@wrongstack/acp 1.0.8 → 1.0.10

package/dist/agent/protocol-contract.d.ts

@@ -117,6 +117,15 @@ export interface RunTurnApi {
         output: string;
         exitCode: number | null;
     }>;
+    /**
+     * Send a `session/update` notification OUTSIDE a prompt turn (e.g. "a
+     * background delegation finished; send any message to continue"). ACP only
+     * starts turns on `session/prompt`, so this is the agent's one way to tell
+     * an idle client something happened. Resolves `false` and sends nothing once
+     * the session was closed or deleted. Optional: embedders that build their
+     * own `RunTurnApi` may omit it.
+     */
+    sendSessionUpdate?(update: unknown): Promise<boolean>;
 }
 /**
  * The agent's per-turn work. Streams `SessionUpdate` notifications to

package/dist/agent/protocol-session-ops.d.ts

@@ -20,7 +20,7 @@ export declare function errorToJsonRpc(err: unknown): {
     message: string;
     data?: unknown;
 };
-export declare function createRunTurnApi(sessionId: string, clientCapabilities: ClientCapabilities, request: (method: string, params: unknown) => Promise<unknown>): RunTurnApi;
+export declare function createRunTurnApi(sessionId: string, clientCapabilities: ClientCapabilities, request: (method: string, params: unknown) => Promise<unknown>, sendSessionUpdate?: (update: unknown) => Promise<boolean>): RunTurnApi;
 export declare function buildInitializeResult(agentName: string, modes: readonly SessionMode[], configOptions: readonly SessionConfigOption[]): {
     protocolVersion: 1;
     agentCapabilities: {

package/dist/agent/server-agent-turn.d.ts

@@ -37,6 +37,16 @@
  * `agent.run({signal})` and the underlying provider call observes
  * it. On abort, the adapter maps the resulting `AbortError` to
  * `{stopReason: 'cancelled'}`.
+ *
+ * Background delegations: a background `delegate` result is queued for the
+ * session's leader and injected by the core agent loop at its next iteration
+ * boundary — on ACP that is the next `session/prompt`, because ACP never
+ * starts a turn on its own. So the client is not left guessing, the adapter
+ * listens for `leader.delivery_pending` on the session agent's event bus and,
+ * while no turn is running, sends one coalesced unprompted `session/update`
+ * ("Background delegation <id> finished; send any message to continue.")
+ * through `RunTurnApi.sendSessionUpdate`. Nothing is sent after the session is
+ * disposed, and a notice failure never reaches the event bus.
  */
 import type { Agent, AgentInput } from '@wrongstack/core/agent';
 import type { ContentBlock, McpServer, PlanEntry, StopReason, ToolKind, UsageCost } from '../types/acp-v1.js';
@@ -69,6 +79,19 @@ export interface ACPServerAgentTurnOptions {
     maxHistoryEntries?: number | undefined;
     /** Maximum serialized replay bytes retained per session. Default 8 MiB. */
     maxHistoryBytes?: number | undefined;
+    /**
+     * Coalescing window for the unprompted "background delegation finished"
+     * notice. Deliveries announced within it share one notice. Default 1500 ms.
+     */
+    deliveryNoticeDebounceMs?: number | undefined;
+    /**
+     * Live count of results still queued for the session's leader (the host
+     * wires the core leader-delivery hub here). When provided, a notice is sent
+     * only while something is actually still pending — so a result the agent
+     * loop already drained mid-turn is never announced. When omitted, results
+     * announced during a running turn are assumed drained by that turn.
+     */
+    pendingDeliveries?: ((sessionId: string) => number) | undefined;
 }
 /** A recorded conversation turn, replayable on `session/load`. */
 interface SessionReplayUpdate {
@@ -109,6 +132,14 @@ export interface ACPServerAgentTurn {
  */
 export declare function makeACPServerAgentTurn(opts: ACPServerAgentTurnOptions): ACPServerAgentTurn;
 declare function finitePositiveLimit(value: number | undefined, fallback: number): number;
+declare function finiteNonNegativeLimit(value: number | undefined, fallback: number): number;
+/**
+ * True when an event's session id belongs to this ACP session: the ACP id
+ * itself, or the id the agent's context is bound to.
+ */
+declare function agentOwnsSession(agent: Agent, acpSessionId: string, eventSessionId: unknown): boolean;
+/** The client-facing notice for one or more finished background delegations. */
+declare function deliveryNoticeText(deliveryIds: readonly string[]): string;
 declare function trimHistory(entries: SessionReplayUpdate[], retainedBytes: number, maxEntries: number, maxBytes: number): number;
 declare function replayEntryBytes(entry: SessionReplayUpdate): number;
 /**
@@ -184,6 +215,9 @@ declare function extractUsage(result: unknown): {
 /** Internal deterministic seams used by the per-file coverage suite. */
 export declare const serverAgentTurnCoverage: {
     finitePositiveLimit: typeof finitePositiveLimit;
+    finiteNonNegativeLimit: typeof finiteNonNegativeLimit;
+    agentOwnsSession: typeof agentOwnsSession;
+    deliveryNoticeText: typeof deliveryNoticeText;
     trimHistory: typeof trimHistory;
     replayEntryBytes: typeof replayEntryBytes;
     seedAgentContext: typeof seedAgentContext;

package/dist/agent.js

@@ -129,7 +129,7 @@ function errorToJsonRpc(err) {
   const message = err instanceof Error ? err.message : String(err);
   return { code: -32603, message };
 }
-function createRunTurnApi(sessionId, clientCapabilities, request) {
+function createRunTurnApi(sessionId, clientCapabilities, request, sendSessionUpdate) {
   return {
     clientCapabilities,
     requestPermission: async (req) => {
@@ -173,7 +173,8 @@ function createRunTurnApi(sessionId, clientCapabilities, request) {
         } catch {
         }
       }
-    }
+    },
+    ...sendSessionUpdate ? { sendSessionUpdate } : {}
   };
 }
 function buildInitializeResult(agentName, modes, configOptions) {
@@ -435,7 +436,12 @@ async function handleSessionPromptOp(ctx, id, params) {
   const api = createRunTurnApi(
     sessionId,
     ctx.clientCapabilities ?? {},
-    (method, req) => ctx.request(method, req)
+    (method, req) => ctx.request(method, req),
+    async (update) => {
+      if (ctx.sessions.get(sessionId) !== session) return false;
+      await ctx.sendNotification({ sessionId, update });
+      return true;
+    }
   );
   let result;
   const pendingNotifications = [];
@@ -880,6 +886,76 @@ function makeACPServerAgentTurn(opts) {
   const timeoutMs = opts.timeoutMs ?? 5 * 6e4;
   const maxHistoryEntries = finitePositiveLimit(opts.maxHistoryEntries, 1e3);
   const maxHistoryBytes = finitePositiveLimit(opts.maxHistoryBytes, 8 * 1024 * 1024);
+  const deliveryNoticeDebounceMs = finiteNonNegativeLimit(opts.deliveryNoticeDebounceMs, 1500);
+  const notifiers = /* @__PURE__ */ new Map();
+  const stillPending = (sessionId) => {
+    if (!opts.pendingDeliveries) return true;
+    try {
+      return opts.pendingDeliveries(sessionId) > 0;
+    } catch {
+      return false;
+    }
+  };
+  const flushDeliveryNotice = async (sessionId, state) => {
+    if (notifiers.get(sessionId) !== state || state.running || state.pending.size === 0) return;
+    const api = state.api;
+    if (!api?.sendSessionUpdate) return;
+    const ids = [...state.pending];
+    state.pending.clear();
+    if (!stillPending(sessionId)) return;
+    try {
+      await api.sendSessionUpdate({
+        sessionUpdate: "agent_message_chunk",
+        content: { type: "text", text: deliveryNoticeText(ids) }
+      });
+    } catch {
+    }
+  };
+  const scheduleDeliveryNotice = (sessionId) => {
+    const state = notifiers.get(sessionId);
+    if (!state || state.running || state.pending.size === 0 || state.timer) return;
+    state.timer = setTimeout(() => {
+      state.timer = void 0;
+      void flushDeliveryNotice(sessionId, state);
+    }, deliveryNoticeDebounceMs);
+    state.timer.unref?.();
+  };
+  const attachDeliveryNotifier = (sessionId, agent) => {
+    const existing = notifiers.get(sessionId);
+    if (existing) return existing;
+    const bus = agent.events;
+    if (!bus?.on) return void 0;
+    const state = {
+      api: void 0,
+      pending: /* @__PURE__ */ new Set(),
+      running: false,
+      timer: void 0,
+      unsubscribe: []
+    };
+    notifiers.set(sessionId, state);
+    const owns = (eventSessionId) => agentOwnsSession(agent, sessionId, eventSessionId);
+    state.unsubscribe.push(
+      bus.on("leader.delivery_pending", (e) => {
+        try {
+          if (notifiers.get(sessionId) !== state || !owns(e?.sessionId)) return;
+          for (const id of Array.isArray(e.deliveryIds) ? e.deliveryIds : []) {
+            if (typeof id === "string" && id.length > 0) state.pending.add(id);
+          }
+          scheduleDeliveryNotice(sessionId);
+        } catch {
+        }
+      }),
+      bus.on("delegation.delivered", (e) => {
+        try {
+          if (!owns(e?.sessionId) || typeof e.delegationId !== "string") return;
+          state.pending.delete(e.delegationId);
+          state.pending.delete(`${DELEGATION_DELIVERY_PREFIX}${e.delegationId}`);
+        } catch {
+        }
+      })
+    );
+    return state;
+  };
   const turn = async (input, emit, api) => {
     let agent = agents.get(input.sessionId);
     if (!agent) {
@@ -895,6 +971,16 @@ function makeACPServerAgentTurn(opts) {
         seedAgentContext(agent, history.get(input.sessionId));
       }
     }
+    const notifier = attachDeliveryNotifier(input.sessionId, agent);
+    if (notifier) {
+      if (api) notifier.api = api;
+      notifier.running = true;
+      notifier.pending.clear();
+      if (notifier.timer) {
+        clearTimeout(notifier.timer);
+        notifier.timer = void 0;
+      }
+    }
     const turnAbort = new AbortController();
     const abortForTimeout = () => turnAbort.abort();
     const onParentAbort = () => turnAbort.abort();
@@ -1007,6 +1093,11 @@ function makeACPServerAgentTurn(opts) {
       timeouts.delete(input.sessionId);
       input.signal.removeEventListener("abort", onParentAbort);
       for (const u of unsub) u();
+      if (notifier && notifiers.get(input.sessionId) === notifier) {
+        notifier.running = false;
+        if (!opts.pendingDeliveries) notifier.pending.clear();
+        scheduleDeliveryNotice(input.sessionId);
+      }
     }
   };
   const replay = (sessionId) => [...history.get(sessionId) ?? []];
@@ -1027,6 +1118,19 @@ function makeACPServerAgentTurn(opts) {
     const timer = timeouts.get(sessionId);
     if (timer) clearTimeout(timer);
     timeouts.delete(sessionId);
+    const notifier = notifiers.get(sessionId);
+    if (notifier) {
+      notifiers.delete(sessionId);
+      if (notifier.timer) clearTimeout(notifier.timer);
+      notifier.timer = void 0;
+      notifier.pending.clear();
+      for (const off of notifier.unsubscribe) {
+        try {
+          off();
+        } catch {
+        }
+      }
+    }
     agents.delete(sessionId);
     history.delete(sessionId);
     historyBytes.delete(sessionId);
@@ -1037,6 +1141,34 @@ function makeACPServerAgentTurn(opts) {
 function finitePositiveLimit(value, fallback) {
   return Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
 }
+function finiteNonNegativeLimit(value, fallback) {
+  return Number.isFinite(value) && value >= 0 ? Math.floor(value) : fallback;
+}
+var DELEGATION_DELIVERY_PREFIX = "delegation:";
+var NOTICE_MAX_IDS = 5;
+function normalizeSessionKey(id) {
+  return id.trim().replace(/\\/g, "/");
+}
+function agentOwnsSession(agent, acpSessionId, eventSessionId) {
+  if (typeof eventSessionId !== "string" || eventSessionId.trim().length === 0) return false;
+  const target = normalizeSessionKey(eventSessionId);
+  const ctx = agent.ctx;
+  const candidates = [acpSessionId, ctx?.session?.id, ctx?.meta?.["sessionId"]];
+  return candidates.some(
+    (c) => typeof c === "string" && c.length > 0 && normalizeSessionKey(c) === target
+  );
+}
+function deliveryNoticeText(deliveryIds) {
+  const ids = deliveryIds.map(
+    (id) => id.startsWith(DELEGATION_DELIVERY_PREFIX) ? id.slice(DELEGATION_DELIVERY_PREFIX.length) : id
+  );
+  if (ids.length === 1) {
+    return `Background delegation ${ids[0]} finished; send any message to continue.`;
+  }
+  const shown = ids.slice(0, NOTICE_MAX_IDS).join(", ");
+  const more = ids.length > NOTICE_MAX_IDS ? ` (+${ids.length - NOTICE_MAX_IDS} more)` : "";
+  return `Background delegations ${shown}${more} finished; send any message to continue.`;
+}
 function trimHistory(entries, retainedBytes, maxEntries, maxBytes) {
   while (entries.length > maxEntries || retainedBytes > maxBytes) {
     const removed = entries.shift();
@@ -1172,7 +1304,7 @@ function extractUsage(result) {
   const r = result;
   if (typeof r.usage === "object" && r.usage !== null) {
     const u = r.usage;
-    if (typeof u.used === "number" && typeof u.size === "number") {
+    if (typeof u.used === "number" && Number.isFinite(u.used) && typeof u.size === "number" && Number.isFinite(u.size)) {
       return {
         used: u.used,
         size: u.size,

package/dist/client/acp-session.d.ts

@@ -103,6 +103,16 @@ export declare class ACPSession {
     setProvider(providerId: string, config?: Record<string, unknown>): Promise<void>;
     disableProvider(): Promise<void>;
     prompt(blocks: ContentBlock[], signal: AbortSignal, onProgress?: ACPProgressHandler): Promise<ACPSessionRunResult>;
+    /**
+     * Best-effort cancel for a session the server confirmed after we already
+     * stopped waiting (the abort-during-creation race). `session/cancel` is a
+     * JSON-RPC notification — the server sends no response, so this is a bare
+     * transport send bounded by a timer rather than sendRequest, whose
+     * pending-tracking would just expire waiting for a reply that never
+     * comes. A failure or timeout is surfaced on the warn channel instead of
+     * being silently swallowed.
+     */
+    private cancelLateSession;
     private closeSession;
     close(): Promise<void>;
     private allocId;

package/dist/client.js

@@ -1641,6 +1641,7 @@ function finitePositiveLimit(value, fallback) {
 }
 
 // src/client/acp-session.ts
+var LATE_CANCEL_SEND_TIMEOUT_MS = 1e4;
 var ACPSession = class _ACPSession {
   transport;
   fileServer;
@@ -1941,8 +1942,62 @@ var ACPSession = class _ACPSession {
     if (signal.aborted) {
       return emptyRunResult("cancelled");
     }
+    let cancelled = false;
+    this.promptCallbackAbort = new AbortController();
+    const onAbort = () => {
+      cancelled = true;
+      this.promptCallbackAbort?.abort();
+      if (this.sessionId) {
+        this.transport.send({
+          jsonrpc: "2.0",
+          method: "session/cancel",
+          params: { sessionId: this.sessionId }
+        }).catch(() => {
+        });
+      }
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    let rejectCreate;
+    const onCreateAbort = () => {
+      signal.removeEventListener("abort", onAbort);
+      rejectCreate?.(new ACPSessionError("aborted", "prompt was aborted by the parent"));
+    };
     if (!this.sessionId) {
-      this.sessionId = await this.createSessionWithAuth();
+      let sessionId;
+      const createPromise = this.createSessionWithAuth();
+      try {
+        sessionId = await Promise.race([
+          createPromise,
+          new Promise((_, reject) => {
+            rejectCreate = reject;
+            if (signal.aborted) {
+              reject(new ACPSessionError("aborted", "prompt was aborted by the parent"));
+              return;
+            }
+            signal.addEventListener("abort", onCreateAbort, { once: true });
+          })
+        ]);
+      } catch (err) {
+        signal.removeEventListener("abort", onAbort);
+        signal.removeEventListener("abort", onCreateAbort);
+        rejectCreate = void 0;
+        this.promptCallbackAbort?.abort();
+        this.promptCallbackAbort = null;
+        if (err instanceof ACPSessionError && err.kind === "aborted") {
+          this.cancelLateSession(createPromise);
+          return emptyRunResult("cancelled");
+        }
+        throw err;
+      }
+      signal.removeEventListener("abort", onCreateAbort);
+      rejectCreate = void 0;
+      if (typeof sessionId !== "string" || sessionId.length === 0) {
+        signal.removeEventListener("abort", onAbort);
+        this.promptCallbackAbort?.abort();
+        this.promptCallbackAbort = null;
+        throw new ACPSessionError("protocol_error", "session/new returned no session id");
+      }
+      this.sessionId = sessionId;
     }
     if (signal.aborted) {
       return emptyRunResult("cancelled");
@@ -1950,42 +2005,46 @@ var ACPSession = class _ACPSession {
     this.resetScratch();
     this.progressHandler = onProgress ?? null;
     const promptId = this.allocId();
-    const turnPromise = this.sendRequest(
-      promptId,
-      "session/prompt",
-      {
-        sessionId: this.sessionId,
-        prompt: blocks
-      },
-      this.timeoutMs
-    );
-    let cancelled = false;
-    this.promptCallbackAbort = new AbortController();
-    const onAbort = () => {
-      cancelled = true;
-      this.promptCallbackAbort?.abort();
-      this.transport.send({
-        jsonrpc: "2.0",
-        method: "session/cancel",
-        params: { sessionId: this.sessionId }
-      }).catch(() => {
-      });
+    let rejectTurn;
+    const onTurnAbort = () => {
+      rejectTurn?.(new ACPSessionError("aborted", "prompt was aborted by the parent"));
     };
-    signal.addEventListener("abort", onAbort, { once: true });
+    signal.addEventListener("abort", onTurnAbort, { once: true });
+    const turnPromise = Promise.race([
+      this.sendRequest(
+        promptId,
+        "session/prompt",
+        {
+          sessionId: this.sessionId,
+          prompt: blocks
+        },
+        this.timeoutMs
+      ),
+      new Promise((_, reject) => {
+        rejectTurn = reject;
+      })
+    ]);
     this.state = "prompting";
     let response;
     try {
       response = await turnPromise;
     } catch (err) {
       this.state = "done";
-      signal.removeEventListener("abort", onAbort);
-      if (cancelled || signal.aborted) {
-        throw new ACPSessionError("aborted", "prompt was aborted by the parent");
+      const abortedKind = err instanceof ACPSessionError && err.kind === "aborted";
+      if (cancelled || abortedKind) {
+        return emptyRunResult("cancelled");
       }
       const msg = err instanceof Error ? err.message : String(err);
+      if (signal.aborted) {
+        throw new ACPSessionError("aborted", "prompt was aborted by the parent", err);
+      }
       throw new ACPSessionError("prompt_failed", `session/prompt failed: ${msg}`, err);
     } finally {
       signal.removeEventListener("abort", onAbort);
+      signal.removeEventListener("abort", onTurnAbort);
+      signal.removeEventListener("abort", onCreateAbort);
+      rejectTurn = void 0;
+      rejectCreate = void 0;
       this.promptCallbackAbort?.abort();
       this.promptCallbackAbort = null;
       this.progressHandler = null;
@@ -2007,6 +2066,61 @@ var ACPSession = class _ACPSession {
       thoughts: this.scratch.thoughts
     };
   }
+  /**
+   * Best-effort cancel for a session the server confirmed after we already
+   * stopped waiting (the abort-during-creation race). `session/cancel` is a
+   * JSON-RPC notification — the server sends no response, so this is a bare
+   * transport send bounded by a timer rather than sendRequest, whose
+   * pending-tracking would just expire waiting for a reply that never
+   * comes. A failure or timeout is surfaced on the warn channel instead of
+   * being silently swallowed.
+   */
+  cancelLateSession(createPromise) {
+    createPromise.then(async (lateId) => {
+      try {
+        await new Promise((resolve3, reject) => {
+          const timer = setTimeout(() => {
+            reject(new Error("late session/cancel send timed out"));
+          }, LATE_CANCEL_SEND_TIMEOUT_MS);
+          Promise.resolve(
+            this.transport.send({
+              jsonrpc: "2.0",
+              method: "session/cancel",
+              params: { sessionId: lateId }
+            })
+          ).then(
+            () => {
+              clearTimeout(timer);
+              resolve3();
+            },
+            (sendErr) => {
+              clearTimeout(timer);
+              reject(sendErr instanceof Error ? sendErr : new Error(String(sendErr)));
+            }
+          );
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.warn(
+          JSON.stringify({
+            level: "warn",
+            event: "acp_session.late_cancel_failed",
+            sessionId: lateId,
+            message
+          })
+        );
+      }
+    }).catch((reason) => {
+      const message = reason instanceof Error ? reason.message : String(reason);
+      console.warn(
+        JSON.stringify({
+          level: "warn",
+          event: "acp_session.late_cancel_failed",
+          reason: message
+        })
+      );
+    });
+  }
   async closeSession() {
     if (!this.sessionId) return;
     const sid = this.sessionId;

package/dist/index.js

@@ -132,7 +132,7 @@ function errorToJsonRpc(err) {
   const message = err instanceof Error ? err.message : String(err);
   return { code: -32603, message };
 }
-function createRunTurnApi(sessionId, clientCapabilities, request) {
+function createRunTurnApi(sessionId, clientCapabilities, request, sendSessionUpdate) {
   return {
     clientCapabilities,
     requestPermission: async (req) => {
@@ -176,7 +176,8 @@ function createRunTurnApi(sessionId, clientCapabilities, request) {
         } catch {
         }
       }
-    }
+    },
+    ...sendSessionUpdate ? { sendSessionUpdate } : {}
   };
 }
 function buildInitializeResult(agentName, modes, configOptions) {
@@ -438,7 +439,12 @@ async function handleSessionPromptOp(ctx, id, params) {
   const api = createRunTurnApi(
     sessionId,
     ctx.clientCapabilities ?? {},
-    (method, req) => ctx.request(method, req)
+    (method, req) => ctx.request(method, req),
+    async (update) => {
+      if (ctx.sessions.get(sessionId) !== session) return false;
+      await ctx.sendNotification({ sessionId, update });
+      return true;
+    }
   );
   let result;
   const pendingNotifications = [];
@@ -3044,6 +3050,7 @@ function finitePositiveLimit(value, fallback) {
 }
 
 // src/client/acp-session.ts
+var LATE_CANCEL_SEND_TIMEOUT_MS = 1e4;
 var ACPSession = class _ACPSession {
   transport;
   fileServer;
@@ -3344,8 +3351,62 @@ var ACPSession = class _ACPSession {
     if (signal.aborted) {
       return emptyRunResult("cancelled");
     }
+    let cancelled = false;
+    this.promptCallbackAbort = new AbortController();
+    const onAbort = () => {
+      cancelled = true;
+      this.promptCallbackAbort?.abort();
+      if (this.sessionId) {
+        this.transport.send({
+          jsonrpc: "2.0",
+          method: "session/cancel",
+          params: { sessionId: this.sessionId }
+        }).catch(() => {
+        });
+      }
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    let rejectCreate;
+    const onCreateAbort = () => {
+      signal.removeEventListener("abort", onAbort);
+      rejectCreate?.(new ACPSessionError("aborted", "prompt was aborted by the parent"));
+    };
     if (!this.sessionId) {
-      this.sessionId = await this.createSessionWithAuth();
+      let sessionId;
+      const createPromise = this.createSessionWithAuth();
+      try {
+        sessionId = await Promise.race([
+          createPromise,
+          new Promise((_, reject) => {
+            rejectCreate = reject;
+            if (signal.aborted) {
+              reject(new ACPSessionError("aborted", "prompt was aborted by the parent"));
+              return;
+            }
+            signal.addEventListener("abort", onCreateAbort, { once: true });
+          })
+        ]);
+      } catch (err) {
+        signal.removeEventListener("abort", onAbort);
+        signal.removeEventListener("abort", onCreateAbort);
+        rejectCreate = void 0;
+        this.promptCallbackAbort?.abort();
+        this.promptCallbackAbort = null;
+        if (err instanceof ACPSessionError && err.kind === "aborted") {
+          this.cancelLateSession(createPromise);
+          return emptyRunResult("cancelled");
+        }
+        throw err;
+      }
+      signal.removeEventListener("abort", onCreateAbort);
+      rejectCreate = void 0;
+      if (typeof sessionId !== "string" || sessionId.length === 0) {
+        signal.removeEventListener("abort", onAbort);
+        this.promptCallbackAbort?.abort();
+        this.promptCallbackAbort = null;
+        throw new ACPSessionError("protocol_error", "session/new returned no session id");
+      }
+      this.sessionId = sessionId;
     }
     if (signal.aborted) {
       return emptyRunResult("cancelled");
@@ -3353,42 +3414,46 @@ var ACPSession = class _ACPSession {
     this.resetScratch();
     this.progressHandler = onProgress ?? null;
     const promptId = this.allocId();
-    const turnPromise = this.sendRequest(
-      promptId,
-      "session/prompt",
-      {
-        sessionId: this.sessionId,
-        prompt: blocks
-      },
-      this.timeoutMs
-    );
-    let cancelled = false;
-    this.promptCallbackAbort = new AbortController();
-    const onAbort = () => {
-      cancelled = true;
-      this.promptCallbackAbort?.abort();
-      this.transport.send({
-        jsonrpc: "2.0",
-        method: "session/cancel",
-        params: { sessionId: this.sessionId }
-      }).catch(() => {
-      });
+    let rejectTurn;
+    const onTurnAbort = () => {
+      rejectTurn?.(new ACPSessionError("aborted", "prompt was aborted by the parent"));
     };
-    signal.addEventListener("abort", onAbort, { once: true });
+    signal.addEventListener("abort", onTurnAbort, { once: true });
+    const turnPromise = Promise.race([
+      this.sendRequest(
+        promptId,
+        "session/prompt",
+        {
+          sessionId: this.sessionId,
+          prompt: blocks
+        },
+        this.timeoutMs
+      ),
+      new Promise((_, reject) => {
+        rejectTurn = reject;
+      })
+    ]);
     this.state = "prompting";
     let response;
     try {
       response = await turnPromise;
     } catch (err) {
       this.state = "done";
-      signal.removeEventListener("abort", onAbort);
-      if (cancelled || signal.aborted) {
-        throw new ACPSessionError("aborted", "prompt was aborted by the parent");
+      const abortedKind = err instanceof ACPSessionError && err.kind === "aborted";
+      if (cancelled || abortedKind) {
+        return emptyRunResult("cancelled");
       }
       const msg = err instanceof Error ? err.message : String(err);
+      if (signal.aborted) {
+        throw new ACPSessionError("aborted", "prompt was aborted by the parent", err);
+      }
       throw new ACPSessionError("prompt_failed", `session/prompt failed: ${msg}`, err);
     } finally {
       signal.removeEventListener("abort", onAbort);
+      signal.removeEventListener("abort", onTurnAbort);
+      signal.removeEventListener("abort", onCreateAbort);
+      rejectTurn = void 0;
+      rejectCreate = void 0;
       this.promptCallbackAbort?.abort();
       this.promptCallbackAbort = null;
       this.progressHandler = null;
@@ -3410,6 +3475,61 @@ var ACPSession = class _ACPSession {
       thoughts: this.scratch.thoughts
     };
   }
+  /**
+   * Best-effort cancel for a session the server confirmed after we already
+   * stopped waiting (the abort-during-creation race). `session/cancel` is a
+   * JSON-RPC notification — the server sends no response, so this is a bare
+   * transport send bounded by a timer rather than sendRequest, whose
+   * pending-tracking would just expire waiting for a reply that never
+   * comes. A failure or timeout is surfaced on the warn channel instead of
+   * being silently swallowed.
+   */
+  cancelLateSession(createPromise) {
+    createPromise.then(async (lateId) => {
+      try {
+        await new Promise((resolve4, reject) => {
+          const timer = setTimeout(() => {
+            reject(new Error("late session/cancel send timed out"));
+          }, LATE_CANCEL_SEND_TIMEOUT_MS);
+          Promise.resolve(
+            this.transport.send({
+              jsonrpc: "2.0",
+              method: "session/cancel",
+              params: { sessionId: lateId }
+            })
+          ).then(
+            () => {
+              clearTimeout(timer);
+              resolve4();
+            },
+            (sendErr) => {
+              clearTimeout(timer);
+              reject(sendErr instanceof Error ? sendErr : new Error(String(sendErr)));
+            }
+          );
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.warn(
+          JSON.stringify({
+            level: "warn",
+            event: "acp_session.late_cancel_failed",
+            sessionId: lateId,
+            message
+          })
+        );
+      }
+    }).catch((reason) => {
+      const message = reason instanceof Error ? reason.message : String(reason);
+      console.warn(
+        JSON.stringify({
+          level: "warn",
+          event: "acp_session.late_cancel_failed",
+          reason: message
+        })
+      );
+    });
+  }
   async closeSession() {
     if (!this.sessionId) return;
     const sid = this.sessionId;

package/dist/wrongstack-acp-agent.js

@@ -136,7 +136,7 @@ function errorToJsonRpc(err) {
   const message = err instanceof Error ? err.message : String(err);
   return { code: -32603, message };
 }
-function createRunTurnApi(sessionId, clientCapabilities, request) {
+function createRunTurnApi(sessionId, clientCapabilities, request, sendSessionUpdate) {
   return {
     clientCapabilities,
     requestPermission: async (req) => {
@@ -180,7 +180,8 @@ function createRunTurnApi(sessionId, clientCapabilities, request) {
         } catch {
         }
       }
-    }
+    },
+    ...sendSessionUpdate ? { sendSessionUpdate } : {}
   };
 }
 function buildInitializeResult(agentName, modes, configOptions) {
@@ -442,7 +443,12 @@ async function handleSessionPromptOp(ctx, id, params) {
   const api = createRunTurnApi(
     sessionId,
     ctx.clientCapabilities ?? {},
-    (method, req) => ctx.request(method, req)
+    (method, req) => ctx.request(method, req),
+    async (update) => {
+      if (ctx.sessions.get(sessionId) !== session) return false;
+      await ctx.sendNotification({ sessionId, update });
+      return true;
+    }
   );
   let result;
   const pendingNotifications = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/acp",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "license": "MIT",
   "description": "ACP (Agent Client Protocol) integration for WrongStack — client + agent support",
   "keywords": [
@@ -52,13 +52,13 @@
   ],
   "dependencies": {
     "@agentclientprotocol/sdk": "^1.4.0",
-    "@wrongstack/core": "1.0.8",
-    "@wrongstack/primitives": "1.0.8"
+    "@wrongstack/core": "1.0.10",
+    "@wrongstack/primitives": "1.0.10"
   },
   "devDependencies": {
-    "@types/node": "^26.2.0",
+    "@types/node": "^26.5.1",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.0"
   },
   "publishConfig": {
     "access": "public"