iac-code 0.15.0__tar.gz → 0.16.0__tar.gz

{iac_code-0.15.0 → iac_code-0.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: iac_code
-Version: 0.15.0
+Version: 0.16.0
 Summary: Your AI-powered Infrastructure as Code assistant
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
@@ -114,6 +114,13 @@ By default it opens `http://127.0.0.1:8766` in your browser (loopback only). See
   <img src="https://raw.githubusercontent.com/aliyun/iac-code/main/website/static/img/screenshots/iac-code-web-en.jpg" alt="IaC Code Web app" width="100%">
 </p>
 
+### Agent Skill
+
+Add IaC Code to a compatible agent to plan cloud architectures, work with ROS or Terraform templates, estimate costs,
+operate stacks, and deploy Alibaba Cloud resources from the agent conversation. Download the
+[latest stable Skill package](https://ros-public-tools.oss-cn-beijing.aliyuncs.com/github-releases/aliyun/iac-code/skill/stable/iac-code-skill.zip)
+or compare the distributions in [Official IaC Code Skills](https://aliyun.github.io/iac-code/docs/a2a/skill-overview).
+
 ## Contributing
 
 Install [uv](https://docs.astral.sh/uv/getting-started/installation/), then:

{iac_code-0.15.0 → iac_code-0.16.0}/README.md

@@ -96,6 +96,13 @@ By default it opens `http://127.0.0.1:8766` in your browser (loopback only). See
   <img src="website/static/img/screenshots/iac-code-web-en.jpg" alt="IaC Code Web app" width="100%">
 </p>
 
+### Agent Skill
+
+Add IaC Code to a compatible agent to plan cloud architectures, work with ROS or Terraform templates, estimate costs,
+operate stacks, and deploy Alibaba Cloud resources from the agent conversation. Download the
+[latest stable Skill package](https://ros-public-tools.oss-cn-beijing.aliyuncs.com/github-releases/aliyun/iac-code/skill/stable/iac-code-skill.zip)
+or compare the distributions in [Official IaC Code Skills](https://aliyun.github.io/iac-code/docs/a2a/skill-overview).
+
 ## Contributing
 
 Install [uv](https://docs.astral.sh/uv/getting-started/installation/), then:

{iac_code-0.15.0 → iac_code-0.16.0}/pyproject.toml

@@ -127,6 +127,8 @@ version = {attr = "iac_code.__version__"}
     "**/*.png",
     "**/*.svg",
     "**/*.LICENSE",
+    "**/*.NOTICE",
+    "**/*THIRD_PARTY_NOTICES",
     "**/*.rego",
     "**/*.mo",
     "**/*.po",
@@ -154,6 +156,7 @@ default = true
 timeout = 30
 markers = [
     "integration: process-level integration tests that use local services only",
+    "resource_selector_live: explicit read-only Alibaba Cloud selector API contract smoke tests",
 ]
 
 [tool.coverage.run]

{iac_code-0.15.0 → iac_code-0.16.0}/setup.py

@@ -88,6 +88,8 @@ PACKAGE_DATA = {
         "**/*.js",
         "**/*.svg",
         "**/*.LICENSE",
+        "**/*.NOTICE",
+        "**/*THIRD_PARTY_NOTICES",
         "**/*.mo",
         "**/*.po",
     ],

iac_code-0.16.0/src/iac_code/__init__.py

@@ -0,0 +1,2 @@
+__version__ = "0.16.0"
+__release_date__ = "2026-09-17"

{iac_code-0.15.0 → iac_code-0.16.0}/src/iac_code/a2a/agent_card.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import os
 from typing import Any
 
 from a2a.server.request_handlers.response_helpers import agent_card_to_dict
@@ -29,11 +30,18 @@ from iac_code.a2a.pipeline_outbound import (
 from iac_code.a2a.signing import sign_agent_card_dict
 from iac_code.i18n import _
 from iac_code.pipeline.config import RunMode, get_run_mode
+from iac_code.resource_selector.capability import (
+    A2A_RESOURCE_SELECTOR_ENV,
+    RESOURCE_SELECTOR_EXTENSION_URI,
+    env_enabled,
+)
 
 IAC_CODE_ARTIFACT_METADATA_EXTENSION_URI = "urn:iac-code:a2a:artifact-metadata:v1"
+IAC_CODE_EXECUTION_CONTROL_EXTENSION_URI = "urn:iac-code:a2a:execution-control:v1"
 IAC_CODE_PIPELINE_EVENTS_EXTENSION_URI = PIPELINE_EVENTS_EXTENSION_URI
 IAC_CODE_THINKING_EXPOSURE_EXTENSION_URI = "urn:iac-code:a2a:thinking-exposure:v1"
 CANONICAL_CALLER_EXTENSION_URIS = {
+    IAC_CODE_EXECUTION_CONTROL_EXTENSION_URI,
     IAC_CODE_PIPELINE_EVENTS_EXTENSION_URI,
 }
 
@@ -167,6 +175,56 @@ def build_agent_card(
             required=False,
         )
     )
+    if env_enabled(os.environ.get(A2A_RESOURCE_SELECTOR_ENV)):
+        resource_selector_extension = AgentExtension(
+            uri=RESOURCE_SELECTOR_EXTENSION_URI,
+            description="Select one Alibaba Cloud resource or one derived value through a compatible ROS frontend.",
+            required=False,
+        )
+        ParseDict(
+            {
+                "schemaVersion": 1,
+                "singleSelection": True,
+                "derivedValue": True,
+                "queryMode": "ros_api_json",
+            },
+            resource_selector_extension.params,
+        )
+        card.capabilities.extensions.append(resource_selector_extension)
+    has_http_extension_surface = any(
+        interface.url.startswith(("http://", "https://"))
+        and interface.protocol_binding.upper() in {"JSONRPC", "HTTP+JSON"}
+        for interface in interfaces
+    )
+    if has_http_extension_surface:
+        execution_control_extension = AgentExtension(
+            uri=IAC_CODE_EXECUTION_CONTROL_EXTENSION_URI,
+            description="Control and recover a live iac-code A2A execution during sandbox reconnects.",
+            required=False,
+        )
+        ParseDict(
+            {
+                "schemaVersion": "1.0",
+                "pauseEndpoint": "/iac-code/execution/pause",
+                "stateEndpoint": "/iac-code/execution/state",
+                "resumeEndpoint": "/iac-code/execution/resume",
+                "terminateEndpoint": "/iac-code/execution/terminate",
+                "sessionRecoveryEndpoint": "/iac-code/session/recovery",
+                "phases": [
+                    "running",
+                    "pausing",
+                    "pause_committing",
+                    "paused",
+                    "resuming",
+                    "terminating",
+                    "terminated",
+                ],
+                "toolBatchDrainOnPause": True,
+                "transportScope": "http",
+            },
+            execution_control_extension.params,
+        )
+        card.capabilities.extensions.append(execution_control_extension)
     if thinking_exposure_types is not None:
         enabled_types = format_a2a_exposure_types(thinking_exposure_types)
         if enabled_types:

{iac_code-0.15.0 → iac_code-0.16.0}/src/iac_code/a2a/app.py

@@ -20,6 +20,7 @@ from a2a.auth.user import User
 from a2a.server.context import ServerCallContext
 from a2a.server.routes import create_jsonrpc_routes, create_rest_routes
 from a2a.utils.constants import AGENT_CARD_WELL_KNOWN_PATH
+from google.protobuf.json_format import MessageToDict
 from starlette.applications import Starlette
 from starlette.authentication import AuthCredentials, SimpleUser
 from starlette.middleware.base import BaseHTTPMiddleware
@@ -29,6 +30,7 @@ from starlette.routing import BaseRoute, Route
 
 from iac_code import __version__
 from iac_code.a2a.agent_card import agent_card_to_client_dict
+from iac_code.a2a.execution_control import ExecutionControlConflictError, ExecutionControlNotFoundError
 from iac_code.a2a.jsonrpc_passthrough import (
     install_jsonrpc_error_data_passthrough,
     install_v03_jsonrpc_error_data_passthrough,
@@ -557,6 +559,9 @@ def create_app(
         if parse_error is not None:
             return JSONResponse({"error": parse_error}, status_code=400)
         lean = _parse_lean(request.query_params.get("lean"))
+        include_snapshot = _parse_include_snapshot(request.query_params.get("includeSnapshot"))
+        if not include_snapshot and after_sequence is None:
+            return JSONResponse({"error": _("afterSequence must be a non-negative integer")}, status_code=400)
 
         call_context = _call_context_from_request(request)
         try:
@@ -580,7 +585,178 @@ def create_app(
             task_id=task_id,
         )
         # 先裁掉不发给客户端的字段，再投影：既少发一大半字节，也少一大半要脱敏的字符串
-        return JSONResponse(project_a2a_data(client_pipeline_state(state, lean=lean), public_path_roots=roots))
+        return JSONResponse(
+            project_a2a_data(
+                client_pipeline_state(
+                    state,
+                    lean=lean,
+                    include_snapshot=include_snapshot,
+                    after_sequence=after_sequence,
+                ),
+                public_path_roots=roots,
+            )
+        )
+
+    def execution_owner(request: Request) -> str:
+        return components.task_store.owner_for_context(_call_context_from_request(request))
+
+    async def execution_control_from_request(request: Request, context_id: str):
+        service = components.execution_control_service
+        if service is None:
+            raise ExecutionControlNotFoundError("Execution control is unavailable")
+        return await service.require(
+            context_id=validate_protocol_id(context_id),
+            owner=execution_owner(request),
+        )
+
+    async def execution_error_response(exc: Exception) -> JSONResponse:
+        if isinstance(exc, ExecutionControlNotFoundError):
+            return JSONResponse({"error": str(exc)}, status_code=404)
+        if isinstance(exc, ExecutionControlConflictError):
+            return JSONResponse({"error": str(exc)}, status_code=409)
+        if isinstance(exc, (TypeError, ValueError)):
+            return JSONResponse({"error": "Invalid execution control request."}, status_code=400)
+        logger.exception("A2A execution control request failed")
+        return JSONResponse({"error": "Execution control is unavailable."}, status_code=503)
+
+    async def read_control_payload(request: Request) -> dict[str, Any]:
+        payload = await request.json()
+        if not isinstance(payload, dict):
+            raise ValueError("payload must be an object")
+        return payload
+
+    def required_string(payload: dict[str, Any], name: str) -> str:
+        value = payload.get(name)
+        if not isinstance(value, str) or not value:
+            raise ValueError(f"{name} is required")
+        return value
+
+    def required_epoch(payload: dict[str, Any]) -> int:
+        value = payload.get("connectionEpoch")
+        if isinstance(value, bool) or not isinstance(value, int):
+            raise ValueError("connectionEpoch is required")
+        return value
+
+    async def pause_execution(request: Request) -> JSONResponse:
+        try:
+            payload = await read_control_payload(request)
+            context_id = required_string(payload, "contextId")
+            control = await execution_control_from_request(request, context_id)
+            timeout = payload.get("reconnectTimeoutSeconds", 300)
+            if isinstance(timeout, bool) or not isinstance(timeout, (int, float)):
+                raise ValueError("invalid reconnect timeout")
+            state = await control.pause(
+                task_id=validate_protocol_id(required_string(payload, "taskId")),
+                expected_execution_id=validate_protocol_id(required_string(payload, "expectedExecutionId")),
+                request_id=validate_protocol_id(required_string(payload, "requestId")),
+                connection_epoch=required_epoch(payload),
+                reason=required_string(payload, "reason"),
+                reconnect_timeout_seconds=float(timeout),
+            )
+            return JSONResponse(state, status_code=200 if state["phase"] == "paused" else 202)
+        except Exception as exc:
+            return await execution_error_response(exc)
+
+    async def get_execution_state(request: Request) -> JSONResponse:
+        try:
+            context_id = request.query_params.get("contextId")
+            if not context_id:
+                raise ValueError("contextId is required")
+            control = await execution_control_from_request(request, context_id)
+            expected_execution_id = request.query_params.get("executionId")
+            pause_id = request.query_params.get("pauseId")
+            if expected_execution_id is not None and expected_execution_id != control.execution_id:
+                raise ExecutionControlConflictError("executionId does not identify the current execution")
+            if pause_id is not None and pause_id != control.pause_id:
+                raise ExecutionControlConflictError("pauseId does not identify the current pause")
+            return JSONResponse(control.snapshot())
+        except Exception as exc:
+            return await execution_error_response(exc)
+
+    async def resume_execution(request: Request) -> JSONResponse:
+        try:
+            payload = await read_control_payload(request)
+            context_id = required_string(payload, "contextId")
+            control = await execution_control_from_request(request, context_id)
+            state = await control.resume(
+                execution_id=validate_protocol_id(required_string(payload, "executionId")),
+                pause_id=validate_protocol_id(required_string(payload, "pauseId")),
+                request_id=validate_protocol_id(required_string(payload, "requestId")),
+                connection_epoch=required_epoch(payload),
+            )
+            return JSONResponse(state, status_code=200 if state["phase"] == "running" else 202)
+        except Exception as exc:
+            return await execution_error_response(exc)
+
+    async def terminate_execution(request: Request) -> JSONResponse:
+        try:
+            payload = await read_control_payload(request)
+            context_id = required_string(payload, "contextId")
+            control = await execution_control_from_request(request, context_id)
+            reason = payload.get("reason", "explicit_terminate")
+            if not isinstance(reason, str) or not reason:
+                raise ValueError("reason must be a non-empty string")
+            pause_id = payload.get("pauseId")
+            if pause_id is not None:
+                if not isinstance(pause_id, str) or not pause_id:
+                    raise ValueError("pauseId must be a non-empty string")
+                pause_id = validate_protocol_id(pause_id)
+            state = await control.terminate(
+                execution_id=validate_protocol_id(required_string(payload, "expectedExecutionId")),
+                request_id=validate_protocol_id(required_string(payload, "requestId")),
+                connection_epoch=required_epoch(payload),
+                reason=reason,
+                pause_id=pause_id,
+            )
+            return JSONResponse(state, status_code=200 if state["phase"] == "terminated" else 202)
+        except Exception as exc:
+            return await execution_error_response(exc)
+
+    async def get_session_recovery(request: Request) -> JSONResponse:
+        try:
+            context_id = request.query_params.get("contextId")
+            execution_id = request.query_params.get("executionId")
+            if not context_id or not execution_id:
+                raise ValueError("contextId and executionId are required")
+            control = await execution_control_from_request(request, context_id)
+            if execution_id != control.execution_id:
+                raise ExecutionControlConflictError("executionId does not identify the current execution")
+            task_id = control.task_id
+            context_record = await components.task_store.get_context_record(context_id)
+            session_id = context_record.session_id
+            task_record = await components.task_store.get_task_record(task_id)
+            task = await components.task_store.get(task_id, _call_context_from_request(request))
+            if task is None:
+                raise ExecutionControlNotFoundError("Execution was not found")
+            messages = await asyncio.to_thread(SessionStorage().load, context_record.cwd, session_id)
+            roots = await recovery_path_roots(context_id=context_id, task_id=task_id)
+            current_context = await components.task_store.get_context_record(context_id)
+            service = components.execution_control_service
+            current_control = service.get_for_context(context_id) if service is not None else None
+            if (
+                current_control is not control
+                or control.execution_id != execution_id
+                or control.task_id != task_id
+                or current_context.session_id != session_id
+                or current_context.cwd != context_record.cwd
+            ):
+                raise ExecutionControlConflictError("executionId does not identify the current execution")
+            # No awaits after identity validation: rollover must not mix a new
+            # execution's control with the task/messages read above.
+            recovery = {
+                "contextId": context_id,
+                "taskId": task_id,
+                "executionId": execution_id,
+                "revision": control.revision,
+                "executionStatus": task_record.state,
+                "outputText": list(task_record.output_text),
+                "task": MessageToDict(task, preserving_proto_field_name=False),
+                "messages": [message.to_dict() for message in messages],
+                "executionControl": control.snapshot(),
+            }
+            return JSONResponse(project_a2a_data(recovery, public_path_roots=roots))
+        except Exception as exc:
+            return await execution_error_response(exc)
 
     routes: list[BaseRoute] = [
         Route("/health", health, methods=["GET"]),
@@ -588,6 +764,11 @@ def create_app(
         Route("/iac-code/readiness", get_readiness, methods=["GET"]),
         Route("/iac-code/session/ensure-restored", ensure_session_restored, methods=["POST"]),
         Route("/iac-code/pipeline/state", get_pipeline_state, methods=["GET"]),
+        Route("/iac-code/execution/pause", pause_execution, methods=["POST"]),
+        Route("/iac-code/execution/state", get_execution_state, methods=["GET"]),
+        Route("/iac-code/execution/resume", resume_execution, methods=["POST"]),
+        Route("/iac-code/execution/terminate", terminate_execution, methods=["POST"]),
+        Route("/iac-code/session/recovery", get_session_recovery, methods=["GET"]),
     ]
     install_jsonrpc_error_data_passthrough()
     jsonrpc_endpoint = create_jsonrpc_routes(components.handler, rpc_url="/", enable_v0_3_compat=True)[0].endpoint
@@ -600,6 +781,7 @@ def create_app(
     routes.append(Route("/", handle_jsonrpc, methods=["POST"]))
     routes.extend(create_rest_routes(components.handler, enable_v0_3_compat=True))
     app = Starlette(routes=routes, lifespan=lifespan)
+    app.state.a2a_components = components
     app.add_middleware(A2AProjectionMiddleware, task_store=components.task_store)
     app.add_middleware(
         A2AAuthMiddleware,
@@ -643,6 +825,19 @@ def _parse_lean(value: str | None) -> bool:
     return False
 
 
+def _parse_include_snapshot(value: str | None) -> bool:
+    """Default to the compatible full response unless omission is explicit."""
+
+    if value is None or value == "":
+        return True
+    normalized = value.strip().lower()
+    if normalized in {"0", "false"}:
+        return False
+    if normalized not in _LEAN_TRUTHY_VALUES:
+        logger.warning("Ignoring unrecognized pipeline state includeSnapshot value %r", value)
+    return True
+
+
 def _parse_after_sequence(value: str | None) -> tuple[int | None, str | None]:
     if value is None or value == "":
         return None, None

{iac_code-0.15.0 → iac_code-0.16.0}/src/iac_code/a2a/backup.py

@@ -1,24 +1,64 @@
 from __future__ import annotations
 
 import asyncio
-import contextlib
+import inspect
 import logging
-from collections.abc import Callable
-from typing import Any
+from collections.abc import Awaitable, Callable
+from typing import Any, ParamSpec, TypeVar, cast
 
 from iac_code.i18n import _
 from iac_code.services.session_backup import BackupReason, SessionBackupBlocked
 from iac_code.services.session_backup_state import BackupPublicationProof
 
 logger = logging.getLogger(__name__)
+_P = ParamSpec("_P")
+_T = TypeVar("_T")
 
 
-async def run_sync_fenced(function: Callable[..., Any], /, *args: Any, **kwargs: Any) -> Any:
+async def await_fenced(awaitable: Awaitable[_T]) -> _T:
+    """Finish an owned cleanup/commit before propagating cancellation to its caller."""
+    task = asyncio.ensure_future(awaitable)
+    try:
+        return await asyncio.shield(task)
+    except asyncio.CancelledError:
+        while not task.done():
+            try:
+                await asyncio.shield(task)
+            except asyncio.CancelledError:
+                continue
+            except Exception:
+                break
+        if not task.cancelled():
+            task.exception()
+        raise
+
+
+async def run_sync_fenced(function: Callable[_P, _T], /, *args: _P.args, **kwargs: _P.kwargs) -> _T:
     """Delay coroutine cancellation until the synchronous mutation has actually stopped."""
+    return await _run_sync_fenced(function, None, args, kwargs)
+
+
+async def run_sync_fenced_with_cancel_completion(
+    function: Callable[_P, _T],
+    on_cancel_completion: Callable[[_T | None, BaseException | None], Awaitable[None] | None],
+    /,
+    *args: _P.args,
+    **kwargs: _P.kwargs,
+) -> _T:
+    """Fence a synchronous mutation and save its late result before propagating cancellation."""
+    return cast(_T, await _run_sync_fenced(function, on_cancel_completion, args, kwargs))
+
+
+async def _run_sync_fenced(
+    function: Callable[..., _T],
+    on_cancel_completion: Callable[[_T | None, BaseException | None], Awaitable[None] | None] | None,
+    args: tuple[Any, ...],
+    kwargs: dict[str, Any],
+) -> _T:
     thread_task = asyncio.create_task(asyncio.to_thread(function, *args, **kwargs))
     try:
         return await asyncio.shield(thread_task)
-    except asyncio.CancelledError:
+    except asyncio.CancelledError as cancellation:
         while not thread_task.done():
             try:
                 await asyncio.shield(thread_task)
@@ -26,10 +66,27 @@ async def run_sync_fenced(function: Callable[..., Any], /, *args: Any, **kwargs:
                 continue
             except Exception:
                 break
+        result: _T | None = None
+        error: BaseException | None = None
         if thread_task.done() and not thread_task.cancelled():
-            with contextlib.suppress(Exception):
-                thread_task.result()
-        raise
+            try:
+                result = thread_task.result()
+            except BaseException as exc:
+                error = exc
+        if on_cancel_completion is not None:
+            try:
+                completion = on_cancel_completion(result, error)
+                if inspect.isawaitable(completion):
+                    completion_task = asyncio.ensure_future(completion)
+                    while not completion_task.done():
+                        try:
+                            await asyncio.shield(completion_task)
+                        except asyncio.CancelledError:
+                            continue
+                    completion_task.result()
+            except BaseException:
+                logger.exception("Failed to record a synchronous mutation result returned during cancellation")
+        raise cancellation
 
 
 async def backup_session_async(

{iac_code-0.15.0 → iac_code-0.16.0}/src/iac_code/a2a/client.py

@@ -108,6 +108,14 @@ def _extract_parts_text(message: Any) -> str:
     return "".join(pieces)
 
 
+def _validated_extension_response(response: Any, name: str) -> dict[str, Any]:
+    response.raise_for_status()
+    data = response.json()
+    if not isinstance(data, dict):
+        raise ValueError(f"A2A {name} response must be a JSON object")
+    return data
+
+
 class A2AClient:
     def __init__(
         self,
@@ -306,11 +314,16 @@ class A2AClient:
         *,
         task_id: str,
         after_sequence: int | None = None,
+        include_snapshot: bool = True,
     ) -> dict[str, Any] | None:
-        """Read iac-code's existing A2A pipeline recovery extension over HTTP."""
+        """Read an A2A pipeline snapshot or a cursor-based event delta over HTTP."""
 
+        if not include_snapshot and after_sequence is None:
+            raise ValueError("after_sequence is required when include_snapshot is False")
         endpoint = url.rstrip("/") + "/iac-code/pipeline/state"
         params = _without_none({"taskId": task_id, "afterSequence": after_sequence})
+        if not include_snapshot:
+            params["includeSnapshot"] = "false"
         response = await self._http_client.get(endpoint, params=params, headers=self._jsonrpc_headers())
         if response.status_code == 404:
             return None
@@ -358,6 +371,127 @@ class A2AClient:
             raise ValueError("A2A session restore response must report a ready session")
         return True
 
+    async def pause_execution(
+        self,
+        url: str,
+        *,
+        context_id: str,
+        task_id: str,
+        execution_id: str,
+        request_id: str,
+        connection_epoch: int,
+        reason: str = "client_disconnected",
+        reconnect_timeout_seconds: float = 300,
+    ) -> dict[str, Any]:
+        return await self._execution_control_post(
+            url,
+            "pause",
+            {
+                "contextId": context_id,
+                "taskId": task_id,
+                "expectedExecutionId": execution_id,
+                "requestId": request_id,
+                "connectionEpoch": connection_epoch,
+                "reason": reason,
+                "reconnectTimeoutSeconds": reconnect_timeout_seconds,
+            },
+        )
+
+    async def get_execution_state(
+        self,
+        url: str,
+        *,
+        context_id: str,
+        execution_id: str | None = None,
+        pause_id: str | None = None,
+    ) -> dict[str, Any]:
+        endpoint = url.rstrip("/") + "/iac-code/execution/state"
+        response = await self._http_client.get(
+            endpoint,
+            params=_without_none(
+                {
+                    "contextId": context_id,
+                    "executionId": execution_id,
+                    "pauseId": pause_id,
+                }
+            ),
+            headers=self._jsonrpc_headers(),
+        )
+        return _validated_extension_response(response, "execution state")
+
+    async def resume_execution(
+        self,
+        url: str,
+        *,
+        context_id: str,
+        execution_id: str,
+        pause_id: str,
+        request_id: str,
+        connection_epoch: int,
+    ) -> dict[str, Any]:
+        return await self._execution_control_post(
+            url,
+            "resume",
+            {
+                "contextId": context_id,
+                "executionId": execution_id,
+                "pauseId": pause_id,
+                "requestId": request_id,
+                "connectionEpoch": connection_epoch,
+            },
+        )
+
+    async def terminate_execution(
+        self,
+        url: str,
+        *,
+        context_id: str,
+        execution_id: str,
+        request_id: str,
+        connection_epoch: int,
+        reason: str = "explicit_terminate",
+        pause_id: str | None = None,
+    ) -> dict[str, Any]:
+        return await self._execution_control_post(
+            url,
+            "terminate",
+            _without_none(
+                {
+                    "contextId": context_id,
+                    "expectedExecutionId": execution_id,
+                    "requestId": request_id,
+                    "connectionEpoch": connection_epoch,
+                    "reason": reason,
+                    "pauseId": pause_id,
+                }
+            ),
+        )
+
+    async def get_session_recovery(
+        self,
+        url: str,
+        *,
+        context_id: str,
+        execution_id: str,
+    ) -> dict[str, Any]:
+        endpoint = url.rstrip("/") + "/iac-code/session/recovery"
+        response = await self._http_client.get(
+            endpoint,
+            params={"contextId": context_id, "executionId": execution_id},
+            headers=self._jsonrpc_headers(),
+        )
+        return _validated_extension_response(response, "session recovery")
+
+    async def _execution_control_post(
+        self,
+        url: str,
+        action: str,
+        payload: dict[str, Any],
+    ) -> dict[str, Any]:
+        endpoint = url.rstrip("/") + f"/iac-code/execution/{action}"
+        response = await self._http_client.post(endpoint, json=payload, headers=self._jsonrpc_headers())
+        return _validated_extension_response(response, f"execution {action}")
+
     async def list_tasks(
         self,
         url: str,