acpx 0.17.1 → 0.18.0

package/dist/{queue-owner-runtime-Dgv3e2Tp.js → queue-owner-runtime-Cr0dWJuL.js}

@@ -1,5 +1,5 @@
-import { $ as startPerfTimer, At as AgentSpawnError, B as extractAgentSessionId, Bt as SessionModeReplayError, C as textPrompt, Ct as OUTPUT_ERROR_ORIGINS, E as findGitRepositoryRoot, F as resolveSessionRecord, Ft as GeminiAcpStartupTimeoutError, H as SESSION_JOURNAL_SCHEMA, I as writeSessionRecord, It as PermissionDeniedError, J as incrementPerfCounter, K as formatPerfMetric, Lt as PermissionPromptUnavailableError, M as normalizeName, Mt as AuthPolicyError, Nt as ClaudeAcpSessionCreateTimeoutError, O as findSessionByDirectoryWalk, Ot as AcpxOperationalError, Pt as CopilotAcpUnsupportedError, Q as setPerfGauge, Rt as QueueConnectionError, S as promptToDisplayText, St as OUTPUT_ERROR_CODES, T as absolutePath, U as SessionJournalReader, Ut as SessionResumeRequiredError, V as normalizeAgentSessionId, Vt as SessionModelReplayError, Wt as UnsupportedPromptContentError, X as recordPerfDuration, Y as measurePerf, Z as resetPerfMetrics, _ as waitMs$1, _t as formatUnknownErrorMessage, a as trySetModelOnRunningOwner, bt as EXIT_CODES, c as queueRequestExceedsLimit, ct as defaultSessionEventLog, dt as sessionEventLockPath, f as refreshQueueOwnerLease, ft as sessionEventSegmentPath, g as tryAcquireQueueOwnerLease, gt as extractAcpError, h as terminateQueueOwnerForSession, ht as isProcessAlive, i as trySetModeOnRunningOwner, jt as AgentStartupError, k as isoNow$1, kt as AgentDisconnectedError, l as parseQueueRequest, lt as sessionBaseDir, m as terminateProcess, n as tryCloseSessionOnRunningOwner, nt as isAcpMessageObject, o as trySubmitToRunningOwner, p as releaseQueueOwnerLease, q as getPerfMetricsSnapshot, r as trySetConfigOptionOnRunningOwner, rt as isSessionUpdateNotification, s as queueRequestByteLimit, t as tryCancelOnRunningOwner, tt as isAcpJsonRpcMessage, ut as sessionEventActivePath, vt as isAcpResourceNotFoundError, y as getUnsupportedPromptContentMessage, zt as SessionConfigOptionReplayError } from "./ipc-D2rstexT.js";
-import { A as resolveAgentCommandParts, C as asAbsoluteCwd, E as isoNow$2, F as waitForSpawn, M as runTimedExecFile, N as splitCommandLine, P as waitForChildExit, S as PROCESS_HELPER_TIMEOUT_MS, T as isChildProcessRunning, _ as buildSpawnCommandOptions, b as readWindowsEnvValue, f as resolveBuiltInAgentLaunch, g as buildAgentSpawnCommand, j as resolveAgentSessionCwd, k as requireAgentStdio, v as buildTerminalShellSpawnCommand, w as basenameToken, x as resolveWindowsExecutablePath, y as buildTerminalSpawnCommand } from "./agent-registry-evUoJINz.js";
+import { $ as setPerfGauge, A as isoNow$1, At as AcpxOperationalError, Bt as QueueConnectionError, C as promptToDisplayText, D as findGitRepositoryRoot, E as absolutePath, Ft as ClaudeAcpSessionCreateTimeoutError, Gt as SessionResumeRequiredError, H as normalizeAgentSessionId, Ht as SessionModeReplayError, I as resolveSessionRecord, It as CopilotAcpUnsupportedError, J as getPerfMetricsSnapshot, Kt as UnsupportedPromptContentError, L as writeSessionRecord, Lt as GeminiAcpStartupTimeoutError, Mt as AgentSpawnError, N as normalizeName, Nt as AgentStartupError, Pt as AuthPolicyError, Q as resetPerfMetrics, Rt as PermissionDeniedError, St as EXIT_CODES, Tt as OUTPUT_ERROR_ORIGINS, U as SESSION_JOURNAL_SCHEMA, Ut as SessionModelReplayError, V as extractAgentSessionId, Vt as SessionConfigOptionReplayError, W as SessionJournalReader, X as measurePerf, Y as incrementPerfCounter, Z as recordPerfDuration, _ as waitMs$1, _t as isProcessDefinitelyDead, a as trySetModelOnRunningOwner, b as getUnsupportedPromptContentMessage, bt as isAcpResourceNotFoundError, c as queueRequestExceedsLimit, dt as sessionEventActivePath, et as startPerfTimer, f as refreshQueueOwnerLease, ft as sessionEventLockPath, g as tryAcquireQueueOwnerLease, gt as isProcessAlive, h as terminateQueueOwnerForSession, i as trySetModeOnRunningOwner, it as isSessionUpdateNotification, jt as AgentDisconnectedError, k as findSessionByDirectoryWalk, l as parseQueueRequest, lt as defaultSessionEventLog, m as terminateProcess, n as tryCloseSessionOnRunningOwner, nt as isAcpJsonRpcMessage, o as trySubmitToRunningOwner, p as releaseQueueOwnerLease, pt as sessionEventSegmentPath, q as formatPerfMetric, r as trySetConfigOptionOnRunningOwner, rt as isAcpMessageObject, s as queueRequestByteLimit, t as tryCancelOnRunningOwner, ut as sessionBaseDir, v as QueueLeaseGuardSettlementError, vt as extractAcpError, w as textPrompt, wt as OUTPUT_ERROR_CODES, yt as formatUnknownErrorMessage, zt as PermissionPromptUnavailableError } from "./ipc-BJrvfNXr.js";
+import { A as resolveAgentCommandParts, C as asAbsoluteCwd, E as isoNow$2, F as waitForSpawn, M as runTimedExecFile, N as splitCommandLine, P as waitForChildExit, S as PROCESS_HELPER_TIMEOUT_MS, T as isChildProcessRunning, _ as buildSpawnCommandOptions, b as readWindowsEnvValue, f as resolveBuiltInAgentLaunch, g as buildAgentSpawnCommand, j as resolveAgentSessionCwd, k as requireAgentStdio, v as buildTerminalShellSpawnCommand, w as basenameToken, x as resolveWindowsExecutablePath, y as buildTerminalSpawnCommand } from "./agent-registry-DdKB-zia.js";
 import fs, { readFileSync, realpathSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import path from "node:path";
@@ -15,6 +15,7 @@ import { isPathInside } from "@openclaw/fs-safe/path";
 import { root } from "@openclaw/fs-safe/root";
 import readline from "node:readline/promises";
 import { isHardlinkFallbackError } from "@openclaw/fs-safe/durability";
+import { acquireFileLock } from "@openclaw/fs-safe/file-lock";
 import net from "node:net";
 //#region src/acp/error-normalization.ts
 const AUTH_REQUIRED_ACP_CODES = /* @__PURE__ */ new Set([-32e3]);
@@ -485,21 +486,57 @@ function normalizeQueueOwnerTtlMs(ttlMs) {
 }
 //#endregion
 //#region src/permission-prompt.ts
+let promptQueue = Promise.resolve();
 async function promptForPermission(options) {
-	if (!process.stdin.isTTY || !process.stderr.isTTY) return false;
-	if (options.header) process.stderr.write(`\n${options.header}\n`);
-	if (options.details && options.details.trim().length > 0) process.stderr.write(`${options.details}\n`);
+	options.signal?.throwIfAborted();
+	const result = promptQueue.then(() => askPermission(options));
+	promptQueue = result.then(() => {}, () => {});
+	const signal = options.signal;
+	if (!signal) return await result;
+	let onAbort = () => {};
+	const aborted = new Promise((_, reject) => {
+		onAbort = () => reject(signal.reason);
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+	try {
+		return await Promise.race([result, aborted]);
+	} finally {
+		signal.removeEventListener("abort", onAbort);
+	}
+}
+async function askPermission(options) {
+	options.signal?.throwIfAborted();
+	if (!canPrompt()) return false;
+	writePromptDetails(options);
 	const rl = readline.createInterface({
 		input: process.stdin,
 		output: process.stderr
 	});
+	const questionController = new AbortController();
+	const signal = options.signal ? AbortSignal.any([options.signal, questionController.signal]) : questionController.signal;
+	let onClose = () => {};
+	const closed = new Promise((resolve) => {
+		onClose = () => resolve(void 0);
+		rl.once("close", onClose);
+	});
 	try {
-		const normalized = (await rl.question(options.prompt)).trim().toLowerCase();
+		const answer = await Promise.race([rl.question(options.prompt, { signal }), closed]);
+		options.signal?.throwIfAborted();
+		const normalized = answer?.trim().toLowerCase();
 		return normalized === "y" || normalized === "yes";
 	} finally {
+		rl.removeListener("close", onClose);
+		questionController.abort();
 		rl.close();
 	}
 }
+function canPrompt() {
+	return process.stdin.isTTY && process.stderr.isTTY && !process.stdin.readableEnded && !process.stdin.destroyed;
+}
+function writePromptDetails(options) {
+	if (options.header) process.stderr.write(`\n${options.header}\n`);
+	if (options.details && options.details.trim().length > 0) process.stderr.write(`${options.details}\n`);
+}
 //#endregion
 //#region src/filesystem.ts
 const WRITE_PREVIEW_MAX_LINES = 16;
@@ -515,11 +552,12 @@ function toWritePreview(content) {
 	if (preview.length > WRITE_PREVIEW_MAX_CHARS) preview = `${preview.slice(0, 1197)}...`;
 	return preview;
 }
-async function defaultConfirmWrite(filePath, preview) {
+async function defaultConfirmWrite(filePath, preview, signal) {
 	return await promptForPermission({
 		header: `[permission] Allow write to ${filePath}?`,
 		details: preview,
-		prompt: "Allow write? (y/N) "
+		prompt: "Allow write? (y/N) ",
+		signal
 	});
 }
 function canPromptForPermission$2() {
@@ -545,7 +583,8 @@ var FileSystemHandlers = class {
 		this.permissionMode = permissionMode;
 		this.nonInteractivePermissions = nonInteractivePermissions ?? "deny";
 	}
-	async readTextFile(params) {
+	async readTextFile(params, authority) {
+		assertControlAuthority(authority);
 		const filePath = this.resolvePathWithinRoot(params.path);
 		const summary = `read_text_file: ${filePath}`;
 		this.emitOperation({
@@ -557,7 +596,8 @@ var FileSystemHandlers = class {
 		});
 		try {
 			if (this.permissionMode === "deny-all") throw new PermissionDeniedError("Permission denied for fs/read_text_file (--deny-all)");
-			const content = await (await this.getWorkspace()).readText(`.${path.sep}${path.relative(this.rootDir, filePath)}`);
+			const content = await (await this.getWorkspace()).readText(filePath);
+			assertControlAuthority(authority);
 			const sliced = this.sliceContent(content, params.line, params.limit);
 			this.emitOperation({
 				method: "fs/read_text_file",
@@ -579,7 +619,8 @@ var FileSystemHandlers = class {
 			throw error;
 		}
 	}
-	async writeTextFile(params) {
+	async writeTextFile(params, authority) {
+		assertControlAuthority(authority);
 		const filePath = this.resolvePathWithinRoot(params.path);
 		const preview = toWritePreview(params.content);
 		const summary = `write_text_file: ${filePath}`;
@@ -591,9 +632,17 @@ var FileSystemHandlers = class {
 			timestamp: nowIso$1()
 		});
 		try {
-			if (!await this.isWriteApproved(filePath, preview)) throw new PermissionDeniedError("Permission denied for fs/write_text_file");
-			const file = await (await this.getWorkspace()).openWritable(`.${path.sep}${path.relative(this.rootDir, filePath)}`, { mode: 438 });
+			const approved = await this.isWriteApproved(filePath, preview, authority?.signal);
+			assertControlAuthority(authority);
+			if (!approved) throw new PermissionDeniedError("Permission denied for fs/write_text_file");
+			const workspace = await this.getWorkspace();
+			const target = await workspace.resolve(filePath);
+			const file = await workspace.openWritable(target, {
+				mode: 438,
+				assertBeforeMutation: () => assertControlAuthority(authority)
+			});
 			try {
+				assertControlAuthority(authority);
 				await file.handle.writeFile(params.content, "utf8");
 			} finally {
 				await file.handle.close();
@@ -618,17 +667,17 @@ var FileSystemHandlers = class {
 			throw error;
 		}
 	}
-	async isWriteApproved(filePath, preview) {
+	async isWriteApproved(filePath, preview, signal) {
 		if (this.permissionMode === "approve-all") return true;
 		if (this.permissionMode === "deny-all") return false;
 		if (this.usesDefaultConfirmWrite && this.nonInteractivePermissions === "fail" && !canPromptForPermission$2()) throw new PermissionPromptUnavailableError();
-		return await this.confirmWrite(filePath, preview);
+		return await this.confirmWrite(filePath, preview, signal);
 	}
 	resolvePathWithinRoot(rawPath) {
 		if (!path.isAbsolute(rawPath)) throw new Error(`Path must be absolute: ${rawPath}`);
 		const resolved = path.resolve(rawPath);
 		if (!isPathInside(this.rootDir, resolved)) throw new Error(`Path is outside allowed cwd subtree: ${resolved}`);
-		return resolved;
+		return rawPath;
 	}
 	getWorkspace() {
 		return this.workspace ??= root(this.rootDir, {
@@ -691,11 +740,11 @@ function pickOption(options, kinds) {
 const TOOL_KIND_TITLE_MATCHERS = [
 	{
 		kind: "read",
-		needles: ["read", "cat"]
+		names: ["read", "cat"]
 	},
 	{
 		kind: "search",
-		needles: [
+		names: [
 			"search",
 			"find",
 			"grep"
@@ -703,7 +752,7 @@ const TOOL_KIND_TITLE_MATCHERS = [
 	},
 	{
 		kind: "edit",
-		needles: [
+		names: [
 			"write",
 			"edit",
 			"patch"
@@ -711,15 +760,15 @@ const TOOL_KIND_TITLE_MATCHERS = [
 	},
 	{
 		kind: "delete",
-		needles: ["delete", "remove"]
+		names: ["delete", "remove"]
 	},
 	{
 		kind: "move",
-		needles: ["move", "rename"]
+		names: ["move", "rename"]
 	},
 	{
 		kind: "execute",
-		needles: [
+		names: [
 			"run",
 			"execute",
 			"bash"
@@ -727,7 +776,7 @@ const TOOL_KIND_TITLE_MATCHERS = [
 	},
 	{
 		kind: "fetch",
-		needles: [
+		names: [
 			"fetch",
 			"http",
 			"url"
@@ -735,25 +784,25 @@ const TOOL_KIND_TITLE_MATCHERS = [
 	},
 	{
 		kind: "think",
-		needles: ["think"]
+		names: ["think"]
 	}
 ];
 function inferToolKind(params) {
 	if (params.toolCall.kind) return params.toolCall.kind;
 	const title = params.toolCall.title?.trim().toLowerCase();
 	if (!title) return;
-	const head = title.split(":", 1)[0]?.trim();
+	const head = title.split(/[:\s]/, 1)[0];
 	if (!head) return;
-	return titleHeadToolKind(head) ?? "other";
-}
-function titleHeadToolKind(head) {
-	return TOOL_KIND_TITLE_MATCHERS.find(({ needles }) => needles.some((needle) => head.includes(needle)))?.kind;
+	return TOOL_KIND_TITLE_MATCHERS.find(({ names }) => names.includes(head))?.kind ?? "other";
 }
 function isAutoApprovedReadKind(kind) {
 	return kind === "read" || kind === "search";
 }
-async function promptForToolPermission(params) {
-	return await promptForPermission({ prompt: `\n[permission] Allow ${params.toolCall.title ?? "tool"} [${inferToolKind(params) ?? "other"}]? (y/N) ` });
+async function promptForToolPermission(params, signal) {
+	return await promptForPermission({
+		prompt: `\n[permission] Allow ${params.toolCall.title ?? "tool"} [${inferToolKind(params) ?? "other"}]? (y/N) `,
+		signal
+	});
 }
 function canPromptForPermission$1() {
 	return process.stdin.isTTY && process.stderr.isTTY;
@@ -848,24 +897,24 @@ function selectedOrFirst(options, allowOption) {
 function selectedOrCancelled(option) {
 	return { response: option ? selected(option.optionId) : cancelled() };
 }
-async function resolveEscalatingPermissionRequest(params, policyMatch, allowOption, rejectOption) {
-	if (canPromptForPermission$1()) return resolveInteractivePromptResult(params, allowOption, rejectOption);
+async function resolveEscalatingPermissionRequest(params, policyMatch, allowOption, rejectOption, signal) {
+	if (canPromptForPermission$1()) return resolveInteractivePromptResult(params, allowOption, rejectOption, signal);
 	const escalation = buildEscalationEvent(params, policyMatch.matchedRule);
 	return {
 		response: withPermissionMetadata(rejectOption ? selected(rejectOption.optionId) : cancelled(), { permissionEscalation: escalation }),
 		escalation
 	};
 }
-async function resolveInteractivePromptResult(params, allowOption, rejectOption) {
-	const approved = await promptForToolPermission(params);
+async function resolveInteractivePromptResult(params, allowOption, rejectOption, signal) {
+	const approved = await promptForToolPermission(params, signal);
 	if (approved && allowOption) return { response: selected(allowOption.optionId) };
 	if (!approved && rejectOption) return { response: selected(rejectOption.optionId) };
 	return { response: cancelled() };
 }
-function resolvePolicyMatch(params, policyMatch, options, allowOption, rejectOption) {
+function resolvePolicyMatch(params, policyMatch, options, allowOption, rejectOption, signal) {
 	if (policyMatch?.action === "approve") return selectedOrFirst(options, allowOption);
 	if (policyMatch?.action === "deny") return selectedOrCancelled(rejectOption);
-	if (policyMatch?.action === "escalate") return resolveEscalatingPermissionRequest(params, policyMatch, allowOption, rejectOption);
+	if (policyMatch?.action === "escalate") return resolveEscalatingPermissionRequest(params, policyMatch, allowOption, rejectOption, signal);
 }
 function resolveModeMatch(options, mode, allowOption, rejectOption) {
 	if (mode === "approve-all") return selectedOrFirst(options, allowOption);
@@ -875,24 +924,35 @@ function resolveNonInteractivePermission(nonInteractivePolicy, rejectOption) {
 	if (nonInteractivePolicy === "fail") throw new PermissionPromptUnavailableError();
 	return selectedOrCancelled(rejectOption);
 }
-async function resolveReadOrPromptPermission(params, nonInteractivePolicy, allowOption, rejectOption) {
+async function resolveReadOrPromptPermission(params, nonInteractivePolicy, allowOption, rejectOption, signal) {
 	if (isAutoApprovedReadKind(inferToolKind(params)) && allowOption) return { response: selected(allowOption.optionId) };
 	if (!canPromptForPermission$1()) return resolveNonInteractivePermission(nonInteractivePolicy, rejectOption);
-	return resolveInteractivePromptResult(params, allowOption, rejectOption);
+	return resolveInteractivePromptResult(params, allowOption, rejectOption, signal);
 }
 function permissionModeSatisfies(actual, required) {
 	return PERMISSION_MODE_RANK[actual] >= PERMISSION_MODE_RANK[required];
 }
-async function resolvePermissionRequestWithDetails(params, mode, nonInteractivePolicy = "deny", policy) {
+async function resolvePermissionRequestWithDetails(params, mode, nonInteractivePolicy = "deny", policy, signal) {
+	try {
+		signal?.throwIfAborted();
+		const result = await resolvePermissionByPolicy(params, mode, nonInteractivePolicy, policy, signal);
+		signal?.throwIfAborted();
+		return result;
+	} catch (error) {
+		if (signal?.aborted) return { response: cancelled() };
+		throw error;
+	}
+}
+async function resolvePermissionByPolicy(params, mode, nonInteractivePolicy, policy, signal) {
 	const options = params.options ?? [];
 	if (options.length === 0) return { response: cancelled() };
 	const allowOption = pickOption(options, ["allow_once", "allow_always"]);
 	const rejectOption = pickOption(options, ["reject_once", "reject_always"]);
-	const resolvedByPolicy = await resolvePolicyMatch(params, matchPermissionPolicy(params, policy), options, allowOption, rejectOption);
+	const resolvedByPolicy = await resolvePolicyMatch(params, matchPermissionPolicy(params, policy), options, allowOption, rejectOption, signal);
 	if (resolvedByPolicy) return resolvedByPolicy;
 	const resolvedByMode = resolveModeMatch(options, mode, allowOption, rejectOption);
 	if (resolvedByMode) return resolvedByMode;
-	return resolveReadOrPromptPermission(params, nonInteractivePolicy, allowOption, rejectOption);
+	return resolveReadOrPromptPermission(params, nonInteractivePolicy, allowOption, rejectOption, signal);
 }
 const DECISION_FALLBACK_ORDER = {
 	allow_once: ["allow_once", "allow_always"],
@@ -1321,10 +1381,12 @@ const REQUESTED_MODEL_UNSUPPORTED_REASONS = ["missing-capability", "unadvertised
 var RequestedModelUnsupportedError = class extends Error {
 	code = REQUESTED_MODEL_UNSUPPORTED_ERROR_CODE;
 	reason;
-	constructor(message, reason) {
+	ambiguous;
+	constructor(message, reason, details) {
 		super(message);
 		this.name = "RequestedModelUnsupportedError";
 		this.reason = reason;
+		if (details?.ambiguous) this.ambiguous = true;
 	}
 };
 function isRequestedModelUnsupportedReason(value) {
@@ -1427,6 +1489,7 @@ function resolveRequestedModelId(params) {
 	if (!params.models || !isCursorAcpCommandForModelAlias(params.agentCommand)) return params.requestedModel;
 	if (params.models.availableModels.some((model) => model.modelId === params.requestedModel)) return params.requestedModel;
 	const candidates = params.models.availableModels.map((model) => model.modelId).filter((modelId) => modelId.startsWith(`${params.requestedModel}[`));
+	if (candidates.length > 1) throw new RequestedModelUnsupportedError(`Cannot select model "${params.requestedModel}": multiple advertised Cursor models match (${candidates.join(", ")}). Use an exact advertised model ID.`, "unadvertised-model", { ambiguous: true });
 	return candidates.length === 1 ? candidates[0] : params.requestedModel;
 }
 function isCursorAcpCommandForModelAlias(agentCommand) {
@@ -1757,8 +1820,11 @@ function trimToUtf8Boundary(buffer, limit) {
 	if (start >= buffer.length) start = buffer.length - limit;
 	return buffer.subarray(start);
 }
-async function defaultConfirmExecute(commandLine) {
-	return await promptForPermission({ prompt: `\n[permission] Allow terminal command "${commandLine}"? (y/N) ` });
+async function defaultConfirmExecute(commandLine, signal) {
+	return await promptForPermission({
+		prompt: `\n[permission] Allow terminal command "${commandLine}"? (y/N) `,
+		signal
+	});
 }
 function canPromptForPermission() {
 	return process.stdin.isTTY && process.stderr.isTTY;
@@ -1795,7 +1861,8 @@ var TerminalManager = class {
 		this.permissionMode = permissionMode;
 		this.nonInteractivePermissions = nonInteractivePermissions ?? "deny";
 	}
-	async createTerminal(params) {
+	async createTerminal(params, authority) {
+		assertControlAuthority(authority);
 		const commandLine = toCommandLine(params.command, params.args);
 		const summary = `terminal/create: ${commandLine}`;
 		this.emitOperation({
@@ -1805,10 +1872,12 @@ var TerminalManager = class {
 			timestamp: nowIso()
 		});
 		try {
-			if (!await this.isExecuteApproved(commandLine)) throw new PermissionDeniedError("Permission denied for terminal/create");
+			const approved = await this.isExecuteApproved(commandLine, authority?.signal);
+			assertControlAuthority(authority);
+			if (!approved) throw new PermissionDeniedError("Permission denied for terminal/create");
 			const requestedLimit = Math.max(0, Math.round(params.outputByteLimit ?? DEFAULT_TERMINAL_OUTPUT_LIMIT_BYTES));
 			const outputByteLimit = Math.min(requestedLimit, this.outputCeilingBytes ?? Number.POSITIVE_INFINITY);
-			const { proc, spawnCommand } = await spawnTerminalProcess(params, this.cwd);
+			const { proc, spawnCommand } = await spawnTerminalProcess(params, this.cwd, authority);
 			let resolveExit = () => {};
 			const exitPromise = new Promise((resolve) => {
 				resolveExit = resolve;
@@ -1853,6 +1922,15 @@ var TerminalManager = class {
 			});
 			const terminalId = randomUUID();
 			this.terminals.set(terminalId, terminal);
+			try {
+				assertControlAuthority(authority);
+			} catch (error) {
+				await this.releaseTerminal({
+					terminalId,
+					sessionId: params.sessionId
+				});
+				throw error;
+			}
 			this.emitOperation({
 				method: "terminal/create",
 				status: "completed",
@@ -1991,11 +2069,11 @@ var TerminalManager = class {
 	emitOperation(operation) {
 		this.onOperation?.(operation);
 	}
-	async isExecuteApproved(commandLine) {
+	async isExecuteApproved(commandLine, signal) {
 		if (this.permissionMode === "approve-all") return true;
 		if (this.permissionMode === "deny-all") return false;
 		if (this.usesDefaultConfirmExecute && this.nonInteractivePermissions === "fail" && !canPromptForPermission()) throw new PermissionPromptUnavailableError();
-		return await this.confirmExecute(commandLine);
+		return await this.confirmExecute(commandLine, signal);
 	}
 	isRunning(terminal) {
 		return terminal.exitCode === void 0 && terminal.signal === void 0;
@@ -2059,25 +2137,26 @@ var TerminalManager = class {
 		while (hasLivePid(terminal.descendantPids)) await waitMs(25);
 	}
 };
-async function spawnTerminalProcess(params, defaultCwd) {
+async function spawnTerminalProcess(params, defaultCwd, authority) {
 	const directCommand = buildTerminalSpawnCommand(params.command, params.args);
 	try {
 		return {
-			proc: await spawnAndWait(directCommand, params, defaultCwd),
+			proc: await spawnAndWait(directCommand, params, defaultCwd, authority),
 			spawnCommand: directCommand
 		};
 	} catch (error) {
 		const fallbackCommand = params.args === void 0 && isNotFoundSpawnError(error) ? buildTerminalFallbackSpawnCommand(params.command, params.cwd ?? defaultCwd) : void 0;
 		if (!fallbackCommand) throw error;
 		return {
-			proc: await spawnAndWait(fallbackCommand, params, defaultCwd),
+			proc: await spawnAndWait(fallbackCommand, params, defaultCwd, authority),
 			spawnCommand: fallbackCommand
 		};
 	}
 }
-async function spawnAndWait(spawnCommand, params, defaultCwd) {
+async function spawnAndWait(spawnCommand, params, defaultCwd, authority) {
 	const spawnOptions = buildTerminalSpawnOptions(spawnCommand.command, params.cwd ?? defaultCwd, params.env);
 	if (spawnCommand.killProcessGroup) spawnOptions.detached = true;
+	assertControlAuthority(authority);
 	const proc = spawn(spawnCommand.command, spawnCommand.args, spawnOptions);
 	await waitForSpawn(proc);
 	return proc;
@@ -2368,8 +2447,6 @@ var AcpClient = class {
 	lastKnownPid;
 	promptPermissionFailures = /* @__PURE__ */ new Map();
 	pendingConnectionRequests = /* @__PURE__ */ new Set();
-	modelConfigIds = /* @__PURE__ */ new Map();
-	legacyModelSessionIds = /* @__PURE__ */ new Set();
 	constructor(options) {
 		this.options = {
 			...options,
@@ -2473,11 +2550,15 @@ var AcpClient = class {
 	hasUnresolvedPrompt() {
 		return this.activePrompt !== void 0;
 	}
-	endPromptElicitation(sessionId) {
-		const active = this.activePrompt;
-		if (!active || active.sessionId !== sessionId) return;
-		active.elicitationHandler = void 0;
-		active.elicitationController.abort();
+	abortSessionRequests(sessionId) {
+		const owners = this.pendingPromptOwners.filter((owner) => owner.sessionId === sessionId);
+		const fallback = this.takePermissionAbortController(sessionId);
+		for (const owner of owners) {
+			owner.elicitationHandler = void 0;
+			owner.elicitationController.abort();
+			owner.requestController.abort();
+		}
+		fallback?.abort();
 	}
 	async start() {
 		if (this.hasLiveConnection()) return;
@@ -2634,19 +2715,19 @@ var AcpClient = class {
 	createConnection(stream, launch, capabilities) {
 		const app = client({ name: "acpx" }).onNotification(methods.client.session.update, async ({ params }) => {
 			await this.handleSessionUpdate(params);
-		}).onNotification(methods.client.elicitation.complete, async () => {}).onRequest(methods.client.session.requestPermission, async ({ params }) => {
-			return await this.handlePermissionRequest(params);
+		}).onNotification(methods.client.elicitation.complete, async () => {}).onRequest(methods.client.session.requestPermission, async ({ params, signal }) => {
+			return await this.handlePermissionRequest(params, signal);
 		}).onRequest(methods.client.elicitation.create, async ({ params, requestId, signal }) => {
 			return await this.handleElicitationRequest(params, requestId, signal);
 		});
-		if (capabilities.fs?.readTextFile) app.onRequest(methods.client.fs.readTextFile, async ({ params }) => {
-			return await this.handleReadTextFile(params);
+		if (capabilities.fs?.readTextFile) app.onRequest(methods.client.fs.readTextFile, async ({ params, signal }) => {
+			return await this.handleReadTextFile(params, signal);
 		});
-		if (capabilities.fs?.writeTextFile) app.onRequest(methods.client.fs.writeTextFile, async ({ params }) => {
-			return await this.handleWriteTextFile(params);
+		if (capabilities.fs?.writeTextFile) app.onRequest(methods.client.fs.writeTextFile, async ({ params, signal }) => {
+			return await this.handleWriteTextFile(params, signal);
 		});
-		if (capabilities.terminal) app.onRequest(methods.client.terminal.create, async ({ params }) => {
-			return await this.handleCreateTerminal(params);
+		if (capabilities.terminal) app.onRequest(methods.client.terminal.create, async ({ params, signal }) => {
+			return await this.handleCreateTerminal(params, signal);
 		}).onRequest(methods.client.terminal.output, async ({ params }) => {
 			return await this.terminalManager.terminalOutput(params);
 		}).onRequest(methods.client.terminal.waitForExit, async ({ params }) => {
@@ -2733,7 +2814,6 @@ var AcpClient = class {
 			configOptions,
 			response: result
 		});
-		this.rememberSessionModels(result.sessionId, models);
 		await this.captureAgentDescendants(this.agent);
 		return {
 			sessionId: result.sessionId,
@@ -2765,7 +2845,6 @@ var AcpClient = class {
 		}
 		this.loadedSessionId = sessionId;
 		const result = toReconnectedSessionResult(response);
-		this.updateRememberedSessionModels(sessionId, result);
 		await this.captureAgentDescendants(this.agent);
 		return result;
 	}
@@ -2779,7 +2858,6 @@ var AcpClient = class {
 		}));
 		this.loadedSessionId = sessionId;
 		const result = toReconnectedSessionResult(response);
-		this.updateRememberedSessionModels(sessionId, result);
 		await this.captureAgentDescendants(this.agent);
 		return result;
 	}
@@ -2801,6 +2879,7 @@ var AcpClient = class {
 		const normalizedPrompt = this.normalizePromptForAgent(prompt);
 		const restoreConsoleError = this.options.suppressSdkConsoleErrors ? installSdkConsoleErrorSuppression() : void 0;
 		const previousActivePrompt = this.activePrompt;
+		const replacedOwners = this.pendingPromptOwners.filter((owner) => owner.sessionId === sessionId);
 		const activePrompt = this.beginActivePrompt(sessionId, onRequestWritten, onElicitation, onPermissionRequest, authority);
 		try {
 			const promptPromise = this.runConnectionRequest(() => connection.agent.request(methods.agent.session.prompt, {
@@ -2809,6 +2888,7 @@ var AcpClient = class {
 			}), authority);
 			activePrompt.promise = promptPromise;
 			previousActivePrompt?.elicitationController?.abort();
+			for (const owner of replacedOwners) owner.requestController.abort();
 			return this.returnPromptResponseOrPermissionFailure(sessionId, await promptPromise);
 		} catch (error) {
 			if (activePrompt.admissionFailure) throw activePrompt.admissionFailure.error;
@@ -2827,7 +2907,8 @@ var AcpClient = class {
 			authority,
 			elicitationHandler,
 			permissionHandler,
-			elicitationController: new AbortController()
+			elicitationController: new AbortController(),
+			requestController: new AbortController()
 		};
 		this.activePrompt = active;
 		this.pendingPromptOwners.push(active);
@@ -2866,6 +2947,7 @@ var AcpClient = class {
 			this.promptPermissionFailures.delete(active.sessionId);
 		}
 		active.elicitationController.abort();
+		active.requestController.abort();
 		permissionController?.abort();
 	}
 	normalizePromptForAgent(prompt) {
@@ -2889,33 +2971,41 @@ var AcpClient = class {
 			modeId
 		}), authority, (error) => maybeWrapSessionControlError("session/set_mode", error, `for mode "${modeId}"`));
 	}
-	async setSessionConfigOption(sessionId, configId, value, authority) {
+	async setSessionConfigOption(sessionId, configId, value, models, authority) {
+		assertControlAuthority(authority);
+		const resolvedValue = models?.configId === configId ? this.resolveSessionModelId(value, models) : value;
 		const connection = this.getConnection();
 		return await this.runConnectionRequest(() => connection.agent.request(methods.agent.session.setConfigOption, {
 			sessionId,
 			configId,
-			value
+			value: resolvedValue
 		}), authority, (error) => maybeWrapSessionControlError("session/set_config_option", error, `for "${configId}"="${value}"`));
 	}
-	async setSessionModel(sessionId, modelId, controlOverride, authority) {
-		const control = this.resolveModelControl(sessionId, controlOverride);
-		if (!control) throw new RequestedModelUnsupportedError(`Cannot set model "${modelId}": the ACP session did not advertise a model config option or legacy session/set_model support.`, "missing-capability");
-		const resolvedModelId = resolveRequestedModelId({
+	async setSessionModel(sessionId, modelId, models, authority) {
+		assertControlAuthority(authority);
+		if (!models) throw new RequestedModelUnsupportedError(`Cannot set model "${modelId}": the ACP session did not advertise a model config option or legacy session/set_model support.`, "missing-capability");
+		const resolvedModelId = this.resolveSessionModelId(modelId, models);
+		return models.configId ? await this.setSessionModelThroughConfig(sessionId, resolvedModelId, models.configId, authority) : await this.setSessionModelThroughLegacyMethod(sessionId, resolvedModelId, authority);
+	}
+	resolveSessionModelId(modelId, models) {
+		const params = {
 			requestedModel: modelId,
-			models: controlOverride?.availableModels ? { availableModels: controlOverride.availableModels } : void 0,
+			models,
 			agentCommand: this.options.agentCommand
+		};
+		assertRequestedModelSupported({
+			...params,
+			context: "apply"
 		});
-		return control.kind === "config_option" ? await this.setSessionModelThroughConfig(sessionId, resolvedModelId, control.configId, authority) : await this.setSessionModelThroughLegacyMethod(sessionId, resolvedModelId, authority);
+		return resolveRequestedModelId(params);
 	}
 	async setSessionModelThroughConfig(sessionId, modelId, configId, authority) {
 		const connection = this.getConnection();
-		const response = await this.runConnectionRequest(() => connection.agent.request(methods.agent.session.setConfigOption, {
+		return await this.runConnectionRequest(() => connection.agent.request(methods.agent.session.setConfigOption, {
 			sessionId,
 			configId,
 			value: modelId
 		}), authority, (error) => this.throwSessionModelError("session/set_config_option", modelId, error));
-		this.rememberSessionModels(sessionId, modelStateFromConfigOptions(response.configOptions));
-		return response;
 	}
 	async setSessionModelThroughLegacyMethod(sessionId, modelId, authority) {
 		const connection = this.getConnection();
@@ -2931,39 +3021,10 @@ var AcpClient = class {
 		const summary = acp ? formatSessionControlAcpSummary(acp) : error instanceof Error ? error.message : String(error);
 		throw new Error(`Failed ${method} for model "${modelId}": ${summary}`, { cause: error });
 	}
-	resolveModelControl(sessionId, controlOverride) {
-		if (controlOverride) return controlOverride.configId ? {
-			kind: "config_option",
-			configId: controlOverride.configId
-		} : { kind: "legacy_set_model" };
-		const configId = this.modelConfigIds.get(sessionId);
-		if (configId) return {
-			kind: "config_option",
-			configId
-		};
-		return this.legacyModelSessionIds.has(sessionId) ? { kind: "legacy_set_model" } : void 0;
-	}
-	rememberSessionModels(sessionId, models) {
-		if (!models) {
-			this.modelConfigIds.delete(sessionId);
-			this.legacyModelSessionIds.delete(sessionId);
-			return;
-		}
-		if (models.configId) {
-			this.modelConfigIds.set(sessionId, models.configId);
-			this.legacyModelSessionIds.delete(sessionId);
-			return;
-		}
-		this.modelConfigIds.delete(sessionId);
-		this.legacyModelSessionIds.add(sessionId);
-	}
-	updateRememberedSessionModels(sessionId, result) {
-		const explicitConfigRemoval = result.configOptionsPresent && this.modelConfigIds.has(sessionId);
-		if (result.models || result.legacyModelMetadataPresent || explicitConfigRemoval) this.rememberSessionModels(sessionId, result.models);
-	}
 	async cancel(sessionId) {
 		const connection = this.getConnection();
-		const active = this.activePrompt?.sessionId === sessionId ? this.activePrompt : void 0;
+		const owners = this.pendingPromptOwners.filter((owner) => owner.sessionId === sessionId);
+		const active = owners.at(-1);
 		const cancellation = active?.cancelPromise ?? this.runConnectionRequest(() => connection.agent.notify(methods.agent.session.cancel, { sessionId })).catch((error) => {
 			if (active?.cancelPromise === cancellation) active.cancelPromise = void 0;
 			throw error;
@@ -2972,19 +3033,20 @@ var AcpClient = class {
 		if (active) {
 			active.cancelPromise = cancellation;
 			this.cancellingSessionIds.add(sessionId);
-			active.elicitationController?.abort();
 		} else this.cancellingSessionIds.delete(sessionId);
+		for (const owner of owners) {
+			owner.elicitationController.abort();
+			owner.requestController.abort();
+		}
 		permissionController?.abort();
 		await cancellation;
 	}
 	async closeSession(sessionId) {
 		const connection = this.getConnection();
 		this.cancellingSessionIds.add(sessionId);
-		if (this.activePrompt?.sessionId === sessionId) this.activePrompt.elicitationController?.abort();
+		this.abortSessionRequests(sessionId);
 		await this.runConnectionRequest(() => connection.agent.request(methods.agent.session.close, { sessionId }));
 		if (this.loadedSessionId === sessionId) this.loadedSessionId = void 0;
-		this.modelConfigIds.delete(sessionId);
-		this.legacyModelSessionIds.delete(sessionId);
 	}
 	async listSessions(params = {}) {
 		const connection = this.getConnection();
@@ -3021,7 +3083,12 @@ var AcpClient = class {
 	async close() {
 		this.closing = true;
 		this.closeEpoch += 1;
+		const permissionControllers = [...this.permissionAbortControllers.values()];
+		this.permissionAbortControllers.clear();
+		const owners = [...this.pendingPromptOwners];
 		this.abortActiveElicitation();
+		for (const owner of owners) owner.requestController.abort();
+		for (const controller of permissionControllers) controller.abort();
 		await this.terminalManager.shutdown();
 		const agent = this.agent;
 		if (agent) await this.terminateAgentProcess(agent);
@@ -3039,8 +3106,6 @@ var AcpClient = class {
 		this.permissionAbortControllers.clear();
 		this.promptPermissionFailures.clear();
 		this.loadedSessionId = void 0;
-		this.modelConfigIds.clear();
-		this.legacyModelSessionIds.clear();
 		this.initResult = void 0;
 		this.connection = void 0;
 		this.agent = void 0;
@@ -3255,27 +3320,41 @@ var AcpClient = class {
 		await connection.agent.request(methods.agent.authenticate, { methodId: selected.methodId });
 		this.log(`authenticated with method ${selected.methodId} (${selected.source})`);
 	}
-	async handlePermissionRequest(params) {
-		if (this.cancellingSessionIds.has(params.sessionId)) return cancelledPermissionResponse();
-		if (this.initResult?.agentInfo?.name === "antigravity-acp" && params.toolCall.toolCallId.startsWith("interaction_")) return this.handleModePermissionError(params.sessionId, new PermissionPromptUnavailableError("Antigravity requested a user answer. acpx cannot answer Antigravity interaction questions; continue in an interactive client.")).response;
-		const hostResponse = await this.tryHandlePermissionRequestWithHost(params);
-		if (hostResponse) return hostResponse;
-		const { response, recorded } = await this.resolvePermissionRequestFromMode(params);
-		if (!recorded) {
-			const decision = classifyPermissionDecision(params, response);
-			this.recordPermissionDecision(decision);
+	async handlePermissionRequest(params, requestSignal) {
+		const owner = this.captureDelegatedRequestOwner(params.sessionId, requestSignal);
+		if (!this.isDelegatedRequestActive(owner)) return cancelledPermissionResponse();
+		if (!this.hasPermissionOwner(params.sessionId)) return this.finishPermissionRequest(params, owner, cancelledPermissionResponse());
+		if (this.initResult?.agentInfo?.name === "antigravity-acp" && params.toolCall.toolCallId.startsWith("interaction_")) {
+			const response = this.handleModePermissionError(params.sessionId, new PermissionPromptUnavailableError("Antigravity requested a user answer. acpx cannot answer Antigravity interaction questions; continue in an interactive client."));
+			return this.finishPermissionRequest(params, owner, response);
 		}
-		return response;
+		const response = await this.tryHandlePermissionRequestWithHost(params, owner) ?? await this.resolvePermissionRequestFromMode(params, owner);
+		return this.finishPermissionRequest(params, owner, response);
+	}
+	finishPermissionRequest(params, owner, response) {
+		const result = this.isDelegatedRequestActive(owner) ? response : cancelledPermissionResponse();
+		this.recordPermissionDecision(classifyPermissionDecision(params, result));
+		return result;
+	}
+	hasPermissionOwner(sessionId) {
+		return !this.pendingPromptOwners.some((owner) => owner.permissionHandler !== void 0) || this.pendingPromptOwners.some((owner) => owner.sessionId === sessionId);
 	}
 	async handleElicitationRequest(request, requestId, requestSignal) {
 		const resolved = this.resolveElicitationOwner(request);
 		if ("response" in resolved) return resolved.response;
 		const { active, handler } = resolved.owner;
-		const signal = AbortSignal.any([requestSignal, active.elicitationController.signal]);
-		const outcome = await raceWithAbort(signal, Promise.resolve().then(async () => await handler(request, {
-			requestId,
-			signal
-		})).then((response) => ({
+		const signal = AbortSignal.any([
+			requestSignal,
+			active.elicitationController.signal,
+			active.authority?.signal
+		].filter((candidate) => candidate !== void 0));
+		const outcome = await raceWithAbort(signal, Promise.resolve().then(async () => {
+			signal.throwIfAborted();
+			return await handler(request, {
+				requestId,
+				signal
+			});
+		}).then((response) => ({
 			kind: "response",
 			response
 		}), (error) => ({
@@ -3310,62 +3389,65 @@ var AcpClient = class {
 	isElicitationSessionCancelling(sessionId) {
 		return this.closing || this.cancellingSessionIds.has(sessionId);
 	}
-	resolvePermissionOwner(sessionId) {
-		const active = this.activePrompt;
-		const handler = active?.permissionHandler ?? this.options.onPermissionRequest;
-		if (!handler) return;
-		const signal = this.cancellationSignalForSession(sessionId);
-		if (!active?.permissionHandler) return {
-			handler,
-			signal
-		};
+	captureDelegatedRequestOwner(sessionId, requestSignal) {
+		const active = this.pendingPromptOwners.findLast((owner) => owner.sessionId === sessionId);
+		const signal = AbortSignal.any([
+			active?.requestController.signal ?? this.cancellationSignalForSession(sessionId),
+			active?.authority?.signal,
+			requestSignal
+		].filter((candidate) => candidate !== void 0));
+		const epoch = this.closeEpoch;
 		return {
-			handler,
-			signal: active.sessionId === sessionId ? AbortSignal.any([signal, active.elicitationController.signal]) : AbortSignal.abort()
+			signal,
+			permissionHandler: active?.permissionHandler ?? this.options.onPermissionRequest,
+			assertActive: () => {
+				if (this.closing || this.closeEpoch !== epoch || this.cancellingSessionIds.has(sessionId)) throw RequestError.requestCancelled();
+			}
 		};
 	}
-	async tryHandlePermissionRequestWithHost(params) {
-		const owner = this.resolvePermissionOwner(params.sessionId);
-		if (!owner) return;
-		const { handler, signal } = owner;
-		if (signal.aborted) return this.hostPermissionDecisionResponse(params, signal, void 0);
+	isDelegatedRequestActive(owner) {
+		try {
+			assertControlAuthority(owner);
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	async tryHandlePermissionRequestWithHost(params, owner) {
+		const handler = owner.permissionHandler;
+		if (!handler) return;
+		const { signal } = owner;
+		if (!this.isDelegatedRequestActive(owner)) return cancelledPermissionResponse();
 		try {
 			const decision = await raceWithAbort(signal, handler({
 				sessionId: params.sessionId,
 				raw: params,
 				inferredKind: inferToolKind(params)
 			}, { signal }));
-			return this.hostPermissionDecisionResponse(params, signal, decision);
+			return this.hostPermissionDecisionResponse(params, owner, decision);
 		} catch (error) {
-			return this.hostPermissionErrorResponse(params, signal, error);
+			return this.hostPermissionErrorResponse(owner, error);
 		}
 	}
-	hostPermissionDecisionResponse(params, signal, decision) {
-		if (signal.aborted || this.cancellingSessionIds.has(params.sessionId)) {
-			this.recordPermissionDecision("cancelled");
-			return cancelledPermissionResponse();
-		}
+	hostPermissionDecisionResponse(params, owner, decision) {
+		if (!this.isDelegatedRequestActive(owner)) return cancelledPermissionResponse();
 		if (!decision) return;
 		const response = decisionToResponse(preferCodexPermissionRefusal(params, this.initResult?.agentInfo?.name), decision);
-		this.recordPermissionDecision(classifyPermissionDecision(params, response));
 		return decision.outcome === "cancel" ? response : this.explainPermissionRefusal(params, response);
 	}
-	hostPermissionErrorResponse(params, signal, error) {
-		if (signal.aborted || this.cancellingSessionIds.has(params.sessionId)) {
-			this.recordPermissionDecision("cancelled");
-			return cancelledPermissionResponse();
-		}
+	hostPermissionErrorResponse(owner, error) {
+		if (!this.isDelegatedRequestActive(owner)) return cancelledPermissionResponse();
 		this.log(`onPermissionRequest threw, falling through to mode-based resolver: ${error instanceof Error ? error.message : String(error)}`);
 	}
-	async resolvePermissionRequestFromMode(params) {
+	async resolvePermissionRequestFromMode(params, owner) {
 		try {
-			const result = await resolvePermissionRequestWithDetails(preferCodexPermissionRefusal(params, this.initResult?.agentInfo?.name), this.options.permissionMode, this.options.nonInteractivePermissions ?? "deny", this.options.permissionPolicy);
+			assertControlAuthority(owner);
+			const result = await resolvePermissionRequestWithDetails(preferCodexPermissionRefusal(params, this.initResult?.agentInfo?.name), this.options.permissionMode, this.options.nonInteractivePermissions ?? "deny", this.options.permissionPolicy, owner.signal);
+			assertControlAuthority(owner);
 			this.emitPermissionEscalation(result.escalation);
-			return {
-				response: this.explainPermissionRefusal(params, result.response),
-				recorded: false
-			};
+			return this.explainPermissionRefusal(params, result.response);
 		} catch (error) {
+			if (!this.isDelegatedRequestActive(owner)) return cancelledPermissionResponse();
 			return this.handleModePermissionError(params.sessionId, error);
 		}
 	}
@@ -3388,11 +3470,7 @@ var AcpClient = class {
 	handleModePermissionError(sessionId, error) {
 		if (!(error instanceof PermissionPromptUnavailableError)) throw error;
 		this.notePromptPermissionFailure(sessionId, error);
-		this.recordPermissionDecision("cancelled");
-		return {
-			response: cancelledPermissionResponse(),
-			recorded: true
-		};
+		return cancelledPermissionResponse();
 	}
 	attachAgentLifecycleObservers(child, startedProcess, exitNotificationBarrier) {
 		const onExit = (exitCode, signal) => {
@@ -3519,28 +3597,30 @@ var AcpClient = class {
 			pending.reject(error);
 		}
 	}
-	async handleReadTextFile(params) {
+	async handleReadTextFile(params, requestSignal) {
 		try {
-			return await this.filesystem.readTextFile(params);
+			return await this.runDelegatedOperation(params.sessionId, requestSignal, (owner) => this.filesystem.readTextFile(params, owner));
 		} catch (error) {
-			this.recordPermissionError(params.sessionId, error);
 			if (error instanceof FsSafeError && error.code === "not-found" || error instanceof Error && "code" in error && error.code === "ENOENT") throw RequestError.resourceNotFound(pathToFileURL(params.path).href);
 			throw error;
 		}
 	}
-	async handleWriteTextFile(params) {
-		try {
-			return await this.filesystem.writeTextFile(params);
-		} catch (error) {
-			this.recordPermissionError(params.sessionId, error);
-			throw error;
-		}
+	async handleWriteTextFile(params, requestSignal) {
+		return await this.runDelegatedOperation(params.sessionId, requestSignal, (owner) => this.filesystem.writeTextFile(params, owner));
 	}
-	async handleCreateTerminal(params) {
+	async handleCreateTerminal(params, requestSignal) {
+		return await this.runDelegatedOperation(params.sessionId, requestSignal, (owner) => this.terminalManager.createTerminal(params, owner));
+	}
+	async runDelegatedOperation(sessionId, requestSignal, run) {
+		const owner = this.captureDelegatedRequestOwner(sessionId, requestSignal);
 		try {
-			return await this.terminalManager.createTerminal(params);
+			assertControlAuthority(owner);
+			const result = await run(owner);
+			assertControlAuthority(owner);
+			return result;
 		} catch (error) {
-			this.recordPermissionError(params.sessionId, error);
+			if (!this.isDelegatedRequestActive(owner)) throw RequestError.requestCancelled();
+			this.recordPermissionError(sessionId, error);
 			throw error;
 		}
 	}
@@ -4037,20 +4117,6 @@ function recordPromptSubmission(conversation, prompt, timestamp = isoNow(), mess
 	trimConversationForRuntime(conversation);
 	return promptMessageId;
 }
-function agentMessageHasObservedReply(message) {
-	return message.content.length > 0 || Object.keys(message.tool_results).length > 0;
-}
-function hasAgentReplyAfterPrompt(conversation, promptMessageId) {
-	let sawPrompt = false;
-	for (const message of conversation.messages) {
-		if (!sawPrompt) {
-			if (isUserMessage(message) && message.User.id === promptMessageId) sawPrompt = true;
-			continue;
-		}
-		if (isAgentMessage(message) && agentMessageHasObservedReply(message.Agent)) return true;
-	}
-	return false;
-}
 function recordSessionUpdate(conversation, state, notification, timestamp = isoNow(), userMessageId) {
 	const acpx = ensureAcpxState$1(state);
 	const update = notification.update;
@@ -4456,14 +4522,42 @@ async function readLock(filePath) {
 		throw error;
 	}
 }
-function lockPid(payload) {
+function lockPid(value) {
+	if (!value || typeof value !== "object" || !("pid" in value)) return;
+	const pid = value.pid;
+	return typeof pid === "number" && Number.isSafeInteger(pid) && pid > 0 ? pid : void 0;
+}
+function parseLock(payload) {
 	try {
-		const pid = JSON.parse(payload)?.pid;
-		return typeof pid === "number" && Number.isInteger(pid) && pid > 0 ? pid : void 0;
+		return JSON.parse(payload);
 	} catch {
 		return;
 	}
 }
+async function tryAcquireGuard(filePath) {
+	try {
+		return await acquireFileLock(filePath, {
+			managerKey: "acpx.session-turn",
+			lockPath: `${filePath}.guard`,
+			staleMs: Infinity,
+			timeoutMs: LOCK_RETRY_MS,
+			retry: {
+				retries: 8,
+				minTimeout: 1,
+				maxTimeout: 2,
+				factor: 1,
+				randomize: false
+			},
+			staleRecovery: "remove-if-unchanged",
+			payload: () => ({ pid: process.pid }),
+			shouldReclaim: ({ payload }) => isProcessDefinitelyDead(lockPid(payload)),
+			shouldRemoveStaleLock: ({ payload }) => isProcessDefinitelyDead(lockPid(payload))
+		});
+	} catch (error) {
+		if (error.code === "file_lock_timeout") return;
+		throw error;
+	}
+}
 async function removeObservedLock(filePath, observed) {
 	const current = await readLock(filePath);
 	if (!current) return true;
@@ -4475,64 +4569,105 @@ async function removeObservedLock(filePath, observed) {
 }
 async function recoverAbandonedLock(filePath) {
 	const observed = await readLock(filePath);
-	if (!observed) return;
-	const pid = lockPid(observed.payload);
-	if (pid === process.pid || isProcessAlive(pid)) return;
-	if (!pid && Date.now() - Number(observed.stat.mtimeMs) <= INCOMPLETE_RESERVATION_GRACE_MS) return;
-	if (await removeObservedLock(filePath, observed)) incrementPerfCounter("session.events.stale_lock_recovered");
+	if (!observed) return true;
+	const pid = lockPid(parseLock(observed.payload));
+	if (pid && !isProcessDefinitelyDead(pid)) return false;
+	if (!pid && Date.now() - Number(observed.stat.mtimeMs) <= INCOMPLETE_RESERVATION_GRACE_MS) return false;
+	if (await removeObservedLock(filePath, observed)) {
+		incrementPerfCounter("session.events.stale_lock_recovered");
+		return true;
+	}
+	return false;
 }
 async function publishLock(filePath, payload, signal) {
-	try {
-		await withTempFile({
-			rootDir: path.dirname(filePath),
-			prefix: "session-turn",
-			fileName: "lock"
-		}, async (temporaryPath) => {
-			await fs$1.writeFile(temporaryPath, payload, {
+	await withTempFile({
+		rootDir: path.dirname(filePath),
+		prefix: "session-turn",
+		fileName: "lock"
+	}, async (temporaryPath) => {
+		await fs$1.writeFile(temporaryPath, payload, {
+			encoding: "utf8",
+			flag: "wx",
+			mode: 384
+		});
+		signal?.throwIfAborted();
+		try {
+			await fs$1.link(temporaryPath, filePath);
+		} catch (error) {
+			if (!isHardlinkFallbackError(error)) throw error;
+			await fs$1.writeFile(filePath, payload, {
 				encoding: "utf8",
 				flag: "wx",
 				mode: 384
 			});
-			signal?.throwIfAborted();
-			try {
-				await fs$1.link(temporaryPath, filePath);
-			} catch (error) {
-				if (!isHardlinkFallbackError(error)) throw error;
-				await fs$1.writeFile(filePath, payload, {
-					encoding: "utf8",
-					flag: "wx",
-					mode: 384
-				});
-			}
-		});
-	} catch (error) {
-		await removePublishedLock(filePath, payload).catch(() => {});
-		throw error;
-	}
+		}
+	});
 }
 async function removePublishedLock(filePath, payload) {
 	const current = await readLock(filePath);
 	if (current?.payload === payload) await removeObservedLock(filePath, current);
 }
-async function observePublishedLock(filePath, payload, signal) {
+async function rejectAcquisition(filePath, payload, guard, error) {
+	const failures = [error];
+	await removePublishedLock(filePath, payload).catch((cleanupError) => {
+		failures.push(cleanupError);
+	});
+	await guard.release().catch((releaseError) => {
+		failures.push(releaseError);
+	});
+	if (failures.length > 1) throw new AggregateError(failures, "Session turn acquisition and cleanup failed");
+	throw error;
+}
+function turnReceipt(filePath, observed, guard) {
+	let disposed = false;
+	let disposal;
+	return { [Symbol.asyncDispose]: async () => {
+		if (disposed) return;
+		const pending = disposal ??= (async () => {
+			await removeObservedLock(filePath, observed);
+			await guard.release();
+			disposed = true;
+		})();
+		try {
+			await pending;
+		} finally {
+			if (disposal === pending) disposal = void 0;
+		}
+	} };
+}
+async function tryPublishLock(filePath, payload, signal) {
+	for (;;) try {
+		await publishLock(filePath, payload, signal);
+		return true;
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+		if (!await recoverAbandonedLock(filePath)) return false;
+	}
+}
+async function tryAcquireTurn(filePath, payload, signal) {
+	const guard = await tryAcquireGuard(filePath);
+	if (!guard) return;
 	try {
+		signal?.throwIfAborted();
+		if (!await tryPublishLock(filePath, payload, signal)) {
+			await guard.release();
+			return;
+		}
 		const observed = await readLock(filePath);
 		if (observed?.payload !== payload) throw new Error(`Session turn ownership changed before admission: ${filePath}`);
 		signal?.throwIfAborted();
-		return { [Symbol.asyncDispose]: async () => {
-			await removeObservedLock(filePath, observed);
-		} };
+		return turnReceipt(filePath, observed, guard);
 	} catch (error) {
-		await removePublishedLock(filePath, payload).catch(() => {});
-		throw error;
+		return await rejectAcquisition(filePath, payload, guard, error);
 	}
 }
 async function acquireSessionTurn(recordId, signal) {
-	const filePath = sessionEventLockPath(recordId);
-	await fs$1.mkdir(path.dirname(filePath), {
+	const requestedPath = sessionEventLockPath(recordId);
+	await fs$1.mkdir(path.dirname(requestedPath), {
 		recursive: true,
 		mode: 448
 	});
+	const filePath = path.join(await fs$1.realpath(path.dirname(requestedPath)), path.basename(requestedPath));
 	lastCreatedAt = Math.max(Date.now(), lastCreatedAt + 1);
 	const payload = `${JSON.stringify({
 		pid: process.pid,
@@ -4540,16 +4675,10 @@ async function acquireSessionTurn(recordId, signal) {
 	}, null, 2)}\n`;
 	for (;;) {
 		signal?.throwIfAborted();
-		try {
-			await publishLock(filePath, payload, signal);
-			break;
-		} catch (error) {
-			if (error.code !== "EEXIST") throw error;
-			await recoverAbandonedLock(filePath);
-			await setTimeout$1(LOCK_RETRY_MS, void 0, { signal });
-		}
+		const turn = await tryAcquireTurn(filePath, payload, signal);
+		if (turn) return turn;
+		await setTimeout$1(LOCK_RETRY_MS, void 0, { signal });
 	}
-	return await observePublishedLock(filePath, payload, signal);
 }
 //#endregion
 //#region src/session/queue/ipc-server.ts
@@ -4730,6 +4859,7 @@ var SessionQueueOwner = class SessionQueueOwner {
 		return true;
 	}
 	handleControlRequest(options) {
+		this.taskSockets.add(options.socket);
 		writeQueueMessage(options.socket, {
 			type: "accepted",
 			requestId: options.requestId,
@@ -5042,7 +5172,7 @@ async function replayDesiredConfigOptions(params) {
 	for (const [configId, value] of Object.entries(params.desiredConfigOptions)) {
 		if (configId === replacingKey || acceptedConfigOptions && !acceptsSavedConfigValue(acceptedConfigOptions.find((option) => option.id === configId), value)) continue;
 		try {
-			const response = await withTimeout(params.client.setSessionConfigOption(params.sessionId, configId, value, params.replay.authority), params.timeoutMs);
+			const response = await withTimeout(params.client.setSessionConfigOption(params.sessionId, configId, value, advertisedModelState(params.record.acpx), params.replay.authority), params.timeoutMs);
 			params.replay.acknowledged = true;
 			params.record.acpx = applyConfigOptionSelection(params.record.acpx, configId, value, response);
 			acceptedConfigOptions = response.configOptions;
@@ -5093,6 +5223,7 @@ async function connectAndLoadSession(options) {
 		timeoutMs: options.timeoutMs
 	});
 	const { resumed, loadError, sessionId, createdFreshSession, pendingAgentSessionId, sessionModels } = loadState;
+	applyReconnectedModelState(record, sessionModels, loadState.configOptionsPresent, loadState.legacyModelMetadataPresent, createdFreshSession);
 	const preferenceReplay = await replaySessionPreferences({
 		client,
 		record,
@@ -5313,7 +5444,7 @@ function createActiveSessionController(params) {
 			return response;
 		},
 		setSessionConfigOption: async (configId, value) => {
-			return await params.client.setSessionConfigOption(getActiveSessionId(), configId, value);
+			return await params.client.setSessionConfigOption(getActiveSessionId(), configId, value, advertisedModelState(params.record.acpx));
 		}
 	};
 }
@@ -5436,14 +5567,38 @@ function toSessionMutationResult(result) {
 		loadError: result.loadError
 	};
 }
+async function withOwnedDirectSession(options) {
+	const waiting = new AbortController();
+	const timeoutMs = options.timeoutMs;
+	const timer = timeoutMs != null && timeoutMs > 0 ? setTimeout(() => waiting.abort(new TimeoutError(timeoutMs)), timeoutMs) : void 0;
+	let ownership;
+	let recordId;
+	try {
+		recordId = (await options.loadRecord(options.sessionRecordId)).acpxRecordId;
+		ownership = await acquireSessionTurn(recordId, waiting.signal);
+	} catch (error) {
+		waiting.signal.throwIfAborted();
+		throw error;
+	} finally {
+		clearTimeout(timer);
+	}
+	try {
+		return await withConnectedSession({
+			...options,
+			sessionRecordId: recordId
+		});
+	} finally {
+		await ownership[Symbol.asyncDispose]();
+	}
+}
 async function runSessionSetModeDirect(options) {
-	return toSessionMutationResult(await withConnectedSession(buildDirectConnectedSessionOptions(options, async ({ client, sessionId, record }) => {
+	return toSessionMutationResult(await withOwnedDirectSession(buildDirectConnectedSessionOptions(options, async ({ client, sessionId, record }) => {
 		await withTimeout(client.setSessionMode(sessionId, options.modeId), options.timeoutMs);
 		setDesiredModeId(record, options.modeId);
 	})));
 }
 async function runSessionSetModelDirect(options) {
-	const result = await withConnectedSession(buildDirectConnectedSessionOptions({
+	const result = await withOwnedDirectSession(buildDirectConnectedSessionOptions({
 		...options,
 		replacingConfigOption: { key: "model" }
 	}, async ({ client, sessionId, record }) => {
@@ -5458,12 +5613,13 @@ async function runSessionSetModelDirect(options) {
 	};
 }
 async function runSessionSetConfigOptionDirect(options) {
-	const result = await withConnectedSession(buildDirectConnectedSessionOptions({
+	const result = await withOwnedDirectSession(buildDirectConnectedSessionOptions({
 		...options,
 		replacingConfigOption: { key: options.configId }
 	}, async ({ client, sessionId, record }) => {
-		const response = await withTimeout(client.setSessionConfigOption(sessionId, options.configId, options.value), options.timeoutMs);
-		record.acpx = applyConfigOptionSelection(record.acpx, options.configId, options.value, response);
+		const models = advertisedModelState(record.acpx);
+		const response = await withTimeout(client.setSessionConfigOption(sessionId, options.configId, options.value, models), options.timeoutMs);
+		record.acpx = applyConfigOptionSelection(record.acpx, options.configId, options.value, response, models?.configId);
 		return response;
 	}));
 	return {
@@ -5482,16 +5638,31 @@ async function cancelSessionPrompt(options) {
 		cancelled: cancelled === true
 	};
 }
-async function setSessionMode(options) {
-	if (await trySetModeOnRunningOwner(options.sessionId, options.modeId, options.timeoutMs, options.verbose)) {
-		const record = await resolveSessionRecord(options.sessionId);
+/**
+* Dispatches the mode change to a running queue owner. Returns `undefined`
+* when no owner holds the session, leaving the direct-connection decision to
+* the caller.
+*
+* An owner advertising `persistsControlState` saves the accepted state itself.
+* Only the older caller-save path still reloads and rewrites the record here,
+* which is not serialized against another process doing the same.
+*/
+async function setSessionModeOnOwner(options) {
+	const submittedToOwner = await trySetModeOnRunningOwner(options.sessionId, options.modeId, options.timeoutMs, options.verbose, options.assertDispatch);
+	if (!submittedToOwner?.value) return;
+	const record = await resolveSessionRecord(options.sessionId);
+	if (!submittedToOwner.persistsControlState) {
 		setDesiredModeId(record, options.modeId);
 		await writeSessionRecord(record);
-		return {
-			record,
-			resumed: false
-		};
 	}
+	return {
+		record,
+		resumed: false
+	};
+}
+async function setSessionMode(options) {
+	const onOwner = await setSessionModeOnOwner(options);
+	if (onOwner) return onOwner;
 	return await runSessionSetModeDirect({
 		sessionRecordId: options.sessionId,
 		modeId: options.modeId,
@@ -5505,18 +5676,24 @@ async function setSessionMode(options) {
 		verbose: options.verbose
 	});
 }
-async function setSessionModel(options) {
-	const submittedToOwner = await trySetModelOnRunningOwner(options.sessionId, options.modelId, options.timeoutMs, options.verbose);
-	if (submittedToOwner) {
-		const record = await resolveSessionRecord(options.sessionId);
-		record.acpx = applyModelSelection(record.acpx, options.modelId, submittedToOwner.response);
+/** Owner-only counterpart of {@link setSessionMode} for the model control. */
+async function setSessionModelOnOwner(options) {
+	const submittedToOwner = await trySetModelOnRunningOwner(options.sessionId, options.modelId, options.timeoutMs, options.verbose, options.assertDispatch);
+	if (!submittedToOwner) return;
+	const record = await resolveSessionRecord(options.sessionId);
+	if (!submittedToOwner.persistsControlState) {
+		record.acpx = applyModelSelection(record.acpx, options.modelId, submittedToOwner.value.response);
 		await writeSessionRecord(record);
-		return {
-			record,
-			response: submittedToOwner.response,
-			resumed: false
-		};
 	}
+	return {
+		record,
+		response: submittedToOwner.value.response,
+		resumed: false
+	};
+}
+async function setSessionModel(options) {
+	const onOwner = await setSessionModelOnOwner(options);
+	if (onOwner) return onOwner;
 	return await runSessionSetModelDirect({
 		sessionRecordId: options.sessionId,
 		modelId: options.modelId,
@@ -5530,18 +5707,24 @@ async function setSessionModel(options) {
 		verbose: options.verbose
 	});
 }
-async function setSessionConfigOption(options) {
-	const ownerResponse = await trySetConfigOptionOnRunningOwner(options.sessionId, options.configId, options.value, options.timeoutMs, options.verbose);
-	if (ownerResponse) {
-		const record = await resolveSessionRecord(options.sessionId);
-		record.acpx = applyConfigOptionSelection(record.acpx, options.configId, options.value, ownerResponse);
+/** Owner-only counterpart of {@link setSessionMode} for the config option control. */
+async function setSessionConfigOptionOnOwner(options) {
+	const ownerResponse = await trySetConfigOptionOnRunningOwner(options.sessionId, options.configId, options.value, options.timeoutMs, options.verbose, options.assertDispatch);
+	if (!ownerResponse) return;
+	const record = await resolveSessionRecord(options.sessionId);
+	if (!ownerResponse.persistsControlState) {
+		record.acpx = applyConfigOptionSelection(record.acpx, options.configId, options.value, ownerResponse.value);
 		await writeSessionRecord(record);
-		return {
-			record,
-			response: ownerResponse,
-			resumed: false
-		};
 	}
+	return {
+		record,
+		response: ownerResponse.value,
+		resumed: false
+	};
+}
+async function setSessionConfigOption(options) {
+	const onOwner = await setSessionConfigOptionOnOwner(options);
+	if (onOwner) return onOwner;
 	return await runSessionSetConfigOptionDirect({
 		sessionRecordId: options.sessionId,
 		configId: options.configId,
@@ -5626,11 +5809,17 @@ async function closeSession(sessionId) {
 	await tryCloseSessionOnRunningOwner({ sessionId: record.acpxRecordId }).catch(() => {});
 	await terminateQueueOwnerForSession(record.acpxRecordId);
 	if (record.pid != null && isProcessAlive(record.pid) && await isLikelyMatchingProcess(record.pid, record.agentCommand)) await terminateProcess(record.pid);
-	record.pid = void 0;
-	record.closed = true;
-	record.closedAt = isoNow$1();
-	await writeSessionRecord(record);
-	return record;
+	const ownership = await acquireSessionTurn(record.acpxRecordId);
+	try {
+		const current = await resolveSessionRecord(record.acpxRecordId);
+		current.pid = void 0;
+		current.closed = true;
+		current.closedAt = isoNow$1();
+		await writeSessionRecord(current);
+		return current;
+	} finally {
+		await ownership[Symbol.asyncDispose]();
+	}
 }
 //#endregion
 //#region src/session/execution/session-management.ts
@@ -5951,16 +6140,182 @@ function installPerfMetricsCapture(options = {}) {
 	}
 }
 //#endregion
+//#region src/session/queue/control-admission.ts
+var QueueControlDeadline = class {
+	controller = new AbortController();
+	admissionSignal;
+	expiresAt;
+	expired;
+	timeoutError;
+	rejectExpiry;
+	timer;
+	nativeSettled = false;
+	admitted = false;
+	constructor(timeoutMs, ownerSignal) {
+		this.admissionSignal = ownerSignal ? AbortSignal.any([this.controller.signal, ownerSignal]) : this.controller.signal;
+		this.expiresAt = timeoutMs != null && timeoutMs > 0 ? performance.now() + timeoutMs : void 0;
+		this.timeoutError = this.expiresAt === void 0 ? void 0 : new TimeoutError(timeoutMs);
+		this.expired = new Promise((_resolve, reject) => {
+			this.rejectExpiry = reject;
+			if (this.expiresAt !== void 0) this.timer = setTimeout(() => this.expire(), timeoutMs);
+		});
+		this.expired.catch(() => {});
+	}
+	get signal() {
+		return this.admissionSignal;
+	}
+	get timeoutSignal() {
+		return this.controller.signal;
+	}
+	get remainingMs() {
+		this.assertActive();
+		return this.expiresAt === void 0 || this.nativeSettled ? void 0 : Math.max(1, this.expiresAt - performance.now());
+	}
+	get nativeAdmitted() {
+		return this.admitted;
+	}
+	get authority() {
+		return {
+			signal: this.signal,
+			assertActive: () => {
+				this.assertActive();
+				this.admitted = true;
+			}
+		};
+	}
+	assertActive() {
+		if (this.expiresAt !== void 0 && performance.now() >= this.expiresAt) this.expire();
+		this.signal.throwIfAborted();
+	}
+	expire() {
+		if (this.nativeSettled || this.timeoutSignal.aborted || !this.timeoutError) return;
+		this.controller.abort(this.timeoutError);
+		this.rejectExpiry(this.timeoutError);
+	}
+	responseSettled() {
+		this.nativeSettled = true;
+		clearTimeout(this.timer);
+		this.timer = void 0;
+	}
+	isExpired(error) {
+		return this.timeoutSignal.aborted && error === this.timeoutSignal.reason;
+	}
+	async wait(operation) {
+		return await Promise.race([operation, this.expired]);
+	}
+};
+function deferred() {
+	let resolve;
+	let reject;
+	const promise = new Promise((accept, fail) => {
+		resolve = accept;
+		reject = fail;
+	});
+	promise.catch(() => {});
+	return {
+		promise,
+		resolve,
+		reject
+	};
+}
+function drained(operation) {
+	return operation.then(() => {}, () => {});
+}
+var QueueOwnerControlAdmission = class {
+	options;
+	idleTail = Promise.resolve();
+	ticket;
+	stopped = new AbortController();
+	pending = 0;
+	constructor(options) {
+		this.options = options;
+	}
+	get hasPending() {
+		return this.pending > 0;
+	}
+	beginPrompt() {
+		const ticket = {
+			ready: deferred(),
+			released: deferred(),
+			rawTail: Promise.resolve(),
+			sealed: false
+		};
+		this.ticket = ticket;
+		return {
+			ticket,
+			priorIdle: this.idleTail
+		};
+	}
+	publish(ticket, controls) {
+		if (!ticket.sealed) ticket.ready.resolve(controls);
+	}
+	seal(ticket) {
+		ticket.sealed = true;
+		ticket.ready.reject(new QueueConnectionError("Prompt ended before controls became ready", {
+			detailCode: "QUEUE_CONTROL_REQUEST_FAILED",
+			origin: "queue",
+			retryable: true
+		}));
+		return ticket.rawTail;
+	}
+	release(ticket) {
+		if (this.ticket === ticket) this.ticket = void 0;
+		ticket.released.resolve();
+	}
+	stopAdmission() {
+		this.stopped.abort(new QueueConnectionError("Queue owner is closing", {
+			detailCode: "QUEUE_OWNER_SHUTTING_DOWN",
+			origin: "queue",
+			retryable: true
+		}));
+	}
+	async drainAdmitted() {
+		await Promise.all([this.idleTail, this.ticket?.rawTail]);
+	}
+	async run(invoke, timeoutMs, replacingConfigOption) {
+		const deadline = new QueueControlDeadline(timeoutMs, this.stopped.signal);
+		this.pending += 1;
+		const operation = this.enqueue(invoke, {
+			deadline,
+			replacingConfigOption
+		});
+		operation.finally(() => {
+			this.pending -= 1;
+			deadline.responseSettled();
+		}).catch(() => {});
+		return await deadline.wait(operation);
+	}
+	async enqueue(invoke, options) {
+		options.deadline.assertActive();
+		const ticket = this.ticket;
+		if (ticket?.sealed) return ticket.released.promise.then(() => this.enqueue(invoke, options));
+		if (ticket) {
+			const operation = ticket.rawTail.then(async () => {
+				const controls = await ticket.ready.promise.catch((error) => {
+					options.deadline.assertActive();
+					throw error;
+				});
+				options.deadline.assertActive();
+				return await invoke(controls, options.deadline);
+			});
+			ticket.rawTail = drained(operation);
+			return operation;
+		}
+		const operation = this.idleTail.then(async () => {
+			options.deadline.assertActive();
+			return await this.options.runIdle(invoke, options);
+		});
+		this.idleTail = drained(operation);
+		return operation;
+	}
+};
+//#endregion
 //#region src/session/queue/owner-turn-controller.ts
 var QueueOwnerTurnController = class {
-	options;
 	state = "idle";
 	pendingCancel = false;
 	activeController;
 	waitingTurn;
-	constructor(options) {
-		this.options = options;
-	}
 	get lifecycleState() {
 		return this.state;
 	}
@@ -5992,20 +6347,9 @@ var QueueOwnerTurnController = class {
 	clearActiveController() {
 		this.activeController = void 0;
 	}
-	assertCanHandleControlRequest() {
-		if (this.state === "closing") throw new QueueConnectionError("Queue owner is closing", {
-			detailCode: "QUEUE_OWNER_SHUTTING_DOWN",
-			origin: "queue",
-			retryable: true
-		});
-	}
 	async requestCancel() {
 		const activeController = this.activeController;
-		if (activeController?.hasActivePrompt()) {
-			const cancelled = await activeController.requestCancelActivePrompt();
-			if (cancelled) this.pendingCancel = false;
-			return cancelled;
-		}
+		if (activeController?.hasActivePrompt()) return await this.cancelActivePrompt(activeController);
 		if (this.state === "starting" || this.state === "active") {
 			this.pendingCancel = true;
 			this.waitingTurn?.abort();
@@ -6016,32 +6360,138 @@ var QueueOwnerTurnController = class {
 	async applyPendingCancel() {
 		const activeController = this.activeController;
 		if (!this.pendingCancel || !activeController || !activeController.hasActivePrompt()) return false;
-		const cancelled = await activeController.requestCancelActivePrompt();
-		if (cancelled) this.pendingCancel = false;
+		return await this.cancelActivePrompt(activeController);
+	}
+	async cancelActivePrompt(activeController) {
+		const turn = this.waitingTurn;
+		const cancellation = activeController.requestCancelActivePrompt();
+		turn?.abort();
+		const cancelled = await cancellation;
+		if (cancelled && this.waitingTurn === turn) this.pendingCancel = false;
 		return cancelled;
 	}
-	async setSessionMode(modeId, timeoutMs) {
-		this.assertCanHandleControlRequest();
-		const activeController = this.activeController;
-		if (activeController) {
-			await this.options.withTimeout(async () => await activeController.setSessionMode(modeId), timeoutMs);
-			return;
+};
+//#endregion
+//#region src/session/execution/owned-controls.ts
+async function acceptControl(options, invoke, apply, deadline = new QueueControlDeadline()) {
+	deadline.assertActive();
+	const raw = invoke(deadline.authority).then(async (response) => {
+		deadline.responseSettled();
+		apply(response);
+		await options.checkpoint();
+		return response;
+	}, (error) => {
+		deadline.responseSettled();
+		throw error;
+	});
+	try {
+		return await deadline.wait(raw);
+	} catch (error) {
+		if (deadline.isExpired(error) && deadline.nativeAdmitted) {
+			const [retired] = await Promise.allSettled([options.retire(), raw]);
+			if (retired.status === "rejected") throw retired.reason;
 		}
-		await this.options.setSessionModeFallback(modeId, timeoutMs);
+		throw error;
 	}
-	async setSessionModel(modelId, timeoutMs) {
-		this.assertCanHandleControlRequest();
-		const activeController = this.activeController;
-		if (activeController) return await this.options.withTimeout(async () => await activeController.setSessionModel(modelId), timeoutMs);
-		return await this.options.setSessionModelFallback(modelId, timeoutMs);
+}
+function createOwnedSessionControls(options) {
+	return {
+		setSessionMode: async (modeId, deadline) => {
+			await acceptControl(options, (authority) => options.client.setSessionMode(options.sessionId(), modeId, authority), () => setDesiredModeId(options.record, modeId), deadline);
+		},
+		setSessionModel: async (modelId, deadline) => {
+			const models = advertisedModelState(options.record.acpx);
+			return await acceptControl(options, (authority) => options.client.setSessionModel(options.sessionId(), modelId, models, authority), (response) => {
+				options.record.acpx = applyModelSelection(options.record.acpx, modelId, response);
+			}, deadline);
+		},
+		setSessionConfigOption: async (configId, value, deadline) => {
+			const models = advertisedModelState(options.record.acpx);
+			return await acceptControl(options, (authority) => options.client.setSessionConfigOption(options.sessionId(), configId, value, models, authority), (response) => {
+				options.record.acpx = applyConfigOptionSelection(options.record.acpx, configId, value, response, models?.configId);
+			}, deadline);
+		}
+	};
+}
+async function runIdleControlWithRecord(options, record, invoke) {
+	const { client, deadline } = options;
+	deadline.assertActive();
+	let retirement;
+	const retire = () => {
+		retirement ??= client.close().catch((error) => {
+			options.onRetirementFailure();
+			throw error;
+		});
+		return retirement;
+	};
+	const onAbort = () => {
+		retire().catch(() => {});
+	};
+	const checkpoint = async () => {
+		record.lastUsedAt = isoNow$1();
+		applyLifecycleSnapshotToRecord(record, client.getAgentLifecycleSnapshot());
+		await writeSessionRecord(record);
+	};
+	let sessionId = record.acpSessionId;
+	const controls = createOwnedSessionControls({
+		client,
+		record,
+		sessionId: () => sessionId,
+		checkpoint,
+		retire
+	});
+	client.setEventHandlers({ onSessionUpdate: (notification) => {
+		record.acpx = recordSessionUpdate(record, record.acpx, notification);
+	} });
+	deadline.timeoutSignal.addEventListener("abort", onAbort, { once: true });
+	let connected = false;
+	let completed = false;
+	try {
+		await connectAndLoadSession({
+			client,
+			record,
+			resumePolicy: "same-session-only",
+			replacingConfigOption: options.replacingConfigOption,
+			timeoutMs: deadline.remainingMs,
+			authority: deadline.authority,
+			verbose: options.verbose,
+			activeController: {
+				...controls,
+				hasActivePrompt: () => client.hasActivePrompt(),
+				requestCancelActivePrompt: () => client.requestCancelActivePrompt()
+			},
+			onSessionIdResolved: (value) => {
+				sessionId = value;
+			}
+		});
+		connected = true;
+		deadline.assertActive();
+		const value = await invoke(controls, deadline);
+		completed = true;
+		return value;
+	} finally {
+		deadline.timeoutSignal.removeEventListener("abort", onAbort);
+		try {
+			if (!connected) await retire();
+			await retirement;
+			if (!completed || retirement) await checkpoint().catch(() => {});
+		} finally {
+			client.clearEventHandlers();
+		}
 	}
-	async setSessionConfigOption(configId, value, timeoutMs) {
-		this.assertCanHandleControlRequest();
-		const activeController = this.activeController;
-		if (activeController) return await this.options.withTimeout(async () => await activeController.setSessionConfigOption(configId, value), timeoutMs);
-		return await this.options.setSessionConfigOptionFallback(configId, value, timeoutMs);
+}
+async function runIdleOwnerControl(options, invoke) {
+	const { acpxRecordId } = await resolveSessionRecord(options.sessionId);
+	const ownership = await acquireSessionTurn(acpxRecordId, options.deadline.signal).catch((error) => {
+		options.deadline.assertActive();
+		throw error;
+	});
+	try {
+		return await runIdleControlWithRecord(options, await resolveSessionRecord(acpxRecordId), invoke);
+	} finally {
+		await ownership[Symbol.asyncDispose]();
 	}
-};
+}
 //#endregion
 //#region src/session/execution/queue-owner-process.ts
 function isNonEmptyStringArray(value) {
@@ -6223,20 +6673,27 @@ function responseMetaField(meta) {
 	return meta === void 0 ? {} : { _meta: meta };
 }
 function recoveredSessionResult(response, conversation, promptMessageId) {
-	recordPromptResponseUsage(conversation, response?.usage, promptMessageId);
+	recordPromptResponseUsage(conversation, response.usage, promptMessageId);
 	return {
-		stopReason: "end_turn",
+		stopReason: response.stopReason,
 		source: "session",
-		...responseMetaField(response?._meta)
+		...responseMetaField(response._meta)
 	};
 }
-function abortTimedOutRequests(error, client, sessionId) {
-	if (error instanceof TimeoutError) client.endPromptElicitation?.(sessionId);
+function abortTimedOutRequests(error, lifetime) {
+	if (error instanceof TimeoutError) lifetime.abort(error);
+}
+function promptRequestAuthority(lifetime, authority) {
+	return {
+		signal: authority?.signal ? AbortSignal.any([authority.signal, lifetime.signal]) : lifetime.signal,
+		assertActive: () => assertControlAuthority(authority)
+	};
 }
 async function runPromptTurn(params) {
 	let settledResponse;
+	const lifetime = new AbortController();
 	try {
-		const promptPromise = params.client.prompt(params.sessionId, params.prompt, params.onPromptRequestWritten, params.onElicitation, params.onPermissionRequest, params.authority);
+		const promptPromise = params.client.prompt(params.sessionId, params.prompt, params.onPromptRequestWritten, params.onElicitation, params.onPermissionRequest, promptRequestAuthority(lifetime, params.authority));
 		promptPromise.then((response) => {
 			settledResponse = response;
 		}, () => {});
@@ -6253,14 +6710,16 @@ async function runPromptTurn(params) {
 			...responseMetaField(response._meta)
 		};
 	} catch (error) {
-		abortTimedOutRequests(error, params.client, params.sessionId);
+		abortTimedOutRequests(error, lifetime);
 		if (!(error instanceof TimeoutError) || !params.promptMessageId) throw error;
 		await params.client.waitForSessionUpdatesIdle?.({
 			idleMs: SESSION_REPLY_IDLE_MS,
 			timeoutMs: SESSION_REPLY_DRAIN_TIMEOUT_MS
 		}).catch(() => {});
-		if (hasAgentReplyAfterPrompt(params.conversation, params.promptMessageId)) return recoveredSessionResult(settledResponse, params.conversation, params.promptMessageId);
+		if (settledResponse) return recoveredSessionResult(settledResponse, params.conversation, params.promptMessageId);
 		throw error;
+	} finally {
+		lifetime.abort();
 	}
 }
 //#endregion
@@ -6510,8 +6969,9 @@ function emitPromptDisconnectNotice(snapshot, verbose) {
 	if (!lastExit?.unexpectedDuringPrompt || !verbose) return;
 	process.stderr.write("[acpx] agent disconnected during prompt (" + lastExit.reason + ", exit=" + lastExit.exitCode + ", signal=" + (lastExit.signal ?? "none") + ")\n");
 }
-async function preparePromptRetry(error, attempt, maxRetries, hasSideEffects, suppressSdkConsoleErrors) {
+async function preparePromptRetry(error, attempt, maxRetries, hasSideEffects, suppressSdkConsoleErrors, signal) {
 	if (attempt < maxRetries && !hasSideEffects() && isRetryablePromptError(error)) {
+		signal?.throwIfAborted();
 		const delayMs = Math.min(1e3 * 2 ** attempt, 1e4);
 		emitPromptRetryNotice({
 			error,
@@ -6520,11 +6980,18 @@ async function preparePromptRetry(error, attempt, maxRetries, hasSideEffects, su
 			maxRetries,
 			suppressSdkConsoleErrors
 		});
-		await waitMs$1(delayMs);
+		await setTimeout$1(delayMs, void 0, { signal }).catch((error) => {
+			signal?.throwIfAborted();
+			throw error;
+		});
+		signal?.throwIfAborted();
 		return !hasSideEffects();
 	}
 	return false;
 }
+function isTurnCancellation(error, signal) {
+	return signal?.aborted === true && error === signal.reason;
+}
 function buildQueuedTaskRunOptions(sessionRecordId, task, options, outputFormatter) {
 	return {
 		sessionRecordId,
@@ -6546,7 +7013,9 @@ function buildQueuedTaskRunOptions(sessionRecordId, task, options, outputFormatt
 		sessionOptions: mergeSessionOptions(task.sessionOptions, options.sessionOptions),
 		onClientAvailable: options.onClientAvailable,
 		onClientClosed: options.onClientClosed,
+		onClientCloseFailure: options.onClientCloseFailure,
 		onPromptActive: options.onPromptActive,
+		onPromptFinalizing: options.onPromptFinalizing,
 		onPromptRequestWritten: () => {
 			if (task.reportPromptStarted) task.send({
 				type: "prompt_started",
@@ -6852,24 +7321,23 @@ async function runOwnedSessionPrompt(options) {
 	});
 	let activeSessionIdForControl = record.acpSessionId;
 	let notifiedClientAvailable = false;
+	let controlRetirement;
 	const activeController = {
 		hasActivePrompt: () => client.hasActivePrompt(),
 		requestCancelActivePrompt: async () => await client.requestCancelActivePrompt(),
-		setSessionMode: async (modeId) => {
-			await client.setSessionMode(activeSessionIdForControl, modeId);
-		},
-		setSessionModel: async (modelId) => {
-			const models = advertisedModelState(record.acpx);
-			const response = await client.setSessionModel(activeSessionIdForControl, modelId, models);
-			record.acpx = applyModelSelection(record.acpx, modelId, response);
-			return response;
-		},
-		setSessionConfigOption: async (configId, value) => {
-			const modelConfigId = advertisedModelState(record.acpx)?.configId;
-			const response = await client.setSessionConfigOption(activeSessionIdForControl, configId, value);
-			record.acpx = applyConfigOptionSelection(record.acpx, configId, value, response, modelConfigId);
-			return response;
-		}
+		...createOwnedSessionControls({
+			client,
+			record,
+			sessionId: () => activeSessionIdForControl,
+			checkpoint: () => liveCheckpoint.checkpoint(),
+			retire: () => {
+				controlRetirement ??= client.close().catch((error) => {
+					options.onClientCloseFailure?.();
+					throw error;
+				});
+				return controlRetirement;
+			}
+		})
 	};
 	const flushConnectOutput = (loadError) => {
 		bufferingConnectOutput = false;
@@ -6933,15 +7401,17 @@ async function runOwnedSessionPrompt(options) {
 				conversation,
 				promptMessageId,
 				onPromptRequestWritten: options.onPromptRequestWritten,
-				onPromptStarted: buildPromptStartedHook(attempt)
+				onPromptStarted: buildPromptStartedHook(attempt),
+				authority: { signal: options.waitSignal }
 			});
 		});
 		emitPromptPerfMetric(promptStartedAt, options.verbose);
 		return response;
 	};
 	const handlePromptFailure = async (error, attempt) => {
+		if (isTurnCancellation(error, options.waitSignal)) throw error;
 		const snapshot = client.getAgentLifecycleSnapshot();
-		if (snapshot.lastExit?.unexpectedDuringPrompt !== true && await preparePromptRetry(error, attempt, options.promptRetries ?? 0, () => promptTurnHadSideEffects, options.suppressSdkConsoleErrors)) return;
+		if (snapshot.lastExit?.unexpectedDuringPrompt !== true && await preparePromptRetry(error, attempt, options.promptRetries ?? 0, () => promptTurnHadSideEffects, options.suppressSdkConsoleErrors, options.waitSignal)) return;
 		await failRuntimePrompt(error, snapshot);
 	};
 	const failRuntimePrompt = async (error, snapshot) => {
@@ -6965,10 +7435,18 @@ async function runOwnedSessionPrompt(options) {
 	};
 	const runPromptWithRetries = async (sessionId) => {
 		promptTurnActive = true;
-		for (let attempt = 0;; attempt++) try {
-			return await runPromptAttempt(sessionId, attempt);
+		try {
+			for (let attempt = 0;; attempt++) {
+				options.waitSignal?.throwIfAborted();
+				try {
+					return await runPromptAttempt(sessionId, attempt);
+				} catch (error) {
+					await handlePromptFailure(error, attempt);
+				}
+			}
 		} catch (error) {
-			await handlePromptFailure(error, attempt);
+			if (isTurnCancellation(error, options.waitSignal)) return { stopReason: "cancelled" };
+			throw error;
 		}
 	};
 	const savePromptSuccess = async (response) => {
@@ -7029,7 +7507,24 @@ async function runOwnedSessionPrompt(options) {
 		}
 	};
 	const cleanupPrompt = async (attempt) => {
+		const controlDrain = options.onPromptFinalizing?.();
+		const unresolvedPrompt = client.hasUnresolvedPrompt();
 		const steps = [
+			async () => {
+				if (unresolvedPrompt) await withTimeout(client.cancelActivePrompt(INTERRUPT_CANCEL_WAIT_MS), INTERRUPT_CANCEL_WAIT_MS).catch(() => {});
+			},
+			async () => {
+				const journalFailed = attempt.status === "rejected" && attempt.error instanceof AcpxOperationalError && attempt.error.detailCode === "SESSION_JOURNAL_WRITE_FAILED";
+				if (unresolvedPrompt || closeClientOnExit || journalFailed) try {
+					await client.close();
+				} catch (error) {
+					options.onClientCloseFailure?.();
+					throw error;
+				}
+			},
+			async () => {
+				await controlDrain;
+			},
 			() => {
 				const duration = stopTotalTimer();
 				if (options.verbose) process.stderr.write(`[acpx] ${formatPerfMetric("prompt.total", duration)}\n`);
@@ -7038,10 +7533,6 @@ async function runOwnedSessionPrompt(options) {
 				if (notifiedClientAvailable) options.onClientClosed?.();
 			},
 			() => client.clearEventHandlers(),
-			async () => {
-				const journalFailed = attempt.status === "rejected" && attempt.error instanceof AcpxOperationalError && attempt.error.detailCode === "SESSION_JOURNAL_WRITE_FAILED";
-				if (closeClientOnExit || journalFailed) await client.close();
-			},
 			() => applyLifecycleSnapshotToRecord(record, client.getAgentLifecycleSnapshot()),
 			() => applyConversation(record, conversation)
 		];
@@ -7068,6 +7559,7 @@ async function runOnce(options) {
 	const shouldMarkAcpErrorsEmitted = rendersAcpErrors(options.errorEmissionPolicy);
 	let promptTurnActive = false;
 	let promptTurnHadSideEffects = false;
+	let controlState = {};
 	const acpErrors = new AcpErrorTracker();
 	const client = new AcpClient({
 		agentCommand: options.agentCommand,
@@ -7088,6 +7580,7 @@ async function runOnce(options) {
 			acpErrors.observe(output, direction, message);
 		},
 		onSessionUpdate: (notification) => {
+			if (notification.update.sessionUpdate === "config_option_update") controlState = applyConfigOptionsToState(controlState, notification.update.configOptions);
 			if (promptTurnActive) promptTurnHadSideEffects = true;
 			options.onSessionUpdate?.(notification);
 		},
@@ -7127,7 +7620,9 @@ async function runOnce(options) {
 				return await withTimeout(client.createSession(absolutePath(options.cwd)), options.timeoutMs);
 			});
 			const sessionId = createdSession.sessionId;
-			await applyRequestedModelIfAdvertised({
+			if (createdSession.models) applyAdvertisedModelState(controlState, createdSession.models);
+			controlState = applyConfigOptionsToState(controlState, createdSession.configOptions ?? []);
+			const modelApplication = await applyRequestedModelIfAdvertised({
 				client,
 				sessionId,
 				requestedModel: options.sessionOptions?.model,
@@ -7136,7 +7631,11 @@ async function runOnce(options) {
 				timeoutMs: options.timeoutMs,
 				onWarning: options.suppressSdkConsoleErrors ? void 0 : (message) => process.stderr.write(`[acpx] warning: ${message}\n`)
 			});
-			for (const configOption of options.configOptions ?? []) await withTimeout(client.setSessionConfigOption(sessionId, configOption.configId, configOption.value), options.timeoutMs);
+			if (modelApplication.response) controlState = applyConfigOptionsToState(controlState, modelApplication.response.configOptions);
+			for (const configOption of options.configOptions ?? []) {
+				const response = await withTimeout(client.setSessionConfigOption(sessionId, configOption.configId, configOption.value, advertisedModelState(controlState)), options.timeoutMs);
+				controlState = applyConfigOptionsToState(controlState, response.configOptions);
+			}
 			output.setContext({ sessionId });
 			const response = await runExecPromptWithRetries(sessionId);
 			promptTurnActive = false;
@@ -7231,54 +7730,6 @@ function createQueueOwnerSharedClient(options, sessionRecord) {
 		sessionOptions: mergeSessionOptions(options.sessionOptions, sessionOptionsFromRecord(sessionRecord))
 	});
 }
-function createQueueOwnerTurnController(options) {
-	return new QueueOwnerTurnController({
-		withTimeout: async (run, timeoutMs) => await withTimeout(run(), timeoutMs),
-		setSessionModeFallback: async (modeId, timeoutMs) => {
-			await runSessionSetModeDirect({
-				sessionRecordId: options.sessionId,
-				modeId,
-				mcpServers: options.mcpServers,
-				nonInteractivePermissions: options.nonInteractivePermissions,
-				authCredentials: options.authCredentials,
-				authPolicy: options.authPolicy,
-				fs: options.fs,
-				terminal: options.terminal,
-				timeoutMs,
-				verbose: options.verbose
-			});
-		},
-		setSessionModelFallback: async (modelId, timeoutMs) => {
-			return (await runSessionSetModelDirect({
-				sessionRecordId: options.sessionId,
-				modelId,
-				mcpServers: options.mcpServers,
-				nonInteractivePermissions: options.nonInteractivePermissions,
-				authCredentials: options.authCredentials,
-				authPolicy: options.authPolicy,
-				fs: options.fs,
-				terminal: options.terminal,
-				timeoutMs,
-				verbose: options.verbose
-			})).response;
-		},
-		setSessionConfigOptionFallback: async (configId, value, timeoutMs) => {
-			return (await runSessionSetConfigOptionDirect({
-				sessionRecordId: options.sessionId,
-				configId,
-				value,
-				mcpServers: options.mcpServers,
-				nonInteractivePermissions: options.nonInteractivePermissions,
-				authCredentials: options.authCredentials,
-				authPolicy: options.authPolicy,
-				fs: options.fs,
-				terminal: options.terminal,
-				timeoutMs,
-				verbose: options.verbose
-			})).response;
-		}
-	});
-}
 function logDeferredCancelFailure(error, verbose) {
 	if (!verbose) return;
 	process.stderr.write(`[acpx] failed to apply deferred cancel: ${formatErrorMessage(error)}\n`);
@@ -7322,16 +7773,17 @@ function createQueueOwnerShutdownController(params) {
 	let shutdownPromise;
 	const drainActiveTurn = async () => {
 		const turn = activeTurn;
-		if (!turn) return;
-		params.turnController.requestCancel().catch((error) => {
+		const pending = Promise.allSettled([turn, params.controls.drainAdmitted()]);
+		if (turn) params.turnController.requestCancel().catch((error) => {
 			logDeferredCancelFailure(error, params.verbose);
 		});
-		if (!await settlesWithin(turn, QUEUE_OWNER_ACTIVE_TURN_CANCEL_GRACE_MS)) await params.sharedClient.close().catch(() => {});
-		await turn.catch(() => {});
+		if (!await settlesWithin(pending, QUEUE_OWNER_ACTIVE_TURN_CANCEL_GRACE_MS)) await params.sharedClient.close().catch(() => {});
+		await pending;
 	};
 	const request = () => {
 		requested = true;
 		params.stopHeartbeat();
+		params.controls.stopAdmission();
 		params.getOwner()?.beginShutdown();
 		activeTurnShutdown ??= drainActiveTurn();
 	};
@@ -7342,14 +7794,20 @@ function createQueueOwnerShutdownController(params) {
 		request,
 		setActiveTurn: (turn) => {
 			activeTurn = turn;
+			if (requested) activeTurnShutdown = Promise.all([activeTurnShutdown, drainActiveTurn()]).then(() => {});
 		},
 		clearActiveTurn: (turn) => {
 			if (activeTurn === turn) activeTurn = void 0;
 		},
+		drain: () => {
+			request();
+			return activeTurnShutdown;
+		},
 		shutdown: () => {
 			request();
 			shutdownPromise ??= (async () => {
 				await activeTurnShutdown;
+				await params.getBackendClose()?.catch(() => {});
 				await closeQueueOwnerRuntime({
 					owner: params.getOwner(),
 					turnController: params.turnController,
@@ -7368,20 +7826,50 @@ function applyRequestedShutdown(owner, shutdown) {
 function startQueueOwnerHeartbeat(params) {
 	if (!params.enabled) return;
 	return setInterval(() => {
-		refreshQueueOwnerLease(params.lease, { queueDepth: params.owner.queueDepth() }).catch(() => {});
+		params.refresh(params.owner.queueDepth());
 	}, QUEUE_OWNER_HEARTBEAT_INTERVAL_MS);
 }
+function createLeaseHeartbeat(lease, shutdown) {
+	let guardFailure;
+	return {
+		refresh: async (queueDepth) => {
+			if (shutdown.requested) return;
+			await refreshQueueOwnerLease(lease, { queueDepth }).catch((error) => {
+				if (error instanceof QueueLeaseGuardSettlementError) {
+					guardFailure ??= error;
+					shutdown.request();
+				}
+			});
+		},
+		throwIfFailed: () => {
+			if (guardFailure) throw guardFailure;
+		}
+	};
+}
 async function runSessionQueueOwner(options) {
 	const lease = await tryAcquireQueueOwnerLease(options.sessionId, {
 		path: options.mcpConfigPath,
 		fingerprint: options.mcpConfigFingerprint
 	});
 	if (!lease) return;
+	let runtimeFailure;
 	try {
 		await runQueueOwnerRuntime(options, lease);
-	} finally {
+	} catch (error) {
+		runtimeFailure = { error };
+	}
+	try {
 		await releaseQueueOwnerLease(lease);
+	} catch (error) {
+		if (runtimeFailure) throw new AggregateError([runtimeFailure.error, error], "Queue owner shutdown failed", { cause: error });
+		throw error;
 	}
+	if (runtimeFailure) throw runtimeFailure.error;
+}
+async function keepOwnerForPendingControls(controls, shutdown) {
+	if (shutdown.requested || !controls.hasPending) return false;
+	await controls.drainAdmitted();
+	return !shutdown.requested;
 }
 async function runQueueOwnerRuntime(options, lease) {
 	const sessionRecord = await resolveSessionRecord(options.sessionId);
@@ -7392,7 +7880,16 @@ async function runQueueOwnerRuntime(options, lease) {
 	const maxQueueDepth = Math.max(1, Math.round(options.maxQueueDepth ?? 16));
 	const taskPollTimeoutMs = ttlMs === 0 ? void 0 : ttlMs;
 	const initialTaskPollTimeoutMs = taskPollTimeoutMs == null ? void 0 : Math.max(taskPollTimeoutMs, 1e3);
-	const turnController = createQueueOwnerTurnController(options);
+	const turnController = new QueueOwnerTurnController();
+	let activeControls;
+	let backendCloseRequest;
+	const controls = new QueueOwnerControlAdmission({ runIdle: async (invoke, controlOptions) => await runIdleOwnerControl({
+		...controlOptions,
+		client: sharedClient,
+		sessionId: options.sessionId,
+		verbose: options.verbose,
+		onRetirementFailure: () => shutdown.request()
+	}, invoke) });
 	const applyPendingCancel = async () => {
 		return await turnController.applyPendingCancel();
 	};
@@ -7402,23 +7899,34 @@ async function runQueueOwnerRuntime(options, lease) {
 		});
 	};
 	const setActiveController = (controller) => {
+		activeControls = controller;
 		turnController.setActiveController(controller);
 		scheduleApplyPendingCancel();
 	};
 	const clearActiveController = () => {
+		activeControls = void 0;
 		turnController.clearActiveController();
 	};
-	const closeActiveBackendSession = async (timeoutMs) => {
-		const latestRecord = await resolveSessionRecord(options.sessionId);
-		if (!sharedClient.supportsCloseSession()) return false;
-		await withTimeout(sharedClient.closeSession(latestRecord.acpSessionId), timeoutMs);
-		return true;
+	const closeActiveBackendSession = (timeoutMs) => {
+		backendCloseRequest ??= Promise.resolve().then(async () => {
+			await shutdown.drain();
+			const latestRecord = await resolveSessionRecord(options.sessionId);
+			if (!sharedClient.supportsCloseSession()) return false;
+			await withTimeout(sharedClient.closeSession(latestRecord.acpSessionId), timeoutMs);
+			return true;
+		});
+		return backendCloseRequest;
 	};
 	const runPromptTurn = async (run) => {
 		const waitSignal = turnController.beginTurn();
+		const { ticket, priorIdle } = controls.beginPrompt();
+		if (shutdown.requested) turnController.requestCancel().catch(() => {});
 		try {
-			return await run(waitSignal);
+			await priorIdle;
+			return await run(waitSignal, ticket);
 		} finally {
+			await controls.seal(ticket);
+			controls.release(ticket);
 			turnController.endTurn();
 		}
 	};
@@ -7431,6 +7939,8 @@ async function runQueueOwnerRuntime(options, lease) {
 			}
 		},
 		turnController,
+		controls,
+		getBackendClose: () => backendCloseRequest,
 		sharedClient,
 		sessionId: options.sessionId,
 		verbose: options.verbose
@@ -7438,6 +7948,7 @@ async function runQueueOwnerRuntime(options, lease) {
 	const onSignal = () => {
 		shutdown.request();
 	};
+	const heartbeat = createLeaseHeartbeat(lease, shutdown);
 	process.once("SIGINT", onSignal);
 	process.once("SIGTERM", onSignal);
 	process.once("SIGHUP", onSignal);
@@ -7450,17 +7961,17 @@ async function runQueueOwnerRuntime(options, lease) {
 			},
 			closeSession: async (timeoutMs) => await closeActiveBackendSession(timeoutMs),
 			setSessionMode: async (modeId, timeoutMs) => {
-				await turnController.setSessionMode(modeId, timeoutMs);
+				await controls.run((context, deadline) => context.setSessionMode(modeId, deadline), timeoutMs);
 			},
-			setSessionModel: async (modelId, timeoutMs) => await turnController.setSessionModel(modelId, timeoutMs),
+			setSessionModel: async (modelId, timeoutMs) => await controls.run((context, deadline) => context.setSessionModel(modelId, deadline), timeoutMs, { key: "model" }),
 			setSessionConfigOption: async (configId, value, timeoutMs) => {
-				return await turnController.setSessionConfigOption(configId, value, timeoutMs);
+				return await controls.run((context, deadline) => context.setSessionConfigOption(configId, value, deadline), timeoutMs, { key: configId });
 			}
 		}, {
 			maxQueueDepth,
 			onQueueDepthChanged: (queueDepth) => {
 				setPerfGauge("queue.owner.depth", queueDepth);
-				refreshQueueOwnerLease(lease, { queueDepth }).catch(() => {});
+				heartbeat.refresh(queueDepth);
 			}
 		});
 		applyRequestedShutdown(owner, shutdown);
@@ -7470,19 +7981,22 @@ async function runQueueOwnerRuntime(options, lease) {
 			maxQueueDepth,
 			verbose: options.verbose
 		});
-		await refreshQueueOwnerLease(lease, { queueDepth: owner.queueDepth() }).catch(() => {});
+		await heartbeat.refresh(owner.queueDepth());
 		heartbeatTimer = startQueueOwnerHeartbeat({
 			enabled: !shutdown.requested,
-			lease,
+			refresh: heartbeat.refresh,
 			owner
 		});
 		let isFirstTask = true;
 		while (true) {
 			const pollTimeoutMs = isFirstTask ? initialTaskPollTimeoutMs : taskPollTimeoutMs;
 			const task = await owner.nextTask(pollTimeoutMs);
-			if (!task) break;
+			if (!task) {
+				if (await keepOwnerForPendingControls(controls, shutdown)) continue;
+				break;
+			}
 			isFirstTask = false;
-			const turnPromise = runPromptTurn(async (waitSignal) => {
+			const turnPromise = runPromptTurn(async (waitSignal, ticket) => {
 				try {
 					await runQueuedTask(options.sessionId, task, {
 						sharedClient,
@@ -7496,7 +8010,10 @@ async function runQueueOwnerRuntime(options, lease) {
 						sessionOptions: options.sessionOptions,
 						onClientAvailable: setActiveController,
 						onClientClosed: clearActiveController,
+						onClientCloseFailure: shutdown.request,
+						onPromptFinalizing: () => controls.seal(ticket),
 						onPromptActive: async () => {
+							if (activeControls) controls.publish(ticket, activeControls);
 							turnController.markPromptActive();
 							await applyPendingCancel();
 						},
@@ -7520,7 +8037,9 @@ async function runQueueOwnerRuntime(options, lease) {
 		process.off("SIGTERM", onSignal);
 		process.off("SIGHUP", onSignal);
 		await shutdown.shutdown();
+		await lease.updates;
 	}
+	heartbeat.throwIfFailed();
 }
 async function sendSession(options) {
 	options.signal?.throwIfAborted();
@@ -7560,6 +8079,6 @@ async function sendSession(options) {
 }
 const queueOwnerRuntimeTestInternals = { queueOwnerExitIsFatal };
 //#endregion
-export { normalizeQueueOwnerTtlMs as $, setDesiredModeId as A, recordClientOperation as B, withConnectedSession as C, applyInitialModelSelection as D, applyConfigOptionsToRecord as E, createInitialSessionRecord as F, AcpClient as G, recordSessionUpdate as H, reconcileAgentSessionId as I, RequestedModelUnsupportedError as J, REQUESTED_MODEL_UNSUPPORTED_ERROR_CODE as K, cloneSessionAcpxState as L, sessionOptionsFromRecord as M, applyConversation as N, applyModelSelection as O, applyLifecycleSnapshotToRecord as P, DEFAULT_QUEUE_OWNER_TTL_MS as Q, cloneSessionConversation as R, setSessionModel as S, applyConfigOptionSelection as T, trimConversationForRuntime as U, recordPromptSubmission as V, advertisedModelState as W, getAcpxVersion as X, isRequestedModelUnsupportedError as Y, permissionModeSatisfies as Z, cancelSessionPrompt as _, runQueuedTask as a, withInterrupt as at, setSessionConfigOption as b, LiveSessionCheckpoint as c, normalizeOutputError as ct, flushPerfMetricsCapture as d, listSessionEvents as et, installPerfMetricsCapture as f, listAgentSessions as g, ensureSession as h, runOnce as i, assertControlAuthority as it, persistSessionOptions as j, applyRequestedModelIfAdvertised as k, runPromptTurn as l, createSessionWithClient as m, runSessionQueueOwner as n, InterruptedError as nt, sendSessionDirect as o, withTimeout as ot, createSession as p, REQUESTED_MODEL_UNSUPPORTED_REASONS as q, sendSession as r, TimeoutError as rt, DISCARD_OUTPUT_FORMATTER as s, exitCodeForOutputErrorCode as st, queueOwnerRuntimeTestInternals as t, isLegacyZedCodexAcpInvocation as tt, buildQueueOwnerArgOverride as u, closeSession as v, connectAndLoadSession as w, setSessionMode as x, sessionControlTestInternals as y, createSessionConversation as z };
+export { getAcpxVersion as $, applyInitialModelSelection as A, cloneSessionAcpxState as B, setSessionModeOnOwner as C, connectAndLoadSession as D, withConnectedSession as E, sessionOptionsFromRecord as F, recordSessionUpdate as G, createSessionConversation as H, applyConversation as I, AcpClient as J, trimConversationForRuntime as K, applyLifecycleSnapshotToRecord as L, applyRequestedModelIfAdvertised as M, setDesiredModeId as N, applyConfigOptionSelection as O, persistSessionOptions as P, isRequestedModelUnsupportedError as Q, createInitialSessionRecord as R, setSessionMode as S, setSessionModelOnOwner as T, recordClientOperation as U, cloneSessionConversation as V, recordPromptSubmission as W, REQUESTED_MODEL_UNSUPPORTED_REASONS as X, REQUESTED_MODEL_UNSUPPORTED_ERROR_CODE as Y, RequestedModelUnsupportedError as Z, cancelSessionPrompt as _, runQueuedTask as a, InterruptedError as at, setSessionConfigOption as b, LiveSessionCheckpoint as c, withInterrupt as ct, flushPerfMetricsCapture as d, normalizeOutputError as dt, permissionModeSatisfies as et, installPerfMetricsCapture as f, listAgentSessions as g, ensureSession as h, runOnce as i, isLegacyZedCodexAcpInvocation as it, applyModelSelection as j, applyConfigOptionsToRecord as k, runPromptTurn as l, withTimeout as lt, createSessionWithClient as m, runSessionQueueOwner as n, normalizeQueueOwnerTtlMs as nt, sendSessionDirect as o, TimeoutError as ot, createSession as p, advertisedModelState as q, sendSession as r, listSessionEvents as rt, DISCARD_OUTPUT_FORMATTER as s, assertControlAuthority as st, queueOwnerRuntimeTestInternals as t, DEFAULT_QUEUE_OWNER_TTL_MS as tt, buildQueueOwnerArgOverride as u, exitCodeForOutputErrorCode as ut, closeSession as v, setSessionModel as w, setSessionConfigOptionOnOwner as x, sessionControlTestInternals as y, reconcileAgentSessionId as z };
 
-//# sourceMappingURL=queue-owner-runtime-Dgv3e2Tp.js.map
+//# sourceMappingURL=queue-owner-runtime-Cr0dWJuL.js.map