lark-remote 0.4.2 → 0.4.4

package/dist/runner/claude/session.js

@@ -25,7 +25,7 @@
  * 生命周期：一个 workspace 一个长驻进程（lifetime='workspace'）。每次
  * run(message) = 写一条 user 消息 + 消费 stdout 事件直到本 turn 的 result；
  * 进程在 turn 之间保持存活（stdin 不关闭），/stop / /new / /cd / 看门狗超时
- * 时经 ProcessStopper 组杀，下条消息按 SessionStore 的 sessionId --resume。
+ * 时经 Terminator 组杀，下条消息按 SessionStore 的 sessionId --resume。
  */
 import { readFile } from 'node:fs/promises';
 import { silentlyUnlink } from '../../common/fs.js';
@@ -43,7 +43,7 @@ const DEFAULT_IDLE_TTL_MS = 30 * 60 * 1000;
 const COMPACTION_RESULT_SUBTYPES = new Set(['compact', 'compaction']);
 /**
  * ClaudeSession extends SpawningRunner 复用其 spawn/pid 文件/killOrphan/
- * ProcessStopper/SpawnHeartbeat/退出分发器机制（P1-1/P1-10/P1-11 契约保持），
+ * Terminator/SpawnHeartbeat/退出分发器机制（P1-1/P1-10/P1-11 契约保持），
  * 但 run() 覆盖为「长驻 + 按 turn 消费」：进程跨 turn 存活，turn 结束以
  * stream-json result 事件（非 compact）为界，而不是进程退出。
  */
@@ -97,6 +97,8 @@ export class ClaudeSession extends SpawningRunner {
             spawnHeartbeatMs: opts.spawnHeartbeatMs,
             pidFilePrefix: 'claude',
             logTag: 'claude-runner',
+            // win32 查协议停止通道用的 agent key（claude 的 channel = 控制通道/关 stdin）
+            agent: 'claude',
         });
         this.binary = 'claude';
         this.permissionMode = opts.permissionMode ?? 'bypassPermissions';
@@ -166,12 +168,6 @@ export class ClaudeSession extends SpawningRunner {
             this.armIdleTimer();
         }
     }
-    /**
-     * 写一条用户消息到 stdin（--input-format stream-json 的 user 事件）。
-     */
-    async sendUserMessage(message) {
-        await this.writeUserMessage(message);
-    }
     /**
      * 回写审批响应（允许/拒绝）。
      */
@@ -373,6 +369,9 @@ export class ClaudeSession extends SpawningRunner {
                 if (generation === this.processGeneration) {
                     this.streamEnded = true;
                     this.currentProcess = null;
+                    // 进程自行结束（崩溃/上游退出）：注销协议停止通道，别把死 pid 的
+                    // 条目留在注册表里等 pid 复用。
+                    this.unregisterStopper();
                     silentlyUnlink(this.pidFilePath);
                     this.wakeWaiters();
                 }

package/dist/runner/codex/app-server/protocol-types.d.ts

@@ -6,6 +6,10 @@
  * field names use the wire format exactly: camelCase paths for methods
  * (`item/agentMessage/delta`) and snake_case only where the server requires it
  * (e.g. permission profile fields).
+ *
+ * 本文件是上游 schema 的完整镜像，不是"用到什么抄什么"：少数导出类型当前没有
+ * consumer，是有意保留（接新通知/新方法时不必回头重抄 schema）。静态扫描再报
+ * "零引用导出类型"指的就是这一批，别据此删除。
  */
 export type { JsonRpcRequest, JsonRpcNotification, JsonRpcSuccessResponse, JsonRpcErrorResponse, } from '../../common/jsonrpc/types.js';
 export interface ClientInfo {

package/dist/runner/codex/app-server/protocol-types.js

@@ -6,6 +6,10 @@
  * field names use the wire format exactly: camelCase paths for methods
  * (`item/agentMessage/delta`) and snake_case only where the server requires it
  * (e.g. permission profile fields).
+ *
+ * 本文件是上游 schema 的完整镜像，不是"用到什么抄什么"：少数导出类型当前没有
+ * consumer，是有意保留（接新通知/新方法时不必回头重抄 schema）。静态扫描再报
+ * "零引用导出类型"指的就是这一批，别据此删除。
  */
 // =============================================================================
 // Notifications (server → client)

package/dist/runner/codex/app-server/runner.js

@@ -136,6 +136,9 @@ export class CodexAppServerRunner extends ConnectionBasedRunner {
             },
         };
         this.connectionManager = new ConnectionManager(managerOpts);
+        // 协议停止通道（design §3.3）：codex 的 cancel 是 `turn/interrupt` 请求，已由
+        // cancelCurrentTurn 实现；登记后 win32 优雅停止才有通道可用（否则一路树杀）。
+        this.connectionManager.stopper = ({ client }) => this.buildCooperativeStop(client);
     }
     get logTag() {
         return 'codex-app-server-runner';

package/dist/runner/common/acp/base-acp-runner.js

@@ -15,6 +15,10 @@ export class BaseAcpRunner extends ConnectionBasedRunner {
     constructor(opts, connectionManager) {
         super(opts);
         this.connectionManager = connectionManager;
+        // 协议停止通道（design §3.3）：ACP 的 cancel 就是 `session/cancel`，已由
+        // cancelCurrentTurn 实现。这里只做登记接线——manager 建在 super() 实参里，
+        // 那时 this 不可用，所以只能等 super() 返回后再赋值。
+        connectionManager.stopper = ({ client }) => this.buildCooperativeStop(client);
     }
     // =========================================================================
     // Shared plumbing
@@ -40,6 +44,9 @@ export class BaseAcpRunner extends ConnectionBasedRunner {
         this.promptSettled = false;
         this.promptSent = false;
         this.activeSessionId = null;
+        // 未答的审批随轮次一起作废：连接是按工作区长驻的，请求 id 会从 1 重新
+        // 计数，留着旧条目等于让下一轮的迟到的卡片点击回信到一条无关请求上。
+        this.pendingApprovals.clear();
     }
     async releaseConnection(cwd) {
         await this.connectionManager.release(cwd);

package/dist/runner/common/acp/base-translator.d.ts

@@ -15,6 +15,8 @@
  *   handleRequestPermission                           — approval rendering (abstract)
  *   handleOtherServerRequest                          — extra reverse RPC (kimi: elicitation)
  *   extractToolResultContent                          — tool_result content (default: rawOutput)
+ *   extractToolCallArgsText                           — streaming-args source (opencode: none)
+ *   buildToolUseUpdate                                — tool_use patch from tool_call_update
  *   onUsageSample                                     — extra usage bookkeeping (opencode: cost)
  */
 import type { AgentEvent, ApprovalRequestedEvent, ResultEvent } from '../../types.js';
@@ -69,6 +71,13 @@ export declare abstract class BaseAcpTranslator {
      * approval handler correlate by toolCallId and recover the real command.
      */
     private toolCallArgsByCallId;
+    /**
+     * tool_use name recorded at tool_call time (kind mapping wins, else title).
+     * A later tool_call_update may carry only a title (opencode's completed
+     * update has neither kind nor rawInput); pairing it with the recorded name
+     * lets a tool_use patch render the original title as a subtitle.
+     */
+    private toolCallNameByCallId;
     /**
      * Handle a notification from the ACP server and return translated events.
      * Wire envelope: {sessionId, update: {sessionUpdate: '<kind>', ...}} — the
@@ -132,8 +141,42 @@ export declare abstract class BaseAcpTranslator {
      * command (see toolCallArgsByCallId).
      */
     protected getTrackedToolCallArgs(toolCallId: string): string | undefined;
+    /** tool_use name recorded at tool_call time (kind mapping wins, else title). */
+    protected getToolCallName(toolCallId: string): string | undefined;
+    /**
+     * kind → canonical tool name (信息保真 C3.1). Shared by the initial tool_call
+     * handler and the tool_call_update patch builder so both agree on the name.
+     */
+    protected toolNameFromKind(kind: string | undefined): string | undefined;
+    /**
+     * Streaming-args text carried by a tool_call/_update notification.
+     *
+     * Default: the notification's content text — kimi's events-map.ts encodes the
+     * accumulated args there (toolCallDeltaToSessionUpdate: content.text =
+     * accumulator.args), and the approval handler relies on it.
+     *
+     * opencode overrides this to return undefined: its tool_call/_update content
+     * is the shell OUTPUT snapshot (decompiled acp service `WP`), never args
+     * (args ride rawInput in `XC`/`BP`). Treating that output as args would
+     * corrupt approval command recovery — the hazard this hook exists to close.
+     */
+    protected extractToolCallArgsText(event: ToolCallEvent | ToolCallUpdateEvent): string | undefined;
+    /**
+     * tool_call_update → optional tool_use patch event. When an update carries
+     * richer identity than the initial tool_call did (opencode emits the
+     * tool_call while args are still streaming, then delivers the real title /
+     * rawInput in later updates), the returned `assistant`/`tool_use` block is
+     * merged into the existing tool block by the card reducer (matched by id)
+     * instead of creating a duplicate panel.
+     *
+     * Default: null (kimi self-produces its Bash tool_use from terminal/create
+     * with the real command, so it needs no patch). opencode overrides.
+     */
+    protected buildToolUseUpdate(_event: ToolCallUpdateEvent): AgentEvent | null;
     /** Record latest args text, bounded so a long session cannot grow it forever. */
     private trackToolCallArgs;
+    /** Record tool_use name, bounded to keep a long session from growing it. */
+    private trackToolCallName;
     /**
      * tool_result content extraction. Default: rawOutput passthrough (kimi
      * semantics). opencode overrides — its rawOutput is an OBJECT

package/dist/runner/common/acp/base-translator.js

@@ -65,6 +65,13 @@ export class BaseAcpTranslator {
      * approval handler correlate by toolCallId and recover the real command.
      */
     toolCallArgsByCallId = new Map();
+    /**
+     * tool_use name recorded at tool_call time (kind mapping wins, else title).
+     * A later tool_call_update may carry only a title (opencode's completed
+     * update has neither kind nor rawInput); pairing it with the recorded name
+     * lets a tool_use patch render the original title as a subtitle.
+     */
+    toolCallNameByCallId = new Map();
     /**
      * Handle a notification from the ACP server and return translated events.
      * Wire envelope: {sessionId, update: {sessionUpdate: '<kind>', ...}} — the
@@ -231,15 +238,16 @@ export class BaseAcpTranslator {
                 // Keep raw string as-is
             }
         }
-        const argsText = extractToolCallContentText(event.content);
+        const argsText = this.extractToolCallArgsText(event);
         if (argsText !== undefined) {
             this.trackToolCallArgs(event.toolCallId, argsText);
         }
         else if (event.rawInput !== undefined && event.rawInput !== null) {
             this.trackToolCallArgs(event.toolCallId, stringifyUnknown(event.rawInput));
         }
-        const mapped = event.kind ? KIND_TO_TOOL[event.kind] : undefined;
+        const mapped = this.toolNameFromKind(event.kind);
         const name = mapped ?? event.title;
+        this.trackToolCallName(event.toolCallId, name);
         const summary = mapped && event.title && event.title !== name ? event.title : undefined;
         return [
             {
@@ -265,6 +273,11 @@ export class BaseAcpTranslator {
     handleToolCallUpdate(event, _sessionId) {
         const isError = event.status === 'failed';
         const content = this.extractToolResultContent(event);
+        // Patch the existing tool block with identity that was not available at the
+        // initial tool_call (opencode streams args after emitting tool_call). The
+        // reducer merges by id, so this never duplicates the panel. Built before
+        // the terminal cleanup below so it can still resolve the recorded name.
+        const useUpdate = this.buildToolUseUpdate(event);
         // Terminal updates end the args-streaming phase — drop the tracked entry.
         // In-progress delta text is cumulative (events-map.ts
         // toolCallDeltaToSessionUpdate: content.text = accumulator.args), so the
@@ -273,7 +286,7 @@ export class BaseAcpTranslator {
             this.toolCallArgsByCallId.delete(event.toolCallId);
         }
         else {
-            const argsText = extractToolCallContentText(event.content);
+            const argsText = this.extractToolCallArgsText(event);
             if (argsText !== undefined) {
                 this.trackToolCallArgs(event.toolCallId, argsText);
             }
@@ -281,22 +294,24 @@ export class BaseAcpTranslator {
                 this.trackToolCallArgs(event.toolCallId, stringifyUnknown(event.rawInput));
             }
         }
-        return [
-            {
-                type: 'user',
-                message: {
-                    content: [
-                        {
-                            type: 'tool_result',
-                            tool_use_id: event.toolCallId,
-                            content,
-                            is_error: isError,
-                        },
-                    ],
-                },
-                timestamp: new Date().toISOString(),
+        const events = [];
+        if (useUpdate)
+            events.push(useUpdate);
+        events.push({
+            type: 'user',
+            message: {
+                content: [
+                    {
+                        type: 'tool_result',
+                        tool_use_id: event.toolCallId,
+                        content,
+                        is_error: isError,
+                    },
+                ],
             },
-        ];
+            timestamp: new Date().toISOString(),
+        });
+        return events;
     }
     /**
      * Latest tracked streaming-args text for a tool call (undefined when never
@@ -307,6 +322,46 @@ export class BaseAcpTranslator {
     getTrackedToolCallArgs(toolCallId) {
         return this.toolCallArgsByCallId.get(toolCallId);
     }
+    /** tool_use name recorded at tool_call time (kind mapping wins, else title). */
+    getToolCallName(toolCallId) {
+        return this.toolCallNameByCallId.get(toolCallId);
+    }
+    /**
+     * kind → canonical tool name (信息保真 C3.1). Shared by the initial tool_call
+     * handler and the tool_call_update patch builder so both agree on the name.
+     */
+    toolNameFromKind(kind) {
+        return kind ? KIND_TO_TOOL[kind] : undefined;
+    }
+    /**
+     * Streaming-args text carried by a tool_call/_update notification.
+     *
+     * Default: the notification's content text — kimi's events-map.ts encodes the
+     * accumulated args there (toolCallDeltaToSessionUpdate: content.text =
+     * accumulator.args), and the approval handler relies on it.
+     *
+     * opencode overrides this to return undefined: its tool_call/_update content
+     * is the shell OUTPUT snapshot (decompiled acp service `WP`), never args
+     * (args ride rawInput in `XC`/`BP`). Treating that output as args would
+     * corrupt approval command recovery — the hazard this hook exists to close.
+     */
+    extractToolCallArgsText(event) {
+        return extractToolCallContentText(event.content);
+    }
+    /**
+     * tool_call_update → optional tool_use patch event. When an update carries
+     * richer identity than the initial tool_call did (opencode emits the
+     * tool_call while args are still streaming, then delivers the real title /
+     * rawInput in later updates), the returned `assistant`/`tool_use` block is
+     * merged into the existing tool block by the card reducer (matched by id)
+     * instead of creating a duplicate panel.
+     *
+     * Default: null (kimi self-produces its Bash tool_use from terminal/create
+     * with the real command, so it needs no patch). opencode overrides.
+     */
+    buildToolUseUpdate(_event) {
+        return null;
+    }
     /** Record latest args text, bounded so a long session cannot grow it forever. */
     trackToolCallArgs(toolCallId, argsText) {
         this.toolCallArgsByCallId.delete(toolCallId);
@@ -317,6 +372,16 @@ export class BaseAcpTranslator {
                 this.toolCallArgsByCallId.delete(oldest);
         }
     }
+    /** Record tool_use name, bounded to keep a long session from growing it. */
+    trackToolCallName(toolCallId, name) {
+        this.toolCallNameByCallId.delete(toolCallId);
+        this.toolCallNameByCallId.set(toolCallId, name);
+        if (this.toolCallNameByCallId.size > 100) {
+            const oldest = this.toolCallNameByCallId.keys().next().value;
+            if (oldest !== undefined)
+                this.toolCallNameByCallId.delete(oldest);
+        }
+    }
     /**
      * tool_result content extraction. Default: rawOutput passthrough (kimi
      * semantics). opencode overrides — its rawOutput is an OBJECT

package/dist/runner/common/connection-based-runner.d.ts

@@ -15,6 +15,7 @@
  * updateApprovalMode, getStatusInfo) and provide the small abstract hooks below.
  */
 import type { AgentKind, AgentSessionReader, AgentEvent, AgentRunner, AgentStatusInfo, SpawnOptions } from '../types.js';
+import type { AgentStopper } from '../../platform/agent-stopper.js';
 export declare abstract class ConnectionBasedRunner<TClient, TEvent = AgentEvent> implements AgentRunner {
     readonly kind: AgentKind;
     readonly sessionReader: AgentSessionReader;
@@ -49,6 +50,23 @@ export declare abstract class ConnectionBasedRunner<TClient, TEvent = AgentEvent
     protected abstract cancelCurrentTurn(): Promise<void>;
     /** Set up the turn: acquire + thread|session new/resume + prompt. */
     protected abstract setupTurn(message: string, opts: SpawnOptions): Promise<void>;
+    /**
+     * 本连接的协议停止通道（design §3.3）。
+     *
+     * win32 上「优雅停止」没有可拦截的跨进程 SIGTERM，只能经 agent 自有协议通道
+     * 请求对方收摊。子类把这个方法的结果交给 ConnectionManager.stopper，由后者按
+     * `agent + pid` 登记到 AgentStopperRegistry，Terminator 停进程时按 pid 取回。
+     *
+     * 两件事，顺序不能反：
+     *   1. 若本连接就是当前在途 turn 的连接，先发协议取消（codex turn/interrupt /
+     *      ACP session/cancel / pi abort）。**归属判定不能省**：runner 实例按 agent
+     *      维度共享（一个实例管多条 workspace 连接），无条件调用
+     *      `cancelCurrentTurn()` 会用它自己的 currentClient/activeSessionId 去打断
+     *      **另一个 workspace** 正在跑的 turn；
+     *   2. 关 stdin。stdio 型 agent server 在 stdin EOF 后自行退出——只发协议取消
+     *      不会让进程退出，优雅段会空转到 grace 超时后照样树杀，等于通道白注册。
+     */
+    protected buildCooperativeStop(client: TClient): AgentStopper;
     get isRunning(): boolean;
     /** Agent self-describing status info for /status display. */
     abstract getStatusInfo(): AgentStatusInfo;

package/dist/runner/common/connection-based-runner.js

@@ -27,6 +27,37 @@ export class ConnectionBasedRunner {
         this.sessionReader = opts.sessionReader;
         this.turnIdleTimeoutMs = opts.turnIdleTimeoutMs ?? defaultTurnIdleTimeoutMs;
     }
+    /**
+     * 本连接的协议停止通道（design §3.3）。
+     *
+     * win32 上「优雅停止」没有可拦截的跨进程 SIGTERM，只能经 agent 自有协议通道
+     * 请求对方收摊。子类把这个方法的结果交给 ConnectionManager.stopper，由后者按
+     * `agent + pid` 登记到 AgentStopperRegistry，Terminator 停进程时按 pid 取回。
+     *
+     * 两件事，顺序不能反：
+     *   1. 若本连接就是当前在途 turn 的连接，先发协议取消（codex turn/interrupt /
+     *      ACP session/cancel / pi abort）。**归属判定不能省**：runner 实例按 agent
+     *      维度共享（一个实例管多条 workspace 连接），无条件调用
+     *      `cancelCurrentTurn()` 会用它自己的 currentClient/activeSessionId 去打断
+     *      **另一个 workspace** 正在跑的 turn；
+     *   2. 关 stdin。stdio 型 agent server 在 stdin EOF 后自行退出——只发协议取消
+     *      不会让进程退出，优雅段会空转到 grace 超时后照样树杀，等于通道白注册。
+     */
+    buildCooperativeStop(client) {
+        return async (proc) => {
+            if (this.currentClient === client) {
+                try {
+                    await this.cancelCurrentTurn();
+                }
+                catch (err) {
+                    getLogger().warn(`[${this.logTag}] cooperative stop: cancel failed: ${err.message}`);
+                }
+            }
+            if (proc.stdin && !proc.stdin.destroyed) {
+                proc.stdin.end();
+            }
+        };
+    }
     get isRunning() {
         return this._isRunning;
     }

package/dist/runner/common/jsonrpc/client.js

@@ -128,7 +128,12 @@ export class JsonRpcClient {
         return new Promise((resolve, reject) => {
             // Clamp to setTimeout's max: callers may pass Infinity for turn-scoped
             // requests (session/prompt) — Infinity would fire immediately in Node.
-            const effectiveTimeout = Math.min(timeoutMs ?? this.requestTimeoutMs, 2_147_483_647);
+            // 配置里的 `requestTimeoutMs: 0` = 不超时（同族 `turnIdleTimeoutMinutes`、
+            // `claude.idleTtlMinutes` 都是「0 = 禁用」）。按 0 直接 setTimeout 会让
+            // 每个请求在响应到达前抢先 reject，等于整个 agent 不可用。
+            const budget = timeoutMs ??
+                (this.requestTimeoutMs === 0 ? Number.POSITIVE_INFINITY : this.requestTimeoutMs);
+            const effectiveTimeout = Math.min(budget, 2_147_483_647);
             const timer = setTimeout(() => {
                 this.pendingRequests.delete(id);
                 reject(new RpcTimeoutError(`request timed out: ${method}`));

package/dist/runner/common/jsonrpc/connection-manager.d.ts

@@ -15,6 +15,7 @@
  */
 import { JsonlRpcTransport } from './transport.js';
 import { JsonRpcClient } from './client.js';
+import { AgentStopperRegistry, type AgentStopper } from '../../../platform/agent-stopper.js';
 /** Minimal client surface the manager needs from any protocol client. */
 export interface ConnectionClient {
     ready: boolean;
@@ -75,6 +76,8 @@ export interface ConnectionManagerOptions<TClient extends ConnectionClient = Jso
     }) => boolean;
     /** Log tag prefix for operational log lines. */
     logTag?: string;
+    /** 协议停止通道注册表注入（测试隔离）；默认进程级单例，透传给 transport。 */
+    stoppers?: AgentStopperRegistry;
 }
 export declare class ConnectionManager<TClient extends ConnectionClient = JsonRpcClient> {
     private slots;
@@ -87,8 +90,22 @@ export declare class ConnectionManager<TClient extends ConnectionClient = JsonRp
     private readonly clientFactory;
     private readonly shouldReuse;
     private readonly logTag;
+    private readonly stoppers;
     /** Callback when a connection is lost — cleared from slot map. */
     onConnectionLost?: (workspace: string) => void;
+    /**
+     * 协议停止通道工厂（design §3.3）：连接建立后按 pid 登记到 AgentStopperRegistry，
+     * 供 Terminator 在**优雅**停止时回调（win32 上没有可拦截的 SIGTERM，只能靠
+     * 协议通道让 agent 自己收摊）。返回 undefined = 该协议无通道。
+     *
+     * 做成「构造后赋值的字段」而不是构造选项：kimi/opencode 的 manager 建在
+     * `super(...)` 的实参里，那时 `this` 尚不可用，runner 无法把
+     * cancelCurrentTurn 塞进选项——只能等 super() 返回后赋值。
+     */
+    stopper?: (ctx: {
+        pid: number;
+        client: TClient;
+    }) => AgentStopper | undefined;
     constructor(opts: ConnectionManagerOptions<TClient>);
     /**
      * Acquire a connection for the given workspace.
@@ -117,6 +134,9 @@ export declare class ConnectionManager<TClient extends ConnectionClient = JsonRp
     notifyActivity(workspace: string): void;
     /**
      * Notify that the workspace is idle — arm the idle timer.
+     *
+     * `idleTtlMs: 0` = 不回收（与 claude 会话层的 `armIdleTimer` 同口径；按 0
+     * setTimeout 会秒删刚建好的连接，等于每条消息重起一次进程）。
      */
     notifyIdle(workspace: string): void;
     private createClient;

package/dist/runner/common/jsonrpc/connection-manager.js

@@ -16,6 +16,7 @@
 import { JsonlRpcTransport } from './transport.js';
 import { JsonRpcClient } from './client.js';
 import { getLogger } from '../../../logger/index.js';
+import { agentStopperRegistry, } from '../../../platform/agent-stopper.js';
 const DEFAULT_IDLE_TTL_MS = 30 * 60 * 1000; // 30 minutes
 const DEFAULT_REQUEST_TIMEOUT_MS = 60_000; // 60 seconds
 export class ConnectionManager {
@@ -29,8 +30,19 @@ export class ConnectionManager {
     clientFactory;
     shouldReuse;
     logTag;
+    stoppers;
     /** Callback when a connection is lost — cleared from slot map. */
     onConnectionLost;
+    /**
+     * 协议停止通道工厂（design §3.3）：连接建立后按 pid 登记到 AgentStopperRegistry，
+     * 供 Terminator 在**优雅**停止时回调（win32 上没有可拦截的 SIGTERM，只能靠
+     * 协议通道让 agent 自己收摊）。返回 undefined = 该协议无通道。
+     *
+     * 做成「构造后赋值的字段」而不是构造选项：kimi/opencode 的 manager 建在
+     * `super(...)` 的实参里，那时 `this` 尚不可用，runner 无法把
+     * cancelCurrentTurn 塞进选项——只能等 super() 返回后赋值。
+     */
+    stopper;
     constructor(opts) {
         this.binary = opts.binary;
         this.buildArgs = opts.buildArgs ?? (() => opts.args ?? []);
@@ -47,6 +59,7 @@ export class ConnectionManager {
                 }, ctx.requestTimeoutMs, this.initializeParams));
         this.shouldReuse = opts.shouldReuse ?? (({ client }) => client.ready && client.healthy);
         this.logTag = opts.logTag ?? 'jsonrpc-connection-manager';
+        this.stoppers = opts.stoppers ?? agentStopperRegistry;
     }
     /**
      * Acquire a connection for the given workspace.
@@ -142,8 +155,13 @@ export class ConnectionManager {
     }
     /**
      * Notify that the workspace is idle — arm the idle timer.
+     *
+     * `idleTtlMs: 0` = 不回收（与 claude 会话层的 `armIdleTimer` 同口径；按 0
+     * setTimeout 会秒删刚建好的连接，等于每条消息重起一次进程）。
      */
     notifyIdle(workspace) {
+        if (this.idleTtlMs <= 0)
+            return;
         const slot = this.slots.get(workspace);
         if (slot) {
             this.clearIdleTimer(slot);
@@ -157,13 +175,21 @@ export class ConnectionManager {
     // Internal
     // =========================================================================
     async createClient(workspace, req) {
+        let client = null;
         const transport = new JsonlRpcTransport({
             binary: this.binary,
             args: this.buildArgs(req),
             cwd: workspace,
             env: this.env,
+            stoppers: this.stoppers,
+            // 通道工厂要拿到**连接本身**：协议取消（codex turn/interrupt、ACP
+            // session/cancel）必须发在这条连接上，不能借 runner 的共享状态——那会
+            // 打断另一 workspace 正在跑的 turn。工厂是在 transport.start() 内侧调用
+            // 的，那时 client 已由下面的 clientFactory 赋好。
+            stopper: this.stopper
+                ? (pid) => this.stopper?.({ pid, client: client })
+                : undefined,
         });
-        let client = null;
         client = this.clientFactory({
             transport,
             requestTimeoutMs: this.requestTimeoutMs,

package/dist/runner/common/jsonrpc/transport.d.ts

@@ -6,6 +6,8 @@
  * each line on stdout is a JSON message from the server; each `write()`
  * sends a JSON line to stdin.
  */
+import { type Terminator } from '../../../platform/terminator.js';
+import { AgentStopperRegistry, type AgentStopper } from '../../../platform/agent-stopper.js';
 export interface TransportEvents {
     onMessage(msg: unknown): void;
     onClose(reason: string): void;
@@ -14,11 +16,17 @@ export declare class JsonlRpcTransport {
     private proc;
     private _closed;
     private events;
-    private stopper;
+    private terminator;
     private readonly binary;
     private readonly args;
     private readonly cwd;
     private readonly env;
+    /** 协议停止通道查找键（与 Terminator 用的 agent key 同一来源，见构造函数）。 */
+    private readonly agent;
+    private readonly stoppers;
+    private readonly stopperFactory?;
+    /** 已登记的通道（agent+pid 键）；null = 本连接没有可用通道或已注销。 */
+    private registration;
     /** JSON lines buffered while stdin is under backpressure (bounded by callers). */
     private writeQueue;
     private flushing;
@@ -29,7 +37,20 @@ export declare class JsonlRpcTransport {
         args: string[];
         cwd: string;
         env?: Record<string, string | undefined>;
+        /** win32 查协议停止通道用的 agent key；缺省取 binary 名（'kimi'/'codex'/…） */
+        agent?: string;
+        /** 终止器注入（测试用）；默认按平台建实现 */
+        terminator?: Terminator;
+        /**
+         * 协议停止通道工厂（design §3.3）：spawn 成功后按 pid 建通道并登记到
+         * AgentStopperRegistry，进程退出/关闭时注销。返回 undefined = 无通道。
+         */
+        stopper?: (pid: number) => AgentStopper | undefined;
+        /** 协议通道注册表注入（测试隔离）；默认进程级单例 */
+        stoppers?: AgentStopperRegistry;
     });
+    /** 子进程 pid（spawn 前/退出后为 undefined）；供测试与连接层按 pid 定位。 */
+    get pid(): number | undefined;
     get closed(): boolean;
     /**
      * Spawn the child process and start reading its stdout.
@@ -48,5 +69,12 @@ export declare class JsonlRpcTransport {
      * Idempotent — safe to call multiple times.
      */
     close(): Promise<void>;
+    /**
+     * 按 pid 登记协议停止通道（工厂返回 undefined = 该 agent 无通道）。
+     * pid 是归属键：同一 agent 的多条长驻连接各有自己的通道，不能互相顶替。
+     */
+    private registerStopper;
+    /** 注销自己登记的那条通道（幂等；带身份校验，防误删同 pid 上的新通道）。 */
+    private unregisterStopper;
     private handleClose;
 }