Currently, `package.json` allows zod version `3.x`. But
`agentclientprotocol/sdk` and our code use explicit `zod/v4` imports.
But `v4` became a proper ES module only in `4.x`. Before that, it was
just a directory. So if a user has zod 3.x, running this ACP server will
fail with `ERR_UNSUPPORTED_DIR_IMPORT`.
## Summary
- keep the standard latest-turn ACP fork behavior
- accept an optional AIR fork point at `_meta.jetbrains.air.fork`
- translate the ACP `messageId` to the Claude transcript UUID
- use the current Agent SDK `forkSession(..., { upToMessageId })` API
- resume the new SDK session with the same working directory and
additional directories
No Agent SDK dependency update is required. Version `0.3.238` already
provides the required API.
## Tests
- `npm run build`
- `npm run lint`
- `env -u ANTHROPIC_BASE_URL npm run test:run` — 981 passed, 27 skipped
## Summary
- negotiate native ACP subagent sessions and AIR async task support
- map Claude Agent/Task lifecycle to independent child session streams
- publish background workflow, monitor, MCP, and backgrounded shell work
as async tasks
- attach background shell tasks to their originating tool calls so
clients can update one command card and open its output log
- stream task progress and preserve running, paused, completed, failed,
and stopped states
- keep synchronous shell work, generic tools, and task notifications out
of user message chunks
- preserve typed session failures and root permission/elicitation
requests
- preserve the legacy generic Agent/Task representation and flattened
transcript opt-ins for clients without native subagent capability
## Compatibility
The published ACP SDK does not yet contain PR #1992 types, so the change
isolates the temporary structural cast in `src/acp-subagents.ts`.
Clients that do not negotiate native subagent sessions retain the
existing generic tool-call fallback, including the historical
`_meta["subagent-transcript"]` capability and `forwardSubagentText`
session option. Async tasks use the negotiated `asyncTasks` AIR
capability and remain invisible to clients that do not advertise it.
Claude does not expose a safe targeted child-cancel primitive, therefore
child `cancel` and `close` capabilities remain disabled.
## Validation
- `npm run check`
- `npm run build`
- `env -u ANTHROPIC_BASE_URL npm run test:run` (830 passed, 20 skipped)
- `npm run test:run -- src/tests/async-tasks.test.ts` (5 passed)
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
## Problem
The ACP steering extension injects follow-up user messages into a
running Claude SDK turn. Until now, every injected message used priority
`now`. That is normally desirable because it makes Claude react
immediately, but `now` is interrupting delivery: the SDK aborts the
currently running cycle before processing the new message.
This becomes unsafe while the SDK is blocked in a user-input callback,
such as a permission request or elicitation. Interrupting that cycle
makes the SDK send `$/cancel_request` for the pending ACP request. The
client then removes the permission/elicitation card before the user can
answer it. Depending on timing, the original ACP prompt can remain
pending because the callback and interrupted cycle no longer complete
through their normal lifecycle.
The failure sequence was:
1. Claude requests permission or opens an elicitation.
2. The ACP client displays a user-input card and waits for an answer.
3. The user sends a steering message while that card is still open.
4. The adapter injects the message with priority `now`.
5. The Claude SDK interrupts the cycle and emits `$/cancel_request` for
the open card.
6. The card disappears, and the original prompt may be left waiting
indefinitely.
## Fix
Track the number of permission/elicitation requests currently awaiting
user input for each session. Steering now selects its internal SDK
delivery priority as follows:
- `later` while at least one user-input request is pending, so the
steering message is queued without interrupting or cancelling the open
request;
- `now` at all other times, preserving the existing immediate steering
behavior.
The state is a counter rather than a boolean because multiple background
subagents can have concurrent permission requests. The `finally` cleanup
keeps the count correct for accepted, declined, cancelled, aborted, and
failed requests.
All ACP-backed user-input paths are covered:
- regular tool permission requests;
- the built-in `AskUserQuestion` form elicitation;
- MCP form/URL elicitations;
- refusal-fallback user dialogs.
## Regression coverage
Added parameterized tests that hold each user-input path open, inject a
steering message, and verify that the SDK message uses priority `later`.
The existing steering regression test continues to verify priority `now`
when no user input is pending. The tests also verify that the
pending-user-input state is cleared after the request settles.
Fixes IJAI-1191.
## Validation
- `npm run check`
- `npm run build`
- `env -u ANTHROPIC_BASE_URL npm run test:run` — 975 passed, 27 skipped
`ANTHROPIC_BASE_URL` was removed only for the test command because the
Codex environment injects a local proxy URL, while four provider tests
intentionally assert the native `https://api.anthropic.com` default.
## Summary
- translate Claude SDK permission suggestions and tool-specific
decisions into ACP v1 presentation and editable option metadata
- align Claude session permission modes and clear-context plan handling
- split permission effects, modes, normalization, option construction,
presentation, and response handling into focused modules
- document the permission extension and add unit plus live-audit
coverage for native edge cases
## Tests
- `npm run check`
- `npm run build`
- `env -u ANTHROPIC_BASE_URL npm run test:run` (931 passed, 27 skipped)
Bumps the minor group with 6 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.232` | `0.3.233` |
| [@tsconfig/node22](https://github.com/tsconfig/bases/tree/HEAD/bases)
| `22.0.5` | `22.0.6` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.0` |
`2.1.1` |
| [@tsconfig/node10](https://github.com/tsconfig/bases/tree/HEAD/bases)
| `1.0.12` | `1.0.13` |
| [es-module-lexer](https://github.com/guybedford/es-module-lexer) |
`2.3.1` | `2.3.2` |
| [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.9` |
Updates `@anthropic-ai/claude-agent-sdk` from 0.3.232 to 0.3.233
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.233</h2>
<h2>What's changed</h2>
<ul>
<li>Notification hooks now fire for pending permission prompts on the
SDK path, matching the interactive REPL behavior</li>
<li>Todo/task-tracking tools
(<code>TaskCreate</code>/<code>TaskGet</code>/<code>TaskUpdate</code>/<code>TaskList</code>,
<code>TodoWrite</code>) are no longer in the default tool surface on
Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; name them in
the <code>tools</code> option or reference them in
<code>allowedTools</code> (or set
<code>CLAUDE_CODE_ENABLE_TODO_TOOLS=1</code>) to keep them</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.233
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.233
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.233
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.233
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.233</h2>
<ul>
<li>Notification hooks now fire for pending permission prompts on the
SDK path, matching the interactive REPL behavior</li>
<li>Todo/task-tracking tools
(<code>TaskCreate</code>/<code>TaskGet</code>/<code>TaskUpdate</code>/<code>TaskList</code>,
<code>TodoWrite</code>) are no longer in the default tool surface on
Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; name them in
the <code>tools</code> option or reference them in
<code>allowedTools</code> (or set
<code>CLAUDE_CODE_ENABLE_TODO_TOOLS=1</code>) to keep them</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="73a28abad0"><code>73a28ab</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.232...v0.3.233">compare
view</a></li>
</ul>
</details>
<br />
Updates `@tsconfig/node22` from 22.0.5 to 22.0.6
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/tsconfig/bases/commits/HEAD/bases">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.3.232 to
0.3.233
Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.3.232 to
0.3.233
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.3.232 to
0.3.233
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.3.232
to 0.3.233
Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.3.232 to
0.3.233
Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.3.232 to
0.3.233
Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.3.232 to
0.3.233
Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.3.232 to
0.3.233
Updates `@hono/node-server` from 2.1.0 to 2.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/node-server/releases">@hono/node-server's
releases</a>.</em></p>
<blockquote>
<h2>v2.1.1</h2>
<h2>What's Changed</h2>
<ul>
<li>perf: lazily materialize request headers by <a
href="https://github.com/BlankParticle"><code>@BlankParticle</code></a>
in <a
href="https://redirect.github.com/honojs/node-server/pull/389">honojs/node-server#389</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v2.1.0...v2.1.1">https://github.com/honojs/node-server/compare/v2.1.0...v2.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="73c03adfb0"><code>73c03ad</code></a>
2.1.1</li>
<li><a
href="5515aa0a37"><code>5515aa0</code></a>
perf: lazily materialize request headers (<a
href="https://redirect.github.com/honojs/node-server/issues/389">#389</a>)</li>
<li>See full diff in <a
href="https://github.com/honojs/node-server/compare/v2.1.0...v2.1.1">compare
view</a></li>
</ul>
</details>
<br />
Updates `@tsconfig/node10` from 1.0.12 to 1.0.13
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/tsconfig/bases/commits/HEAD/bases">compare
view</a></li>
</ul>
</details>
<br />
Updates `es-module-lexer` from 2.3.1 to 2.3.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/guybedford/es-module-lexer/releases">es-module-lexer's
releases</a>.</em></p>
<blockquote>
<h2>2.3.2</h2>
<h2>What's Changed</h2>
<ul>
<li>perf(lexer): skip identifier and number runs by <a
href="https://github.com/BridgeAR"><code>@BridgeAR</code></a> in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/227">guybedford/es-module-lexer#227</a></li>
<li>fix: annotate asm.js integer return type by <a
href="https://github.com/Justineo"><code>@Justineo</code></a> in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/230">guybedford/es-module-lexer#230</a></li>
<li>Add side effects to package.json by <a
href="https://github.com/denisx"><code>@denisx</code></a> in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/183">guybedford/es-module-lexer#183</a></li>
<li>fix: forward the sourcename through the pre-init parse path by <a
href="https://github.com/hdimer"><code>@hdimer</code></a> in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/236">guybedford/es-module-lexer#236</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Justineo"><code>@Justineo</code></a>
made their first contribution in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/230">guybedford/es-module-lexer#230</a></li>
<li><a href="https://github.com/denisx"><code>@denisx</code></a> made
their first contribution in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/183">guybedford/es-module-lexer#183</a></li>
<li><a href="https://github.com/hdimer"><code>@hdimer</code></a> made
their first contribution in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/236">guybedford/es-module-lexer#236</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/guybedford/es-module-lexer/compare/2.3.1...2.3.2">https://github.com/guybedford/es-module-lexer/compare/2.3.1...2.3.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="08ee1be867"><code>08ee1be</code></a>
fix: forward the sourcename through the pre-init parse path (<a
href="https://redirect.github.com/guybedford/es-module-lexer/issues/236">#236</a>)</li>
<li><a
href="5a824a13a6"><code>5a824a1</code></a>
Update package.json (<a
href="https://redirect.github.com/guybedford/es-module-lexer/issues/183">#183</a>)</li>
<li><a
href="8274d0331a"><code>8274d03</code></a>
fix: annotate asm.js integer return type (<a
href="https://redirect.github.com/guybedford/es-module-lexer/issues/230">#230</a>)</li>
<li><a
href="2abc49eafc"><code>2abc49e</code></a>
perf(lexer): skip identifier and number runs (<a
href="https://redirect.github.com/guybedford/es-module-lexer/issues/227">#227</a>)</li>
<li>See full diff in <a
href="https://github.com/guybedford/es-module-lexer/compare/2.3.1...2.3.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `jose` from 6.2.8 to 6.2.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/panva/jose/releases">jose's
releases</a>.</em></p>
<blockquote>
<h2>v6.2.9</h2>
<h3>Fixes</h3>
<ul>
<li>reject a JWE whose generated Key Management Parameters collide (<a
href="6ed19a6a97">6ed19a6</a>)</li>
<li><strong>types:</strong> undeprecate PBES2 p2c parameter (<a
href="33bf832986">33bf832</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/panva/jose/blob/main/CHANGELOG.md">jose's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/panva/jose/compare/v6.2.8...v6.2.9">6.2.9</a>
(2026-08-15)</h2>
<h3>Fixes</h3>
<ul>
<li>reject a JWE whose generated Key Management Parameters collide (<a
href="6ed19a6a97">6ed19a6</a>)</li>
<li><strong>types:</strong> undeprecate PBES2 p2c parameter (<a
href="33bf832986">33bf832</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="f3a3c780b9"><code>f3a3c78</code></a>
chore(release): 6.2.9</li>
<li><a
href="33bf832986"><code>33bf832</code></a>
fix(types): undeprecate PBES2 p2c parameter</li>
<li><a
href="6ed19a6a97"><code>6ed19a6</code></a>
fix: reject a JWE whose generated Key Management Parameters collide</li>
<li><a
href="944840d167"><code>944840d</code></a>
ci: use shared release workflows</li>
<li><a
href="05bccf2399"><code>05bccf2</code></a>
chore: bump packages</li>
<li><a
href="f7392d1217"><code>f7392d1</code></a>
test: account for workerd nodejs_compat flag default changes</li>
<li><a
href="4e944be71e"><code>4e944be</code></a>
ci: drop the wait-for-npm machinery</li>
<li><a
href="4285b6f411"><code>4285b6f</code></a>
chore(deps-dev): bump undici</li>
<li><a
href="cb114ecde7"><code>cb114ec</code></a>
chore: cleanup after release</li>
<li>See full diff in <a
href="https://github.com/panva/jose/compare/v6.2.8...v6.2.9">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Claude Code's automatic title generation never runs under the Agent SDK,
so `SDKSessionInfo.summary` degrades to the raw first prompt — meaning
we were publishing up to 256 characters of the user's opening message as
the session title.
This PR asks the SDK for a real title instead. On the first completed
turn we send the `generate_session_title` control request with the
trailing 1000 characters of the session's own user + assistant text,
fired in the background off the `idle` handler so turn-end never waits
on the ~2 s small-model call, and publish the result through the
existing `session_info_update`.
A title is generated once per session, and any title already in the
session file — a user `/rename` or one we generated earlier, which the
SDK folds into the same field — is adopted rather than
overwritten.`persist: true` writes it to the transcript, so
`session/list` and `session/load` show the same name.
The SDK method is undeclared in `sdk.d.ts`, so it's called behind a
`typeof` check and a `try/catch` that degrades to the previous
behaviour.
### Problem
Provider routing is captured when the Claude SDK `Query` is created. As
a result, `providers/set` and `providers/disable` updated newly created
sessions but an already loaded ACP session continued using its previous
backend.
User and project Claude settings could also override the ACP-selected
URL or credentials after the subprocess environment was assembled,
making the configured proxy ineffective.
### Solution
- Serialize provider changes and wait for submitted turns to settle.
- Close and recreate every loaded SDK query with the same Claude session
ID, cwd, MCP configuration, and ACP creation parameters.
- Block new/load/resume/prompt requests only while a provider update is
in progress.
- Apply the active ACP route in both the subprocess environment and
programmatic settings tier.
- Clear competing Anthropic, Bedrock, Vertex, OAuth, API-key, and
`apiKeyHelper` routing while an ACP override is active; preserve
unrelated settings.
- Restore native/environment routing when the provider is disabled.
- Add opt-in routing diagnostics through `CLAUDE_AGENT_LOGS` without
logging request content or secret headers.
### Tests
Added coverage for:
- native behavior when Providers API is unused;
- live recreation of loaded sessions;
- waiting for active turns;
- multiple loaded sessions across native → proxy A → proxy B → native;
- user settings precedence and preservation of unrelated settings;
- Anthropic, Bedrock, Vertex, legacy gateway auth, and logout behavior.
Verification:
- `npm test`: 789 passed, 20 skipped
- `npm run build`
- `npm run check`
- `git diff --check`
---------
Co-authored-by: Junie <junie@jetbrains.com>
## Summary
- negotiate the opt-in AIR `_meta.jetbrains.air.agentFileChangeReport`
capability
- assign a unique `requestId` to each prompt and return canonical,
workspace-bounded changed paths in response metadata
- add a hidden Stop hook and an internal MCP reporting tool so Claude
can report files changed through shell commands, Git operations, and
generators
The audit is best-effort and is inactive unless the client advertises
the capability.
## Safety
- accept reports only for the active session and matching turn request
- canonicalize filesystem aliases, including `/tmp` to `/private/tmp` on
macOS
- reject paths outside the session working directory and deduplicate
valid paths
## Tests
- `npm run test:run`
- `npm run build`
- `npm run check`
## Summary
- align `_meta.jetbrains.air.sessionFailure` with AIR's
transcript-record protocol: `id`, `revision`, broad `category`, explicit
`severity`, `title`, optional `details`, and `actions`
- forward Claude's actual user-facing assistant/result text as `title`;
use adapter-authored fallback text only when Claude provides no message
(transport failure, worker EOF, or an internal invariant)
- reduce categories to `connection`, `access`, `limit`, `request`,
`service`, and `unknown`
- limit suggested actions to `retry`, `login`, and `new_session`
- update one transcript record through `id + revision`, keep resolved
entries in history, and remove clear/tombstone updates
- suppress duplicate assistant failure prose only for clients that
negotiated typed failures; preserve legacy ACP behavior otherwise
- restore synthetic usage-limit failures from session history with their
exact stored Claude text
- document negotiation, delivery carriers, identity/revision behavior,
mappings, recovery, and compatibility in the extension spec
## Validation
- `npm run check`
- `npm run build`
- `npm run test:run` — 777 passed, 26 skipped
- `git diff --check`
## Tracking
[IJAI-993](https://youtrack.jetbrains.com/issue/IJAI-993)
### Summary
- expose one `main` provider slot because Anthropic, Bedrock, and Vertex
routing are mutually exclusive
- advertise all three supported API types on that slot and replace the
active configuration on each `providers/set`
- restore native Claude routing when the slot is disabled
- keep provider headers out of list responses and preserve per-protocol
validation
### Testing
- `npm run test:run` (767 passed, 20 skipped)
- `npm run build`
- `npm run check`
Co-authored-by: Junie <junie@jetbrains.com>
## Problem
When the API refuses a turn, the SDK retries on the fallback model and
makes the swap persistent for the session. We flag that with a
transcript line:
```ts
text: `**Model fallback:** ${message.original_model} declined this request${category}; retried with ${message.fallback_model}. ${outcome}${explanation}`,
```
It goes out as an `agent_message_chunk`, so the client cannot tell a
session-level advisory from something the model actually said — the bold
label is the only severity signal available, and it is just characters
inside the assistant's own text.
The comment above that code already states the stakes: *"Without a
notice the user just sees regenerated output."* The notice matters; the
channel it uses does not fit it.
## Change
Routes it through the AIR typed session-failure extension instead, as a
new `advisory` category:
- `severity?: "error" | "warning"` on the record. **Optional, and absent
means `error`**, so a client that predates this keeps treating every
record it receives as a failure.
- The advisory carries its own wording (`safeMessage`) rather than the
canned per-category message, so the client renders the explanation
verbatim in a warning banner.
- **Clients that did not negotiate the `sessionFailure` capability keep
the exact transcript line they get today.**
### Advisories are not turn failures
Two existing behaviours would have mangled them, so both are now
guarded:
- `createSessionFailure` clears every other active record when a new one
is published. An advisory no longer does that, and is no longer cleared
by one — otherwise a model-fallback notice would erase an actionable
error, or vice versa.
- `clearFailuresFromEarlierTurns` clears everything whose `turnId` is
not the active turn. Advisories carry no `turnId`, so without the guard
every turn boundary would sweep them away.
They therefore live under their own `:notice:` id namespace,
session-scoped, one slot, newest wins.
## Scoped out
`**Fast mode turned off:**` (`syncFastMode…`) is the same pattern and
deserves the same treatment, but it sits in a class method while the
failure machinery is closure-scoped inside `prompt()`. Lifting that out
is a separate change rather than something to smuggle into this one.
## Tests
`npm run build`, `npm run check`, and `npm run test:run` (**766
passed**) are clean.
The existing `model_refusal_fallback` tests still assert the `**Model
fallback:**` transcript line and still pass — they never call
`initialize`, so they exercise the no-capability path, which is exactly
the backward-compatibility guarantee.
One test added for the typed path, asserting that the advisory is
published with `severity: "warning"`, that its `safeMessage` carries the
real model ids and refusal category, that it uses the `:notice:` id
namespace, that it contains no `**` markdown lead-in, and that the
transcript line is **not** also emitted.
Client side: IJAI-993.
## Summary
- Add `skill?: string` to `ToolUpdateMeta.claudeCode`, populated from
`toolUse.input.skill` in `claudeCodeMetaFromToolUse`. Lets ACP clients
detect skill invocations from structured metadata rather than parsing
the title string.
- Add `case "Skill":` to `toolInfoFromToolUse`: sets `title` to `"Load
skill: <name>"` and returns empty content — readable fallback for
clients that don't read `_meta`.
- Add `case "Skill":` to `toolUpdateFromToolResult`: returns `{}` to
suppress the raw `"Launching skill: <name>"` result text, matching the
pattern used for `Edit`/`Write`.
## Motivation
Without this, the Skill tool falls through to the `default` case and
renders as a generic `kind: "other"` block with title `"Skill"` and an
expand control showing the raw result text. With this change, clients
that read `_meta.claudeCode.skill` can render the block with the
appropriate icon, the skill name, and no expand control.
## Test plan
- [ ] Invoke a skill (e.g. `/commits`) and confirm
`_meta.claudeCode.skill` is present in the emitted `tool_call` update
- [ ] Confirm title is `"Load skill: commits"` in the ACP event stream
- [ ] Confirm no content is emitted for the skill tool result
## Summary
- When the SDK's `"default"` model entry carries a `resolvedModel` (e.g.
`"claude-sonnet-5"`), `buildConfigOptions` now sets the option's
`description` to the human-readable `displayName` of the matching named
model (e.g. `"Claude Sonnet 5"`)
- Falls back to the raw `resolvedModel` string if no named entry shares
that resolved ID
- No behaviour change when `resolvedModel` is absent
This lets ACP clients show the actual model behind "Default" — e.g.
"Default (Claude Sonnet 5)" — instead of just "Default (recommended)".
## Test plan
- [ ] `buildConfigOptions model option resolved description > sets
description to the named model's displayName when resolvedModel matches`
- [ ] `buildConfigOptions model option resolved description > falls back
to resolvedModel itself when no named model shares it`
- [ ] `buildConfigOptions model option resolved description > leaves
description undefined when default model has no resolvedModel`
- [ ] All 753 existing tests still pass
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
- Negotiate the JetBrains AIR `sessionFailure` extension when the client
advertises an integer version `>= 1` and the capability name.
- Return turn-terminal failures only on `PromptResponse._meta`; publish
idle and asynchronous session health failures through `session/update`.
- Preserve legacy ACP behavior for clients that do not negotiate the
extension.
- Emit bounded fixed safe messages without SDK/provider details, paths,
credentials, or stack traces.
## Recovery contract
Failures use `_meta.jetbrains.air.sessionFailure` with a stable id,
monotonic revision, phase, category, source, safe message, retryability,
and optional real turn attribution. Session-scoped ids include a
consumer epoch, so replayed tombstones from a dead consumer cannot
suppress failures after restart. Stale consumers cannot publish into a
replacement session.
AIR owns localized action presentation. Claude supplies typed category
and retryability facts. Billing maps to quota exhaustion, max-output
limits map to context exhaustion, and the irreversibly closed Claude
Query reports non-retryable `transport_lost` so AIR offers New Session.
A held-open turn keeps its already recorded successful `PromptResponse`,
while worker shutdown or transport death also emits a separate
session-scoped health failure without `turnId`; the next prompt is
proven to fail because the Query is closed. Worker-shutdown remains
armed through buffered trailing frames and is classified only when EOF
proves the live tail.
## Validation
- 750 passed, 25 skipped.
- Build passed.
- ESLint passed.
- Changed files pass Prettier; the repository-wide check is blocked only
by an unrelated untracked local proposal file.
- Tests cover negotiation, taxonomy, sanitization, terminal/asynchronous
carrier separation, stale consumers, worker replay/live-tail behavior,
held turns, process/transport failure, restart-safe ids, clear
revisions, and capability-off behavior.
## Summary
- show `Preparing file…` instead of the bare `Write` title while
streamed input has no `file_path`
- refine the same tool call to `Write <display path>` as soon as the
path is available
- cover both partial-field refinement and
complete-input/consolidated-message delivery
## Tests
- `npm run lint`
- `npx prettier --check src/tools.ts src/tests/acp-agent.test.ts`
- `npm run build`
- `npm run test:run` — 716 passed, 25 skipped
YouTrack: https://youtrack.jetbrains.com/issue/IJAI-841
## Summary
- republish unfinished Task* plan snapshots when a follow-up prompt
starts
- avoid resurfacing fully completed historical plans on unrelated
prompts
- clear stale task state when Claude starts a fresh conversation
- reconcile task state from authoritative TaskList results after resume
or history compaction
- consume structured Task* outputs during live sessions and parse Claude
Code textual output when replaying history
- reject logically failed TaskUpdate results instead of persisting the
requested mutation
- keep scanning structured tool output past unrelated JSON blocks
- use Claude activeForm for in-progress TodoWrite and Task* entries
This keeps ACP clients from losing an unfinished task list at prompt
boundaries, restores state when incremental history is unavailable, and
prevents plans from leaking across conversation resets.
## Tests
- npm run test:run (713 passed, 20 skipped)
- npm run check
- npm run build
- git diff --check
## Summary
- publish optimistic provider-neutral goal snapshots for submitted and
steered goal commands
- advertise and implement `set`, using steering for an active turn and
an ordinary prompt while idle
- suppress stale old-goal runtime updates while replacement/clear is
pending and roll back failed commands
- keep cancellation turn-scoped and orphan-account pending steers so
stale results cannot settle the next prompt
- reject unsupported pause/resume controls without host-side fallbacks
## Validation
- `npm test -- --run` (702 passed, 20 skipped)
- `npm run check`
- `npm run build`
- regression coverage for idle/active set and clear, stale runtime
updates, command failure rollback, cancellation, and stale steer
isolation
## Summary
- advertise a provider-neutral goal extension in
`InitializeResponse._meta.goal`
- map Claude SDK `active_goal` messages to
`session_info_update._meta.goal`
- expose the shared `_session/goal` control method with the truthfully
supported `clear` action
- document the extension as a candidate shape for a future first-class
ACP goal API
## Architecture
A goal is persistent **session state**, not the lifecycle of one
`session/prompt` request. `goal.status === "active"` says that the
objective may drive more work; it does not say that a prompt is
executing now.
This keeps two independent axes:
1. **Goal state** is published asynchronously as session metadata and
may survive multiple prompt turns.
2. **Prompt activity** follows the backend's actual running/quiescent
boundaries. While a turn runs, clients use advertised steering or prompt
queueing. Once the backend is quiescent, an ordinary `session/prompt` is
valid even if the goal remains active.
The metadata is deliberately provider-neutral:
```json
{
"_meta": {
"goal": {
"version": 1,
"controlMethod": "_session/goal",
"actions": ["clear"]
}
}
}
```
State is emitted as `session_info_update._meta.goal`; `null` clears it.
The common snapshot vocabulary supports `objective`, common statuses,
timestamps in Unix milliseconds, budgets/usage, iteration count, and a
continuation reason. Each implementation emits only fields it actually
knows. This shape is intentionally close to a future typed ACP
capability/update so promotion out of `_meta` would not require a
provider-specific migration.
Control actions are capability-negotiated. The shared vocabulary
reserves `set`, `pause`, `resume`, and `clear`, but an agent advertises
only the subset it can implement with correct semantics.
## Claude mapping
The Claude runtime already emits internal `active_goal` messages,
although that message is not currently included in the public
`SDKMessage` union. The adapter handles it before the exhaustive switch:
- `condition` → `objective`
- `iterations` → `iterations`
- `set_at` → `createdAt`
- `last_reason` → `lastReason`
- `value: null` → `goal: null`
Provider bookkeeping such as `tokens_at_start` is intentionally not
exposed. Goal updates do not settle, extend, or otherwise mutate ACP
prompt lifecycle. Claude's existing Stop hook remains authoritative for
whether the backend itself continues working.
Only `clear` is advertised for out-of-band control. It submits `/goal
clear` through the existing session prompt queue, preserving the
adapter's established ordering and turn ownership. Setting a goal
remains available through `/goal <condition>` but is not advertised as a
control action because it starts the long-running Stop-hook workflow.
The companion Codex implementation is agentclientprotocol/codex-acp#371.
## Verification
- `npm run test:run` — 692 passed, 20 skipped
- `npm run build`
- `npm run check`
Bumps the minor group with 1 update:
[globals](https://github.com/sindresorhus/globals).
Updates `globals` from 17.8.0 to 17.9.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sindresorhus/globals/releases">globals's
releases</a>.</em></p>
<blockquote>
<h2>v17.9.0</h2>
<ul>
<li>Update globals (2026-08-01) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/348">#348</a>)
5a958ed</li>
</ul>
<hr />
<p><a
href="https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0">https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="8e7b9358b1"><code>8e7b935</code></a>
17.9.0</li>
<li><a
href="5a958ed060"><code>5a958ed</code></a>
Update globals (2026-08-01) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/348">#348</a>)</li>
<li>See full diff in <a
href="https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Steering is delivered at priority `now`, which makes the CLI **abort**
the running cycle instead of folding the message into it. The aborted
cycle ends with an ordinary human-origin `result`, so we answered
`session/prompt` with `end_turn` while the steered work was still going
— its remaining tool calls, its answer, and its file edits then streamed
with no turn in flight.
A steered turn's results now only record their outcome, and the turn
settles at the SDK's `idle` — the only signal spanning both the
interrupted and the steered cycle. The injected message's replay tells
them apart: an idle arriving before it means the steered cycle hasn't
started, so it is swallowed. `session/cancel` and the next prompt still
settle the turn early, with the recorded stop reason.
Four steering tests cover the interrupt, an early idle, the next-prompt
hand-off, and cancel.
Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.16 to 3.3.17.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ai/nanoid/releases">nanoid's
releases</a>.</em></p>
<blockquote>
<h2>3.3.17</h2>
<ul>
<li>Fixed infinite loop on zero size.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ai/nanoid/blob/main/CHANGELOG.md">nanoid's
changelog</a>.</em></p>
<blockquote>
<h2>3.3.17</h2>
<ul>
<li>Fixed infinite loop on zero size.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="73d6716813"><code>73d6716</code></a>
Release 3.3.17 version</li>
<li><a
href="f9d13f1508"><code>f9d13f1</code></a>
Sync 0 size behaviour with PostCSS 5</li>
<li>See full diff in <a
href="https://github.com/ai/nanoid/compare/3.3.16...3.3.17">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Description
Testing this agent means wiring it into an editor's ACP integration,
which is an overkill when you just want to watch the JSON and reply with
JSON. This adds a second example next to `examples/steering.ts`: a
minimal interactive ACP client that spawns the built agent, prints every
JSON-RPC message in both directions, and turns what you type into
prompts.
```
npm run build
npm run example:simple-client
```
All four ways a client can get a message to this agent are reachable
from the prompt"
| Input | Wire |
| --- | --- |
| `<text>` | `session/prompt`; buffered client-side if a turn is running
|
| `!steer <text>` | `_session/steering`, injected into the running turn
|
| `!queue <text>` | `session/prompt` sent mid-turn, so the agent queues
it |
| `!cancel`, Ctrl-C | `session/cancel` |
## Additional options
* `--debug-port=<port>` rebuilds with source maps and starts the agent
under
* `--inspect-brk`, paused, so a debugger can attach and step through
`src/*.ts` —
replacing a hand-written editor run configuration. Teardown cancels any
live
turn, closes the agent's stdin (its clean-exit path), waits, and only
then
closes the connection, so neither side dies of EPIPE and nothing is
orphaned.
npm may accept a package before the registry update stage can run, and
repeating the workflow would attempt to republish the same immutable
version.
Add an opt-out for npm publishing on manual dispatch so the repository
GitHub App can safely retry only the registry update. The default
remains `true`, preserving the normal manual release path.
Validation: Prettier workflow check.
A skipped `release-please` job propagates to downstream jobs during a
manual release, even when npm publishing succeeds through an `always()`
condition.
Explicitly evaluate the npm job result so successful manual publications
continue to update the agent registry.
Validation: Prettier workflow check.
Release-please cannot process the already-merged, untagged release PR
#943.
This adds an explicit workflow dispatch path for publishing a supplied
tag or commit while preserving the normal push-driven release flow, and
restores the 0.64.2 release metadata for the recovery tag.
After merge, I will create `v0.64.2` at this commit and dispatch the
publish workflow for that tag.
Validation:
- ESLint
- Prettier
- TypeScript build
- Vitest: 684 passed, 20 skipped
## Summary
- revert the ExitPlanMode plan_update integration from #938
- restore the previous single switch_mode tool-call representation
- keep plan Markdown and approval state on the same transcript item
## Why
Clients currently receive both a plan_update and the separate tool call
required by requestPermission. Without a protocol-level link between
those entries, clients can render the same final plan twice. Returning
to the legacy representation avoids the duplicate while preserving the
existing approval flow.
## Testing
- pnpm exec vitest run src/tests/tools.test.ts
src/tests/acp-agent.test.ts src/tests/session-config-options.test.ts
(482 passed, 9 skipped)
- pnpm run build
- pnpm run lint
- pnpm run format:check
## Summary
- publish `ExitPlanMode` Markdown through experimental ACP `plan_update`
when the client advertises `clientCapabilities.plan`
- keep `requestPermission` as the confirmation mechanism and retain
`rawInput.plan` on the `switch_mode` tool call
- fall back to the existing tool-call content for clients without plan
support
- serialize live plan publication through the permission path so
`plan_update` and the referenced `tool_call` are delivered before
`requestPermission`
- use stable per-scope plan IDs so main-agent and subagent plans cannot
overwrite each other
- replay capable-client plans through `plan_update` without duplicating
Markdown in tool content
## Testing
- permission-first and stream-first event ordering
- approve, reject, and cancel outcomes
- capable-client Markdown payload and legacy fallback
- empty plan suppression, replay, deduplication, and subagent plan IDs
- `vitest run` (697 passed, 20 skipped)
- `tsc --noEmit`
- ESLint and Prettier on changed files
## Summary
Expose Claude Code permission-update suggestions through the same
versioned option-level metadata contract used by other ACP agents:
```json
{
"_meta": {
"permission": {
"version": 1,
"changes": []
}
}
}
```
The approval actions are presented as `Deny`, `Allow Once`, and `Always
Allow`. Exact scope and policy details live in metadata instead of being
encoded into the button label.
## Why
ACP already transports button semantics via `PermissionOption.kind`,
display text via `name`, and the selected value via `optionId`. It does
not currently expose the exact persistent policy update.
Claude Code suggestions can do considerably more than add one allow
rule: they may add, remove, or replace allow/deny/ask rule sets, add or
remove directories, change permission mode, and target different storage
destinations. Flattening those suggestions into labels or a list of
scopes loses mutation semantics and can incorrectly describe a narrow or
restrictive update as permission for the whole tool.
## Contract
Every change carries a producer-supplied human-readable `description`.
Structured fields preserve:
- ordered `add`, `remove`, and atomic `replace` operations
- `allow`, `deny`, and `ask` rule sets through `ruleBehavior`
- whole-tool targets and provider-rule matchers
- filesystem directory targets
- permission-mode changes
- session, process, user, project, and project-local destinations as
lifetime/storage
Example scoped Bash rule:
```json
{
"type": "policy_rule",
"operation": "add",
"ruleBehavior": "allow",
"description": "Allow Bash calls matching npm test:*",
"lifetime": { "scope": "session" },
"targets": [
{
"type": "tool",
"toolName": "Bash",
"matcher": {
"type": "provider_rule",
"provider": "claudeCode",
"value": "npm test:*"
}
}
]
}
```
A tool target without a matcher means the whole tool. A provider rule is
intentionally opaque; clients should show `description` rather than
reverse-engineering Claude Code rule syntax.
When Claude Code supplies no suggestions, the adapter preserves its
existing fallback behavior by describing the exact session rule it
returns: allow the whole requested tool for the session.
## Compatibility
This remains on the current ACP protocol and uses only `_meta`. Clients
that do not understand `_meta.permission` continue rendering and
dispatching the standard options. Option IDs and permission outcomes are
unchanged.
## Tests
- full suite: 682 passed, 20 skipped
- lint passed
- Prettier check passed
- TypeScript build passed
- coverage includes whole-tool fallback, scoped rules, directories,
replace/remove, deny rules, destinations, and mode changes
Andrey Bragin