.createElicitationsDuringPrompt) {
+                const result = await ctx.client.request(methods.client.elicitation.create, payload);
+                results.push(result);
+                if (config.createElicitationResultsSink) {
+                    writeFileSync(config.createElicitationResultsSink, JSON.stringify(results));
+                }
+            }
+        }
         if (config.hangUntilCancel) {
             await cancelled;
             return { stopReason: config.stopReasonAfterCancel ?? 'end_turn' };

package/dist/workstation/acp/validate.js

@@ -18,10 +18,13 @@
  * question. Its two wire names behave differently here, and the difference is the suffix, not the
  * family:
  *
- * - `elicitation_request` (`TimelineEvent.InteractionRequested`) is request-shaped and absent from
- *   the set, so a bridge emitting it is rejected. That stays true after Plan B minted the name:
- *   the platform now *has* the vocabulary but still has no bridge decode branch for it, so it still
- *   cannot answer one. Adding it here would exempt it into a generic item — a card with no button.
+ * - `elicitation_request` (`TimelineEvent.ElicitationRequested`) is request-shaped and, since the
+ *   platform grew a named decode branch for it (`TimelineEventWire.decodeElicitationRequested`,
+ *   landing a `WorkItemKind.USER_INTERACTION` item that parks the run), is now a member of this
+ *   set: a bridge emitting it is answerable, not rejected. The reply that unblocks the agent's
+ *   `elicitation/create` travels back on its own frame — `AgentFrame.AgentElicitationAnswer` — not
+ *   through `permission_request`'s `agent_answer`, because ACP's `CreateElicitationResponse.content`
+ *   is a structured object `agent_answer`'s single-string `outcome` cannot carry.
  * - `elicitation` (`TimelineEvent.UserInteractionRequested`) carries no request suffix, so this gate
  *   never looks at it and a bridge emitting it passes through. That is now correct rather than
  *   merely harmless: `TimelineEventWire.decode` has a named `elicitation` branch that rebuilds the
@@ -32,7 +35,7 @@
  *   run never parks on. Well-formedness is defined in exactly one place, that decoder; this gate
  *   deliberately does not carry a second copy of the shape rules to drift from it.
  */
-export const KNOWN_REQUEST_EVENT_NAMES = new Set(['permission_request']);
+export const KNOWN_REQUEST_EVENT_NAMES = new Set(['permission_request', 'elicitation_request']);
 /**
  * Does this name carry the "answer me exactly once" promise?
  *
@@ -130,5 +133,30 @@ function inspect(event) {
             }
         }
     }
+    // `elicitation_request`'s counterpart to the `permission_request` checks above — added by Task 18,
+    // which is also this event's first real producer (`permission.ts`'s `handleFormElicitation`).
+    // `validate.test.ts` used to pin the opposite — `{requestId: 'r1'}` alone passing — on the explicit
+    // reasoning that a shape rule with no producer to catch would only be guarding against a caller
+    // that did not exist; that premise no longer holds, so the rule now exists too. `mode`/`message` are
+    // the two fields `elicitationRequestFromPayload` (`ElicitationRequest.kt`) requires no matter which
+    // mode arrives — a payload missing either is dropped silently server-side (`runCatching { ... }
+    // .getOrNull()`), the same "advisory here, silent there" gap the `permission_request` checks above
+    // exist to close.
+    if (event.eventName === 'elicitation_request') {
+        if (!nonEmptyString(payload.requestId)) {
+            return { reason: 'invalid elicitation_request', detail: 'requestId must be a non-empty string' };
+        }
+        const request = payload.request;
+        if (request === null || typeof request !== 'object' || Array.isArray(request)) {
+            return { reason: 'invalid elicitation_request', detail: 'request must be an object' };
+        }
+        const requestPayload = request;
+        if (!nonEmptyString(requestPayload.mode)) {
+            return { reason: 'invalid elicitation_request', detail: 'request.mode must be a non-empty string' };
+        }
+        if (!nonEmptyString(requestPayload.message)) {
+            return { reason: 'invalid elicitation_request', detail: 'request.message must be a non-empty string' };
+        }
+    }
     return null;
 }