acpx 0.17.1 → 0.19.0

package/dist/{queue-owner-runtime-Dgv3e2Tp.js → queue-owner-runtime-CLwjMYNL.js}

@@ -1,5 +1,5 @@
-import { $ as startPerfTimer, At as AgentSpawnError, B as extractAgentSessionId, Bt as SessionModeReplayError, C as textPrompt, Ct as OUTPUT_ERROR_ORIGINS, E as findGitRepositoryRoot, F as resolveSessionRecord, Ft as GeminiAcpStartupTimeoutError, H as SESSION_JOURNAL_SCHEMA, I as writeSessionRecord, It as PermissionDeniedError, J as incrementPerfCounter, K as formatPerfMetric, Lt as PermissionPromptUnavailableError, M as normalizeName, Mt as AuthPolicyError, Nt as ClaudeAcpSessionCreateTimeoutError, O as findSessionByDirectoryWalk, Ot as AcpxOperationalError, Pt as CopilotAcpUnsupportedError, Q as setPerfGauge, Rt as QueueConnectionError, S as promptToDisplayText, St as OUTPUT_ERROR_CODES, T as absolutePath, U as SessionJournalReader, Ut as SessionResumeRequiredError, V as normalizeAgentSessionId, Vt as SessionModelReplayError, Wt as UnsupportedPromptContentError, X as recordPerfDuration, Y as measurePerf, Z as resetPerfMetrics, _ as waitMs$1, _t as formatUnknownErrorMessage, a as trySetModelOnRunningOwner, bt as EXIT_CODES, c as queueRequestExceedsLimit, ct as defaultSessionEventLog, dt as sessionEventLockPath, f as refreshQueueOwnerLease, ft as sessionEventSegmentPath, g as tryAcquireQueueOwnerLease, gt as extractAcpError, h as terminateQueueOwnerForSession, ht as isProcessAlive, i as trySetModeOnRunningOwner, jt as AgentStartupError, k as isoNow$1, kt as AgentDisconnectedError, l as parseQueueRequest, lt as sessionBaseDir, m as terminateProcess, n as tryCloseSessionOnRunningOwner, nt as isAcpMessageObject, o as trySubmitToRunningOwner, p as releaseQueueOwnerLease, q as getPerfMetricsSnapshot, r as trySetConfigOptionOnRunningOwner, rt as isSessionUpdateNotification, s as queueRequestByteLimit, t as tryCancelOnRunningOwner, tt as isAcpJsonRpcMessage, ut as sessionEventActivePath, vt as isAcpResourceNotFoundError, y as getUnsupportedPromptContentMessage, zt as SessionConfigOptionReplayError } from "./ipc-D2rstexT.js";
-import { A as resolveAgentCommandParts, C as asAbsoluteCwd, E as isoNow$2, F as waitForSpawn, M as runTimedExecFile, N as splitCommandLine, P as waitForChildExit, S as PROCESS_HELPER_TIMEOUT_MS, T as isChildProcessRunning, _ as buildSpawnCommandOptions, b as readWindowsEnvValue, f as resolveBuiltInAgentLaunch, g as buildAgentSpawnCommand, j as resolveAgentSessionCwd, k as requireAgentStdio, v as buildTerminalShellSpawnCommand, w as basenameToken, x as resolveWindowsExecutablePath, y as buildTerminalSpawnCommand } from "./agent-registry-evUoJINz.js";
+import { $ as measurePerf, A as findGitRepositoryRoot, B as writeSessionRecord, Bt as PermissionDeniedError, C as getUnsupportedPromptContentMessage, D as textPrompt, Dt as OUTPUT_ERROR_ORIGINS, E as promptToDisplayText, Et as OUTPUT_ERROR_CODES, Ft as AgentStartupError, G as normalizeAgentSessionId, Gt as SessionModelReplayError, Ht as QueueConnectionError, I as normalizeName, It as AuthPolicyError, Jt as UnsupportedPromptContentError, K as SESSION_JOURNAL_SCHEMA, Lt as ClaudeAcpSessionCreateTimeoutError, M as findSessionByDirectoryWalk, Mt as AcpxOperationalError, N as isoNow$1, Nt as AgentDisconnectedError, Pt as AgentSpawnError, Q as incrementPerfCounter, Rt as CopilotAcpUnsupportedError, St as isAcpResourceNotFoundError, Ut as SessionConfigOptionReplayError, Vt as PermissionPromptUnavailableError, W as extractAgentSessionId, Wt as SessionModeReplayError, X as formatPerfMetric, Z as getPerfMetricsSnapshot, _ as waitMs$1, a as trySetModelOnRunningOwner, at as isAcpJsonRpcMessage, b as lockOwnerPid, bt as extractAcpError, c as queueRequestExceedsLimit, et as recordPerfDuration, f as refreshQueueOwnerLease, ft as defaultSessionEventLog, g as tryAcquireQueueOwnerLease, gt as sessionEventSegmentPath, h as terminateQueueOwnerForSession, ht as sessionEventLockPath, i as trySetModeOnRunningOwner, k as absolutePath, l as parseQueueRequest, m as terminateProcess, mt as sessionEventActivePath, n as tryCloseSessionOnRunningOwner, nt as setPerfGauge, o as trySubmitToRunningOwner, ot as isAcpMessageObject, p as releaseQueueOwnerLease, pt as sessionBaseDir, q as SessionJournalReader, qt as SessionResumeRequiredError, r as trySetConfigOptionOnRunningOwner, rt as startPerfTimer, s as queueRequestByteLimit, st as isSessionUpdateNotification, t as tryCancelOnRunningOwner, tt as resetPerfMetrics, v as QueueLeaseGuardSettlementError, wt as EXIT_CODES, x as readProcessTable, xt as formatUnknownErrorMessage, y as createLockOwner, yt as isProcessAlive, z as resolveSessionRecord, zt as GeminiAcpStartupTimeoutError } from "./ipc-fMgj5vrO.js";
+import { A as resolveAgentCommandParts, C as asAbsoluteCwd, E as isoNow$2, F as waitForSpawn, M as runTimedExecFile, N as splitCommandLine, P as waitForChildExit, S as PROCESS_HELPER_TIMEOUT_MS, T as isChildProcessRunning, _ as buildSpawnCommandOptions, b as readWindowsEnvValue, f as resolveBuiltInAgentLaunch, g as buildAgentSpawnCommand, j as resolveAgentSessionCwd, k as requireAgentStdio, v as buildTerminalShellSpawnCommand, w as basenameToken, x as resolveWindowsExecutablePath, y as buildTerminalSpawnCommand } from "./agent-registry-Ct2yWPW7.js";
 import fs, { readFileSync, realpathSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import path from "node:path";
@@ -15,6 +15,7 @@ import { isPathInside } from "@openclaw/fs-safe/path";
 import { root } from "@openclaw/fs-safe/root";
 import readline from "node:readline/promises";
 import { isHardlinkFallbackError } from "@openclaw/fs-safe/durability";
+import { acquireFileLock } from "@openclaw/fs-safe/file-lock";
 import net from "node:net";
 //#region src/acp/error-normalization.ts
 const AUTH_REQUIRED_ACP_CODES = /* @__PURE__ */ new Set([-32e3]);
@@ -484,22 +485,69 @@ function normalizeQueueOwnerTtlMs(ttlMs) {
 	return Math.round(ttlMs);
 }
 //#endregion
+//#region src/file-read-window.ts
+function sliceReadWindow(content, line, limit) {
+	if (line == null && limit == null) return content;
+	const lines = content.split("\n");
+	const startIndex = Math.max(0, (line == null ? 1 : Math.max(1, Math.trunc(line))) - 1);
+	const maxLines = limit == null ? void 0 : Math.max(0, Math.trunc(limit));
+	if (maxLines === 0) return "";
+	const endIndex = maxLines == null ? lines.length : Math.min(lines.length, startIndex + maxLines);
+	return lines.slice(startIndex, endIndex).join("\n");
+}
+//#endregion
 //#region src/permission-prompt.ts
+let promptQueue = Promise.resolve();
 async function promptForPermission(options) {
-	if (!process.stdin.isTTY || !process.stderr.isTTY) return false;
-	if (options.header) process.stderr.write(`\n${options.header}\n`);
-	if (options.details && options.details.trim().length > 0) process.stderr.write(`${options.details}\n`);
+	options.signal?.throwIfAborted();
+	const result = promptQueue.then(() => askPermission(options));
+	promptQueue = result.then(() => {}, () => {});
+	const signal = options.signal;
+	if (!signal) return await result;
+	let onAbort = () => {};
+	const aborted = new Promise((_, reject) => {
+		onAbort = () => reject(signal.reason);
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+	try {
+		return await Promise.race([result, aborted]);
+	} finally {
+		signal.removeEventListener("abort", onAbort);
+	}
+}
+async function askPermission(options) {
+	options.signal?.throwIfAborted();
+	if (!canPrompt()) return false;
+	writePromptDetails(options);
 	const rl = readline.createInterface({
 		input: process.stdin,
 		output: process.stderr
 	});
+	const questionController = new AbortController();
+	const signal = options.signal ? AbortSignal.any([options.signal, questionController.signal]) : questionController.signal;
+	let onClose = () => {};
+	const closed = new Promise((resolve) => {
+		onClose = () => resolve(void 0);
+		rl.once("close", onClose);
+	});
 	try {
-		const normalized = (await rl.question(options.prompt)).trim().toLowerCase();
+		const answer = await Promise.race([rl.question(options.prompt, { signal }), closed]);
+		options.signal?.throwIfAborted();
+		const normalized = answer?.trim().toLowerCase();
 		return normalized === "y" || normalized === "yes";
 	} finally {
+		rl.removeListener("close", onClose);
+		questionController.abort();
 		rl.close();
 	}
 }
+function canPrompt() {
+	return process.stdin.isTTY && process.stderr.isTTY && !process.stdin.readableEnded && !process.stdin.destroyed;
+}
+function writePromptDetails(options) {
+	if (options.header) process.stderr.write(`\n${options.header}\n`);
+	if (options.details && options.details.trim().length > 0) process.stderr.write(`${options.details}\n`);
+}
 //#endregion
 //#region src/filesystem.ts
 const WRITE_PREVIEW_MAX_LINES = 16;
@@ -515,11 +563,12 @@ function toWritePreview(content) {
 	if (preview.length > WRITE_PREVIEW_MAX_CHARS) preview = `${preview.slice(0, 1197)}...`;
 	return preview;
 }
-async function defaultConfirmWrite(filePath, preview) {
+async function defaultConfirmWrite(filePath, preview, signal) {
 	return await promptForPermission({
 		header: `[permission] Allow write to ${filePath}?`,
 		details: preview,
-		prompt: "Allow write? (y/N) "
+		prompt: "Allow write? (y/N) ",
+		signal
 	});
 }
 function canPromptForPermission$2() {
@@ -545,7 +594,8 @@ var FileSystemHandlers = class {
 		this.permissionMode = permissionMode;
 		this.nonInteractivePermissions = nonInteractivePermissions ?? "deny";
 	}
-	async readTextFile(params) {
+	async readTextFile(params, authority) {
+		assertControlAuthority(authority);
 		const filePath = this.resolvePathWithinRoot(params.path);
 		const summary = `read_text_file: ${filePath}`;
 		this.emitOperation({
@@ -557,8 +607,9 @@ var FileSystemHandlers = class {
 		});
 		try {
 			if (this.permissionMode === "deny-all") throw new PermissionDeniedError("Permission denied for fs/read_text_file (--deny-all)");
-			const content = await (await this.getWorkspace()).readText(`.${path.sep}${path.relative(this.rootDir, filePath)}`);
-			const sliced = this.sliceContent(content, params.line, params.limit);
+			const content = await (await this.getWorkspace()).readText(filePath);
+			assertControlAuthority(authority);
+			const sliced = sliceReadWindow(content, params.line, params.limit);
 			this.emitOperation({
 				method: "fs/read_text_file",
 				status: "completed",
@@ -579,7 +630,8 @@ var FileSystemHandlers = class {
 			throw error;
 		}
 	}
-	async writeTextFile(params) {
+	async writeTextFile(params, authority) {
+		assertControlAuthority(authority);
 		const filePath = this.resolvePathWithinRoot(params.path);
 		const preview = toWritePreview(params.content);
 		const summary = `write_text_file: ${filePath}`;
@@ -591,9 +643,17 @@ var FileSystemHandlers = class {
 			timestamp: nowIso$1()
 		});
 		try {
-			if (!await this.isWriteApproved(filePath, preview)) throw new PermissionDeniedError("Permission denied for fs/write_text_file");
-			const file = await (await this.getWorkspace()).openWritable(`.${path.sep}${path.relative(this.rootDir, filePath)}`, { mode: 438 });
+			const approved = await this.isWriteApproved(filePath, preview, authority?.signal);
+			assertControlAuthority(authority);
+			if (!approved) throw new PermissionDeniedError("Permission denied for fs/write_text_file");
+			const workspace = await this.getWorkspace();
+			const target = await workspace.resolve(filePath);
+			const file = await workspace.openWritable(target, {
+				mode: 438,
+				assertBeforeMutation: () => assertControlAuthority(authority)
+			});
 			try {
+				assertControlAuthority(authority);
 				await file.handle.writeFile(params.content, "utf8");
 			} finally {
 				await file.handle.close();
@@ -618,17 +678,17 @@ var FileSystemHandlers = class {
 			throw error;
 		}
 	}
-	async isWriteApproved(filePath, preview) {
+	async isWriteApproved(filePath, preview, signal) {
 		if (this.permissionMode === "approve-all") return true;
 		if (this.permissionMode === "deny-all") return false;
 		if (this.usesDefaultConfirmWrite && this.nonInteractivePermissions === "fail" && !canPromptForPermission$2()) throw new PermissionPromptUnavailableError();
-		return await this.confirmWrite(filePath, preview);
+		return await this.confirmWrite(filePath, preview, signal);
 	}
 	resolvePathWithinRoot(rawPath) {
 		if (!path.isAbsolute(rawPath)) throw new Error(`Path must be absolute: ${rawPath}`);
 		const resolved = path.resolve(rawPath);
 		if (!isPathInside(this.rootDir, resolved)) throw new Error(`Path is outside allowed cwd subtree: ${resolved}`);
-		return resolved;
+		return rawPath;
 	}
 	getWorkspace() {
 		return this.workspace ??= root(this.rootDir, {
@@ -637,15 +697,6 @@ var FileSystemHandlers = class {
 			maxBytes: Infinity
 		});
 	}
-	sliceContent(content, line, limit) {
-		if (line == null && limit == null) return content;
-		const lines = content.split("\n");
-		const startIndex = Math.max(0, (line == null ? 1 : Math.max(1, Math.trunc(line))) - 1);
-		const maxLines = limit == null ? void 0 : Math.max(0, Math.trunc(limit));
-		if (maxLines === 0) return "";
-		const endIndex = maxLines == null ? lines.length : Math.min(lines.length, startIndex + maxLines);
-		return lines.slice(startIndex, endIndex).join("\n");
-	}
 	readWindowDetails(line, limit) {
 		if (line == null && limit == null) return;
 		return `line=${line == null ? 1 : Math.max(1, Math.trunc(line))}, limit=${limit == null ? "all" : Math.max(0, Math.trunc(limit))}`;
@@ -691,11 +742,11 @@ function pickOption(options, kinds) {
 const TOOL_KIND_TITLE_MATCHERS = [
 	{
 		kind: "read",
-		needles: ["read", "cat"]
+		names: ["read", "cat"]
 	},
 	{
 		kind: "search",
-		needles: [
+		names: [
 			"search",
 			"find",
 			"grep"
@@ -703,7 +754,7 @@ const TOOL_KIND_TITLE_MATCHERS = [
 	},
 	{
 		kind: "edit",
-		needles: [
+		names: [
 			"write",
 			"edit",
 			"patch"
@@ -711,15 +762,15 @@ const TOOL_KIND_TITLE_MATCHERS = [
 	},
 	{
 		kind: "delete",
-		needles: ["delete", "remove"]
+		names: ["delete", "remove"]
 	},
 	{
 		kind: "move",
-		needles: ["move", "rename"]
+		names: ["move", "rename"]
 	},
 	{
 		kind: "execute",
-		needles: [
+		names: [
 			"run",
 			"execute",
 			"bash"
@@ -727,7 +778,7 @@ const TOOL_KIND_TITLE_MATCHERS = [
 	},
 	{
 		kind: "fetch",
-		needles: [
+		names: [
 			"fetch",
 			"http",
 			"url"
@@ -735,25 +786,25 @@ const TOOL_KIND_TITLE_MATCHERS = [
 	},
 	{
 		kind: "think",
-		needles: ["think"]
+		names: ["think"]
 	}
 ];
 function inferToolKind(params) {
 	if (params.toolCall.kind) return params.toolCall.kind;
 	const title = params.toolCall.title?.trim().toLowerCase();
 	if (!title) return;
-	const head = title.split(":", 1)[0]?.trim();
+	const head = title.split(/[:\s]/, 1)[0];
 	if (!head) return;
-	return titleHeadToolKind(head) ?? "other";
-}
-function titleHeadToolKind(head) {
-	return TOOL_KIND_TITLE_MATCHERS.find(({ needles }) => needles.some((needle) => head.includes(needle)))?.kind;
+	return TOOL_KIND_TITLE_MATCHERS.find(({ names }) => names.includes(head))?.kind ?? "other";
 }
 function isAutoApprovedReadKind(kind) {
 	return kind === "read" || kind === "search";
 }
-async function promptForToolPermission(params) {
-	return await promptForPermission({ prompt: `\n[permission] Allow ${params.toolCall.title ?? "tool"} [${inferToolKind(params) ?? "other"}]? (y/N) ` });
+async function promptForToolPermission(params, signal) {
+	return await promptForPermission({
+		prompt: `\n[permission] Allow ${params.toolCall.title ?? "tool"} [${inferToolKind(params) ?? "other"}]? (y/N) `,
+		signal
+	});
 }
 function canPromptForPermission$1() {
 	return process.stdin.isTTY && process.stderr.isTTY;
@@ -848,24 +899,24 @@ function selectedOrFirst(options, allowOption) {
 function selectedOrCancelled(option) {
 	return { response: option ? selected(option.optionId) : cancelled() };
 }
-async function resolveEscalatingPermissionRequest(params, policyMatch, allowOption, rejectOption) {
-	if (canPromptForPermission$1()) return resolveInteractivePromptResult(params, allowOption, rejectOption);
+async function resolveEscalatingPermissionRequest(params, policyMatch, allowOption, rejectOption, signal) {
+	if (canPromptForPermission$1()) return resolveInteractivePromptResult(params, allowOption, rejectOption, signal);
 	const escalation = buildEscalationEvent(params, policyMatch.matchedRule);
 	return {
 		response: withPermissionMetadata(rejectOption ? selected(rejectOption.optionId) : cancelled(), { permissionEscalation: escalation }),
 		escalation
 	};
 }
-async function resolveInteractivePromptResult(params, allowOption, rejectOption) {
-	const approved = await promptForToolPermission(params);
+async function resolveInteractivePromptResult(params, allowOption, rejectOption, signal) {
+	const approved = await promptForToolPermission(params, signal);
 	if (approved && allowOption) return { response: selected(allowOption.optionId) };
 	if (!approved && rejectOption) return { response: selected(rejectOption.optionId) };
 	return { response: cancelled() };
 }
-function resolvePolicyMatch(params, policyMatch, options, allowOption, rejectOption) {
+function resolvePolicyMatch(params, policyMatch, options, allowOption, rejectOption, signal) {
 	if (policyMatch?.action === "approve") return selectedOrFirst(options, allowOption);
 	if (policyMatch?.action === "deny") return selectedOrCancelled(rejectOption);
-	if (policyMatch?.action === "escalate") return resolveEscalatingPermissionRequest(params, policyMatch, allowOption, rejectOption);
+	if (policyMatch?.action === "escalate") return resolveEscalatingPermissionRequest(params, policyMatch, allowOption, rejectOption, signal);
 }
 function resolveModeMatch(options, mode, allowOption, rejectOption) {
 	if (mode === "approve-all") return selectedOrFirst(options, allowOption);
@@ -875,24 +926,35 @@ function resolveNonInteractivePermission(nonInteractivePolicy, rejectOption) {
 	if (nonInteractivePolicy === "fail") throw new PermissionPromptUnavailableError();
 	return selectedOrCancelled(rejectOption);
 }
-async function resolveReadOrPromptPermission(params, nonInteractivePolicy, allowOption, rejectOption) {
+async function resolveReadOrPromptPermission(params, nonInteractivePolicy, allowOption, rejectOption, signal) {
 	if (isAutoApprovedReadKind(inferToolKind(params)) && allowOption) return { response: selected(allowOption.optionId) };
 	if (!canPromptForPermission$1()) return resolveNonInteractivePermission(nonInteractivePolicy, rejectOption);
-	return resolveInteractivePromptResult(params, allowOption, rejectOption);
+	return resolveInteractivePromptResult(params, allowOption, rejectOption, signal);
 }
 function permissionModeSatisfies(actual, required) {
 	return PERMISSION_MODE_RANK[actual] >= PERMISSION_MODE_RANK[required];
 }
-async function resolvePermissionRequestWithDetails(params, mode, nonInteractivePolicy = "deny", policy) {
+async function resolvePermissionRequestWithDetails(params, mode, nonInteractivePolicy = "deny", policy, signal) {
+	try {
+		signal?.throwIfAborted();
+		const result = await resolvePermissionByPolicy(params, mode, nonInteractivePolicy, policy, signal);
+		signal?.throwIfAborted();
+		return result;
+	} catch (error) {
+		if (signal?.aborted) return { response: cancelled() };
+		throw error;
+	}
+}
+async function resolvePermissionByPolicy(params, mode, nonInteractivePolicy, policy, signal) {
 	const options = params.options ?? [];
 	if (options.length === 0) return { response: cancelled() };
 	const allowOption = pickOption(options, ["allow_once", "allow_always"]);
 	const rejectOption = pickOption(options, ["reject_once", "reject_always"]);
-	const resolvedByPolicy = await resolvePolicyMatch(params, matchPermissionPolicy(params, policy), options, allowOption, rejectOption);
+	const resolvedByPolicy = await resolvePolicyMatch(params, matchPermissionPolicy(params, policy), options, allowOption, rejectOption, signal);
 	if (resolvedByPolicy) return resolvedByPolicy;
 	const resolvedByMode = resolveModeMatch(options, mode, allowOption, rejectOption);
 	if (resolvedByMode) return resolvedByMode;
-	return resolveReadOrPromptPermission(params, nonInteractivePolicy, allowOption, rejectOption);
+	return resolveReadOrPromptPermission(params, nonInteractivePolicy, allowOption, rejectOption, signal);
 }
 const DECISION_FALLBACK_ORDER = {
 	allow_once: ["allow_once", "allow_always"],
@@ -1321,10 +1383,12 @@ const REQUESTED_MODEL_UNSUPPORTED_REASONS = ["missing-capability", "unadvertised
 var RequestedModelUnsupportedError = class extends Error {
 	code = REQUESTED_MODEL_UNSUPPORTED_ERROR_CODE;
 	reason;
-	constructor(message, reason) {
+	ambiguous;
+	constructor(message, reason, details) {
 		super(message);
 		this.name = "RequestedModelUnsupportedError";
 		this.reason = reason;
+		if (details?.ambiguous) this.ambiguous = true;
 	}
 };
 function isRequestedModelUnsupportedReason(value) {
@@ -1427,6 +1491,7 @@ function resolveRequestedModelId(params) {
 	if (!params.models || !isCursorAcpCommandForModelAlias(params.agentCommand)) return params.requestedModel;
 	if (params.models.availableModels.some((model) => model.modelId === params.requestedModel)) return params.requestedModel;
 	const candidates = params.models.availableModels.map((model) => model.modelId).filter((modelId) => modelId.startsWith(`${params.requestedModel}[`));
+	if (candidates.length > 1) throw new RequestedModelUnsupportedError(`Cannot select model "${params.requestedModel}": multiple advertised Cursor models match (${candidates.join(", ")}). Use an exact advertised model ID.`, "unadvertised-model", { ambiguous: true });
 	return candidates.length === 1 ? candidates[0] : params.requestedModel;
 }
 function isCursorAcpCommandForModelAlias(agentCommand) {
@@ -1493,15 +1558,22 @@ function enqueueNdJsonLine(agentCommand, line, controller) {
 		console.error("Failed to parse JSON message:", trimmedLine, err);
 	}
 }
-function enqueueNdJsonLines(agentCommand, lines, controller) {
+function enqueueNdJsonChunk(agentCommand, chunk, fragments, controller) {
+	const lines = chunk.split("\n");
+	const suffix = lines.pop() || "";
+	if (lines.length > 0 && fragments.length > 0) {
+		lines[0] = fragments.join("") + lines[0];
+		fragments.length = 0;
+	}
 	for (const line of lines) enqueueNdJsonLine(agentCommand, line, controller);
+	if (suffix) fragments.push(suffix);
 }
 function createNdJsonMessageStream(agentCommand, output, input, maxMessageBytes, onReadError) {
 	const textEncoder = new TextEncoder();
 	const textDecoder = new TextDecoder();
 	return {
 		readable: new ReadableStream({ async start(controller) {
-			let content = "";
+			const fragments = [];
 			let retainedBytes = 0;
 			const reader = input.getReader();
 			try {
@@ -1509,10 +1581,7 @@ function createNdJsonMessageStream(agentCommand, output, input, maxMessageBytes,
 					const { value, done } = await reader.read();
 					if (done) break;
 					if (maxMessageBytes !== void 0) retainedBytes = countLineBytes(value, retainedBytes, maxMessageBytes);
-					content += textDecoder.decode(value, { stream: true });
-					const lines = content.split("\n");
-					content = lines.pop() || "";
-					enqueueNdJsonLines(agentCommand, lines, controller);
+					enqueueNdJsonChunk(agentCommand, textDecoder.decode(value, { stream: true }), fragments, controller);
 				}
 				controller.close();
 			} catch (err) {
@@ -1604,65 +1673,88 @@ function promptRequestOwner(message) {
 }
 //#endregion
 //#region src/acp/process-descendants.ts
-function parseProcessTable(output) {
-	const table = /* @__PURE__ */ new Map();
-	for (const line of output.split("\n")) {
-		const match = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.+?)\s*$/.exec(line);
-		if (match && !match[3].startsWith("Z")) {
-			const pid = Number(match[1]);
-			if (Number.isSafeInteger(pid) && pid > 1 && pid !== process.pid) table.set(pid, {
-				pid,
-				parentPid: Number(match[2]),
-				birth: match[4]
-			});
-		}
-	}
-	return table;
-}
 function includeDescendants(table, owned) {
 	let expanded;
 	do {
 		expanded = false;
-		for (const identity of table.values()) if (owned.has(identity.parentPid) && !owned.has(identity.pid)) {
-			owned.add(identity.pid);
-			expanded = true;
+		for (const identity of table.values()) {
+			const parent = table.get(identity.parentPid);
+			if (process.platform === "win32" && (!parent || parent.birth > identity.birth)) continue;
+			if (owned.has(identity.parentPid) && !owned.has(identity.pid)) {
+				owned.add(identity.pid);
+				expanded = true;
+			}
 		}
 	} while (expanded);
 }
-/** Best-effort POSIX cleanup for descendants witnessed during this child launch. */
+/** Best-effort cleanup for descendants witnessed during this child launch. */
 var ProcessDescendants = class {
 	child;
 	identities = /* @__PURE__ */ new Map();
+	rootBirth;
 	pending;
 	retired = false;
-	constructor(child) {
+	ownProcessGroup;
+	captureGroupAfterExit;
+	groupExitedAt;
+	onRootExit = () => {
+		this.groupExitedAt = Date.now();
+	};
+	constructor(child, options = {}) {
 		this.child = child;
+		this.ownProcessGroup = process.platform !== "win32" && Boolean(options.ownProcessGroup);
+		this.captureGroupAfterExit = this.ownProcessGroup && isChildProcessRunning(child);
+		if (this.ownProcessGroup) child.once("exit", this.onRootExit);
 	}
 	capture(timeoutMs = PROCESS_HELPER_TIMEOUT_MS) {
-		if (this.retired || process.platform === "win32") return Promise.resolve(true);
+		if (this.retired) return Promise.resolve(true);
 		this.pending ??= this.readSnapshot(timeoutMs).finally(() => {
 			this.pending = void 0;
 		});
 		return this.pending;
 	}
 	async readSnapshot(timeoutMs) {
+		const deadline = performance.now() + timeoutMs;
+		const rootWasRunning = isChildProcessRunning(this.child);
+		const captureRootGroup = rootWasRunning || this.captureGroupAfterExit;
+		if (!rootWasRunning) this.captureGroupAfterExit = false;
 		try {
-			const output = await runTimedExecFile("ps", ["-eo", "pid=,ppid=,stat=,lstart="], { timeoutMs });
-			if (!this.retired) this.refresh(parseProcessTable(output));
+			const table = await readProcessTable(timeoutMs);
+			if (!this.retired) {
+				table.delete(1);
+				table.delete(process.pid);
+				this.refresh(table, captureRootGroup);
+				if (this.captureGroupAfterExit && !isChildProcessRunning(this.child)) return await this.readSnapshot(Math.max(1, deadline - performance.now()));
+			}
 			return true;
 		} catch {
+			if (!isChildProcessRunning(this.child)) this.captureGroupAfterExit = false;
 			return false;
 		}
 	}
-	refresh(table) {
+	refresh(table, rootWasRunning) {
 		const owned = /* @__PURE__ */ new Set();
 		for (const [pid, identity] of this.identities) if (table.get(pid)?.birth === identity.birth) owned.add(pid);
-		const root = this.child.pid;
-		if (root && isChildProcessRunning(this.child)) owned.add(root);
+		this.includeRoot(table, owned);
+		if (this.ownProcessGroup) this.includeProcessGroup(table, owned, rootWasRunning);
 		includeDescendants(table, owned);
-		owned.delete(root ?? 0);
+		owned.delete(this.child.pid ?? 0);
 		this.identities = new Map([...table].filter(([pid]) => owned.has(pid)));
 	}
+	includeRoot(table, owned) {
+		const root = this.child.pid;
+		const rootIdentity = root && table.get(root);
+		if (rootIdentity && isChildProcessRunning(this.child)) {
+			this.rootBirth ??= rootIdentity.birth;
+			if (rootIdentity.birth === this.rootBirth) owned.add(rootIdentity.pid);
+		}
+	}
+	includeProcessGroup(table, owned, rootWasRunning) {
+		const root = this.child.pid;
+		if (root && (rootWasRunning || [...owned].some((pid) => table.get(pid)?.groupPid === root))) {
+			for (const identity of table.values()) if (identity.groupPid === root && (this.groupExitedAt === void 0 || Date.parse(identity.birth) <= this.groupExitedAt)) owned.add(identity.pid);
+		}
+	}
 	async signal(signal, timeoutMs) {
 		if (!await this.capture(timeoutMs) || this.retired) return;
 		for (const pid of this.identities.keys()) try {
@@ -1671,6 +1763,9 @@ var ProcessDescendants = class {
 			this.identities.delete(pid);
 		}
 	}
+	hasTrackedProcesses() {
+		return this.identities.size > 0;
+	}
 	async waitForExit(timeoutMs) {
 		const deadline = Date.now() + timeoutMs;
 		do {
@@ -1682,6 +1777,7 @@ var ProcessDescendants = class {
 	}
 	retire() {
 		this.retired = true;
+		this.child.off("exit", this.onRootExit);
 		this.identities.clear();
 	}
 };
@@ -1749,16 +1845,27 @@ function readTerminalOutputCeiling() {
 	if (!/^\d+$/.test(raw) || !Number.isSafeInteger(bytes)) throw new Error("ACPX_TERMINAL_MAX_OUTPUT_BYTES must be a non-negative safe integer; zero disables the host ceiling");
 	return bytes === 0 ? void 0 : bytes;
 }
+function resolveTerminalOutputLimit(requested, ceiling) {
+	return Math.min(Math.max(0, Math.round(requested ?? DEFAULT_TERMINAL_OUTPUT_LIMIT_BYTES)), ceiling ?? Number.POSITIVE_INFINITY);
+}
+function tracksTerminalDescendants(terminal) {
+	return terminal.killProcessGroup || terminal.descendants !== void 0;
+}
+function createTerminalDescendants(proc, killProcessGroup) {
+	return process.platform === "win32" && killProcessGroup ? void 0 : new ProcessDescendants(proc, { ownProcessGroup: true });
+}
 function trimToUtf8Boundary(buffer, limit) {
 	if (limit <= 0) return Buffer.alloc(0);
-	if (buffer.length <= limit) return buffer;
-	let start = buffer.length - limit;
+	let start = Math.max(0, buffer.length - limit);
 	while (start < buffer.length && (buffer[start] & 192) === 128) start += 1;
-	if (start >= buffer.length) start = buffer.length - limit;
+	if (start >= buffer.length) return Buffer.alloc(0);
 	return buffer.subarray(start);
 }
-async function defaultConfirmExecute(commandLine) {
-	return await promptForPermission({ prompt: `\n[permission] Allow terminal command "${commandLine}"? (y/N) ` });
+async function defaultConfirmExecute(commandLine, signal) {
+	return await promptForPermission({
+		prompt: `\n[permission] Allow terminal command "${commandLine}"? (y/N) `,
+		signal
+	});
 }
 function canPromptForPermission() {
 	return process.stdin.isTTY && process.stderr.isTTY;
@@ -1788,14 +1895,16 @@ var TerminalManager = class {
 		this.onOperation = options.onOperation;
 		this.usesDefaultConfirmExecute = options.confirmExecute == null;
 		this.confirmExecute = options.confirmExecute ?? defaultConfirmExecute;
-		this.killGraceMs = Math.max(0, Math.round(options.killGraceMs ?? DEFAULT_KILL_GRACE_MS));
+		const killGraceMs = Math.max(0, Math.round(options.killGraceMs ?? DEFAULT_KILL_GRACE_MS));
+		this.killGraceMs = Number.isFinite(killGraceMs) && killGraceMs <= 2147483647 ? killGraceMs : 1;
 		this.processHelperTimeoutMs = Math.max(1, Math.round(options.processHelperTimeoutMs ?? 8e3));
 	}
 	updatePermissionPolicy(permissionMode, nonInteractivePermissions) {
 		this.permissionMode = permissionMode;
 		this.nonInteractivePermissions = nonInteractivePermissions ?? "deny";
 	}
-	async createTerminal(params) {
+	async createTerminal(params, authority) {
+		assertControlAuthority(authority);
 		const commandLine = toCommandLine(params.command, params.args);
 		const summary = `terminal/create: ${commandLine}`;
 		this.emitOperation({
@@ -1805,10 +1914,11 @@ var TerminalManager = class {
 			timestamp: nowIso()
 		});
 		try {
-			if (!await this.isExecuteApproved(commandLine)) throw new PermissionDeniedError("Permission denied for terminal/create");
-			const requestedLimit = Math.max(0, Math.round(params.outputByteLimit ?? DEFAULT_TERMINAL_OUTPUT_LIMIT_BYTES));
-			const outputByteLimit = Math.min(requestedLimit, this.outputCeilingBytes ?? Number.POSITIVE_INFINITY);
-			const { proc, spawnCommand } = await spawnTerminalProcess(params, this.cwd);
+			const approved = await this.isExecuteApproved(commandLine, authority?.signal);
+			assertControlAuthority(authority);
+			if (!approved) throw new PermissionDeniedError("Permission denied for terminal/create");
+			const outputByteLimit = resolveTerminalOutputLimit(params.outputByteLimit, this.outputCeilingBytes);
+			const { proc, spawnCommand } = await spawnTerminalProcess(params, this.cwd, authority);
 			let resolveExit = () => {};
 			const exitPromise = new Promise((resolve) => {
 				resolveExit = resolve;
@@ -1817,6 +1927,7 @@ var TerminalManager = class {
 				process: proc,
 				killProcessGroup: spawnCommand.killProcessGroup,
 				descendantPids: /* @__PURE__ */ new Set(),
+				descendants: createTerminalDescendants(proc, spawnCommand.killProcessGroup),
 				processHelperTimeoutMs: this.processHelperTimeoutMs,
 				output: Buffer.alloc(0),
 				truncated: false,
@@ -1830,10 +1941,8 @@ var TerminalManager = class {
 				const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 				if (bytes.length === 0) return;
 				terminal.output = Buffer.concat([terminal.output, bytes]);
-				if (terminal.output.length > terminal.outputByteLimit) {
-					terminal.output = trimToUtf8Boundary(terminal.output, terminal.outputByteLimit);
-					terminal.truncated = true;
-				}
+				terminal.truncated ||= terminal.output.length > terminal.outputByteLimit;
+				if (terminal.truncated) terminal.output = trimToUtf8Boundary(terminal.output, terminal.outputByteLimit);
 			};
 			proc.stdout.on("data", appendOutput);
 			proc.stderr.on("data", appendOutput);
@@ -1842,9 +1951,10 @@ var TerminalManager = class {
 			proc.once("exit", (exitCode, signal) => {
 				terminal.exitCode = exitCode;
 				terminal.signal = signal;
-				terminal.processGroupSnapshotPromise = rememberProcessGroupPids(terminal);
+				terminal.processGroupSnapshotPromise = terminal.descendants ? terminal.descendants.capture(terminal.processHelperTimeoutMs).then(() => {}) : rememberProcessGroupPids(terminal);
 				(async () => {
 					await terminal.processGroupSnapshotPromise;
+					terminal.processGroupSnapshotPromise = void 0;
 					terminal.resolveExit({
 						exitCode: exitCode ?? null,
 						signal: signal ?? null
@@ -1853,6 +1963,16 @@ var TerminalManager = class {
 			});
 			const terminalId = randomUUID();
 			this.terminals.set(terminalId, terminal);
+			try {
+				await terminal.descendants?.capture(terminal.processHelperTimeoutMs);
+				assertControlAuthority(authority);
+			} catch (error) {
+				await this.releaseTerminal({
+					terminalId,
+					sessionId: params.sessionId
+				});
+				throw error;
+			}
 			this.emitOperation({
 				method: "terminal/create",
 				status: "completed",
@@ -1958,6 +2078,9 @@ var TerminalManager = class {
 		try {
 			await this.killProcess(terminal);
 			await terminal.exitPromise.catch(() => {});
+			terminal.descendants?.retire();
+			terminal.process.stdout.destroy();
+			terminal.process.stderr.destroy();
 			terminal.output = Buffer.alloc(0);
 			this.terminals.delete(params.terminalId);
 			this.emitOperation({
@@ -1980,10 +2103,13 @@ var TerminalManager = class {
 		}
 	}
 	async shutdown() {
-		for (const terminalId of Array.from(this.terminals.keys())) await this.releaseTerminal({
+		const results = await Promise.allSettled(Array.from(this.terminals.keys(), (terminalId) => this.releaseTerminal({
 			terminalId,
 			sessionId: "shutdown"
-		});
+		})));
+		const failures = [];
+		for (const result of results) if (result.status === "rejected") failures.push(result.reason);
+		if (failures.length > 0) throw new AggregateError(failures, "Terminal shutdown failed", { cause: failures[0] });
 	}
 	getTerminal(terminalId) {
 		return this.terminals.get(terminalId);
@@ -1991,23 +2117,23 @@ var TerminalManager = class {
 	emitOperation(operation) {
 		this.onOperation?.(operation);
 	}
-	async isExecuteApproved(commandLine) {
+	async isExecuteApproved(commandLine, signal) {
 		if (this.permissionMode === "approve-all") return true;
 		if (this.permissionMode === "deny-all") return false;
 		if (this.usesDefaultConfirmExecute && this.nonInteractivePermissions === "fail" && !canPromptForPermission()) throw new PermissionPromptUnavailableError();
-		return await this.confirmExecute(commandLine);
+		return await this.confirmExecute(commandLine, signal);
 	}
 	isRunning(terminal) {
 		return terminal.exitCode === void 0 && terminal.signal === void 0;
 	}
 	async killProcess(terminal) {
-		if (!this.isRunning(terminal) && !terminal.killProcessGroup) return;
+		if (!this.isRunning(terminal) && !tracksTerminalDescendants(terminal)) return;
 		try {
 			await this.signalProcess(terminal, "SIGTERM");
 		} catch {
 			return;
 		}
-		if (await this.waitForCleanupAfterSignal(terminal) && !terminal.killProcessGroup) return;
+		if (await this.waitForCleanupAfterSignal(terminal) && (!terminal.killProcessGroup || terminal.descendants)) return;
 		try {
 			await this.signalProcess(terminal, "SIGKILL");
 		} catch {
@@ -2016,15 +2142,16 @@ var TerminalManager = class {
 		await this.waitForFinalCleanup(terminal);
 	}
 	async signalProcess(terminal, signal) {
+		if (terminal.descendants) {
+			await terminal.descendants.signal(signal, terminal.processHelperTimeoutMs);
+			if (this.isRunning(terminal)) terminal.process.kill(signal);
+			return;
+		}
 		const pid = terminal.process.pid;
 		if (terminal.killProcessGroup && pid && process.platform === "win32") {
 			await this.signalWindowsProcessGroup(terminal, pid, signal);
 			return;
 		}
-		if (terminal.killProcessGroup && pid) {
-			await this.signalPosixProcessGroup(terminal, pid, signal);
-			return;
-		}
 		terminal.process.kill(signal);
 	}
 	async signalWindowsProcessGroup(terminal, pid, signal) {
@@ -2035,14 +2162,6 @@ var TerminalManager = class {
 		}
 		for (const descendantPid of terminal.descendantPids) await killWindowsProcessTree(descendantPid, signal, terminal.processHelperTimeoutMs);
 	}
-	async signalPosixProcessGroup(terminal, pid, signal) {
-		await this.captureDescendantPids(terminal, pid);
-		if (hasLiveProcessGroup(pid)) {
-			sendSignal(-pid, signal);
-			return;
-		}
-		for (const descendantPid of terminal.descendantPids) sendSignal(descendantPid, signal);
-	}
 	async captureDescendantPids(terminal, pid) {
 		if (!this.isRunning(terminal)) await terminal.processGroupSnapshotPromise?.catch(() => {});
 		for (const descendantPid of await listDescendantPids(pid, terminal.processHelperTimeoutMs)) terminal.descendantPids.add(descendantPid);
@@ -2051,33 +2170,35 @@ var TerminalManager = class {
 		if (!await this.waitForCleanupAfterSignal(terminal) && process.platform === "win32") throw new Error("Terminal process cleanup did not finish after SIGKILL");
 	}
 	async waitForCleanupAfterSignal(terminal) {
-		return await Promise.race([this.waitForTerminalAndTrackedDescendants(terminal).then(() => true), waitMs(this.killGraceMs).then(() => false)]);
-	}
-	async waitForTerminalAndTrackedDescendants(terminal) {
-		await terminal.exitPromise;
-		while (hasLiveTerminalProcessGroup(terminal)) await waitMs(25);
-		while (hasLivePid(terminal.descendantPids)) await waitMs(25);
+		const deadline = performance.now() + this.killGraceMs;
+		while (this.isRunning(terminal) || terminal.processGroupSnapshotPromise || await hasLiveTerminalDescendants(terminal, deadline - performance.now()) || hasLivePid(terminal.descendantPids)) {
+			const remaining = deadline - performance.now();
+			if (remaining <= 0) return false;
+			await waitMs(Math.min(25, remaining));
+		}
+		return true;
 	}
 };
-async function spawnTerminalProcess(params, defaultCwd) {
+async function spawnTerminalProcess(params, defaultCwd, authority) {
 	const directCommand = buildTerminalSpawnCommand(params.command, params.args);
 	try {
 		return {
-			proc: await spawnAndWait(directCommand, params, defaultCwd),
+			proc: await spawnAndWait(directCommand, params, defaultCwd, authority),
 			spawnCommand: directCommand
 		};
 	} catch (error) {
 		const fallbackCommand = params.args === void 0 && isNotFoundSpawnError(error) ? buildTerminalFallbackSpawnCommand(params.command, params.cwd ?? defaultCwd) : void 0;
 		if (!fallbackCommand) throw error;
 		return {
-			proc: await spawnAndWait(fallbackCommand, params, defaultCwd),
+			proc: await spawnAndWait(fallbackCommand, params, defaultCwd, authority),
 			spawnCommand: fallbackCommand
 		};
 	}
 }
-async function spawnAndWait(spawnCommand, params, defaultCwd) {
+async function spawnAndWait(spawnCommand, params, defaultCwd, authority) {
 	const spawnOptions = buildTerminalSpawnOptions(spawnCommand.command, params.cwd ?? defaultCwd, params.env);
-	if (spawnCommand.killProcessGroup) spawnOptions.detached = true;
+	if (spawnCommand.killProcessGroup || process.platform !== "win32") spawnOptions.detached = true;
+	assertControlAuthority(authority);
 	const proc = spawn(spawnCommand.command, spawnCommand.args, spawnOptions);
 	await waitForSpawn(proc);
 	return proc;
@@ -2104,7 +2225,7 @@ function commandPathExists(command, cwd) {
 async function listDescendantPids(rootPid, timeoutMs) {
 	let output;
 	try {
-		output = await runProcessListCommand(timeoutMs);
+		output = await runWindowsProcessListCommand(timeoutMs);
 	} catch {
 		return [];
 	}
@@ -2137,38 +2258,10 @@ function parseProcessListLine(line) {
 		parentPid
 	};
 }
-async function runProcessListCommand(timeoutMs) {
-	if (process.platform === "win32") return await runWindowsProcessListCommand(timeoutMs);
-	return await runTimedExecFile("ps", ["-eo", "pid=,ppid="], { timeoutMs });
-}
 async function rememberProcessGroupPids(terminal) {
 	const processGroupId = terminal.process.pid;
 	if (!terminal.killProcessGroup || !processGroupId) return;
-	if (process.platform === "win32") {
-		for (const pid of await listDescendantPids(processGroupId, terminal.processHelperTimeoutMs)) terminal.descendantPids.add(pid);
-		return;
-	}
-	for (const pid of await listProcessGroupPids(processGroupId, terminal.processHelperTimeoutMs)) if (pid !== processGroupId) terminal.descendantPids.add(pid);
-}
-async function listProcessGroupPids(processGroupId, timeoutMs) {
-	let output;
-	try {
-		output = await runProcessGroupListCommand(timeoutMs);
-	} catch {
-		return [];
-	}
-	const pids = [];
-	for (const line of output.split("\n")) {
-		const match = line.trim().match(/^(\d+)\s+(\d+)$/);
-		if (!match) continue;
-		const pid = Number(match[1]);
-		const pgid = Number(match[2]);
-		if (Number.isInteger(pid) && Number.isInteger(pgid) && pid > 0 && pgid === processGroupId) pids.push(pid);
-	}
-	return pids;
-}
-async function runProcessGroupListCommand(timeoutMs) {
-	return await runTimedExecFile("ps", ["-eo", "pid=,pgid="], { timeoutMs });
+	for (const pid of await listDescendantPids(processGroupId, terminal.processHelperTimeoutMs)) terminal.descendantPids.add(pid);
 }
 async function runWindowsProcessListCommand(timeoutMs) {
 	const command = ["Get-CimInstance Win32_Process |", "ForEach-Object { \"$($_.ProcessId) $($_.ParentProcessId)\" }"].join(" ");
@@ -2196,22 +2289,11 @@ async function killWindowsProcessTree(pid, signal, timeoutMs = PROCESS_HELPER_TI
 		});
 	} catch {}
 }
-function sendSignal(pid, signal) {
-	try {
-		process.kill(pid, signal);
-	} catch {}
-}
-function hasLiveProcessGroup(processGroupId) {
-	try {
-		process.kill(-processGroupId, 0);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function hasLiveTerminalProcessGroup(terminal) {
-	const pid = terminal.process.pid;
-	return Boolean(terminal.killProcessGroup && pid && process.platform !== "win32" && hasLiveProcessGroup(pid));
+async function hasLiveTerminalDescendants(terminal, timeoutMs) {
+	const descendants = terminal.descendants;
+	if (!descendants) return false;
+	if (timeoutMs > 0) await descendants.capture(Math.min(terminal.processHelperTimeoutMs, timeoutMs));
+	return descendants.hasTrackedProcesses();
 }
 function hasLivePid(pids) {
 	for (const pid of pids) try {
@@ -2362,14 +2444,13 @@ var AcpClient = class {
 	cancellingSessionIds = /* @__PURE__ */ new Set();
 	permissionAbortControllers = /* @__PURE__ */ new Map();
 	closing = false;
+	closeTask;
 	closeEpoch = 0;
 	agentStartedAt;
 	lastAgentExit;
 	lastKnownPid;
 	promptPermissionFailures = /* @__PURE__ */ new Map();
 	pendingConnectionRequests = /* @__PURE__ */ new Set();
-	modelConfigIds = /* @__PURE__ */ new Map();
-	legacyModelSessionIds = /* @__PURE__ */ new Set();
 	constructor(options) {
 		this.options = {
 			...options,
@@ -2460,7 +2541,7 @@ var AcpClient = class {
 		this.terminalManager.updatePermissionPolicy(this.options.permissionMode, this.options.nonInteractivePermissions);
 	}
 	hasLiveConnection() {
-		return this.connection != null && !this.connection.signal.aborted && this.agent != null && isChildProcessRunning(this.agent);
+		return !this.closing && this.connection != null && !this.connection.signal.aborted && this.agent != null && isChildProcessRunning(this.agent);
 	}
 	hasReusableSession(sessionId) {
 		return this.hasLiveConnection() && this.loadedSessionId === sessionId;
@@ -2473,21 +2554,27 @@ var AcpClient = class {
 	hasUnresolvedPrompt() {
 		return this.activePrompt !== void 0;
 	}
-	endPromptElicitation(sessionId) {
-		const active = this.activePrompt;
-		if (!active || active.sessionId !== sessionId) return;
-		active.elicitationHandler = void 0;
-		active.elicitationController.abort();
+	abortSessionRequests(sessionId) {
+		const owners = this.pendingPromptOwners.filter((owner) => owner.sessionId === sessionId);
+		const fallback = this.takePermissionAbortController(sessionId);
+		for (const owner of owners) {
+			owner.elicitationHandler = void 0;
+			owner.elicitationController.abort();
+			owner.requestController.abort();
+		}
+		fallback?.abort();
 	}
-	async start() {
+	async start(authority) {
+		assertControlAuthority(authority);
 		if (this.hasLiveConnection()) return;
-		if (this.connection || this.agent) await this.close();
-		const epoch = this.closeEpoch;
+		const epoch = await this.waitForPreviousClose();
 		const maxMessageBytes = readMaxAcpMessageBytes();
 		const launch = await this.resolveAgentLaunchPlan();
+		assertControlAuthority(authority);
 		this.logAgentLaunch(launch);
 		await this.ensureLaunchSupport(launch);
-		const { child, process: startedProcess } = await this.spawnAgentProcess(launch);
+		assertControlAuthority(authority);
+		const { child, process: startedProcess } = await this.spawnAgentProcess(launch, authority);
 		if (this.closeEpoch === epoch) {
 			this.agent = child;
 			this.closing = false;
@@ -2510,7 +2597,7 @@ var AcpClient = class {
 			startupFailure.dispose();
 			throw error;
 		}
-		await this.stopIfClosedDuringLaunch(epoch, child, startupFailure);
+		await this.stopIfClosedDuringLaunch(epoch, child, startupFailure, authority);
 		const input = Writable.toWeb(child.stdin);
 		const output = Readable.toWeb(child.stdout);
 		let connection;
@@ -2525,9 +2612,10 @@ var AcpClient = class {
 			elicitationModes: this.options.elicitationModes
 		});
 		connection = this.createConnection(stream, launch, capabilities);
-		connection.signal.addEventListener("abort", () => {
-			this.recordAgentExit(child, "connection_close", child.exitCode ?? null, child.signalCode ?? null);
-		}, { once: true });
+		const onConnectionClose = () => {
+			this.handleAgentDisconnect(child, "connection_close", child.exitCode ?? null, child.signalCode ?? null);
+		};
+		connection.signal.addEventListener("abort", onConnectionClose, { once: true });
 		await this.initializeAgentConnection({
 			child,
 			connection,
@@ -2536,6 +2624,14 @@ var AcpClient = class {
 			launch,
 			capabilities
 		});
+		if (connection.signal.aborted) onConnectionClose();
+	}
+	async waitForPreviousClose() {
+		const cleanup = this.closeTask ?? (this.connection || this.agent ? this.close() : void 0);
+		const epoch = this.closeEpoch;
+		await cleanup;
+		if (this.closeEpoch !== epoch) throw new Error("ACP client was closed while the agent was starting");
+		return epoch;
 	}
 	async resolveAgentLaunchPlan() {
 		const configuredCommand = resolveAgentCommandParts(this.options.agentCommand, this.options.agentArgv);
@@ -2576,7 +2672,7 @@ var AcpClient = class {
 			this.log(`resolved system Claude Code executable: ${claudeExe}`);
 		}
 	}
-	async spawnAgentProcess(plan) {
+	async spawnAgentProcess(plan, authority) {
 		const spawnCommand = buildAgentSpawnCommand(plan.spawnCommand, plan.args, process.platform, plan.spawnOptions.env);
 		const launch = Object.freeze({
 			launchId: randomUUID(),
@@ -2586,6 +2682,7 @@ var AcpClient = class {
 			cwd: this.options.cwd
 		});
 		await this.options.processLifecycle?.onBeforeSpawn?.(launch);
+		assertControlAuthority(authority);
 		let spawnedChild;
 		try {
 			spawnedChild = spawn(spawnCommand.command, spawnCommand.args, {
@@ -2634,19 +2731,19 @@ var AcpClient = class {
 	createConnection(stream, launch, capabilities) {
 		const app = client({ name: "acpx" }).onNotification(methods.client.session.update, async ({ params }) => {
 			await this.handleSessionUpdate(params);
-		}).onNotification(methods.client.elicitation.complete, async () => {}).onRequest(methods.client.session.requestPermission, async ({ params }) => {
-			return await this.handlePermissionRequest(params);
+		}).onNotification(methods.client.elicitation.complete, async () => {}).onRequest(methods.client.session.requestPermission, async ({ params, signal }) => {
+			return await this.handlePermissionRequest(params, signal);
 		}).onRequest(methods.client.elicitation.create, async ({ params, requestId, signal }) => {
 			return await this.handleElicitationRequest(params, requestId, signal);
 		});
-		if (capabilities.fs?.readTextFile) app.onRequest(methods.client.fs.readTextFile, async ({ params }) => {
-			return await this.handleReadTextFile(params);
+		if (capabilities.fs?.readTextFile) app.onRequest(methods.client.fs.readTextFile, async ({ params, signal }) => {
+			return await this.handleReadTextFile(params, signal);
 		});
-		if (capabilities.fs?.writeTextFile) app.onRequest(methods.client.fs.writeTextFile, async ({ params }) => {
-			return await this.handleWriteTextFile(params);
+		if (capabilities.fs?.writeTextFile) app.onRequest(methods.client.fs.writeTextFile, async ({ params, signal }) => {
+			return await this.handleWriteTextFile(params, signal);
 		});
-		if (capabilities.terminal) app.onRequest(methods.client.terminal.create, async ({ params }) => {
-			return await this.handleCreateTerminal(params);
+		if (capabilities.terminal) app.onRequest(methods.client.terminal.create, async ({ params, signal }) => {
+			return await this.handleCreateTerminal(params, signal);
 		}).onRequest(methods.client.terminal.output, async ({ params }) => {
 			return await this.terminalManager.terminalOutput(params);
 		}).onRequest(methods.client.terminal.waitForExit, async ({ params }) => {
@@ -2707,7 +2804,8 @@ var AcpClient = class {
 			onPromptRequestWritten: (active, owner) => this.onPromptRequestWritten(active, owner)
 		});
 	}
-	async createSession(cwd = this.options.cwd) {
+	async createSession(cwd = this.options.cwd, authority) {
+		assertControlAuthority(authority);
 		const connection = this.getConnection();
 		const { command, args } = resolveAgentCommandParts(this.options.agentCommand, this.options.agentArgv);
 		const claudeAcp = isClaudeAcpCommand(command, args);
@@ -2718,7 +2816,7 @@ var AcpClient = class {
 				cwd: sessionCwd,
 				mcpServers: this.options.mcpServers ?? [],
 				_meta: buildClaudeCodeOptionsMeta(this.options.sessionOptions, claudeAcp)
-			}));
+			}), authority);
 			result = claudeAcp ? await withTimeout(createPromise, resolveClaudeAcpSessionCreateTimeoutMs()) : await createPromise;
 		} catch (error) {
 			if (claudeAcp && error instanceof TimeoutError) throw new ClaudeAcpSessionCreateTimeoutError(buildClaudeAcpSessionCreateTimeoutMessage(), {
@@ -2733,7 +2831,6 @@ var AcpClient = class {
 			configOptions,
 			response: result
 		});
-		this.rememberSessionModels(result.sessionId, models);
 		await this.captureAgentDescendants(this.agent);
 		return {
 			sessionId: result.sessionId,
@@ -2751,6 +2848,7 @@ var AcpClient = class {
 	async loadSessionWithOptions(sessionId, cwd = this.options.cwd, options = {}) {
 		const connection = this.getConnection();
 		const sessionCwd = await resolveAgentSessionCwd(cwd, this.options.agentCommand);
+		assertControlAuthority(options.authority);
 		const previousSuppression = this.applySessionUpdateSuppression(Boolean(options.suppressReplayUpdates));
 		let response;
 		try {
@@ -2758,28 +2856,27 @@ var AcpClient = class {
 				sessionId,
 				cwd: sessionCwd,
 				mcpServers: this.options.mcpServers ?? []
-			}));
+			}), options.authority);
 			await this.waitForSessionUpdateDrain(options.replayIdleMs ?? REPLAY_IDLE_MS, options.replayDrainTimeoutMs ?? REPLAY_DRAIN_TIMEOUT_MS);
 		} finally {
 			this.restoreSessionUpdateSuppression(previousSuppression);
 		}
 		this.loadedSessionId = sessionId;
 		const result = toReconnectedSessionResult(response);
-		this.updateRememberedSessionModels(sessionId, result);
 		await this.captureAgentDescendants(this.agent);
 		return result;
 	}
-	async resumeSession(sessionId, cwd = this.options.cwd) {
+	async resumeSession(sessionId, cwd = this.options.cwd, authority) {
+		assertControlAuthority(authority);
 		const connection = this.getConnection();
 		const sessionCwd = await resolveAgentSessionCwd(cwd, this.options.agentCommand);
 		const response = await this.runConnectionRequest(() => connection.agent.request(methods.agent.session.resume, {
 			sessionId,
 			cwd: sessionCwd,
 			mcpServers: this.options.mcpServers ?? []
-		}));
+		}), authority);
 		this.loadedSessionId = sessionId;
 		const result = toReconnectedSessionResult(response);
-		this.updateRememberedSessionModels(sessionId, result);
 		await this.captureAgentDescendants(this.agent);
 		return result;
 	}
@@ -2801,6 +2898,7 @@ var AcpClient = class {
 		const normalizedPrompt = this.normalizePromptForAgent(prompt);
 		const restoreConsoleError = this.options.suppressSdkConsoleErrors ? installSdkConsoleErrorSuppression() : void 0;
 		const previousActivePrompt = this.activePrompt;
+		const replacedOwners = this.pendingPromptOwners.filter((owner) => owner.sessionId === sessionId);
 		const activePrompt = this.beginActivePrompt(sessionId, onRequestWritten, onElicitation, onPermissionRequest, authority);
 		try {
 			const promptPromise = this.runConnectionRequest(() => connection.agent.request(methods.agent.session.prompt, {
@@ -2809,6 +2907,7 @@ var AcpClient = class {
 			}), authority);
 			activePrompt.promise = promptPromise;
 			previousActivePrompt?.elicitationController?.abort();
+			for (const owner of replacedOwners) owner.requestController.abort();
 			return this.returnPromptResponseOrPermissionFailure(sessionId, await promptPromise);
 		} catch (error) {
 			if (activePrompt.admissionFailure) throw activePrompt.admissionFailure.error;
@@ -2827,7 +2926,8 @@ var AcpClient = class {
 			authority,
 			elicitationHandler,
 			permissionHandler,
-			elicitationController: new AbortController()
+			elicitationController: new AbortController(),
+			requestController: new AbortController()
 		};
 		this.activePrompt = active;
 		this.pendingPromptOwners.push(active);
@@ -2866,6 +2966,7 @@ var AcpClient = class {
 			this.promptPermissionFailures.delete(active.sessionId);
 		}
 		active.elicitationController.abort();
+		active.requestController.abort();
 		permissionController?.abort();
 	}
 	normalizePromptForAgent(prompt) {
@@ -2889,33 +2990,41 @@ var AcpClient = class {
 			modeId
 		}), authority, (error) => maybeWrapSessionControlError("session/set_mode", error, `for mode "${modeId}"`));
 	}
-	async setSessionConfigOption(sessionId, configId, value, authority) {
+	async setSessionConfigOption(sessionId, configId, value, models, authority) {
+		assertControlAuthority(authority);
+		const resolvedValue = models?.configId === configId ? this.resolveSessionModelId(value, models) : value;
 		const connection = this.getConnection();
 		return await this.runConnectionRequest(() => connection.agent.request(methods.agent.session.setConfigOption, {
 			sessionId,
 			configId,
-			value
+			value: resolvedValue
 		}), authority, (error) => maybeWrapSessionControlError("session/set_config_option", error, `for "${configId}"="${value}"`));
 	}
-	async setSessionModel(sessionId, modelId, controlOverride, authority) {
-		const control = this.resolveModelControl(sessionId, controlOverride);
-		if (!control) throw new RequestedModelUnsupportedError(`Cannot set model "${modelId}": the ACP session did not advertise a model config option or legacy session/set_model support.`, "missing-capability");
-		const resolvedModelId = resolveRequestedModelId({
+	async setSessionModel(sessionId, modelId, models, authority) {
+		assertControlAuthority(authority);
+		if (!models) throw new RequestedModelUnsupportedError(`Cannot set model "${modelId}": the ACP session did not advertise a model config option or legacy session/set_model support.`, "missing-capability");
+		const resolvedModelId = this.resolveSessionModelId(modelId, models);
+		return models.configId ? await this.setSessionModelThroughConfig(sessionId, resolvedModelId, models.configId, authority) : await this.setSessionModelThroughLegacyMethod(sessionId, resolvedModelId, authority);
+	}
+	resolveSessionModelId(modelId, models) {
+		const params = {
 			requestedModel: modelId,
-			models: controlOverride?.availableModels ? { availableModels: controlOverride.availableModels } : void 0,
+			models,
 			agentCommand: this.options.agentCommand
+		};
+		assertRequestedModelSupported({
+			...params,
+			context: "apply"
 		});
-		return control.kind === "config_option" ? await this.setSessionModelThroughConfig(sessionId, resolvedModelId, control.configId, authority) : await this.setSessionModelThroughLegacyMethod(sessionId, resolvedModelId, authority);
+		return resolveRequestedModelId(params);
 	}
 	async setSessionModelThroughConfig(sessionId, modelId, configId, authority) {
 		const connection = this.getConnection();
-		const response = await this.runConnectionRequest(() => connection.agent.request(methods.agent.session.setConfigOption, {
+		return await this.runConnectionRequest(() => connection.agent.request(methods.agent.session.setConfigOption, {
 			sessionId,
 			configId,
 			value: modelId
 		}), authority, (error) => this.throwSessionModelError("session/set_config_option", modelId, error));
-		this.rememberSessionModels(sessionId, modelStateFromConfigOptions(response.configOptions));
-		return response;
 	}
 	async setSessionModelThroughLegacyMethod(sessionId, modelId, authority) {
 		const connection = this.getConnection();
@@ -2931,39 +3040,10 @@ var AcpClient = class {
 		const summary = acp ? formatSessionControlAcpSummary(acp) : error instanceof Error ? error.message : String(error);
 		throw new Error(`Failed ${method} for model "${modelId}": ${summary}`, { cause: error });
 	}
-	resolveModelControl(sessionId, controlOverride) {
-		if (controlOverride) return controlOverride.configId ? {
-			kind: "config_option",
-			configId: controlOverride.configId
-		} : { kind: "legacy_set_model" };
-		const configId = this.modelConfigIds.get(sessionId);
-		if (configId) return {
-			kind: "config_option",
-			configId
-		};
-		return this.legacyModelSessionIds.has(sessionId) ? { kind: "legacy_set_model" } : void 0;
-	}
-	rememberSessionModels(sessionId, models) {
-		if (!models) {
-			this.modelConfigIds.delete(sessionId);
-			this.legacyModelSessionIds.delete(sessionId);
-			return;
-		}
-		if (models.configId) {
-			this.modelConfigIds.set(sessionId, models.configId);
-			this.legacyModelSessionIds.delete(sessionId);
-			return;
-		}
-		this.modelConfigIds.delete(sessionId);
-		this.legacyModelSessionIds.add(sessionId);
-	}
-	updateRememberedSessionModels(sessionId, result) {
-		const explicitConfigRemoval = result.configOptionsPresent && this.modelConfigIds.has(sessionId);
-		if (result.models || result.legacyModelMetadataPresent || explicitConfigRemoval) this.rememberSessionModels(sessionId, result.models);
-	}
 	async cancel(sessionId) {
 		const connection = this.getConnection();
-		const active = this.activePrompt?.sessionId === sessionId ? this.activePrompt : void 0;
+		const owners = this.pendingPromptOwners.filter((owner) => owner.sessionId === sessionId);
+		const active = owners.at(-1);
 		const cancellation = active?.cancelPromise ?? this.runConnectionRequest(() => connection.agent.notify(methods.agent.session.cancel, { sessionId })).catch((error) => {
 			if (active?.cancelPromise === cancellation) active.cancelPromise = void 0;
 			throw error;
@@ -2972,19 +3052,20 @@ var AcpClient = class {
 		if (active) {
 			active.cancelPromise = cancellation;
 			this.cancellingSessionIds.add(sessionId);
-			active.elicitationController?.abort();
 		} else this.cancellingSessionIds.delete(sessionId);
+		for (const owner of owners) {
+			owner.elicitationController.abort();
+			owner.requestController.abort();
+		}
 		permissionController?.abort();
 		await cancellation;
 	}
 	async closeSession(sessionId) {
 		const connection = this.getConnection();
 		this.cancellingSessionIds.add(sessionId);
-		if (this.activePrompt?.sessionId === sessionId) this.activePrompt.elicitationController?.abort();
+		this.abortSessionRequests(sessionId);
 		await this.runConnectionRequest(() => connection.agent.request(methods.agent.session.close, { sessionId }));
 		if (this.loadedSessionId === sessionId) this.loadedSessionId = void 0;
-		this.modelConfigIds.delete(sessionId);
-		this.legacyModelSessionIds.delete(sessionId);
 	}
 	async listSessions(params = {}) {
 		const connection = this.getConnection();
@@ -3018,15 +3099,23 @@ var AcpClient = class {
 			if (timer) clearTimeout(timer);
 		}
 	}
-	async close() {
+	close() {
 		this.closing = true;
 		this.closeEpoch += 1;
+		if (this.closeTask) return this.closeTask;
+		this.closeTask = Promise.resolve().then(() => this.finishClose()).finally(() => {
+			this.closeTask = void 0;
+		});
+		return this.closeTask;
+	}
+	async finishClose() {
+		const permissionControllers = [...this.permissionAbortControllers.values()];
+		this.permissionAbortControllers.clear();
+		const owners = [...this.pendingPromptOwners];
 		this.abortActiveElicitation();
-		await this.terminalManager.shutdown();
-		const agent = this.agent;
-		if (agent) await this.terminateAgentProcess(agent);
-		this.closeConnection();
-		if (this.pendingConnectionRequests.size > 0) this.rejectPendingConnectionRequests(this.lastAgentExit ? new AgentDisconnectedError(this.lastAgentExit.reason, this.lastAgentExit.exitCode, this.lastAgentExit.signal, { outputAlreadyEmitted: Boolean(this.activePrompt) }) : new AgentDisconnectedError("connection_close", null, null, { outputAlreadyEmitted: Boolean(this.activePrompt) }));
+		for (const owner of owners) owner.requestController.abort();
+		for (const controller of permissionControllers) controller.abort();
+		await this.retireNativeResources();
 		this.sessionUpdateChain = Promise.resolve();
 		this.observedSessionUpdates = 0;
 		this.processedSessionUpdates = 0;
@@ -3039,16 +3128,35 @@ var AcpClient = class {
 		this.permissionAbortControllers.clear();
 		this.promptPermissionFailures.clear();
 		this.loadedSessionId = void 0;
-		this.modelConfigIds.clear();
-		this.legacyModelSessionIds.clear();
 		this.initResult = void 0;
 		this.connection = void 0;
 		this.agent = void 0;
 	}
-	async stopIfClosedDuringLaunch(epoch, child, startupFailure) {
+	async retireNativeResources() {
+		const agent = this.agent;
+		const failures = [];
+		try {
+			await this.terminalManager.shutdown();
+		} catch (error) {
+			failures.push(error);
+		}
+		try {
+			if (agent) await this.terminateAgentProcess(agent);
+		} catch (error) {
+			failures.push(error);
+		}
+		try {
+			this.closeConnection();
+		} finally {
+			this.rejectPendingConnectionRequests(this.lastAgentExit ? new AgentDisconnectedError(this.lastAgentExit.reason, this.lastAgentExit.exitCode, this.lastAgentExit.signal, { outputAlreadyEmitted: Boolean(this.activePrompt) }) : new AgentDisconnectedError("connection_close", null, null, { outputAlreadyEmitted: Boolean(this.activePrompt) }));
+		}
+		if (failures.length > 0) throw new AggregateError(failures, "ACP client cleanup failed", { cause: failures[0] });
+	}
+	async stopIfClosedDuringLaunch(epoch, child, startupFailure, authority) {
 		if (this.closeEpoch === epoch) return;
 		startupFailure.dispose();
 		await this.terminateAgentProcess(child);
+		assertControlAuthority(authority);
 		throw new Error("ACP client was closed while the agent was starting");
 	}
 	abortActiveElicitation() {
@@ -3255,27 +3363,41 @@ var AcpClient = class {
 		await connection.agent.request(methods.agent.authenticate, { methodId: selected.methodId });
 		this.log(`authenticated with method ${selected.methodId} (${selected.source})`);
 	}
-	async handlePermissionRequest(params) {
-		if (this.cancellingSessionIds.has(params.sessionId)) return cancelledPermissionResponse();
-		if (this.initResult?.agentInfo?.name === "antigravity-acp" && params.toolCall.toolCallId.startsWith("interaction_")) return this.handleModePermissionError(params.sessionId, new PermissionPromptUnavailableError("Antigravity requested a user answer. acpx cannot answer Antigravity interaction questions; continue in an interactive client.")).response;
-		const hostResponse = await this.tryHandlePermissionRequestWithHost(params);
-		if (hostResponse) return hostResponse;
-		const { response, recorded } = await this.resolvePermissionRequestFromMode(params);
-		if (!recorded) {
-			const decision = classifyPermissionDecision(params, response);
-			this.recordPermissionDecision(decision);
+	async handlePermissionRequest(params, requestSignal) {
+		const owner = this.captureDelegatedRequestOwner(params.sessionId, requestSignal);
+		if (!this.isDelegatedRequestActive(owner)) return cancelledPermissionResponse();
+		if (!this.hasPermissionOwner(params.sessionId)) return this.finishPermissionRequest(params, owner, cancelledPermissionResponse());
+		if (this.initResult?.agentInfo?.name === "antigravity-acp" && params.toolCall.toolCallId.startsWith("interaction_")) {
+			const response = this.handleModePermissionError(params.sessionId, new PermissionPromptUnavailableError("Antigravity requested a user answer. acpx cannot answer Antigravity interaction questions; continue in an interactive client."));
+			return this.finishPermissionRequest(params, owner, response);
 		}
-		return response;
+		const response = await this.tryHandlePermissionRequestWithHost(params, owner) ?? await this.resolvePermissionRequestFromMode(params, owner);
+		return this.finishPermissionRequest(params, owner, response);
+	}
+	finishPermissionRequest(params, owner, response) {
+		const result = this.isDelegatedRequestActive(owner) ? response : cancelledPermissionResponse();
+		this.recordPermissionDecision(classifyPermissionDecision(params, result));
+		return result;
+	}
+	hasPermissionOwner(sessionId) {
+		return !this.pendingPromptOwners.some((owner) => owner.permissionHandler !== void 0) || this.pendingPromptOwners.some((owner) => owner.sessionId === sessionId);
 	}
 	async handleElicitationRequest(request, requestId, requestSignal) {
 		const resolved = this.resolveElicitationOwner(request);
 		if ("response" in resolved) return resolved.response;
 		const { active, handler } = resolved.owner;
-		const signal = AbortSignal.any([requestSignal, active.elicitationController.signal]);
-		const outcome = await raceWithAbort(signal, Promise.resolve().then(async () => await handler(request, {
-			requestId,
-			signal
-		})).then((response) => ({
+		const signal = AbortSignal.any([
+			requestSignal,
+			active.elicitationController.signal,
+			active.authority?.signal
+		].filter((candidate) => candidate !== void 0));
+		const outcome = await raceWithAbort(signal, Promise.resolve().then(async () => {
+			signal.throwIfAborted();
+			return await handler(request, {
+				requestId,
+				signal
+			});
+		}).then((response) => ({
 			kind: "response",
 			response
 		}), (error) => ({
@@ -3310,62 +3432,65 @@ var AcpClient = class {
 	isElicitationSessionCancelling(sessionId) {
 		return this.closing || this.cancellingSessionIds.has(sessionId);
 	}
-	resolvePermissionOwner(sessionId) {
-		const active = this.activePrompt;
-		const handler = active?.permissionHandler ?? this.options.onPermissionRequest;
-		if (!handler) return;
-		const signal = this.cancellationSignalForSession(sessionId);
-		if (!active?.permissionHandler) return {
-			handler,
-			signal
-		};
+	captureDelegatedRequestOwner(sessionId, requestSignal) {
+		const active = this.pendingPromptOwners.findLast((owner) => owner.sessionId === sessionId);
+		const signal = AbortSignal.any([
+			active?.requestController.signal ?? this.cancellationSignalForSession(sessionId),
+			active?.authority?.signal,
+			requestSignal
+		].filter((candidate) => candidate !== void 0));
+		const epoch = this.closeEpoch;
 		return {
-			handler,
-			signal: active.sessionId === sessionId ? AbortSignal.any([signal, active.elicitationController.signal]) : AbortSignal.abort()
+			signal,
+			permissionHandler: active?.permissionHandler ?? this.options.onPermissionRequest,
+			assertActive: () => {
+				if (this.closing || this.closeEpoch !== epoch || this.cancellingSessionIds.has(sessionId)) throw RequestError.requestCancelled();
+			}
 		};
 	}
-	async tryHandlePermissionRequestWithHost(params) {
-		const owner = this.resolvePermissionOwner(params.sessionId);
-		if (!owner) return;
-		const { handler, signal } = owner;
-		if (signal.aborted) return this.hostPermissionDecisionResponse(params, signal, void 0);
+	isDelegatedRequestActive(owner) {
+		try {
+			assertControlAuthority(owner);
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	async tryHandlePermissionRequestWithHost(params, owner) {
+		const handler = owner.permissionHandler;
+		if (!handler) return;
+		const { signal } = owner;
+		if (!this.isDelegatedRequestActive(owner)) return cancelledPermissionResponse();
 		try {
 			const decision = await raceWithAbort(signal, handler({
 				sessionId: params.sessionId,
 				raw: params,
 				inferredKind: inferToolKind(params)
 			}, { signal }));
-			return this.hostPermissionDecisionResponse(params, signal, decision);
+			return this.hostPermissionDecisionResponse(params, owner, decision);
 		} catch (error) {
-			return this.hostPermissionErrorResponse(params, signal, error);
+			return this.hostPermissionErrorResponse(owner, error);
 		}
 	}
-	hostPermissionDecisionResponse(params, signal, decision) {
-		if (signal.aborted || this.cancellingSessionIds.has(params.sessionId)) {
-			this.recordPermissionDecision("cancelled");
-			return cancelledPermissionResponse();
-		}
+	hostPermissionDecisionResponse(params, owner, decision) {
+		if (!this.isDelegatedRequestActive(owner)) return cancelledPermissionResponse();
 		if (!decision) return;
 		const response = decisionToResponse(preferCodexPermissionRefusal(params, this.initResult?.agentInfo?.name), decision);
-		this.recordPermissionDecision(classifyPermissionDecision(params, response));
 		return decision.outcome === "cancel" ? response : this.explainPermissionRefusal(params, response);
 	}
-	hostPermissionErrorResponse(params, signal, error) {
-		if (signal.aborted || this.cancellingSessionIds.has(params.sessionId)) {
-			this.recordPermissionDecision("cancelled");
-			return cancelledPermissionResponse();
-		}
+	hostPermissionErrorResponse(owner, error) {
+		if (!this.isDelegatedRequestActive(owner)) return cancelledPermissionResponse();
 		this.log(`onPermissionRequest threw, falling through to mode-based resolver: ${error instanceof Error ? error.message : String(error)}`);
 	}
-	async resolvePermissionRequestFromMode(params) {
+	async resolvePermissionRequestFromMode(params, owner) {
 		try {
-			const result = await resolvePermissionRequestWithDetails(preferCodexPermissionRefusal(params, this.initResult?.agentInfo?.name), this.options.permissionMode, this.options.nonInteractivePermissions ?? "deny", this.options.permissionPolicy);
+			assertControlAuthority(owner);
+			const result = await resolvePermissionRequestWithDetails(preferCodexPermissionRefusal(params, this.initResult?.agentInfo?.name), this.options.permissionMode, this.options.nonInteractivePermissions ?? "deny", this.options.permissionPolicy, owner.signal);
+			assertControlAuthority(owner);
 			this.emitPermissionEscalation(result.escalation);
-			return {
-				response: this.explainPermissionRefusal(params, result.response),
-				recorded: false
-			};
+			return this.explainPermissionRefusal(params, result.response);
 		} catch (error) {
+			if (!this.isDelegatedRequestActive(owner)) return cancelledPermissionResponse();
 			return this.handleModePermissionError(params.sessionId, error);
 		}
 	}
@@ -3388,16 +3513,12 @@ var AcpClient = class {
 	handleModePermissionError(sessionId, error) {
 		if (!(error instanceof PermissionPromptUnavailableError)) throw error;
 		this.notePromptPermissionFailure(sessionId, error);
-		this.recordPermissionDecision("cancelled");
-		return {
-			response: cancelledPermissionResponse(),
-			recorded: true
-		};
+		return cancelledPermissionResponse();
 	}
 	attachAgentLifecycleObservers(child, startedProcess, exitNotificationBarrier) {
 		const onExit = (exitCode, signal) => {
 			const exitedAt = isoNow$2();
-			this.recordAgentExit(child, "process_exit", exitCode, signal);
+			this.handleAgentDisconnect(child, "process_exit", exitCode, signal);
 			this.terminateAgentProcess(child);
 			exitNotificationBarrier.then(() => {
 				this.notifyProcessExit(startedProcess, exitCode, signal, exitedAt);
@@ -3409,10 +3530,17 @@ var AcpClient = class {
 			onExit(child.exitCode, child.signalCode);
 		}
 		child.once("close", (exitCode, signal) => {
-			this.recordAgentExit(child, "process_close", exitCode, signal);
+			this.handleAgentDisconnect(child, "process_close", exitCode, signal);
 		});
 		child.stdout.once("close", () => {
-			this.recordAgentExit(child, "pipe_close", child.exitCode ?? null, child.signalCode ?? null);
+			this.handleAgentDisconnect(child, "pipe_close", child.exitCode ?? null, child.signalCode ?? null);
+		});
+	}
+	handleAgentDisconnect(child, reason, exitCode, signal) {
+		this.recordAgentExit(child, reason, exitCode, signal);
+		if (this.agent !== child || this.closing || !this.connection) return;
+		this.close().catch((error) => {
+			this.log(`disconnected agent cleanup failed: ${String(error)}`);
 		});
 	}
 	notifyProcessSpawnFailure(launch, error) {
@@ -3519,28 +3647,30 @@ var AcpClient = class {
 			pending.reject(error);
 		}
 	}
-	async handleReadTextFile(params) {
+	async handleReadTextFile(params, requestSignal) {
 		try {
-			return await this.filesystem.readTextFile(params);
+			return await this.runDelegatedOperation(params.sessionId, requestSignal, (owner) => this.filesystem.readTextFile(params, owner));
 		} catch (error) {
-			this.recordPermissionError(params.sessionId, error);
 			if (error instanceof FsSafeError && error.code === "not-found" || error instanceof Error && "code" in error && error.code === "ENOENT") throw RequestError.resourceNotFound(pathToFileURL(params.path).href);
 			throw error;
 		}
 	}
-	async handleWriteTextFile(params) {
-		try {
-			return await this.filesystem.writeTextFile(params);
-		} catch (error) {
-			this.recordPermissionError(params.sessionId, error);
-			throw error;
-		}
+	async handleWriteTextFile(params, requestSignal) {
+		return await this.runDelegatedOperation(params.sessionId, requestSignal, (owner) => this.filesystem.writeTextFile(params, owner));
+	}
+	async handleCreateTerminal(params, requestSignal) {
+		return await this.runDelegatedOperation(params.sessionId, requestSignal, (owner) => this.terminalManager.createTerminal(params, owner));
 	}
-	async handleCreateTerminal(params) {
+	async runDelegatedOperation(sessionId, requestSignal, run) {
+		const owner = this.captureDelegatedRequestOwner(sessionId, requestSignal);
 		try {
-			return await this.terminalManager.createTerminal(params);
+			assertControlAuthority(owner);
+			const result = await run(owner);
+			assertControlAuthority(owner);
+			return result;
 		} catch (error) {
-			this.recordPermissionError(params.sessionId, error);
+			if (!this.isDelegatedRequestActive(owner)) throw RequestError.requestCancelled();
+			this.recordPermissionError(sessionId, error);
 			throw error;
 		}
 	}
@@ -3774,7 +3904,6 @@ function ensureAgentMessage(conversation) {
 	return created;
 }
 function appendAgentText(agent, text) {
-	if (!text.trim()) return;
 	const last = agent.content.at(-1);
 	if (last && isAgentTextContent(last)) {
 		last.Text = trimRuntimeText(`${last.Text}${text}`, MAX_RUNTIME_AGENT_TEXT_CHARS);
@@ -3784,7 +3913,6 @@ function appendAgentText(agent, text) {
 	agent.content.push(next);
 }
 function appendAgentThinking(agent, text) {
-	if (!text.trim()) return;
 	const last = agent.content.at(-1);
 	if (last && isAgentThinkingContent(last)) {
 		last.Thinking.text = trimRuntimeText(`${last.Thinking.text}${text}`, MAX_RUNTIME_THINKING_CHARS);
@@ -3841,8 +3969,7 @@ function ensureToolUseContent(agent, toolCallId) {
 	return created;
 }
 function upsertToolResult(agent, toolCallId, patch) {
-	const existing = agent.tool_results[toolCallId];
-	const fallback = existingToolResultValues(existing);
+	const fallback = existingToolResultValues(hasOwn(agent.tool_results, toolCallId) ? agent.tool_results[toolCallId] : void 0);
 	const next = {
 		tool_use_id: toolCallId,
 		tool_name: patch.tool_name ?? fallback.tool_name,
@@ -3850,7 +3977,12 @@ function upsertToolResult(agent, toolCallId, patch) {
 		content: patch.content ?? fallback.content,
 		output: patch.output ?? fallback.output
 	};
-	agent.tool_results[toolCallId] = next;
+	Object.defineProperty(agent.tool_results, toolCallId, {
+		value: next,
+		writable: true,
+		enumerable: true,
+		configurable: true
+	});
 }
 function existingToolResultValues(existing) {
 	if (existing) return existing;
@@ -3891,7 +4023,7 @@ function applyToolResultUpdate(agent, tool, update) {
 	const output = hasOwn(update, "rawOutput") ? deepClone(update.rawOutput) : void 0;
 	upsertToolResult(agent, update.toolCallId, {
 		tool_name: tool.name,
-		is_error: statusIndicatesError(status),
+		is_error: status === void 0 ? void 0 : statusIndicatesError(status),
 		content: output === void 0 ? void 0 : toToolResultContent(output),
 		output
 	});
@@ -4037,20 +4169,6 @@ function recordPromptSubmission(conversation, prompt, timestamp = isoNow(), mess
 	trimConversationForRuntime(conversation);
 	return promptMessageId;
 }
-function agentMessageHasObservedReply(message) {
-	return message.content.length > 0 || Object.keys(message.tool_results).length > 0;
-}
-function hasAgentReplyAfterPrompt(conversation, promptMessageId) {
-	let sawPrompt = false;
-	for (const message of conversation.messages) {
-		if (!sawPrompt) {
-			if (isUserMessage(message) && message.User.id === promptMessageId) sawPrompt = true;
-			continue;
-		}
-		if (isAgentMessage(message) && agentMessageHasObservedReply(message.Agent)) return true;
-	}
-	return false;
-}
 function recordSessionUpdate(conversation, state, notification, timestamp = isoNow(), userMessageId) {
 	const acpx = ensureAcpxState$1(state);
 	const update = notification.update;
@@ -4331,10 +4449,7 @@ function getDesiredModeId(state) {
 function getDesiredConfigOptions(state) {
 	const desired = state?.desired_config_options;
 	if (!desired) return {};
-	return Object.fromEntries(Object.entries(desired).flatMap(([configId, value]) => {
-		const normalizedConfigId = normalizeModeId(configId);
-		return normalizedConfigId && typeof value === "string" ? [[normalizedConfigId, value]] : [];
-	}));
+	return Object.fromEntries(Object.entries(desired).filter(([, value]) => typeof value === "string"));
 }
 function setDesiredModeId(record, modeId) {
 	const acpx = ensureAcpxState(record.acpx);
@@ -4344,10 +4459,9 @@ function setDesiredModeId(record, modeId) {
 	record.acpx = acpx;
 }
 function clearDesiredConfigOption(state, configId) {
-	const normalizedConfigId = normalizeModeId(configId);
-	if (!normalizedConfigId || !state.desired_config_options) return;
+	if (typeof configId !== "string" || !state.desired_config_options) return;
 	const desired = { ...state.desired_config_options };
-	delete desired[normalizedConfigId];
+	delete desired[configId];
 	if (Object.keys(desired).length > 0) state.desired_config_options = desired;
 	else delete state.desired_config_options;
 }
@@ -4386,7 +4500,7 @@ async function applyRequestedModelIfAdvertised(params) {
 	if (params.models.currentModelId === requestedModel) return { applied: true };
 	return {
 		applied: true,
-		response: await withTimeout(params.client.setSessionModel(params.sessionId, requestedModel, params.models), params.timeoutMs)
+		response: await withTimeout(params.client.setSessionModel(params.sessionId, requestedModel, params.models, params.authority), params.timeoutMs)
 	};
 }
 //#endregion
@@ -4411,9 +4525,9 @@ function applyAcceptedConfigOptions(state, response) {
 	if (!response) return next;
 	applyConfigOptionsModelState(next, response.configOptions);
 	if (!next.desired_config_options) return next;
-	const desired = {};
-	for (const option of response.configOptions) if (typeof option.currentValue === "string" && Object.hasOwn(next.desired_config_options, option.id)) desired[option.id] = option.currentValue;
-	if (Object.keys(desired).length > 0) next.desired_config_options = desired;
+	const desiredEntries = [];
+	for (const option of response.configOptions) if (typeof option.currentValue === "string" && Object.hasOwn(next.desired_config_options, option.id)) desiredEntries.push([option.id, option.currentValue]);
+	if (desiredEntries.length > 0) next.desired_config_options = Object.fromEntries(desiredEntries);
 	else delete next.desired_config_options;
 	return next;
 }
@@ -4431,8 +4545,7 @@ function applyModelSelection(state, modelId, response) {
 function applyConfigOptionSelection(state, configId, value, response, modelConfigId = advertisedModelState(state)?.configId) {
 	if (configId === modelConfigId || configId === modelStateFromConfigOptions(response.configOptions)?.configId) return applyModelSelection(state, value, response);
 	const next = cloneSessionAcpxState(state) ?? {};
-	if (configId === "mode") next.desired_mode_id = value;
-	else next.desired_config_options = {
+	next.desired_config_options = {
 		...next.desired_config_options,
 		[configId]: value
 	};
@@ -4443,6 +4556,7 @@ function applyConfigOptionSelection(state, configId, value, response, modelConfi
 const LOCK_RETRY_MS = 15;
 const INCOMPLETE_RESERVATION_GRACE_MS = 15e3;
 let lastCreatedAt = 0;
+const localTurns = /* @__PURE__ */ new Map();
 async function readLock(filePath) {
 	try {
 		const stat = await fs$1.lstat(filePath, { bigint: true });
@@ -4456,14 +4570,37 @@ async function readLock(filePath) {
 		throw error;
 	}
 }
-function lockPid(payload) {
+function parseLock(payload) {
 	try {
-		const pid = JSON.parse(payload)?.pid;
-		return typeof pid === "number" && Number.isInteger(pid) && pid > 0 ? pid : void 0;
+		return JSON.parse(payload);
 	} catch {
 		return;
 	}
 }
+async function tryAcquireGuard(filePath, owner, signal) {
+	try {
+		return await acquireFileLock(filePath, {
+			managerKey: "acpx.session-turn",
+			lockPath: `${filePath}.guard`,
+			staleMs: Infinity,
+			timeoutMs: LOCK_RETRY_MS,
+			retry: {
+				retries: 8,
+				minTimeout: 1,
+				maxTimeout: 2,
+				factor: 1,
+				randomize: false
+			},
+			staleRecovery: "remove-if-unchanged",
+			payload: () => owner.payload,
+			shouldReclaim: ({ payload }) => owner.hasExited(payload, false, signal),
+			shouldRemoveStaleLock: ({ payload }) => owner.hasExited(payload, true, signal)
+		});
+	} catch (error) {
+		if (error.code === "file_lock_timeout") return;
+		throw error;
+	}
+}
 async function removeObservedLock(filePath, observed) {
 	const current = await readLock(filePath);
 	if (!current) return true;
@@ -4473,83 +4610,198 @@ async function removeObservedLock(filePath, observed) {
 	});
 	return true;
 }
-async function recoverAbandonedLock(filePath) {
+async function recoverAbandonedLock(filePath, owner, signal) {
 	const observed = await readLock(filePath);
-	if (!observed) return;
-	const pid = lockPid(observed.payload);
-	if (pid === process.pid || isProcessAlive(pid)) return;
-	if (!pid && Date.now() - Number(observed.stat.mtimeMs) <= INCOMPLETE_RESERVATION_GRACE_MS) return;
-	if (await removeObservedLock(filePath, observed)) incrementPerfCounter("session.events.stale_lock_recovered");
+	if (!observed) return true;
+	const payload = parseLock(observed.payload);
+	const pid = lockOwnerPid(payload);
+	if (pid && (!await owner.hasExited(payload, false, signal) || !await owner.hasExited(payload, true, signal))) return false;
+	if (!pid && Date.now() - Number(observed.stat.mtimeMs) <= INCOMPLETE_RESERVATION_GRACE_MS) return false;
+	if (await removeObservedLock(filePath, observed)) {
+		incrementPerfCounter("session.events.stale_lock_recovered");
+		return true;
+	}
+	return false;
 }
 async function publishLock(filePath, payload, signal) {
-	try {
-		await withTempFile({
-			rootDir: path.dirname(filePath),
-			prefix: "session-turn",
-			fileName: "lock"
-		}, async (temporaryPath) => {
-			await fs$1.writeFile(temporaryPath, payload, {
+	await withTempFile({
+		rootDir: path.dirname(filePath),
+		prefix: "session-turn",
+		fileName: "lock"
+	}, async (temporaryPath) => {
+		await fs$1.writeFile(temporaryPath, payload, {
+			encoding: "utf8",
+			flag: "wx",
+			mode: 384
+		});
+		signal?.throwIfAborted();
+		try {
+			await fs$1.link(temporaryPath, filePath);
+		} catch (error) {
+			if (!isHardlinkFallbackError(error)) throw error;
+			await fs$1.writeFile(filePath, payload, {
 				encoding: "utf8",
 				flag: "wx",
 				mode: 384
 			});
-			signal?.throwIfAborted();
-			try {
-				await fs$1.link(temporaryPath, filePath);
-			} catch (error) {
-				if (!isHardlinkFallbackError(error)) throw error;
-				await fs$1.writeFile(filePath, payload, {
-					encoding: "utf8",
-					flag: "wx",
-					mode: 384
-				});
-			}
-		});
-	} catch (error) {
-		await removePublishedLock(filePath, payload).catch(() => {});
-		throw error;
-	}
+		}
+	});
 }
 async function removePublishedLock(filePath, payload) {
 	const current = await readLock(filePath);
 	if (current?.payload === payload) await removeObservedLock(filePath, current);
 }
-async function observePublishedLock(filePath, payload, signal) {
+async function rejectAcquisition(filePath, receipt, error) {
+	const failures = [error];
+	await disposeTurn(filePath, receipt).catch((cleanupError) => {
+		failures.push(...cleanupError instanceof AggregateError ? cleanupError.errors : [cleanupError]);
+	});
+	if (failures.length > 1) throw new AggregateError(failures, "Session turn acquisition and cleanup failed");
+	throw error;
+}
+async function releaseTurnGuard(receipt) {
+	await receipt.guard?.release();
+	receipt.guard = void 0;
+}
+async function removeTurnMarker(filePath, receipt) {
+	if (!receipt.removeMarker) return true;
+	if (receipt.guard && !await receipt.guard.verifyStillHeld()) await releaseTurnGuard(receipt);
+	receipt.guard ??= await tryAcquireGuard(filePath, receipt.owner);
+	if (!receipt.guard) return false;
+	await receipt.removeMarker();
+	receipt.removeMarker = void 0;
+	return true;
+}
+async function settleTurn(filePath, receipt) {
+	if (receipt.settled) return true;
+	const pending = receipt.pending ??= (async () => {
+		receipt.failed = false;
+		const failures = [];
+		try {
+			if (!await removeTurnMarker(filePath, receipt)) return false;
+		} catch (error) {
+			failures.push(error);
+		}
+		if (failures.length === 0 || !receipt.admitted) try {
+			await releaseTurnGuard(receipt);
+		} catch (error) {
+			failures.push(error);
+		}
+		if (failures.length > 1) throw new AggregateError(failures, "Session turn cleanup failed");
+		if (failures.length === 1) throw failures[0];
+		receipt.settled = true;
+		localTurns.delete(filePath);
+		return true;
+	})();
+	try {
+		return await pending;
+	} finally {
+		if (receipt.pending === pending) {
+			receipt.pending = void 0;
+			receipt.failed = !receipt.settled;
+		}
+	}
+}
+async function disposeTurn(filePath, receipt) {
+	if (!await settleTurn(filePath, receipt)) throw new Error(`Session turn cleanup is waiting for its guard: ${filePath}`);
+}
+async function tryPublishLock(filePath, payload, owner, signal) {
+	for (;;) try {
+		await publishLock(filePath, payload, signal);
+		return true;
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+		if (!await recoverAbandonedLock(filePath, owner, signal)) return false;
+	}
+}
+async function tryAcquireTurnCleanup(filePath, payload, owner, signal) {
+	const previous = localTurns.get(filePath);
+	if (previous) {
+		if (previous.failed) await settleTurn(filePath, previous);
+		return;
+	}
+	const receipt = {
+		owner,
+		removeMarker: async () => await removePublishedLock(filePath, payload),
+		admitted: false,
+		failed: false,
+		settled: false
+	};
+	localTurns.set(filePath, receipt);
+	try {
+		receipt.guard = await tryAcquireGuard(filePath, owner, signal);
+	} catch (error) {
+		localTurns.delete(filePath);
+		throw error;
+	}
+	if (!receipt.guard) {
+		localTurns.delete(filePath);
+		return;
+	}
+	return receipt;
+}
+async function tryAcquireTurn(filePath, payload, owner, signal) {
+	const receipt = await tryAcquireTurnCleanup(filePath, payload, owner, signal);
+	if (!receipt) return;
 	try {
+		signal?.throwIfAborted();
+		if (!await tryPublishLock(filePath, payload, owner, signal)) {
+			await disposeTurn(filePath, receipt);
+			return;
+		}
 		const observed = await readLock(filePath);
 		if (observed?.payload !== payload) throw new Error(`Session turn ownership changed before admission: ${filePath}`);
 		signal?.throwIfAborted();
-		return { [Symbol.asyncDispose]: async () => {
-			await removeObservedLock(filePath, observed);
-		} };
+		receipt.admitted = true;
+		receipt.removeMarker = async () => await removeObservedLock(filePath, observed);
+		return { [Symbol.asyncDispose]: async () => await disposeTurn(filePath, receipt) };
 	} catch (error) {
-		await removePublishedLock(filePath, payload).catch(() => {});
-		throw error;
+		return await rejectAcquisition(filePath, receipt, error);
 	}
 }
 async function acquireSessionTurn(recordId, signal) {
-	const filePath = sessionEventLockPath(recordId);
-	await fs$1.mkdir(path.dirname(filePath), {
+	const requestedPath = sessionEventLockPath(recordId);
+	await fs$1.mkdir(path.dirname(requestedPath), {
 		recursive: true,
 		mode: 448
 	});
+	const filePath = path.join(await fs$1.realpath(path.dirname(requestedPath)), path.basename(requestedPath));
+	const owner = await createLockOwner({ signal });
 	lastCreatedAt = Math.max(Date.now(), lastCreatedAt + 1);
 	const payload = `${JSON.stringify({
-		pid: process.pid,
+		...owner.payload,
 		created_at: new Date(lastCreatedAt).toISOString()
 	}, null, 2)}\n`;
 	for (;;) {
 		signal?.throwIfAborted();
-		try {
-			await publishLock(filePath, payload, signal);
-			break;
-		} catch (error) {
-			if (error.code !== "EEXIST") throw error;
-			await recoverAbandonedLock(filePath);
-			await setTimeout$1(LOCK_RETRY_MS, void 0, { signal });
-		}
+		const turn = await tryAcquireTurn(filePath, payload, owner, signal);
+		if (turn) return turn;
+		await setTimeout$1(LOCK_RETRY_MS, void 0, { signal });
 	}
-	return await observePublishedLock(filePath, payload, signal);
+}
+//#endregion
+//#region src/session/execution/direct-lifetime.ts
+function ownDirectClient(client, signal) {
+	let closing;
+	const cancel = async () => {
+		await withTimeout(client.cancelActivePrompt(2500), 2500).catch(() => {});
+		await client.close();
+	};
+	const onAbort = () => {
+		closing ??= cancel();
+		closing.catch(() => {});
+	};
+	signal?.addEventListener("abort", onAbort, { once: true });
+	if (signal?.aborted) onAbort();
+	const release = () => signal?.removeEventListener("abort", onAbort);
+	return Object.assign(() => {
+		release();
+		closing ??= client.close();
+		return closing;
+	}, { release });
+}
+function directExecutionError(error, signal) {
+	return signal?.aborted && error instanceof AgentDisconnectedError ? signal.reason : error;
 }
 //#endregion
 //#region src/session/queue/ipc-server.ts
@@ -4584,9 +4836,12 @@ function makeQueueOwnerErrorFromUnknown(requestId, error, detailCode, options =
 		acp: normalized.acp
 	};
 }
+function armSocketDrainTimeout(socket) {
+	if (process.platform !== "win32") socket.setTimeout(QUEUE_SOCKET_DRAIN_TIMEOUT_MS);
+}
 function writeQueueMessage(socket, message) {
 	if (socket.destroyed || !socket.writable) return;
-	socket.write(`${JSON.stringify(message)}\n`);
+	if (!socket.write(`${JSON.stringify(message)}\n`) && !socket.timeout) armSocketDrainTimeout(socket);
 }
 var SessionQueueOwner = class SessionQueueOwner {
 	server;
@@ -4730,6 +4985,7 @@ var SessionQueueOwner = class SessionQueueOwner {
 		return true;
 	}
 	handleControlRequest(options) {
+		this.taskSockets.add(options.socket);
 		writeQueueMessage(options.socket, {
 			type: "accepted",
 			requestId: options.requestId,
@@ -4753,6 +5009,7 @@ var SessionQueueOwner = class SessionQueueOwner {
 		if (socket.destroyed || this.drainingSockets.has(socket)) return;
 		this.taskSockets.delete(socket);
 		this.drainingSockets.add(socket);
+		armSocketDrainTimeout(socket);
 		socket.end(() => {
 			this.drainingSockets.delete(socket);
 			socket.destroy();
@@ -4902,6 +5159,10 @@ var SessionQueueOwner = class SessionQueueOwner {
 	handleConnection(socket) {
 		this.sockets.add(socket);
 		socket.setEncoding("utf8");
+		socket.on("timeout", () => socket.destroy());
+		socket.on("drain", () => {
+			if (!socket.writableEnded) socket.setTimeout(0);
+		});
 		socket.once("close", () => {
 			this.sockets.delete(socket);
 			this.taskSockets.delete(socket);
@@ -4990,6 +5251,10 @@ async function replayDesiredMode(params) {
 		await withTimeout(params.client.setSessionMode(params.sessionId, params.desiredModeId, params.replay.authority), params.timeoutMs);
 		params.replay.acknowledged = true;
 		if (params.verbose) process.stderr.write(`[acpx] replayed desired mode ${params.desiredModeId} on fresh ACP session ${params.sessionId} (previous ${params.previousSessionId})\n`);
+		return {
+			models: advertisedModelState(params.record.acpx),
+			configOptionsPresent: params.record.acpx?.config_options !== void 0
+		};
 	} catch (error) {
 		rethrowAuthorityFailure(params.replay, error);
 		throw new SessionModeReplayError(`Failed to replay saved session mode ${params.desiredModeId} on fresh ACP session ${params.sessionId}: ${formatErrorMessage(error)}`, {
@@ -5042,7 +5307,7 @@ async function replayDesiredConfigOptions(params) {
 	for (const [configId, value] of Object.entries(params.desiredConfigOptions)) {
 		if (configId === replacingKey || acceptedConfigOptions && !acceptsSavedConfigValue(acceptedConfigOptions.find((option) => option.id === configId), value)) continue;
 		try {
-			const response = await withTimeout(params.client.setSessionConfigOption(params.sessionId, configId, value, params.replay.authority), params.timeoutMs);
+			const response = await withTimeout(params.client.setSessionConfigOption(params.sessionId, configId, value, advertisedModelState(params.record.acpx), params.replay.authority), params.timeoutMs);
 			params.replay.acknowledged = true;
 			params.record.acpx = applyConfigOptionSelection(params.record.acpx, configId, value, response);
 			acceptedConfigOptions = response.configOptions;
@@ -5068,18 +5333,20 @@ function restoreOriginalSessionState(params) {
 async function connectAndLoadSession(options) {
 	const record = options.record;
 	const client = options.client;
+	assertControlAuthority(options.authority);
 	const sameSessionOnly = requiresSameSession(options.resumePolicy) || Boolean(record.importedFrom);
 	const originalSessionId = record.acpSessionId;
 	const originalAgentSessionId = record.agentSessionId;
 	const originalAcpx = cloneSessionAcpxState(record.acpx);
-	const desiredModeId = getDesiredModeId(record.acpx);
+	const desiredModeId = options.replacingMode ? void 0 : getDesiredModeId(record.acpx);
 	const desiredModelId = getDesiredModelId(record.acpx);
 	const desiredConfigOptions = getDesiredConfigOptions(record.acpx);
 	const storedProcessAlive = isProcessAlive(record.pid);
 	logReconnectAttempt(record, storedProcessAlive, Boolean(record.pid) && !storedProcessAlive, options.verbose);
 	const reusingLoadedSession = client.hasReusableSession(record.acpSessionId);
 	if (reusingLoadedSession) incrementPerfCounter("runtime.connect_and_load.reused_session");
-	else await withTimeout(client.start(), options.timeoutMs);
+	else await withTimeout(client.start(options.authority), options.timeoutMs);
+	assertControlAuthority(options.authority);
 	options.onClientAvailable?.(options.activeController);
 	applyLifecycleSnapshotToRecord(record, client.getAgentLifecycleSnapshot());
 	record.closed = false;
@@ -5090,9 +5357,11 @@ async function connectAndLoadSession(options) {
 		record,
 		reusingLoadedSession,
 		sameSessionOnly,
-		timeoutMs: options.timeoutMs
+		timeoutMs: options.timeoutMs,
+		authority: options.authority
 	});
 	const { resumed, loadError, sessionId, createdFreshSession, pendingAgentSessionId, sessionModels } = loadState;
+	applyReconnectedModelState(record, sessionModels, loadState.configOptionsPresent, loadState.legacyModelMetadataPresent, createdFreshSession);
 	const preferenceReplay = await replaySessionPreferences({
 		client,
 		record,
@@ -5123,14 +5392,18 @@ async function connectAndLoadSession(options) {
 	};
 }
 function resolveModelsAfterReplay(replay, initialModels) {
-	if (replay.configReplay.replayed) return replay.configReplay.models ?? preserveLegacyModels(replay.modelReplay.replayed ? replay.modelReplay.models : initialModels);
-	return replay.modelReplay.replayed ? replay.modelReplay.models : initialModels;
+	const models = resolveModeReplayModels(replay.modeMetadata, initialModels);
+	if (replay.configReplay.replayed) return replay.configReplay.models ?? preserveLegacyModels(replay.modelReplay.replayed ? replay.modelReplay.models : models);
+	return replay.modelReplay.replayed ? replay.modelReplay.models : models;
+}
+function resolveModeReplayModels(modeMetadata, initialModels) {
+	return modeMetadata ? modeMetadata.models : initialModels;
 }
 function preserveLegacyModels(models) {
 	return models && !models.configId ? models : void 0;
 }
 function resolveConfigOptionsPresenceAfterReplay(replay, initiallyPresent) {
-	return initiallyPresent || replay.configReplay.replayed || replay.modelReplay.configOptions !== void 0;
+	return initiallyPresent || replay.modeMetadata?.configOptionsPresent === true || replay.configReplay.replayed || replay.modelReplay.configOptions !== void 0;
 }
 function applyReconnectedModelState(record, sessionModels, configOptionsPresent, legacyModelMetadataPresent, createdFreshSession) {
 	clearOmittedFreshSessionConfigOptions(record, createdFreshSession, configOptionsPresent);
@@ -5171,12 +5444,13 @@ async function replaySessionPreferences(params) {
 	};
 	let modelReplay = { replayed: false };
 	let configReplay = { replayed: false };
+	let modeMetadata;
 	const replay = createReplayState(params.authority);
-	const replacingModel = replacesModel(params.replacingConfigOption, params.sessionModels, params.originalAcpx);
 	try {
 		assertControlAuthority(replay.authority);
-		await replayDesiredMode({
+		modeMetadata = await replayDesiredMode({
 			client: params.client,
+			record: params.record,
 			sessionId: params.sessionId,
 			desiredModeId: params.createdFreshSession ? params.desiredModeId : void 0,
 			replay,
@@ -5184,6 +5458,8 @@ async function replaySessionPreferences(params) {
 			timeoutMs: params.timeoutMs,
 			verbose: params.verbose
 		});
+		const effectiveModels = resolveModeReplayModels(modeMetadata, params.sessionModels);
+		const replacingModel = replacesModel(params.replacingConfigOption, effectiveModels, params.originalAcpx);
 		modelReplay = await replayDesiredModel({
 			client: params.client,
 			sessionId: params.sessionId,
@@ -5191,7 +5467,7 @@ async function replaySessionPreferences(params) {
 			replay,
 			previousSessionId: params.originalSessionId,
 			record: params.record,
-			models: params.sessionModels,
+			models: effectiveModels,
 			createdFreshSession: params.createdFreshSession,
 			timeoutMs: params.timeoutMs,
 			verbose: params.verbose,
@@ -5218,7 +5494,8 @@ async function replaySessionPreferences(params) {
 	reconcileAgentSessionId(params.record, params.pendingAgentSessionId);
 	return {
 		modelReplay,
-		configReplay
+		configReplay,
+		modeMetadata
 	};
 }
 function settleFailedReplay(params, replay, error) {
@@ -5250,11 +5527,14 @@ async function loadOrCreateRuntimeSession(params) {
 		record: params.record,
 		reason: "agent does not support session/resume or session/load"
 	});
-	return await createFreshRuntimeSession(params.client, params.record, params.timeoutMs);
+	return await createFreshRuntimeSession(params.client, params.record, params.timeoutMs, params.authority);
 }
 async function loadRuntimeSession(params, resume) {
 	try {
-		const loadResult = await withTimeout(resume ? params.client.resumeSession(params.record.acpSessionId, params.record.cwd) : params.client.loadSessionWithOptions(params.record.acpSessionId, params.record.cwd, { suppressReplayUpdates: true }), params.timeoutMs);
+		const loadResult = await withTimeout(resume ? params.client.resumeSession(params.record.acpSessionId, params.record.cwd, params.authority) : params.client.loadSessionWithOptions(params.record.acpSessionId, params.record.cwd, {
+			suppressReplayUpdates: true,
+			...params.authority ? { authority: params.authority } : {}
+		}), params.timeoutMs);
 		reconcileAgentSessionId(params.record, loadResult.agentSessionId);
 		applyConfigOptionsToRecord(params.record, loadResult);
 		return {
@@ -5267,9 +5547,14 @@ async function loadRuntimeSession(params, resume) {
 			createdFreshSession: false
 		};
 	} catch (error) {
+		rethrowCancelledLoad(error, params.authority);
 		return await recoverRuntimeSessionLoadFailure(params, error);
 	}
 }
+function rethrowCancelledLoad(error, authority) {
+	const signal = authority?.signal;
+	if (signal?.aborted && (error instanceof AgentDisconnectedError || error === signal.reason)) throw signal.reason;
+}
 async function recoverRuntimeSessionLoadFailure(params, error) {
 	const loadError = formatErrorMessage(error);
 	if (params.sameSessionOnly) throw makeSessionResumeRequiredError({
@@ -5279,12 +5564,12 @@ async function recoverRuntimeSessionLoadFailure(params, error) {
 	});
 	if (!shouldFallbackToNewSession(error, params.record)) throw error;
 	return {
-		...await createFreshRuntimeSession(params.client, params.record, params.timeoutMs),
+		...await createFreshRuntimeSession(params.client, params.record, params.timeoutMs, params.authority),
 		loadError
 	};
 }
-async function createFreshRuntimeSession(client, record, timeoutMs) {
-	const createdSession = await withTimeout(client.createSession(record.cwd), timeoutMs);
+async function createFreshRuntimeSession(client, record, timeoutMs, authority) {
+	const createdSession = await withTimeout(client.createSession(record.cwd, authority), timeoutMs);
 	applyConfigOptionsToRecord(record, createdSession);
 	return {
 		sessionId: createdSession.sessionId,
@@ -5313,7 +5598,7 @@ function createActiveSessionController(params) {
 			return response;
 		},
 		setSessionConfigOption: async (configId, value) => {
-			return await params.client.setSessionConfigOption(getActiveSessionId(), configId, value);
+			return await params.client.setSessionConfigOption(getActiveSessionId(), configId, value, advertisedModelState(params.record.acpx));
 		}
 	};
 }
@@ -5351,6 +5636,7 @@ async function withConnectedSession(options) {
 				client,
 				record,
 				resumePolicy: options.resumePolicy,
+				replacingMode: options.replacingMode,
 				replacingConfigOption: options.replacingConfigOption,
 				authority: options.authority,
 				timeoutMs: options.timeoutMs,
@@ -5411,6 +5697,7 @@ async function withConnectedSession(options) {
 function buildDirectConnectedSessionOptions(options, run) {
 	return {
 		sessionRecordId: options.sessionRecordId,
+		replacingMode: options.replacingMode,
 		replacingConfigOption: options.replacingConfigOption,
 		loadRecord: resolveSessionRecord,
 		saveRecord: writeSessionRecord,
@@ -5436,14 +5723,41 @@ function toSessionMutationResult(result) {
 		loadError: result.loadError
 	};
 }
+async function withOwnedDirectSession(options) {
+	const waiting = new AbortController();
+	const timeoutMs = options.timeoutMs;
+	const timer = timeoutMs != null && timeoutMs > 0 ? setTimeout(() => waiting.abort(new TimeoutError(timeoutMs)), timeoutMs) : void 0;
+	let ownership;
+	let recordId;
+	try {
+		recordId = (await options.loadRecord(options.sessionRecordId)).acpxRecordId;
+		ownership = await acquireSessionTurn(recordId, waiting.signal);
+	} catch (error) {
+		waiting.signal.throwIfAborted();
+		throw error;
+	} finally {
+		clearTimeout(timer);
+	}
+	try {
+		return await withConnectedSession({
+			...options,
+			sessionRecordId: recordId
+		});
+	} finally {
+		await ownership[Symbol.asyncDispose]();
+	}
+}
 async function runSessionSetModeDirect(options) {
-	return toSessionMutationResult(await withConnectedSession(buildDirectConnectedSessionOptions(options, async ({ client, sessionId, record }) => {
+	return toSessionMutationResult(await withOwnedDirectSession(buildDirectConnectedSessionOptions({
+		...options,
+		replacingMode: true
+	}, async ({ client, sessionId, record }) => {
 		await withTimeout(client.setSessionMode(sessionId, options.modeId), options.timeoutMs);
 		setDesiredModeId(record, options.modeId);
 	})));
 }
 async function runSessionSetModelDirect(options) {
-	const result = await withConnectedSession(buildDirectConnectedSessionOptions({
+	const result = await withOwnedDirectSession(buildDirectConnectedSessionOptions({
 		...options,
 		replacingConfigOption: { key: "model" }
 	}, async ({ client, sessionId, record }) => {
@@ -5458,12 +5772,13 @@ async function runSessionSetModelDirect(options) {
 	};
 }
 async function runSessionSetConfigOptionDirect(options) {
-	const result = await withConnectedSession(buildDirectConnectedSessionOptions({
+	const result = await withOwnedDirectSession(buildDirectConnectedSessionOptions({
 		...options,
 		replacingConfigOption: { key: options.configId }
 	}, async ({ client, sessionId, record }) => {
-		const response = await withTimeout(client.setSessionConfigOption(sessionId, options.configId, options.value), options.timeoutMs);
-		record.acpx = applyConfigOptionSelection(record.acpx, options.configId, options.value, response);
+		const models = advertisedModelState(record.acpx);
+		const response = await withTimeout(client.setSessionConfigOption(sessionId, options.configId, options.value, models), options.timeoutMs);
+		record.acpx = applyConfigOptionSelection(record.acpx, options.configId, options.value, response, models?.configId);
 		return response;
 	}));
 	return {
@@ -5482,16 +5797,31 @@ async function cancelSessionPrompt(options) {
 		cancelled: cancelled === true
 	};
 }
-async function setSessionMode(options) {
-	if (await trySetModeOnRunningOwner(options.sessionId, options.modeId, options.timeoutMs, options.verbose)) {
-		const record = await resolveSessionRecord(options.sessionId);
+/**
+* Dispatches the mode change to a running queue owner. Returns `undefined`
+* when no owner holds the session, leaving the direct-connection decision to
+* the caller.
+*
+* An owner advertising `persistsControlState` saves the accepted state itself.
+* Only the older caller-save path still reloads and rewrites the record here,
+* which is not serialized against another process doing the same.
+*/
+async function setSessionModeOnOwner(options) {
+	const submittedToOwner = await trySetModeOnRunningOwner(options.sessionId, options.modeId, options.timeoutMs, options.verbose, options.assertDispatch);
+	if (!submittedToOwner?.value) return;
+	const record = await resolveSessionRecord(options.sessionId);
+	if (!submittedToOwner.persistsControlState) {
 		setDesiredModeId(record, options.modeId);
 		await writeSessionRecord(record);
-		return {
-			record,
-			resumed: false
-		};
 	}
+	return {
+		record,
+		resumed: false
+	};
+}
+async function setSessionMode(options) {
+	const onOwner = await setSessionModeOnOwner(options);
+	if (onOwner) return onOwner;
 	return await runSessionSetModeDirect({
 		sessionRecordId: options.sessionId,
 		modeId: options.modeId,
@@ -5505,18 +5835,24 @@ async function setSessionMode(options) {
 		verbose: options.verbose
 	});
 }
-async function setSessionModel(options) {
-	const submittedToOwner = await trySetModelOnRunningOwner(options.sessionId, options.modelId, options.timeoutMs, options.verbose);
-	if (submittedToOwner) {
-		const record = await resolveSessionRecord(options.sessionId);
-		record.acpx = applyModelSelection(record.acpx, options.modelId, submittedToOwner.response);
+/** Owner-only counterpart of {@link setSessionMode} for the model control. */
+async function setSessionModelOnOwner(options) {
+	const submittedToOwner = await trySetModelOnRunningOwner(options.sessionId, options.modelId, options.timeoutMs, options.verbose, options.assertDispatch);
+	if (!submittedToOwner) return;
+	const record = await resolveSessionRecord(options.sessionId);
+	if (!submittedToOwner.persistsControlState) {
+		record.acpx = applyModelSelection(record.acpx, options.modelId, submittedToOwner.value.response);
 		await writeSessionRecord(record);
-		return {
-			record,
-			response: submittedToOwner.response,
-			resumed: false
-		};
 	}
+	return {
+		record,
+		response: submittedToOwner.value.response,
+		resumed: false
+	};
+}
+async function setSessionModel(options) {
+	const onOwner = await setSessionModelOnOwner(options);
+	if (onOwner) return onOwner;
 	return await runSessionSetModelDirect({
 		sessionRecordId: options.sessionId,
 		modelId: options.modelId,
@@ -5530,18 +5866,24 @@ async function setSessionModel(options) {
 		verbose: options.verbose
 	});
 }
-async function setSessionConfigOption(options) {
-	const ownerResponse = await trySetConfigOptionOnRunningOwner(options.sessionId, options.configId, options.value, options.timeoutMs, options.verbose);
-	if (ownerResponse) {
-		const record = await resolveSessionRecord(options.sessionId);
-		record.acpx = applyConfigOptionSelection(record.acpx, options.configId, options.value, ownerResponse);
+/** Owner-only counterpart of {@link setSessionMode} for the config option control. */
+async function setSessionConfigOptionOnOwner(options) {
+	const ownerResponse = await trySetConfigOptionOnRunningOwner(options.sessionId, options.configId, options.value, options.timeoutMs, options.verbose, options.assertDispatch);
+	if (!ownerResponse) return;
+	const record = await resolveSessionRecord(options.sessionId);
+	if (!ownerResponse.persistsControlState) {
+		record.acpx = applyConfigOptionSelection(record.acpx, options.configId, options.value, ownerResponse.value);
 		await writeSessionRecord(record);
-		return {
-			record,
-			response: ownerResponse,
-			resumed: false
-		};
 	}
+	return {
+		record,
+		response: ownerResponse.value,
+		resumed: false
+	};
+}
+async function setSessionConfigOption(options) {
+	const onOwner = await setSessionConfigOptionOnOwner(options);
+	if (onOwner) return onOwner;
 	return await runSessionSetConfigOptionDirect({
 		sessionRecordId: options.sessionId,
 		configId: options.configId,
@@ -5623,22 +5965,36 @@ const sessionControlTestInternals = {
 };
 async function closeSession(sessionId) {
 	const record = await resolveSessionRecord(sessionId);
-	await tryCloseSessionOnRunningOwner({ sessionId: record.acpxRecordId }).catch(() => {});
-	await terminateQueueOwnerForSession(record.acpxRecordId);
+	let selectedOwner;
+	await tryCloseSessionOnRunningOwner({
+		sessionId: record.acpxRecordId,
+		onOwnerSelected: (owner) => {
+			selectedOwner = owner;
+		}
+	}).catch(() => {});
+	if (selectedOwner) await terminateQueueOwnerForSession(record.acpxRecordId, selectedOwner);
 	if (record.pid != null && isProcessAlive(record.pid) && await isLikelyMatchingProcess(record.pid, record.agentCommand)) await terminateProcess(record.pid);
-	record.pid = void 0;
-	record.closed = true;
-	record.closedAt = isoNow$1();
-	await writeSessionRecord(record);
-	return record;
+	const ownership = await acquireSessionTurn(record.acpxRecordId);
+	try {
+		const current = await resolveSessionRecord(record.acpxRecordId);
+		current.pid = void 0;
+		current.closed = true;
+		current.closedAt = isoNow$1();
+		await writeSessionRecord(current);
+		return current;
+	} finally {
+		await ownership[Symbol.asyncDispose]();
+	}
 }
 //#endregion
 //#region src/session/execution/session-management.ts
 async function createSessionRecordWithClient(client, options) {
 	const cwd = absolutePath(options.cwd);
-	await withTimeout(client.start(), options.timeoutMs);
+	await withTimeout(client.start({ signal: options.signal }), options.timeoutMs);
+	assertControlAuthority({ signal: options.signal });
 	const createdState = options.resumeSessionId ? await resumeSessionRecordWithClient(client, options, cwd) : await createFreshSessionState(client, options, cwd);
 	const { sessionId, agentSessionId } = createdState;
+	assertControlAuthority({ signal: options.signal });
 	const lifecycle = client.getAgentLifecycleSnapshot();
 	const record = {
 		...createInitialSessionRecord({
@@ -5660,10 +6016,12 @@ async function createSessionRecordWithClient(client, options) {
 	applyConfigOptionsToRecord(record, createdState.sessionResult);
 	applyInitialModelSelection(record, createdState.sessionResult.models, options.sessionOptions?.model, createdState.modelApplication);
 	await writeSessionRecord(record);
+	assertControlAuthority({ signal: options.signal });
 	return record;
 }
 async function createFreshSessionState(client, options, cwd) {
-	const createdSession = await withTimeout(client.createSession(cwd), options.timeoutMs);
+	const createdSession = await withTimeout(client.createSession(cwd, { signal: options.signal }), options.timeoutMs);
+	assertControlAuthority({ signal: options.signal });
 	const modelApplication = await applyRequestedModelIfAdvertised({
 		client,
 		sessionId: createdSession.sessionId,
@@ -5671,7 +6029,8 @@ async function createFreshSessionState(client, options, cwd) {
 		models: createdSession.models,
 		agentCommand: options.agentCommand,
 		timeoutMs: options.timeoutMs,
-		onWarning: options.onModelWarning
+		onWarning: options.onModelWarning,
+		authority: { signal: options.signal }
 	});
 	return {
 		sessionId: createdSession.sessionId,
@@ -5685,8 +6044,9 @@ async function resumeSessionRecordWithClient(client, options, cwd) {
 	const resumeMethod = client.supportsResumeSession() ? "session/resume" : client.supportsLoadSession() ? "session/load" : void 0;
 	if (!resumeMethod) throw new Error(`Agent command "${options.agentCommand}" does not support session/resume or session/load; cannot resume session ${options.resumeSessionId}`);
 	try {
-		const resumedSession = await withTimeout(resumeMethod === "session/resume" ? client.resumeSession(options.resumeSessionId, cwd) : client.loadSession(options.resumeSessionId, cwd), options.timeoutMs);
+		const resumedSession = await withTimeout(resumeMethod === "session/resume" ? client.resumeSession(options.resumeSessionId, cwd, { signal: options.signal }) : client.loadSessionWithOptions(options.resumeSessionId, cwd, { authority: { signal: options.signal } }), options.timeoutMs);
 		const sessionModels = resumedSession.models;
+		assertControlAuthority({ signal: options.signal });
 		const modelApplication = await applyRequestedModelIfAdvertised({
 			client,
 			sessionId: options.resumeSessionId,
@@ -5694,7 +6054,8 @@ async function resumeSessionRecordWithClient(client, options, cwd) {
 			models: sessionModels,
 			agentCommand: options.agentCommand,
 			timeoutMs: options.timeoutMs,
-			onWarning: options.onModelWarning
+			onWarning: options.onModelWarning,
+			authority: { signal: options.signal }
 		});
 		return {
 			sessionId: options.resumeSessionId,
@@ -5707,7 +6068,7 @@ async function resumeSessionRecordWithClient(client, options, cwd) {
 	}
 }
 async function createSessionWithClient(options) {
-	options.signal?.throwIfAborted();
+	assertControlAuthority({ signal: options.signal });
 	const client = new AcpClient({
 		agentCommand: options.agentCommand,
 		agentArgv: options.agentArgv,
@@ -5723,28 +6084,25 @@ async function createSessionWithClient(options) {
 		verbose: options.verbose,
 		sessionOptions: options.sessionOptions
 	});
-	const onAbort = () => {
-		client.close().catch(() => {});
-	};
-	options.signal?.addEventListener("abort", onAbort, { once: true });
+	const closeOwnedClient = ownDirectClient(client, options.signal);
 	try {
 		const create = async () => {
-			options.signal?.throwIfAborted();
+			assertControlAuthority({ signal: options.signal });
 			const record = await createSessionRecordWithClient(client, options);
-			options.signal?.throwIfAborted();
+			assertControlAuthority({ signal: options.signal });
 			return record;
 		};
 		return {
 			record: options.handleProcessInterrupts === false ? await create() : await withInterrupt(create, async () => {
-				await client.close();
+				await closeOwnedClient();
 			}),
 			client
 		};
 	} catch (error) {
-		await client.close();
-		throw error;
+		await closeOwnedClient();
+		throw directExecutionError(error, options.signal);
 	} finally {
-		options.signal?.removeEventListener("abort", onAbort);
+		closeOwnedClient.release();
 	}
 }
 async function createSession(options) {
@@ -5810,7 +6168,7 @@ async function ensureSession(options) {
 	}
 }
 async function ensureSessionWithOwnership(options, cwd) {
-	options.signal?.throwIfAborted();
+	assertControlAuthority({ signal: options.signal });
 	const gitRoot = findGitRepositoryRoot(cwd);
 	const walkBoundary = options.walkBoundary ?? gitRoot ?? cwd;
 	const existing = await findSessionByDirectoryWalk({
@@ -5951,16 +6309,182 @@ function installPerfMetricsCapture(options = {}) {
 	}
 }
 //#endregion
+//#region src/session/queue/control-admission.ts
+var QueueControlDeadline = class {
+	controller = new AbortController();
+	admissionSignal;
+	expiresAt;
+	expired;
+	timeoutError;
+	rejectExpiry;
+	timer;
+	nativeSettled = false;
+	admitted = false;
+	constructor(timeoutMs, ownerSignal) {
+		this.admissionSignal = ownerSignal ? AbortSignal.any([this.controller.signal, ownerSignal]) : this.controller.signal;
+		this.expiresAt = timeoutMs != null && timeoutMs > 0 ? performance.now() + timeoutMs : void 0;
+		this.timeoutError = this.expiresAt === void 0 ? void 0 : new TimeoutError(timeoutMs);
+		this.expired = new Promise((_resolve, reject) => {
+			this.rejectExpiry = reject;
+			if (this.expiresAt !== void 0) this.timer = setTimeout(() => this.expire(), timeoutMs);
+		});
+		this.expired.catch(() => {});
+	}
+	get signal() {
+		return this.admissionSignal;
+	}
+	get timeoutSignal() {
+		return this.controller.signal;
+	}
+	get remainingMs() {
+		this.assertActive();
+		return this.expiresAt === void 0 || this.nativeSettled ? void 0 : Math.max(1, this.expiresAt - performance.now());
+	}
+	get nativeAdmitted() {
+		return this.admitted;
+	}
+	get authority() {
+		return {
+			signal: this.signal,
+			assertActive: () => {
+				this.assertActive();
+				this.admitted = true;
+			}
+		};
+	}
+	assertActive() {
+		if (this.expiresAt !== void 0 && performance.now() >= this.expiresAt) this.expire();
+		this.signal.throwIfAborted();
+	}
+	expire() {
+		if (this.nativeSettled || this.timeoutSignal.aborted || !this.timeoutError) return;
+		this.controller.abort(this.timeoutError);
+		this.rejectExpiry(this.timeoutError);
+	}
+	responseSettled() {
+		this.nativeSettled = true;
+		clearTimeout(this.timer);
+		this.timer = void 0;
+	}
+	isExpired(error) {
+		return this.timeoutSignal.aborted && error === this.timeoutSignal.reason;
+	}
+	async wait(operation) {
+		return await Promise.race([operation, this.expired]);
+	}
+};
+function deferred() {
+	let resolve;
+	let reject;
+	const promise = new Promise((accept, fail) => {
+		resolve = accept;
+		reject = fail;
+	});
+	promise.catch(() => {});
+	return {
+		promise,
+		resolve,
+		reject
+	};
+}
+function drained(operation) {
+	return operation.then(() => {}, () => {});
+}
+var QueueOwnerControlAdmission = class {
+	options;
+	idleTail = Promise.resolve();
+	ticket;
+	stopped = new AbortController();
+	pending = 0;
+	constructor(options) {
+		this.options = options;
+	}
+	get hasPending() {
+		return this.pending > 0;
+	}
+	beginPrompt() {
+		const ticket = {
+			ready: deferred(),
+			released: deferred(),
+			rawTail: Promise.resolve(),
+			sealed: false
+		};
+		this.ticket = ticket;
+		return {
+			ticket,
+			priorIdle: this.idleTail
+		};
+	}
+	publish(ticket, controls) {
+		if (!ticket.sealed) ticket.ready.resolve(controls);
+	}
+	seal(ticket) {
+		ticket.sealed = true;
+		ticket.ready.reject(new QueueConnectionError("Prompt ended before controls became ready", {
+			detailCode: "QUEUE_CONTROL_REQUEST_FAILED",
+			origin: "queue",
+			retryable: true
+		}));
+		return ticket.rawTail;
+	}
+	release(ticket) {
+		if (this.ticket === ticket) this.ticket = void 0;
+		ticket.released.resolve();
+	}
+	stopAdmission() {
+		this.stopped.abort(new QueueConnectionError("Queue owner is closing", {
+			detailCode: "QUEUE_OWNER_SHUTTING_DOWN",
+			origin: "queue",
+			retryable: true
+		}));
+	}
+	async drainAdmitted() {
+		await Promise.all([this.idleTail, this.ticket?.rawTail]);
+	}
+	async run(invoke, timeoutMs, replacingConfigOption) {
+		const deadline = new QueueControlDeadline(timeoutMs, this.stopped.signal);
+		this.pending += 1;
+		const operation = this.enqueue(invoke, {
+			deadline,
+			replacingConfigOption
+		});
+		operation.finally(() => {
+			this.pending -= 1;
+			deadline.responseSettled();
+		}).catch(() => {});
+		return await deadline.wait(operation);
+	}
+	async enqueue(invoke, options) {
+		options.deadline.assertActive();
+		const ticket = this.ticket;
+		if (ticket?.sealed) return ticket.released.promise.then(() => this.enqueue(invoke, options));
+		if (ticket) {
+			const operation = ticket.rawTail.then(async () => {
+				const controls = await ticket.ready.promise.catch((error) => {
+					options.deadline.assertActive();
+					throw error;
+				});
+				options.deadline.assertActive();
+				return await invoke(controls, options.deadline);
+			});
+			ticket.rawTail = drained(operation);
+			return operation;
+		}
+		const operation = this.idleTail.then(async () => {
+			options.deadline.assertActive();
+			return await this.options.runIdle(invoke, options);
+		});
+		this.idleTail = drained(operation);
+		return operation;
+	}
+};
+//#endregion
 //#region src/session/queue/owner-turn-controller.ts
 var QueueOwnerTurnController = class {
-	options;
 	state = "idle";
 	pendingCancel = false;
 	activeController;
 	waitingTurn;
-	constructor(options) {
-		this.options = options;
-	}
 	get lifecycleState() {
 		return this.state;
 	}
@@ -5992,20 +6516,9 @@ var QueueOwnerTurnController = class {
 	clearActiveController() {
 		this.activeController = void 0;
 	}
-	assertCanHandleControlRequest() {
-		if (this.state === "closing") throw new QueueConnectionError("Queue owner is closing", {
-			detailCode: "QUEUE_OWNER_SHUTTING_DOWN",
-			origin: "queue",
-			retryable: true
-		});
-	}
 	async requestCancel() {
 		const activeController = this.activeController;
-		if (activeController?.hasActivePrompt()) {
-			const cancelled = await activeController.requestCancelActivePrompt();
-			if (cancelled) this.pendingCancel = false;
-			return cancelled;
-		}
+		if (activeController?.hasActivePrompt()) return await this.cancelActivePrompt(activeController);
 		if (this.state === "starting" || this.state === "active") {
 			this.pendingCancel = true;
 			this.waitingTurn?.abort();
@@ -6016,32 +6529,138 @@ var QueueOwnerTurnController = class {
 	async applyPendingCancel() {
 		const activeController = this.activeController;
 		if (!this.pendingCancel || !activeController || !activeController.hasActivePrompt()) return false;
-		const cancelled = await activeController.requestCancelActivePrompt();
-		if (cancelled) this.pendingCancel = false;
+		return await this.cancelActivePrompt(activeController);
+	}
+	async cancelActivePrompt(activeController) {
+		const turn = this.waitingTurn;
+		const cancellation = activeController.requestCancelActivePrompt();
+		turn?.abort();
+		const cancelled = await cancellation;
+		if (cancelled && this.waitingTurn === turn) this.pendingCancel = false;
 		return cancelled;
 	}
-	async setSessionMode(modeId, timeoutMs) {
-		this.assertCanHandleControlRequest();
-		const activeController = this.activeController;
-		if (activeController) {
-			await this.options.withTimeout(async () => await activeController.setSessionMode(modeId), timeoutMs);
-			return;
+};
+//#endregion
+//#region src/session/execution/owned-controls.ts
+async function acceptControl(options, invoke, apply, deadline = new QueueControlDeadline()) {
+	deadline.assertActive();
+	const raw = invoke(deadline.authority).then(async (response) => {
+		deadline.responseSettled();
+		apply(response);
+		await options.checkpoint();
+		return response;
+	}, (error) => {
+		deadline.responseSettled();
+		throw error;
+	});
+	try {
+		return await deadline.wait(raw);
+	} catch (error) {
+		if (deadline.isExpired(error) && deadline.nativeAdmitted) {
+			const [retired] = await Promise.allSettled([options.retire(), raw]);
+			if (retired.status === "rejected") throw retired.reason;
 		}
-		await this.options.setSessionModeFallback(modeId, timeoutMs);
+		throw error;
 	}
-	async setSessionModel(modelId, timeoutMs) {
-		this.assertCanHandleControlRequest();
-		const activeController = this.activeController;
-		if (activeController) return await this.options.withTimeout(async () => await activeController.setSessionModel(modelId), timeoutMs);
-		return await this.options.setSessionModelFallback(modelId, timeoutMs);
+}
+function createOwnedSessionControls(options) {
+	return {
+		setSessionMode: async (modeId, deadline) => {
+			await acceptControl(options, (authority) => options.client.setSessionMode(options.sessionId(), modeId, authority), () => setDesiredModeId(options.record, modeId), deadline);
+		},
+		setSessionModel: async (modelId, deadline) => {
+			const models = advertisedModelState(options.record.acpx);
+			return await acceptControl(options, (authority) => options.client.setSessionModel(options.sessionId(), modelId, models, authority), (response) => {
+				options.record.acpx = applyModelSelection(options.record.acpx, modelId, response);
+			}, deadline);
+		},
+		setSessionConfigOption: async (configId, value, deadline) => {
+			const models = advertisedModelState(options.record.acpx);
+			return await acceptControl(options, (authority) => options.client.setSessionConfigOption(options.sessionId(), configId, value, models, authority), (response) => {
+				options.record.acpx = applyConfigOptionSelection(options.record.acpx, configId, value, response, models?.configId);
+			}, deadline);
+		}
+	};
+}
+async function runIdleControlWithRecord(options, record, invoke) {
+	const { client, deadline } = options;
+	deadline.assertActive();
+	let retirement;
+	const retire = () => {
+		retirement ??= client.close().catch((error) => {
+			options.onRetirementFailure();
+			throw error;
+		});
+		return retirement;
+	};
+	const onAbort = () => {
+		retire().catch(() => {});
+	};
+	const checkpoint = async () => {
+		record.lastUsedAt = isoNow$1();
+		applyLifecycleSnapshotToRecord(record, client.getAgentLifecycleSnapshot());
+		await writeSessionRecord(record);
+	};
+	let sessionId = record.acpSessionId;
+	const controls = createOwnedSessionControls({
+		client,
+		record,
+		sessionId: () => sessionId,
+		checkpoint,
+		retire
+	});
+	client.setEventHandlers({ onSessionUpdate: (notification) => {
+		record.acpx = recordSessionUpdate(record, record.acpx, notification);
+	} });
+	deadline.timeoutSignal.addEventListener("abort", onAbort, { once: true });
+	let connected = false;
+	let completed = false;
+	try {
+		await connectAndLoadSession({
+			client,
+			record,
+			resumePolicy: "same-session-only",
+			replacingConfigOption: options.replacingConfigOption,
+			timeoutMs: deadline.remainingMs,
+			authority: deadline.authority,
+			verbose: options.verbose,
+			activeController: {
+				...controls,
+				hasActivePrompt: () => client.hasActivePrompt(),
+				requestCancelActivePrompt: () => client.requestCancelActivePrompt()
+			},
+			onSessionIdResolved: (value) => {
+				sessionId = value;
+			}
+		});
+		connected = true;
+		deadline.assertActive();
+		const value = await invoke(controls, deadline);
+		completed = true;
+		return value;
+	} finally {
+		deadline.timeoutSignal.removeEventListener("abort", onAbort);
+		try {
+			if (!connected) await retire();
+			await retirement;
+			if (!completed || retirement) await checkpoint().catch(() => {});
+		} finally {
+			client.clearEventHandlers();
+		}
 	}
-	async setSessionConfigOption(configId, value, timeoutMs) {
-		this.assertCanHandleControlRequest();
-		const activeController = this.activeController;
-		if (activeController) return await this.options.withTimeout(async () => await activeController.setSessionConfigOption(configId, value), timeoutMs);
-		return await this.options.setSessionConfigOptionFallback(configId, value, timeoutMs);
+}
+async function runIdleOwnerControl(options, invoke) {
+	const { acpxRecordId } = await resolveSessionRecord(options.sessionId);
+	const ownership = await acquireSessionTurn(acpxRecordId, options.deadline.signal).catch((error) => {
+		options.deadline.assertActive();
+		throw error;
+	});
+	try {
+		return await runIdleControlWithRecord(options, await resolveSessionRecord(acpxRecordId), invoke);
+	} finally {
+		await ownership[Symbol.asyncDispose]();
 	}
-};
+}
 //#endregion
 //#region src/session/execution/queue-owner-process.ts
 function isNonEmptyStringArray(value) {
@@ -6059,27 +6678,27 @@ const NODE_TEST_FLAGS_WITH_VALUE = /* @__PURE__ */ new Set([
 	"--test-reporter",
 	"--test-reporter-destination"
 ]);
-const INSPECTOR_FLAGS_WITH_VALUE = /* @__PURE__ */ new Set([
+const INSPECTOR_FLAGS = /* @__PURE__ */ new Set([
 	"--inspect",
 	"--inspect-brk",
+	"--inspect-wait"
+]);
+const INSPECTOR_FLAGS_WITH_VALUE = /* @__PURE__ */ new Set([
 	"--inspect-port",
 	"--inspect-publish-uid",
 	"--debug-port"
 ]);
-const INSPECTOR_FLAG_PREFIXES = [
-	"--inspect=",
-	"--inspect-brk=",
-	"--inspect-port=",
-	"--inspect-publish-uid=",
-	"--debug-port="
-];
 function classifyExecArgv(value) {
-	if (value === void 0) return "drop";
-	if (NODE_TEST_FLAGS_WITH_VALUE.has(value) || INSPECTOR_FLAGS_WITH_VALUE.has(value)) return "drop-with-value";
-	return dropSingleExecArgv(value) ? "drop" : "keep";
+	if (NODE_TEST_FLAGS_WITH_VALUE.has(value)) return "drop-with-value";
+	if (NODE_TEST_FLAGS.has(value) || value.startsWith("--test-")) return "drop";
+	return classifyInspectorArgv(value);
 }
-function dropSingleExecArgv(value) {
-	return NODE_TEST_FLAGS.has(value) || value.startsWith("--test-") || INSPECTOR_FLAG_PREFIXES.some((prefix) => value.startsWith(prefix));
+function classifyInspectorArgv(value) {
+	const [name] = value.split("=", 1);
+	if (!name?.startsWith("--")) return "keep";
+	const flag = name.replaceAll("_", "-");
+	if (INSPECTOR_FLAGS_WITH_VALUE.has(flag)) return value.includes("=") ? "drop" : "drop-with-value";
+	return INSPECTOR_FLAGS.has(flag) ? "drop" : "keep";
 }
 function sanitizeQueueOwnerExecArgv(execArgv = process.execArgv) {
 	const sanitized = [];
@@ -6223,20 +6842,27 @@ function responseMetaField(meta) {
 	return meta === void 0 ? {} : { _meta: meta };
 }
 function recoveredSessionResult(response, conversation, promptMessageId) {
-	recordPromptResponseUsage(conversation, response?.usage, promptMessageId);
+	recordPromptResponseUsage(conversation, response.usage, promptMessageId);
 	return {
-		stopReason: "end_turn",
+		stopReason: response.stopReason,
 		source: "session",
-		...responseMetaField(response?._meta)
+		...responseMetaField(response._meta)
 	};
 }
-function abortTimedOutRequests(error, client, sessionId) {
-	if (error instanceof TimeoutError) client.endPromptElicitation?.(sessionId);
+function abortTimedOutRequests(error, lifetime) {
+	if (error instanceof TimeoutError) lifetime.abort(error);
+}
+function promptRequestAuthority(lifetime, authority) {
+	return {
+		signal: authority?.signal ? AbortSignal.any([authority.signal, lifetime.signal]) : lifetime.signal,
+		assertActive: () => assertControlAuthority(authority)
+	};
 }
 async function runPromptTurn(params) {
 	let settledResponse;
+	const lifetime = new AbortController();
 	try {
-		const promptPromise = params.client.prompt(params.sessionId, params.prompt, params.onPromptRequestWritten, params.onElicitation, params.onPermissionRequest, params.authority);
+		const promptPromise = params.client.prompt(params.sessionId, params.prompt, params.onPromptRequestWritten, params.onElicitation, params.onPermissionRequest, promptRequestAuthority(lifetime, params.authority));
 		promptPromise.then((response) => {
 			settledResponse = response;
 		}, () => {});
@@ -6253,14 +6879,16 @@ async function runPromptTurn(params) {
 			...responseMetaField(response._meta)
 		};
 	} catch (error) {
-		abortTimedOutRequests(error, params.client, params.sessionId);
+		abortTimedOutRequests(error, lifetime);
 		if (!(error instanceof TimeoutError) || !params.promptMessageId) throw error;
 		await params.client.waitForSessionUpdatesIdle?.({
 			idleMs: SESSION_REPLY_IDLE_MS,
 			timeoutMs: SESSION_REPLY_DRAIN_TIMEOUT_MS
 		}).catch(() => {});
-		if (hasAgentReplyAfterPrompt(params.conversation, params.promptMessageId)) return recoveredSessionResult(settledResponse, params.conversation, params.promptMessageId);
+		if (settledResponse) return recoveredSessionResult(settledResponse, params.conversation, params.promptMessageId);
 		throw error;
+	} finally {
+		lifetime.abort();
 	}
 }
 //#endregion
@@ -6430,6 +7058,7 @@ async function applyPromptModelIfAdvertised(params) {
 		models: advertisedModelState(params.record.acpx),
 		agentCommand: params.record.agentCommand,
 		timeoutMs: params.timeoutMs,
+		authority: { signal: params.signal },
 		onWarning: params.suppressWarnings ? void 0 : (message) => process.stderr.write(`[acpx] warning: ${message}\n`)
 	});
 	if (result.applied) params.record.acpx = applyModelSelection(params.record.acpx, requestedModel, result.response);
@@ -6510,8 +7139,9 @@ function emitPromptDisconnectNotice(snapshot, verbose) {
 	if (!lastExit?.unexpectedDuringPrompt || !verbose) return;
 	process.stderr.write("[acpx] agent disconnected during prompt (" + lastExit.reason + ", exit=" + lastExit.exitCode + ", signal=" + (lastExit.signal ?? "none") + ")\n");
 }
-async function preparePromptRetry(error, attempt, maxRetries, hasSideEffects, suppressSdkConsoleErrors) {
+async function preparePromptRetry(error, attempt, maxRetries, hasSideEffects, suppressSdkConsoleErrors, signal) {
 	if (attempt < maxRetries && !hasSideEffects() && isRetryablePromptError(error)) {
+		signal?.throwIfAborted();
 		const delayMs = Math.min(1e3 * 2 ** attempt, 1e4);
 		emitPromptRetryNotice({
 			error,
@@ -6520,11 +7150,18 @@ async function preparePromptRetry(error, attempt, maxRetries, hasSideEffects, su
 			maxRetries,
 			suppressSdkConsoleErrors
 		});
-		await waitMs$1(delayMs);
+		await setTimeout$1(delayMs, void 0, { signal }).catch((error) => {
+			signal?.throwIfAborted();
+			throw error;
+		});
+		signal?.throwIfAborted();
 		return !hasSideEffects();
 	}
 	return false;
 }
+function isTurnCancellation(error, signal) {
+	return signal?.aborted === true && error === signal.reason;
+}
 function buildQueuedTaskRunOptions(sessionRecordId, task, options, outputFormatter) {
 	return {
 		sessionRecordId,
@@ -6546,7 +7183,9 @@ function buildQueuedTaskRunOptions(sessionRecordId, task, options, outputFormatt
 		sessionOptions: mergeSessionOptions(task.sessionOptions, options.sessionOptions),
 		onClientAvailable: options.onClientAvailable,
 		onClientClosed: options.onClientClosed,
+		onClientCloseFailure: options.onClientCloseFailure,
 		onPromptActive: options.onPromptActive,
+		onPromptFinalizing: options.onPromptFinalizing,
 		onPromptRequestWritten: () => {
 			if (task.reportPromptStarted) task.send({
 				type: "prompt_started",
@@ -6604,7 +7243,7 @@ async function waitForSessionTurn(options) {
 		"SIGTERM",
 		"SIGHUP"
 	];
-	for (const signal of signals) process.once(signal, onInterrupt);
+	if (options.handleProcessInterrupts !== false) for (const signal of signals) process.once(signal, onInterrupt);
 	const timeoutMs = options.timeoutMs;
 	const timeout = timeoutMs != null && timeoutMs > 0 ? setTimeout(() => waiting.abort(new TimeoutError(timeoutMs)), timeoutMs) : void 0;
 	const signal = options.waitSignal ? AbortSignal.any([waiting.signal, options.waitSignal]) : waiting.signal;
@@ -6615,18 +7254,22 @@ async function waitForSessionTurn(options) {
 			ownership: await acquireSessionTurn(acpxRecordId, signal)
 		};
 	} catch (error) {
-		signal.throwIfAborted();
-		throw error;
+		return throwTurnAcquisitionError(error, signal);
 	} finally {
 		clearTimeout(timeout);
 		for (const signal of signals) process.off(signal, onInterrupt);
 	}
 }
+function throwTurnAcquisitionError(error, signal) {
+	if (signal.aborted && error instanceof Error && error.name === "AbortError" && error.cause === signal.reason) throw signal.reason;
+	throw error;
+}
 async function runSessionPrompt(options) {
 	let turn;
 	try {
 		turn = await waitForSessionTurn(options);
 	} catch (error) {
+		if (options.ownedSignal) throw error;
 		if (options.waitSignal?.aborted && error === options.waitSignal.reason) {
 			const record = await resolveSessionRecord(options.sessionRecordId);
 			return {
@@ -6746,8 +7389,10 @@ async function runOwnedSessionPrompt(options) {
 	const record = await measurePerf("session.resolve_prompt_record", async () => {
 		return await resolveSessionRecord(options.sessionRecordId);
 	});
+	options.ownedSignal?.throwIfAborted();
 	const { conversation, promptMessageId } = preparePromptConversation(record, options);
 	await writeSessionRecord(record);
+	options.ownedSignal?.throwIfAborted();
 	output.setContext({ sessionId: record.acpxRecordId });
 	const eventWriter = await measurePerf("session.events.open", async () => {
 		return await SessionEventWriter.open(record);
@@ -6790,7 +7435,7 @@ async function runOwnedSessionPrompt(options) {
 			if (options.verbose) process.stderr.write("[acpx] live session checkpoint failed: " + formatErrorMessage(error) + "\n");
 		}
 	});
-	let closeClientOnExit = options.client == null;
+	let closeClientOnExit = options.client == null || options.ownedSignal !== void 0;
 	const client = options.client ?? new AcpClient({
 		agentCommand: record.agentCommand,
 		agentArgv: record.agentArgv,
@@ -6816,6 +7461,7 @@ async function runOwnedSessionPrompt(options) {
 		suppressSdkConsoleErrors: options.suppressSdkConsoleErrors,
 		verbose: options.verbose
 	});
+	const closeOwnedClient = options.closeProvidedClient ?? ownDirectClient(client, options.ownedSignal);
 	client.setEventHandlers({
 		onAcpMessage: (direction, message) => {
 			pendingMessages.push(message);
@@ -6852,24 +7498,23 @@ async function runOwnedSessionPrompt(options) {
 	});
 	let activeSessionIdForControl = record.acpSessionId;
 	let notifiedClientAvailable = false;
+	let controlRetirement;
 	const activeController = {
 		hasActivePrompt: () => client.hasActivePrompt(),
 		requestCancelActivePrompt: async () => await client.requestCancelActivePrompt(),
-		setSessionMode: async (modeId) => {
-			await client.setSessionMode(activeSessionIdForControl, modeId);
-		},
-		setSessionModel: async (modelId) => {
-			const models = advertisedModelState(record.acpx);
-			const response = await client.setSessionModel(activeSessionIdForControl, modelId, models);
-			record.acpx = applyModelSelection(record.acpx, modelId, response);
-			return response;
-		},
-		setSessionConfigOption: async (configId, value) => {
-			const modelConfigId = advertisedModelState(record.acpx)?.configId;
-			const response = await client.setSessionConfigOption(activeSessionIdForControl, configId, value);
-			record.acpx = applyConfigOptionSelection(record.acpx, configId, value, response, modelConfigId);
-			return response;
-		}
+		...createOwnedSessionControls({
+			client,
+			record,
+			sessionId: () => activeSessionIdForControl,
+			checkpoint: () => liveCheckpoint.checkpoint(),
+			retire: () => {
+				controlRetirement ??= client.close().catch((error) => {
+					options.onClientCloseFailure?.();
+					throw error;
+				});
+				return controlRetirement;
+			}
+		})
 	};
 	const flushConnectOutput = (loadError) => {
 		bufferingConnectOutput = false;
@@ -6890,6 +7535,7 @@ async function runOwnedSessionPrompt(options) {
 					verbose: options.verbose,
 					suppressWarnings: options.suppressSdkConsoleErrors,
 					activeController,
+					authority: { signal: options.ownedSignal },
 					onClientAvailable: (controller) => {
 						options.onClientAvailable?.(controller);
 						notifiedClientAvailable = true;
@@ -6933,15 +7579,17 @@ async function runOwnedSessionPrompt(options) {
 				conversation,
 				promptMessageId,
 				onPromptRequestWritten: options.onPromptRequestWritten,
-				onPromptStarted: buildPromptStartedHook(attempt)
+				onPromptStarted: buildPromptStartedHook(attempt),
+				authority: { signal: options.waitSignal }
 			});
 		});
 		emitPromptPerfMetric(promptStartedAt, options.verbose);
 		return response;
 	};
 	const handlePromptFailure = async (error, attempt) => {
+		if (isTurnCancellation(error, options.waitSignal)) throw error;
 		const snapshot = client.getAgentLifecycleSnapshot();
-		if (snapshot.lastExit?.unexpectedDuringPrompt !== true && await preparePromptRetry(error, attempt, options.promptRetries ?? 0, () => promptTurnHadSideEffects, options.suppressSdkConsoleErrors)) return;
+		if (snapshot.lastExit?.unexpectedDuringPrompt !== true && await preparePromptRetry(error, attempt, options.promptRetries ?? 0, () => promptTurnHadSideEffects, options.suppressSdkConsoleErrors, options.waitSignal)) return;
 		await failRuntimePrompt(error, snapshot);
 	};
 	const failRuntimePrompt = async (error, snapshot) => {
@@ -6965,10 +7613,18 @@ async function runOwnedSessionPrompt(options) {
 	};
 	const runPromptWithRetries = async (sessionId) => {
 		promptTurnActive = true;
-		for (let attempt = 0;; attempt++) try {
-			return await runPromptAttempt(sessionId, attempt);
+		try {
+			for (let attempt = 0;; attempt++) {
+				options.waitSignal?.throwIfAborted();
+				try {
+					return await runPromptAttempt(sessionId, attempt);
+				} catch (error) {
+					await handlePromptFailure(error, attempt);
+				}
+			}
 		} catch (error) {
-			await handlePromptFailure(error, attempt);
+			if (isTurnCancellation(error, options.waitSignal)) return { stopReason: "cancelled" };
+			throw error;
 		}
 	};
 	const savePromptSuccess = async (response) => {
@@ -6986,15 +7642,19 @@ async function runOwnedSessionPrompt(options) {
 		return response;
 	};
 	const runPrompt = async () => {
+		options.ownedSignal?.throwIfAborted();
 		const { sessionId: activeSessionId, resumed, loadError } = await connectForPrompt();
+		options.ownedSignal?.throwIfAborted();
 		await applyPromptModelIfAdvertised({
 			client,
 			sessionId: activeSessionId,
 			requestedModel: options.sessionOptions?.model,
 			record,
 			timeoutMs: options.timeoutMs,
-			suppressWarnings: options.suppressSdkConsoleErrors
+			suppressWarnings: options.suppressSdkConsoleErrors,
+			signal: options.ownedSignal
 		});
+		options.ownedSignal?.throwIfAborted();
 		output.setContext({ sessionId: record.acpxRecordId });
 		await liveCheckpoint.checkpoint();
 		const response = await savePromptSuccess(await runPromptWithRetries(activeSessionId));
@@ -7012,24 +7672,44 @@ async function runOwnedSessionPrompt(options) {
 		record.lastUsedAt = isoNow$1();
 		applyConversation(record, conversation);
 		await flushPendingMessages(false).catch(() => {});
-		if (closeClientOnExit) await client.close();
+		if (closeClientOnExit) await closeOwnedClient();
 	};
 	const runObservedPrompt = async () => {
 		try {
-			return await runWithOptionalInterrupt({
+			const result = await runWithOptionalInterrupt({
 				handleProcessInterrupts: options.handleProcessInterrupts,
 				run: runPrompt,
 				handleInterrupt
 			});
+			options.ownedSignal?.throwIfAborted();
+			return result;
 		} catch (error) {
-			const matchedAcpError = acpErrors.match(error);
-			attachAcpErrorPayload(error, matchedAcpError);
-			markOutputAlreadyEmitted(error, matchedAcpError !== void 0 && shouldMarkAcpErrorsEmitted);
-			throw error;
+			const failure = directExecutionError(error, options.ownedSignal);
+			const matchedAcpError = acpErrors.match(failure);
+			attachAcpErrorPayload(failure, matchedAcpError);
+			markOutputAlreadyEmitted(failure, matchedAcpError !== void 0 && shouldMarkAcpErrorsEmitted);
+			throw failure;
 		}
 	};
 	const cleanupPrompt = async (attempt) => {
+		const controlDrain = options.onPromptFinalizing?.();
+		const unresolvedPrompt = client.hasUnresolvedPrompt();
 		const steps = [
+			async () => {
+				if (unresolvedPrompt) await withTimeout(client.cancelActivePrompt(INTERRUPT_CANCEL_WAIT_MS), INTERRUPT_CANCEL_WAIT_MS).catch(() => {});
+			},
+			async () => {
+				const journalFailed = attempt.status === "rejected" && attempt.error instanceof AcpxOperationalError && attempt.error.detailCode === "SESSION_JOURNAL_WRITE_FAILED";
+				if (unresolvedPrompt || closeClientOnExit || journalFailed) try {
+					await closeOwnedClient();
+				} catch (error) {
+					options.onClientCloseFailure?.();
+					throw error;
+				}
+			},
+			async () => {
+				await controlDrain;
+			},
 			() => {
 				const duration = stopTotalTimer();
 				if (options.verbose) process.stderr.write(`[acpx] ${formatPerfMetric("prompt.total", duration)}\n`);
@@ -7038,10 +7718,6 @@ async function runOwnedSessionPrompt(options) {
 				if (notifiedClientAvailable) options.onClientClosed?.();
 			},
 			() => client.clearEventHandlers(),
-			async () => {
-				const journalFailed = attempt.status === "rejected" && attempt.error instanceof AcpxOperationalError && attempt.error.detailCode === "SESSION_JOURNAL_WRITE_FAILED";
-				if (closeClientOnExit || journalFailed) await client.close();
-			},
 			() => applyLifecycleSnapshotToRecord(record, client.getAgentLifecycleSnapshot()),
 			() => applyConversation(record, conversation)
 		];
@@ -7063,11 +7739,13 @@ async function runOwnedSessionPrompt(options) {
 		cleanup: cleanupPrompt
 	});
 }
-async function runOnce(options) {
+async function runOnce(options, control) {
+	const authority = { signal: control?.signal };
 	const output = options.outputFormatter;
 	const shouldMarkAcpErrorsEmitted = rendersAcpErrors(options.errorEmissionPolicy);
 	let promptTurnActive = false;
 	let promptTurnHadSideEffects = false;
+	let controlState = {};
 	const acpErrors = new AcpErrorTracker();
 	const client = new AcpClient({
 		agentCommand: options.agentCommand,
@@ -7088,6 +7766,7 @@ async function runOnce(options) {
 			acpErrors.observe(output, direction, message);
 		},
 		onSessionUpdate: (notification) => {
+			if (notification.update.sessionUpdate === "config_option_update") controlState = applyConfigOptionsToState(controlState, notification.update.configOptions);
 			if (promptTurnActive) promptTurnHadSideEffects = true;
 			options.onSessionUpdate?.(notification);
 		},
@@ -7101,10 +7780,12 @@ async function runOnce(options) {
 		},
 		sessionOptions: options.sessionOptions
 	});
+	const closeOwnedClient = ownDirectClient(client, control?.signal);
 	const runExecPromptAttempt = async (sessionId) => {
+		assertControlAuthority(authority);
 		acpErrors.reset();
 		return await measurePerf("runtime.exec.prompt", async () => {
-			return await withTimeout(client.prompt(sessionId, options.prompt), options.timeoutMs);
+			return await withTimeout(client.prompt(sessionId, options.prompt, void 0, void 0, void 0, { signal: control?.signal }), options.timeoutMs);
 		});
 	};
 	const runExecPromptWithRetries = async (sessionId) => {
@@ -7113,72 +7794,102 @@ async function runOnce(options) {
 		for (let attempt = 0;; attempt++) try {
 			return await runExecPromptAttempt(sessionId);
 		} catch (error) {
-			if (await preparePromptRetry(error, attempt, maxRetries, () => promptTurnHadSideEffects, options.suppressSdkConsoleErrors)) continue;
+			if (await preparePromptRetry(error, attempt, maxRetries, () => promptTurnHadSideEffects, options.suppressSdkConsoleErrors, control?.signal)) continue;
 			promptTurnActive = false;
 			throw error;
 		}
 	};
 	try {
-		return await withInterrupt(async () => {
-			await measurePerf("runtime.exec.start", async () => {
-				await withTimeout(client.start(), options.timeoutMs);
-			});
-			const createdSession = await measurePerf("runtime.exec.create_session", async () => {
-				return await withTimeout(client.createSession(absolutePath(options.cwd)), options.timeoutMs);
-			});
-			const sessionId = createdSession.sessionId;
-			await applyRequestedModelIfAdvertised({
-				client,
-				sessionId,
-				requestedModel: options.sessionOptions?.model,
-				models: createdSession.models,
-				agentCommand: options.agentCommand,
-				timeoutMs: options.timeoutMs,
-				onWarning: options.suppressSdkConsoleErrors ? void 0 : (message) => process.stderr.write(`[acpx] warning: ${message}\n`)
-			});
-			for (const configOption of options.configOptions ?? []) await withTimeout(client.setSessionConfigOption(sessionId, configOption.configId, configOption.value), options.timeoutMs);
-			output.setContext({ sessionId });
-			const response = await runExecPromptWithRetries(sessionId);
-			promptTurnActive = false;
-			output.flush();
-			return toPromptResult(response.stopReason, sessionId, client, response._meta);
-		}, async () => {
-			await client.cancelActivePrompt(INTERRUPT_CANCEL_WAIT_MS);
-			await client.close();
+		return await runWithOptionalInterrupt({
+			handleProcessInterrupts: control?.handleProcessInterrupts,
+			run: async () => {
+				assertControlAuthority(authority);
+				await measurePerf("runtime.exec.start", async () => {
+					await withTimeout(client.start(authority), options.timeoutMs);
+				});
+				assertControlAuthority(authority);
+				const createdSession = await measurePerf("runtime.exec.create_session", async () => {
+					return await withTimeout(client.createSession(absolutePath(options.cwd), authority), options.timeoutMs);
+				});
+				assertControlAuthority(authority);
+				const sessionId = createdSession.sessionId;
+				if (createdSession.models) applyAdvertisedModelState(controlState, createdSession.models);
+				controlState = applyConfigOptionsToState(controlState, createdSession.configOptions ?? []);
+				const modelApplication = await applyRequestedModelIfAdvertised({
+					client,
+					sessionId,
+					requestedModel: options.sessionOptions?.model,
+					models: createdSession.models,
+					agentCommand: options.agentCommand,
+					timeoutMs: options.timeoutMs,
+					authority,
+					onWarning: options.suppressSdkConsoleErrors ? void 0 : (message) => process.stderr.write(`[acpx] warning: ${message}\n`)
+				});
+				if (modelApplication.response) controlState = applyConfigOptionsToState(controlState, modelApplication.response.configOptions);
+				for (const configOption of options.configOptions ?? []) {
+					assertControlAuthority(authority);
+					const response = await withTimeout(client.setSessionConfigOption(sessionId, configOption.configId, configOption.value, advertisedModelState(controlState), authority), options.timeoutMs);
+					controlState = applyConfigOptionsToState(controlState, response.configOptions);
+				}
+				assertControlAuthority(authority);
+				output.setContext({ sessionId });
+				const response = await runExecPromptWithRetries(sessionId);
+				promptTurnActive = false;
+				return toPromptResult(response.stopReason, sessionId, client, response._meta);
+			},
+			handleInterrupt: async () => {
+				await client.cancelActivePrompt(INTERRUPT_CANCEL_WAIT_MS);
+				await closeOwnedClient();
+			}
 		});
 	} catch (error) {
-		const matchedAcpError = acpErrors.match(error);
-		attachAcpErrorPayload(error, matchedAcpError);
-		markOutputAlreadyEmitted(error, matchedAcpError !== void 0 && shouldMarkAcpErrorsEmitted);
-		throw error;
+		const failure = directExecutionError(error, authority.signal);
+		const matchedAcpError = acpErrors.match(failure);
+		attachAcpErrorPayload(failure, matchedAcpError);
+		markOutputAlreadyEmitted(failure, matchedAcpError !== void 0 && shouldMarkAcpErrorsEmitted);
+		throw failure;
 	} finally {
-		await client.close();
+		try {
+			await closeOwnedClient();
+		} finally {
+			output.flush();
+		}
 	}
 }
-async function sendSessionDirect(options) {
-	return await runSessionPrompt({
-		sessionRecordId: options.sessionId,
-		prompt: options.prompt,
-		mcpServers: options.mcpServers,
-		permissionMode: options.permissionMode,
-		resumePolicy: options.resumePolicy,
-		nonInteractivePermissions: options.nonInteractivePermissions,
-		permissionPolicy: options.permissionPolicy,
-		authCredentials: options.authCredentials,
-		authPolicy: options.authPolicy,
-		fs: options.fs,
-		terminal: options.terminal,
-		outputFormatter: options.outputFormatter,
-		errorEmissionPolicy: options.errorEmissionPolicy,
-		onAcpMessage: options.onAcpMessage,
-		onSessionUpdate: options.onSessionUpdate,
-		onClientOperation: options.onClientOperation,
-		onPermissionEscalation: options.onPermissionEscalation,
-		timeoutMs: options.timeoutMs,
-		suppressSdkConsoleErrors: options.suppressSdkConsoleErrors,
-		verbose: options.verbose,
-		client: options.client
-	});
+async function sendSessionDirect(options, control) {
+	const closeProvidedClient = control && options.client ? ownDirectClient(options.client, control.signal) : void 0;
+	try {
+		control?.signal.throwIfAborted();
+		return await runSessionPrompt({
+			ownedSignal: control?.signal,
+			closeProvidedClient,
+			waitSignal: control?.signal,
+			handleProcessInterrupts: control?.handleProcessInterrupts,
+			sessionRecordId: options.sessionId,
+			prompt: options.prompt,
+			mcpServers: options.mcpServers,
+			permissionMode: options.permissionMode,
+			resumePolicy: options.resumePolicy,
+			nonInteractivePermissions: options.nonInteractivePermissions,
+			permissionPolicy: options.permissionPolicy,
+			authCredentials: options.authCredentials,
+			authPolicy: options.authPolicy,
+			fs: options.fs,
+			terminal: options.terminal,
+			outputFormatter: options.outputFormatter,
+			errorEmissionPolicy: options.errorEmissionPolicy,
+			onAcpMessage: options.onAcpMessage,
+			onSessionUpdate: options.onSessionUpdate,
+			onClientOperation: options.onClientOperation,
+			onPermissionEscalation: options.onPermissionEscalation,
+			timeoutMs: options.timeoutMs,
+			suppressSdkConsoleErrors: options.suppressSdkConsoleErrors,
+			verbose: options.verbose,
+			client: options.client
+		});
+	} finally {
+		await closeProvidedClient?.();
+	}
 }
 //#endregion
 //#region src/session/execution/queue-owner-runtime.ts
@@ -7231,54 +7942,6 @@ function createQueueOwnerSharedClient(options, sessionRecord) {
 		sessionOptions: mergeSessionOptions(options.sessionOptions, sessionOptionsFromRecord(sessionRecord))
 	});
 }
-function createQueueOwnerTurnController(options) {
-	return new QueueOwnerTurnController({
-		withTimeout: async (run, timeoutMs) => await withTimeout(run(), timeoutMs),
-		setSessionModeFallback: async (modeId, timeoutMs) => {
-			await runSessionSetModeDirect({
-				sessionRecordId: options.sessionId,
-				modeId,
-				mcpServers: options.mcpServers,
-				nonInteractivePermissions: options.nonInteractivePermissions,
-				authCredentials: options.authCredentials,
-				authPolicy: options.authPolicy,
-				fs: options.fs,
-				terminal: options.terminal,
-				timeoutMs,
-				verbose: options.verbose
-			});
-		},
-		setSessionModelFallback: async (modelId, timeoutMs) => {
-			return (await runSessionSetModelDirect({
-				sessionRecordId: options.sessionId,
-				modelId,
-				mcpServers: options.mcpServers,
-				nonInteractivePermissions: options.nonInteractivePermissions,
-				authCredentials: options.authCredentials,
-				authPolicy: options.authPolicy,
-				fs: options.fs,
-				terminal: options.terminal,
-				timeoutMs,
-				verbose: options.verbose
-			})).response;
-		},
-		setSessionConfigOptionFallback: async (configId, value, timeoutMs) => {
-			return (await runSessionSetConfigOptionDirect({
-				sessionRecordId: options.sessionId,
-				configId,
-				value,
-				mcpServers: options.mcpServers,
-				nonInteractivePermissions: options.nonInteractivePermissions,
-				authCredentials: options.authCredentials,
-				authPolicy: options.authPolicy,
-				fs: options.fs,
-				terminal: options.terminal,
-				timeoutMs,
-				verbose: options.verbose
-			})).response;
-		}
-	});
-}
 function logDeferredCancelFailure(error, verbose) {
 	if (!verbose) return;
 	process.stderr.write(`[acpx] failed to apply deferred cancel: ${formatErrorMessage(error)}\n`);
@@ -7322,16 +7985,17 @@ function createQueueOwnerShutdownController(params) {
 	let shutdownPromise;
 	const drainActiveTurn = async () => {
 		const turn = activeTurn;
-		if (!turn) return;
-		params.turnController.requestCancel().catch((error) => {
+		const pending = Promise.allSettled([turn, params.controls.drainAdmitted()]);
+		if (turn) params.turnController.requestCancel().catch((error) => {
 			logDeferredCancelFailure(error, params.verbose);
 		});
-		if (!await settlesWithin(turn, QUEUE_OWNER_ACTIVE_TURN_CANCEL_GRACE_MS)) await params.sharedClient.close().catch(() => {});
-		await turn.catch(() => {});
+		if (!await settlesWithin(pending, QUEUE_OWNER_ACTIVE_TURN_CANCEL_GRACE_MS)) await params.sharedClient.close().catch(() => {});
+		await pending;
 	};
 	const request = () => {
 		requested = true;
 		params.stopHeartbeat();
+		params.controls.stopAdmission();
 		params.getOwner()?.beginShutdown();
 		activeTurnShutdown ??= drainActiveTurn();
 	};
@@ -7342,14 +8006,20 @@ function createQueueOwnerShutdownController(params) {
 		request,
 		setActiveTurn: (turn) => {
 			activeTurn = turn;
+			if (requested) activeTurnShutdown = Promise.all([activeTurnShutdown, drainActiveTurn()]).then(() => {});
 		},
 		clearActiveTurn: (turn) => {
 			if (activeTurn === turn) activeTurn = void 0;
 		},
+		drain: () => {
+			request();
+			return activeTurnShutdown;
+		},
 		shutdown: () => {
 			request();
 			shutdownPromise ??= (async () => {
 				await activeTurnShutdown;
+				await params.getBackendClose()?.catch(() => {});
 				await closeQueueOwnerRuntime({
 					owner: params.getOwner(),
 					turnController: params.turnController,
@@ -7368,20 +8038,50 @@ function applyRequestedShutdown(owner, shutdown) {
 function startQueueOwnerHeartbeat(params) {
 	if (!params.enabled) return;
 	return setInterval(() => {
-		refreshQueueOwnerLease(params.lease, { queueDepth: params.owner.queueDepth() }).catch(() => {});
+		params.refresh(params.owner.queueDepth());
 	}, QUEUE_OWNER_HEARTBEAT_INTERVAL_MS);
 }
+function createLeaseHeartbeat(lease, shutdown) {
+	let guardFailure;
+	return {
+		refresh: async (queueDepth) => {
+			if (shutdown.requested) return;
+			await refreshQueueOwnerLease(lease, { queueDepth }).catch((error) => {
+				if (error instanceof QueueLeaseGuardSettlementError) {
+					guardFailure ??= error;
+					shutdown.request();
+				}
+			});
+		},
+		throwIfFailed: () => {
+			if (guardFailure) throw guardFailure;
+		}
+	};
+}
 async function runSessionQueueOwner(options) {
 	const lease = await tryAcquireQueueOwnerLease(options.sessionId, {
 		path: options.mcpConfigPath,
 		fingerprint: options.mcpConfigFingerprint
 	});
 	if (!lease) return;
+	let runtimeFailure;
 	try {
 		await runQueueOwnerRuntime(options, lease);
-	} finally {
+	} catch (error) {
+		runtimeFailure = { error };
+	}
+	try {
 		await releaseQueueOwnerLease(lease);
+	} catch (error) {
+		if (runtimeFailure) throw new AggregateError([runtimeFailure.error, error], "Queue owner shutdown failed", { cause: error });
+		throw error;
 	}
+	if (runtimeFailure) throw runtimeFailure.error;
+}
+async function keepOwnerForPendingControls(controls, shutdown) {
+	if (shutdown.requested || !controls.hasPending) return false;
+	await controls.drainAdmitted();
+	return !shutdown.requested;
 }
 async function runQueueOwnerRuntime(options, lease) {
 	const sessionRecord = await resolveSessionRecord(options.sessionId);
@@ -7392,7 +8092,16 @@ async function runQueueOwnerRuntime(options, lease) {
 	const maxQueueDepth = Math.max(1, Math.round(options.maxQueueDepth ?? 16));
 	const taskPollTimeoutMs = ttlMs === 0 ? void 0 : ttlMs;
 	const initialTaskPollTimeoutMs = taskPollTimeoutMs == null ? void 0 : Math.max(taskPollTimeoutMs, 1e3);
-	const turnController = createQueueOwnerTurnController(options);
+	const turnController = new QueueOwnerTurnController();
+	let activeControls;
+	let backendCloseRequest;
+	const controls = new QueueOwnerControlAdmission({ runIdle: async (invoke, controlOptions) => await runIdleOwnerControl({
+		...controlOptions,
+		client: sharedClient,
+		sessionId: options.sessionId,
+		verbose: options.verbose,
+		onRetirementFailure: () => shutdown.request()
+	}, invoke) });
 	const applyPendingCancel = async () => {
 		return await turnController.applyPendingCancel();
 	};
@@ -7402,23 +8111,34 @@ async function runQueueOwnerRuntime(options, lease) {
 		});
 	};
 	const setActiveController = (controller) => {
+		activeControls = controller;
 		turnController.setActiveController(controller);
 		scheduleApplyPendingCancel();
 	};
 	const clearActiveController = () => {
+		activeControls = void 0;
 		turnController.clearActiveController();
 	};
-	const closeActiveBackendSession = async (timeoutMs) => {
-		const latestRecord = await resolveSessionRecord(options.sessionId);
-		if (!sharedClient.supportsCloseSession()) return false;
-		await withTimeout(sharedClient.closeSession(latestRecord.acpSessionId), timeoutMs);
-		return true;
+	const closeActiveBackendSession = (timeoutMs) => {
+		backendCloseRequest ??= Promise.resolve().then(async () => {
+			await shutdown.drain();
+			const latestRecord = await resolveSessionRecord(options.sessionId);
+			if (!sharedClient.supportsCloseSession()) return false;
+			await withTimeout(sharedClient.closeSession(latestRecord.acpSessionId), timeoutMs);
+			return true;
+		});
+		return backendCloseRequest;
 	};
 	const runPromptTurn = async (run) => {
 		const waitSignal = turnController.beginTurn();
+		const { ticket, priorIdle } = controls.beginPrompt();
+		if (shutdown.requested) turnController.requestCancel().catch(() => {});
 		try {
-			return await run(waitSignal);
+			await priorIdle;
+			return await run(waitSignal, ticket);
 		} finally {
+			await controls.seal(ticket);
+			controls.release(ticket);
 			turnController.endTurn();
 		}
 	};
@@ -7431,6 +8151,8 @@ async function runQueueOwnerRuntime(options, lease) {
 			}
 		},
 		turnController,
+		controls,
+		getBackendClose: () => backendCloseRequest,
 		sharedClient,
 		sessionId: options.sessionId,
 		verbose: options.verbose
@@ -7438,6 +8160,7 @@ async function runQueueOwnerRuntime(options, lease) {
 	const onSignal = () => {
 		shutdown.request();
 	};
+	const heartbeat = createLeaseHeartbeat(lease, shutdown);
 	process.once("SIGINT", onSignal);
 	process.once("SIGTERM", onSignal);
 	process.once("SIGHUP", onSignal);
@@ -7450,17 +8173,17 @@ async function runQueueOwnerRuntime(options, lease) {
 			},
 			closeSession: async (timeoutMs) => await closeActiveBackendSession(timeoutMs),
 			setSessionMode: async (modeId, timeoutMs) => {
-				await turnController.setSessionMode(modeId, timeoutMs);
+				await controls.run((context, deadline) => context.setSessionMode(modeId, deadline), timeoutMs);
 			},
-			setSessionModel: async (modelId, timeoutMs) => await turnController.setSessionModel(modelId, timeoutMs),
+			setSessionModel: async (modelId, timeoutMs) => await controls.run((context, deadline) => context.setSessionModel(modelId, deadline), timeoutMs, { key: "model" }),
 			setSessionConfigOption: async (configId, value, timeoutMs) => {
-				return await turnController.setSessionConfigOption(configId, value, timeoutMs);
+				return await controls.run((context, deadline) => context.setSessionConfigOption(configId, value, deadline), timeoutMs, { key: configId });
 			}
 		}, {
 			maxQueueDepth,
 			onQueueDepthChanged: (queueDepth) => {
 				setPerfGauge("queue.owner.depth", queueDepth);
-				refreshQueueOwnerLease(lease, { queueDepth }).catch(() => {});
+				heartbeat.refresh(queueDepth);
 			}
 		});
 		applyRequestedShutdown(owner, shutdown);
@@ -7470,19 +8193,22 @@ async function runQueueOwnerRuntime(options, lease) {
 			maxQueueDepth,
 			verbose: options.verbose
 		});
-		await refreshQueueOwnerLease(lease, { queueDepth: owner.queueDepth() }).catch(() => {});
+		await heartbeat.refresh(owner.queueDepth());
 		heartbeatTimer = startQueueOwnerHeartbeat({
 			enabled: !shutdown.requested,
-			lease,
+			refresh: heartbeat.refresh,
 			owner
 		});
 		let isFirstTask = true;
 		while (true) {
 			const pollTimeoutMs = isFirstTask ? initialTaskPollTimeoutMs : taskPollTimeoutMs;
 			const task = await owner.nextTask(pollTimeoutMs);
-			if (!task) break;
+			if (!task) {
+				if (await keepOwnerForPendingControls(controls, shutdown)) continue;
+				break;
+			}
 			isFirstTask = false;
-			const turnPromise = runPromptTurn(async (waitSignal) => {
+			const turnPromise = runPromptTurn(async (waitSignal, ticket) => {
 				try {
 					await runQueuedTask(options.sessionId, task, {
 						sharedClient,
@@ -7496,7 +8222,10 @@ async function runQueueOwnerRuntime(options, lease) {
 						sessionOptions: options.sessionOptions,
 						onClientAvailable: setActiveController,
 						onClientClosed: clearActiveController,
+						onClientCloseFailure: shutdown.request,
+						onPromptFinalizing: () => controls.seal(ticket),
 						onPromptActive: async () => {
+							if (activeControls) controls.publish(ticket, activeControls);
 							turnController.markPromptActive();
 							await applyPendingCancel();
 						},
@@ -7520,7 +8249,9 @@ async function runQueueOwnerRuntime(options, lease) {
 		process.off("SIGTERM", onSignal);
 		process.off("SIGHUP", onSignal);
 		await shutdown.shutdown();
+		await lease.updates;
 	}
+	heartbeat.throwIfFailed();
 }
 async function sendSession(options) {
 	options.signal?.throwIfAborted();
@@ -7560,6 +8291,6 @@ async function sendSession(options) {
 }
 const queueOwnerRuntimeTestInternals = { queueOwnerExitIsFatal };
 //#endregion
-export { normalizeQueueOwnerTtlMs as $, setDesiredModeId as A, recordClientOperation as B, withConnectedSession as C, applyInitialModelSelection as D, applyConfigOptionsToRecord as E, createInitialSessionRecord as F, AcpClient as G, recordSessionUpdate as H, reconcileAgentSessionId as I, RequestedModelUnsupportedError as J, REQUESTED_MODEL_UNSUPPORTED_ERROR_CODE as K, cloneSessionAcpxState as L, sessionOptionsFromRecord as M, applyConversation as N, applyModelSelection as O, applyLifecycleSnapshotToRecord as P, DEFAULT_QUEUE_OWNER_TTL_MS as Q, cloneSessionConversation as R, setSessionModel as S, applyConfigOptionSelection as T, trimConversationForRuntime as U, recordPromptSubmission as V, advertisedModelState as W, getAcpxVersion as X, isRequestedModelUnsupportedError as Y, permissionModeSatisfies as Z, cancelSessionPrompt as _, runQueuedTask as a, withInterrupt as at, setSessionConfigOption as b, LiveSessionCheckpoint as c, normalizeOutputError as ct, flushPerfMetricsCapture as d, listSessionEvents as et, installPerfMetricsCapture as f, listAgentSessions as g, ensureSession as h, runOnce as i, assertControlAuthority as it, persistSessionOptions as j, applyRequestedModelIfAdvertised as k, runPromptTurn as l, createSessionWithClient as m, runSessionQueueOwner as n, InterruptedError as nt, sendSessionDirect as o, withTimeout as ot, createSession as p, REQUESTED_MODEL_UNSUPPORTED_REASONS as q, sendSession as r, TimeoutError as rt, DISCARD_OUTPUT_FORMATTER as s, exitCodeForOutputErrorCode as st, queueOwnerRuntimeTestInternals as t, isLegacyZedCodexAcpInvocation as tt, buildQueueOwnerArgOverride as u, closeSession as v, connectAndLoadSession as w, setSessionMode as x, sessionControlTestInternals as y, createSessionConversation as z };
+export { getAcpxVersion as $, applyInitialModelSelection as A, cloneSessionAcpxState as B, setSessionModeOnOwner as C, connectAndLoadSession as D, withConnectedSession as E, sessionOptionsFromRecord as F, recordSessionUpdate as G, createSessionConversation as H, applyConversation as I, AcpClient as J, trimConversationForRuntime as K, applyLifecycleSnapshotToRecord as L, applyRequestedModelIfAdvertised as M, setDesiredModeId as N, applyConfigOptionSelection as O, persistSessionOptions as P, isRequestedModelUnsupportedError as Q, createInitialSessionRecord as R, setSessionMode as S, setSessionModelOnOwner as T, recordClientOperation as U, cloneSessionConversation as V, recordPromptSubmission as W, REQUESTED_MODEL_UNSUPPORTED_REASONS as X, REQUESTED_MODEL_UNSUPPORTED_ERROR_CODE as Y, RequestedModelUnsupportedError as Z, cancelSessionPrompt as _, runQueuedTask as a, InterruptedError as at, setSessionConfigOption as b, LiveSessionCheckpoint as c, withInterrupt as ct, flushPerfMetricsCapture as d, normalizeOutputError as dt, permissionModeSatisfies as et, installPerfMetricsCapture as f, listAgentSessions as g, ensureSession as h, runOnce as i, isLegacyZedCodexAcpInvocation as it, applyModelSelection as j, applyConfigOptionsToRecord as k, runPromptTurn as l, withTimeout as lt, createSessionWithClient as m, runSessionQueueOwner as n, normalizeQueueOwnerTtlMs as nt, sendSessionDirect as o, TimeoutError as ot, createSession as p, advertisedModelState as q, sendSession as r, listSessionEvents as rt, DISCARD_OUTPUT_FORMATTER as s, assertControlAuthority as st, queueOwnerRuntimeTestInternals as t, DEFAULT_QUEUE_OWNER_TTL_MS as tt, buildQueueOwnerArgOverride as u, exitCodeForOutputErrorCode as ut, closeSession as v, setSessionModel as w, setSessionConfigOptionOnOwner as x, sessionControlTestInternals as y, reconcileAgentSessionId as z };
 
-//# sourceMappingURL=queue-owner-runtime-Dgv3e2Tp.js.map
+//# sourceMappingURL=queue-owner-runtime-CLwjMYNL.js.map