Updates `@anthropic-ai/claude-agent-sdk` from 0.3.296 to 0.3.300 (parity
with Claude Code v2.1.300), and `@anthropic-ai/sdk` from 0.133.0 to
0.134.0.
No code changes needed. The new types are an optional `property_order`
on elicitation requests, `nextFireAt` on the CronCreate/CronList
outputs, and `owned` on Artifact outputs. We don't need any of them.
Fixes picked up that affect this agent:
- `importSessionToStore` (used for session forks) no longer skips
transcript rows containing U+2028/U+2029 on Node 24.
- Resuming an SDK session after a compaction no longer loses the recent
messages or the compaction summary in some cases.
- Background subagents in auto mode no longer send their final report
twice or merge it into another turn.
- Queued content-block prompts merged into one turn are now separated by
a line break.
- `ScheduleWakeup` now fires while a background task is running.
Behaviour change: `MAX_THINKING_TOKENS=0` (sent as `thinking: { type:
"disabled" }`) now runs adaptive thinking on models that can't turn
thinking off.
`npm run build`, `npm run check` and `npm run test:run` all pass.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
## What
Marks `session/list` and `_session/list/changes` rows whose session runs
in a linked Git worktree that Claude Code itself created (`claude
--worktree`, the `EnterWorktree` tool), as
`_meta.jetbrains.air.agentWorktree: true`. A new agent capability
`sessionWorktrees`, advertised together with `sessionIndex`, tells the
client that rows carry the field, so a missing field means "not made by
the agent" rather than "unknown".
## Why
With `includeWorktrees`, a client gets sessions from every linked
worktree with nothing to tell them apart. A worktree Claude Code made
for a session belongs to the project the user started it from; a
worktree the user made by hand is a separate checkout. Only the agent
knows which is which.
## How
- The rule reads the transcript's `worktree-state` records: the latest
one wins; the session counts only when `worktreeSession` is non-null and
`enteredExisting` is not `true`. `environment.isWorktree` is not used,
since plain git detection is also true for user-made worktrees.
- The record is parsed in the existing head/tail transcript scan, so no
extra file reads. The row is marked only when its `cwd` is in a linked
worktree (`<common-dir>/worktrees/<name>`), never for the main checkout
or a submodule.
- The row's `cwd` stays the session's own directory. The field is `true`
or absent.
Proposed as `SessionInfo.agentWorktree` plus a `agentWorktrees`
capability marker in the session list extensions RFD:
agentclientprotocol/agent-client-protocol#2323. Docs:
`docs/air-extensions.md`.
## Tests
`src/tests/session-index.test.ts`: marked worktree, `enteredExisting`,
no record (user worktree), a later `null` record, main checkout,
`_session/list/changes` rows, capability negotiation, and scan windows.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Found by running the ACP TCK's v2 suite against the adapter
(ACP-ADDDIRS-202). The code is shared, so it also fixes v1's
`session/load` and `session/resume`.
## The bug
A `session/resume` or `session/load` can change a live session's
settings: its `cwd`, additional directories, MCP servers, or the other
settings in its fingerprint. When that happens, `getOrCreateSession`
tears the live query down and starts a new one with `resume: sessionId`.
Claude Code writes the conversation only at the first prompt, so for a
session that was never prompted, the resume failed with `-32002`
"Resource not found". The live session was already torn down by then, so
the client lost a session it had a moment earlier.
## The fix
The sign-out path already handled the same case: it tries `resume`, and
on `resourceNotFound` it starts a fresh query under the same id with
`reuseSessionId`. That logic is now one helper, `recreateLiveSession`,
used by both:
- **`getOrCreateSession`** uses it when the session was live. A session
that was never prompted then starts a fresh query under its own id. It
loses no history, because it had none, and it keeps its mode.
- **A session that isn't loaded here** still resumes directly. If it has
no stored conversation, that still fails with `-32002`, since the
session really is unknown.
- **`recreateSignedOutQuery`** keeps its own handling: if both attempts
fail, it puts the old session object back.
## Checks
- **ACP TCK v2** (`agentclientprotocol/acp-tck` at `fa00ccd`) against
this build: ACP-ADDDIRS-202 now passes, where it failed before.
ACP-ADDDIRS-201 and ACP-RESUME-201 to 205 still pass.
- **Live v1 `session/load`**, Claude Code 2.1.296: create a session,
then load it with a new additional directory before any prompt.
- On `main`, the load failed with `-32002`.
- With this fix, the load succeeds. A prompt then read a file that
exists only in the new directory, and the transcript was saved under the
same session id.
- **Tests:** three new tests:
- a live session that was never prompted starts a fresh query with its
mode;
- an unknown session still fails;
- another failure of a live session's resume doesn't start a fresh
query.
Removing the fallback, applying it to every error, or applying it to
sessions that aren't loaded each fails a test. The sign-out tests pass
through the shared helper.
- **Suite:** `npm run check`, build and all 3068 tests pass, with no
golden changes.
**Not covered:** a model chosen with `session/set_config_option` before
the first prompt resets to the default when such a session is recreated,
as it already did after a sign-out. The mode is kept.
Found by running the ACP TCK's v2 suite against the adapter
(ACP-DELETE-201 and ACP-DELETE-203). The code is shared, so v1 clients
get the fix too.
## The bug
ACP says: "Deleting an already-deleted session, or a session that never
existed, **SHOULD** succeed silently." For a client that is neither AIR
nor a `sessionIndex` client, `session/delete` instead failed with
`-32603` "Internal error" in three cases:
- **A session this connection ran but never prompted.** Claude Code
writes the transcript at the first prompt. So the adapter closed the
live session, then the SDK delete threw "not found in any project
directory".
- **An unknown session.** The SDK delete throws the same "not found"
error.
- **An id that isn't a UUID.** The SDK delete throws "Invalid
sessionId".
## The fix
A new `deleteSessionIfStored` in `src/session-index/service.ts` handles
every other client's delete:
- An id that isn't a session id can't name a transcript, so it returns
`{}` without calling the SDK.
- The SDK's own "not found" means nothing is on disk, so that also
returns `{}`. It's recognised by the existing `isSdkNotFound`.
- Any other SDK failure, such as a permission error, still fails the
request.
The two AIR paths are unchanged, because `docs/air-extensions.md`
documents their errors: `-32002` for an unknown session on a
`sessionIndex` client, and the SDK's error for AIR without
`sessionIndex`. The doc now describes the plain client's behavior.
## Checks
- **ACP TCK v2** (`agentclientprotocol/acp-tck` at `fa00ccd`) against
this build: ACP-DELETE-201 and ACP-DELETE-203 now pass, where both
failed before. ACP-DELETE-202 is still skipped, because `session/list`
doesn't show a session that was never prompted.
- **Tests:** three new tests: a never-prompted live session, an unknown
session, and an id that isn't a UUID. Removing either rule, or
swallowing every error, fails a test. The existing delete tests now use
UUID ids, which is what real sessions have.
- **Suite:** `npm run check`, build and all 3068 tests pass, with no
golden changes.
Stacked on #1347, which gives each running child the `cancel`
capability. Merge #1347 first; this PR's base is its branch.
## What changes
On a client that gets the subagents RFD form (v1 with
`clientCapabilities.subagents` and not AIR, and v2), `session/cancel` on
the parent now spares background subagents. They keep running, as
acp#2308 prescribes ("a background child that the cancelled work did not
wait on may continue"), and the client can stop each one with its
child's `cancel` from #1347. Foreground subagents that the turn waits on
still stop.
Plain v1 clients and AIR are unchanged: the interrupt still stops their
background subagents, since they have no way to stop one.
## How
- **The declaration.** Claude Code's interrupt kills background
subagents and workflows unless the query declares
`perTaskStopAffordance`. The SDK describes it as "this consumer renders
a per-task stop control", and an RFD client now has that control. The
adapter declares the option for those clients. It comes before
`_meta.claudeCode.options`, so a client can turn it off.
- **Workflows.** The declaration also spares background workflows
(`local_workflow`). A workflow's agents are not subagent tasks and get
no child session, so a client can't stop a workflow unless it is AIR
with `asyncTasks`. When a session declares the option and the client has
no such control, `session/cancel` stops each live background workflow
with `Query.stopTask` after the interrupt. Workflows therefore behave as
they did before.
- **Background commands** survive an interrupt with or without the
declaration (checked live and in the CLI code), so nothing changes for
them.
Where I read Claude Code 2.1.296's CLI: without the declaration, the
interrupt runs a kill of every running background `local_agent` and
`local_workflow` task. With it, the interrupt kills only observer tasks.
Adapter interrupts name no prompt, so this runs on every
`session/cancel`, including one with no turn running. The declaration's
only other effect is on requests with `interrupt_if_running`, which the
adapter never sends.
## Checks
**Live, Claude Code 2.1.296, through the built adapter.** Every update
was checked against the schema, and no run had a violation or left a
tool call open. Survival was checked by whether the background command's
process was alive 2 s after the cancel.
| Client | Background work at the cancel | Result |
|---|---|---|
| v1 RFD | subagent running a command | Prompt `cancelled` 9 ms after
the cancel. The child kept running, completed its command and reported
`idle end_turn`. Claude Code's follow-up cycle then streamed to the
root. |
| v1 RFD | subagent with an open permission request | The request stayed
open through the cancel. The client allowed it 5 s later, and the child
ran the command and ended `idle end_turn`. |
| v1 RFD | workflow | The workflow and its command stopped, with no
follow-up cycle. Same as the plain client. |
| v1 plain | subagent | Unchanged: the interrupt killed the child, and
its command's tool call ended `failed`. |
| v1 plain | workflow | Unchanged: stopped, no follow-up. |
| v2 | subagent | Root `idle cancelled` 11 ms after the cancel. The
child kept running and later reported `idle end_turn`, and the root went
`running`, then `idle end_turn`, for the follow-up. |
| v2 | workflow | Stopped, no follow-up. |
**Direct SDK probes** decided the design:
- With the declaration, an interrupt spares a background workflow.
- Without it, the interrupt kills the workflow.
- A `stopTask` on a workflow, before or after the interrupt, stops it
and its command, and Claude Code starts no follow-up cycle, the same as
when the interrupt killed it.
**Tests:**
- Option tests: the declaration for each client form, a caller's
override, and when a cancel stops workflows.
- Cancel tests: only workflows are stopped, after the interrupt and only
when the flag is set.
- Removing any of the eight rules fails a test.
- `npm run check`, build and all 3020 tests pass, with no golden
changes.
## Not covered
- A paused background workflow (one Claude Code restored on a resume)
would also be stopped at a cancel, where the interrupt left it alone. I
didn't check whether such a workflow reports `task_started`.
- Standard ACP has no control to stop background work that is not a
session, such as a workflow or a background command. Only AIR has one,
through its async tasks extension.
A client on the subagents RFD can now stop one subagent without
cancelling the turn. Each running child is announced with `capabilities:
{ cancel: {} }`, and `session/cancel` with the child's session id stops
that child's current work.
## What Claude Code does
From direct SDK probes of `Query.stopTask(taskId)` and runs through the
adapter (Claude Code 2.1.293 and 2.1.296):
| Case | What Claude Code sends |
|---|---|
| Foreground subagent running a command | At once: `task_updated`
`killed` and `task_notification` `stopped` for the subagent, `stopped`
for its command's task, the command's interrupted result, then the Agent
call's interrupted result (`non_execution_kind: "interrupted"`). The
parent's turn goes on and ends normally. |
| Background subagent | The same events and result, then Claude Code's
follow-up cycle about the stop. |
| Subagent with an open permission request | The request is withdrawn
(its `AbortSignal` fires), and both calls get results. |
| Subagent waiting on its own foreground subagent | The grandchild is
stopped too, with its own `killed` and `stopped`, which is the cascade
the RFD requires. |
## The change
- **The grant:** `announceNativeSubagent` grants `cancel` to each live
RFD child. A replayed child gets no capabilities, since it no longer
runs (the RFD's freshness rule for reconnection). A routing-only
ancestor that a restore announces gets none either.
- **The cancel:** `cancel` checks first whether the session id is a
child of one of its sessions (`NativeSubagentRuntime.cancelChild`), and
if so calls `Query.stopTask` with the child's agent id. It sends no
interrupt, so the parent's work goes on. A stop that Claude Code refuses
is logged.
- **The report comes from the SDK's events,** `killed` or `stopped`,
which `finishTask` already turns into `idle` with `cancelled`. Accepting
the stop is no evidence, as the RFD says, and a cancel that races with a
child's end does not rewrite its outcome.
- **Requests:** a request that the stop withdraws reports no `running`
before `idle cancelled`. `awaitingUser` now counts cancels of the child
and of its ancestors, as it counted the root's (#1337). An ancestor's
cancel stops the foreground subagents under it.
- **Unchanged:** AIR keeps its draft and grants nothing, and a cancel of
a root session works as before.
## Evidence
**Live, through the adapter** (Claude Code 2.1.296, Sonnet), every
update checked against the schema, with no violations:
| Run | Child | Parent |
|---|---|---|
| v1 RFD, foreground child running a command | `running`,
`requires_action`, `running`, `idle cancelled` 9 ms after the cancel;
its command `failed` | Agent call `failed`; turn ends `end_turn` |
| v1 RFD, background child while v1 holds the turn | `idle cancelled`;
its command `failed` | the held turn settles with `end_turn` |
| v1 RFD, child with its permission request open | `requires_action`,
then `idle cancelled`, with no `running` between | turn ends `end_turn`
|
| v2, foreground child | `idle cancelled` on the root's stream and its
own | Agent call `cancelled`; root `idle end_turn` |
No tool call was left open in any run.
**Tests:**
- `native-subagents.test.ts`:
- `cancelChild` stops the child's task and reports nothing itself, and
the SDK's `killed` reports `idle cancelled`;
- no stop for a session that is no child, or for AIR;
- no `running` for a request that the child's own cancel withdraws, or
that its parent's cancel withdraws.
- `acp-agent.test.ts`: `session/cancel` on a child calls `stopTask`, not
`interrupt`, and the turn ends `end_turn`; a refused stop is logged;
nothing happens for an unknown session id or an AIR child.
- `acp-v2.test.ts`: the same over v2, with the child's `idle cancelled`
on both streams.
- **Golden files:** the six v2 subagent golden files gain `capabilities:
{ cancel: {} }` on each announcement, and nothing else. No AIR golden
file changes.
- **Mutation checks:** removing each of these fails at least one test:
- the grant;
- the routing to the child;
- the child's cancel count;
- the ancestors in the count;
- the AIR exclusion;
- the error handling.
So does reporting `idle cancelled` as soon as the stop is accepted.
`npm run check`, build and the full suite (3014 tests) pass.
## Not changed, and a decision
- **A parent cancel still stops background subagents.** Claude Code does
that because the adapter does not declare the SDK's
`perTaskStopAffordance` option. Declared, an interrupt spares background
agents and background shell commands (checked live: both ran to
completion after the interrupt), as
agentclientprotocol/agent-client-protocol#2308 prefers. Background shell
commands would then outlive a cancel too, and ACP has no control to stop
them, so declaring it is left for a separate decision.
- **Order:** Claude Code sends the stopped child's command result right
after its `killed` event, so the client sees `idle cancelled` a few
milliseconds before that call ends. The RFD has the client mark the
child's unfinished calls cancelled at that point and still accept later
updates.
- **On v2,** the stopped child's command ends `failed`, not `cancelled`:
Claude Code's result for a subagent's command carries no non-execution
kind.
### Summary
Addresses [IJAI-1783](https://youtrack.jetbrains.com/issue/IJAI-1783).
An organization can restrict the models its JetBrains gateway serves,
but a session routed through `providers/set` offered the whole Claude
Code catalogue, so the picker showed models the gateway then refused.
`providers/set` now lists the gateway's models before it responds, and
the model picker offers only the SDK models the gateway lists.
- `anthropic`: `GET {baseUrl}/v1/models?limit=1000`, paginated by
`has_more`/`last_id`, with the provider headers and `anthropic-version`.
- `bedrock`: `GET {baseUrl}/foundation-models` (`ListFoundationModels`,
`modelSummaries[].modelId`), the listing the JetBrains gateway answers
on its Bedrock route. Only `anthropic.` ids count. The cross-region
prefix `global` when listed, else that of the first listed id, becomes
the session's `ANTHROPIC_BEDROCK_REGION_PREFIX`, so the CLI calls the
models under the prefix the gateway serves; ids of other prefixes, and
SDK rows resolved to another prefix, are dropped.
- Rows match by `resolvedModel` (or `value`) without dates, `-vN:M`
suffixes, `[1m]` hints and provider prefixes; the narrowing runs after
the `availableModels` allowlist. When the gateway does not list the
model a session runs (the dropped default, or a resumed or recreated
session's last model), the session switches to the first listed one with
`setModel`, so the CLI does not keep running an unlisted model.
- The listing runs in the provider-update queue, so `providers/set` and
`providers/disable` apply in the order they arrive; logout also clears a
`providers/set` that is still listing.
- A 4xx answer means the gateway has no listing: `providers/set`
succeeds and nothing is narrowed. Any other failed listing (network
error, 5xx, unexpected body, 10 s timeout) fails `providers/set` with
`internal_error`, and the previous provider stays in effect. An invalid
header or a base URL with credentials fails without repeating the value.
A listing that matches no SDK model leaves the session with no model to
offer: there is no model config option.
- `vertex`, gateways set through `authenticate`, and native routing are
not listed. Setting the same gateway again reuses its listing;
`providers/disable` and logout drop it.
- `docs/model-configuration.md` describes the narrowing.
### Not covered
Background haiku requests, subagents, and a `/model` typed into the
prompt choose their own model and are not checked against the listing.
### Verification
```bash
npm run check
npm run build
npm run test:run -- --no-file-parallelism # 2964 passed, 5 failed, 30 skipped; all 5 in session-index.test.ts, flaky on main too
```
Tests stub `fetch` (`src/tests/setup-no-network.ts` answers an empty
listing by default) and cover the listing requests and pagination, the
Bedrock region prefix and its env, region-aware matching, the dropped
default, the failing `providers/set`, and the empty picker. The
JetBrains Bedrock gateway's `/foundation-models` answers
`global.anthropic.claude-{haiku,opus,sonnet}-5-5` (seen through Junie,
which lists the same route); this adapter has not yet been run end to
end against it.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
## Problem
On ACP v2 the adapter reports a session's foreground work as
`state_update`s: `running`, then `requires_action` while a permission
request or question that blocks the work is open, then `running` again,
and finally `idle` with a stop reason. A request that ends because
`session/cancel` or `session/close` stopped the work is not an answer,
but it still reported `running`. #1337 fixed that for a subagent's child
session and listed the session's own request under "Not covered". That
request did not change, and since #1338 neither did its AskUserQuestion,
which now ends at the abort too.
On `main`, with Claude Code 2.1.296, v2, a Bash permission request that
the client holds open, and then a cancel or a close:
| What stops the work | States the session reported |
| --- | --- |
| `session/cancel` | `running`, `requires_action`, **`running`**, `idle
cancelled` |
| `session/close` | `running`, `requires_action`, **`running`**, `idle
cancelled`, all before the close response |
Claude Code's interrupt withdraws the request, so the SDK aborts the
signal of the `canUseTool` call, the request's `finally` calls
`syncAwaitingUser`, and with no blocking request left it reports
`running`. The result that ends the work comes 2 to 9 ms later in these
runs, so the client shows work that is being stopped as working.
## Cause
`syncAwaitingUser` reported `running` whenever the last blocking request
ended, whatever ended it. A request ends when the user answers it or
when Claude Code withdraws it, and a withdrawal alone does not say
whether the work was stopped. A `PermissionRequest` hook that answers
also makes Claude Code withdraw the request, and the work goes on (9 s
more in a live run), as #1337 found. So "a withdrawn request reports no
`running`" is wrong. The rule that fits is #1337's: no `running` when
the request was withdrawn after a cancel that came while it was open.
## Change
- `cancelTurns` (called for `session/cancel`, and by the teardown of
`session/close`) marks each request that is open, in
`Session.openUserInputs`.
- `withPendingUserInput` takes the request's `signal`. When the request
ends with its signal aborted and the mark set, `syncAwaitingUser` stops
waiting but reports no `running`. The four callers pass their signal:
permission requests, AskUserQuestion, MCP elicitation, and the refusal
fallback prompt. (#1337 counts the parent's cancels and compares the
count when the request ends. Here each open request is already an entry
of `openUserInputs`, so the cancel marks it. Same rule.)
- Everything else is as before:
- an answered request reports `running`, also after the cancel;
- a withdrawal without a cancel reports `running`;
- with two requests open, only the last one to end reports, by how that
one ended;
- a request that opens after the cancel is judged on its own, so a hook
that withdraws it still reports `running`.
- A foreground subagent's request blocks the turn, so it behaves like
the turn's own. A background subagent's request does not block it
(`blocksForeground`), so the root's states do not change for it. #1337's
child states are unchanged.
- `ForegroundEvents.running` and `v2Foreground` say when `running` is
not reported.
v1 reports no session state, so nothing changes there. AIR is unchanged:
the scenario golden files do not change.
## Evidence
Live runs against Claude Code 2.1.296 (Sonnet), driving `dist/index.js`
over stdio as a v2 client (`CLAUDE_AGENT_ACP_EXPERIMENTAL_V2=1`) that
holds the request and ignores `$/cancel_request`, with the session's cwd
in default permission mode. Every update and request validated against
the SDK's v2 JSON schema: 0 violations in all runs. The root's states:
| Run | `main` | This PR |
| --- | --- | --- |
| `session/cancel`, Bash permission request | `running`,
`requires_action`, `running`, `idle cancelled` | `running`,
`requires_action`, `idle cancelled` |
| `session/cancel`, AskUserQuestion | `running`, `requires_action`,
`running`, `idle cancelled` | `running`, `requires_action`, `idle
cancelled` |
| `session/close` | `running`, `requires_action`, `running`, `idle
cancelled` | `running`, `requires_action`, `idle cancelled` |
| `session/cancel`, request of a foreground subagent (#1337's run) |
root as above; child `running`, `requires_action`, `idle cancelled` |
root `running`, `requires_action`, `idle cancelled`; child the same |
| `PermissionRequest` hook allows after 3 s, no cancel | `running`,
`requires_action`, `running`, `idle end_turn` | the same |
| the client answers after 2 s | `running`, `requires_action`,
`running`, `idle end_turn` | the same |
| `kill -9` of Claude Code, no cancel | `running`, `requires_action`,
`running`, `idle error` | the same (see below) |
The hook run is why a withdrawal alone cannot mean "stopped": Claude
Code withdrew the request 3 s in, and the command then ran 9 s more. A
v1 run of the cancel (no state updates there) is identical on both
builds.
Tests, in `acp-v2.test.ts`, through the v2 client app, which validates
every update:
- For each of the four kinds of request (permission request,
AskUserQuestion, an MCP server's elicitation, the refusal fallback
prompt): a `session/cancel` withdraws it, a `session/close` withdraws it
(the harness gets a `close` hook, as the SDK's cleanup of a closed query
aborts open requests), and Claude Code withdraws it without a cancel.
- The user answers after the cancel; a request that opens after the
cancel and is then withdrawn; two requests open together (both withdrawn
by the cancel, and one withdrawn and the other answered, in each order);
a request of a cycle that Claude Code started.
- Subagents: a foreground subagent's request also holds the root (an
assertion added to #1337's test); a background subagent's request
changes nothing of the root's states, alone and next to the turn's own
request.
13 of them fail on `main` (12 new tests and the extended one); the other
8 new tests pass there and guard what must not change.
Removal checks, each run against `acp-v2.test.ts`:
| Removed or changed | Tests that fail |
| --- | --- |
| no rule: the end always reports `running` | 13 |
| the cancel marks no request | 13 |
| a mark is enough, the signal is not required | 2 (answered after the
cancel) |
| the simple rule "any withdrawal means stopped" | 5 (the hook cases,
and the request after the cancel) |
| `session.cancelled` in place of the mark of a cancel that came while
the request was open | 1 (the request after the cancel) |
| sticky: after one request was withdrawn by a cancel, no later request
reports `running` | 1 (answers the one the cancel did not withdraw) |
| permission requests do not pass their signal | 6 |
| AskUserQuestion does not pass its signal | 3 |
| MCP elicitation does not pass its signal | 2 |
| the refusal fallback prompt does not pass its signal | 2 |
`npm run check`, `npm run build` and `npm run test:run` pass (2999 tests
passed, 30 skipped; the scenario golden files do not change).
## Not covered
- **A stream end without a cancel.** If Claude Code exits by itself, the
SDK's cleanup aborts every request before the consumer reads the end of
the stream, and nothing at that moment tells it from a hook's
withdrawal. Live (`kill -9` of the CLI, table above): `running` 2 ms
before the `idle`, and the session is dead right after. Left as it is,
for the reasons #1337 gives for children.
- The rule assumes, like #1337's, that the work reports its end right
after such a withdrawal. A turn always does (the force-cancel backstop
ends a wedged one); a cycle with no active turn has no such backstop.
- Open PRs #1344 and #1345 also change `src/acp-agent.ts`; this branch
merges cleanly with each (checked with `git merge-tree`).
A model cycle that Claude Code starts on its own now closes, at its end,
the tool calls that Claude abandoned before they ran, as a turn's end
already does.
## The bug
Claude can start a tool use and never finish the message that holds it,
for example when the stream is cut off. The tool never runs, and no
result comes. At a turn's end, `settleActive` closes such a call
(`closeUnfinished`: "Claude stopped this tool call before it ran.",
`failed` on v1, `cancelled` on v2). A cycle that Claude Code started on
its own, such as its follow-up after a background command finished, has
no turn. So nothing closed its abandoned calls, and the client kept them
open.
## The fix
`closeCancelledCycleToolCalls` becomes `closeCycleToolCalls` and runs at
every end of a cycle: its result, or an idle that no result precedes.
- **After a cancel:** unchanged (#1339, #1342).
- **At any other end:** every call that ran already has its result. What
is open is a call of the main conversation that was never dispatched,
which is closed with the same report a turn's end sends. A subagent's
calls are not the cycle's: a background subagent runs on.
On v2 the report comes before the cycle's `idle`.
## Evidence
**Tests:**
- v1, a cycle that runs a command, starts a background subagent that is
streaming a tool use as the cycle ends, and abandons a tool use: only
the abandoned call is closed, once. The command keeps its one result,
and the subagent's call stays open.
- v1, a cycle that ends at an idle with no result (the stream dropped
mid-cycle): its abandoned call is closed there.
- v2: the abandoned call goes `pending`, then `cancelled`, before the
cycle's `idle end_turn`.
- **Mutation checks:** each of these fails at least one test:
- no closing at a normal end;
- closing a subagent's calls;
- closing dispatched calls (an existing test catches it);
- closing only at the result, not at the idle.
`npm run check`, build and the full suite (2982 tests) pass, with no
golden changes.
**Not checked live:** Claude abandons a tool use only when something
cuts its message off, such as a steer or a dropped stream, which a live
run cannot set up reliably.
After a cancel, the output of a background subagent that the cancel did
not stop now reaches the client: its tool results, its new tool calls,
and its permission requests.
## The bug
The adapter has one rule for work that a cancel does not stop, as
agentclientprotocol/agent-client-protocol#2308 asks: a background
subagent that still runs (`runsInBackground`). The closing at the cancel
leaves that subagent's tool calls open for their results
(`closedAtCancel`). But the window after the cancel dropped the same
subagent's output, results included:
- **A subagent that completes after the cancel** kept its calls open.
Its commands' results came after the cancel was reported and were
dropped, and since it was not stopped, nothing closed them.
- **A subagent that runs on** after the cancel showed nothing more: new
tool calls were dropped, and its permission requests were denied as the
stopped work's (#1334).
Claude Code currently stops background subagents at an interrupt, as
live runs show, so today this applies only to the output that comes
before the SDK reports a subagent's end. It decides the rest once Claude
Code lets them run.
## The fix
`isRunningBackgroundSubagentOutput` uses the closing's predicate for the
three places the window applies:
- the drop of streamed output;
- the record that `canUseTool` and the v2 preview hook read (#1334);
- the guard of the user/assistant messages.
A subagent's output after the SDK reported its end is still dropped, and
#1336 closes its calls.
## Evidence
**Tests** (`src/tests/incomplete-tools.test.ts`):
- **A command's own result,** for a subagent that completes after the
cancel, reaches the client, for a held turn and with no turn. This
replaces "leaves the command of a subagent that completed after the
cancel as it is", whose fixture sent no result at all.
- **New work after the cancel was reported:** a command's streamed
start, complete message and result reach the client.
- **Permission requests after the cancel:** they are allowed, for a tool
use that streamed first and for one that only its complete message
holds.
- **Unchanged:** a stopped subagent's late result is still dropped, and
its call closed.
- **Mutation checks:** removing each of the three uses, or widening the
predicate to every subagent, fails at least one test.
**Live, Claude Code 2.1.296,** a v1 cancel of a turn held for a
background subagent that runs a command, on a plain client and an RFD
client: Claude Code stopped the subagent, and its command was closed
after the cancelled response, as on `main`. No schema violations. A
subagent that survives a cancel cannot be set up live today.
`npm run check`, build and the full suite (2983 tests) pass, with no
golden changes.
## Not covered
- **A foreground subagent nested in a background one:** its own Agent
call is not backgrounded, so the closing closes its calls at the cancel,
and the window drops its output, both as before. The two stay
consistent.
On v1, when a cancel stops a model cycle that Claude Code started on its
own, the cycle's open tool calls now end. Before, they stayed `pending`
for good.
## The bug
Example, from a live run (Claude Code 2.1.296, a v1 client):
1. A prompt starts a background command, and its turn ends.
2. The command finishes, and Claude Code starts a cycle on its own: it
launches a foreground subagent, which runs a command.
3. The client sends `session/cancel` while no prompt runs.
Claude Code stops both and sends the Agent call's interrupted result
(`user-rejected`). The client never got it, and the Agent call stayed
`pending`. Before #1336, the subagent's command stayed `pending` too.
**Why:** the window after a cancel drops output once the client has been
told that the stopped work ended (#1313). On v1 that report is the
prompt response, read as "no active turn". A cycle never has a turn, so
from the cancel on, everything it sent counted as late output, including
Claude Code's results for its own tool calls. v2 tracks a cycle as
foreground work and closes its calls before `idle cancelled` (#1339). v1
tracked nothing.
## The fix
- **The agent tracks foreground work on every connection.** Only v2
reports it, through the `foreground` option; v1 gets events that do
nothing (`UNREPORTED_FOREGROUND`). The rules for when a cycle starts and
ends are the ones v2 already uses.
- **On v1, a cycle's end is its result or its idle**
(`workEndReported`). Until then, Claude Code's interrupted results reach
the client. At that end, `closeCancelledCycleToolCalls` closes the calls
that got none, as on v2. After it, the window drops what comes, as
before. A v1 turn's rule is unchanged: no active turn.
- **A held turn's follow-up shares the held turn's closing.** v1 holds a
turn for its background subagents, and the held turn's follow-up is a
cycle too, now on v1 as well. When a second cancel settled the held turn
in `cancelTurns` while the cycle's closing was in flight, the two ran
separate passes. The response then came before the cycle's first report,
and on v2 a call could be closed twice. `closeCancelledCycleToolCalls`
now uses the held turn's closing (`Turn.closingCancelledToolCalls`),
which every settle of the turn waits for. The existing test "closes each
tool call once, before the response, when a cancel settles a held turn
that the consumer is closing" caught this.
## Evidence
**Live, Claude Code 2.1.296, the scenario above**, every update checked
against the schema (no violations):
| Client | Agent call | Subagent's command |
|---|---|---|
| v1, before | `pending` | `failed` (closed by #1336) |
| v1, this PR | `failed`, with Claude Code's own `user-rejected` result
| `failed`, closed at the cycle's end |
| v1 RFD client, this PR | the same | the same, in the child's session |
| v2, this PR | `cancelled`, before `idle cancelled` | `cancelled`,
before `idle cancelled` (unchanged) |
A v1 cancel with a queued prompt, followed by the next prompt, still
left no tool call open, and the next prompt's Write asked for its
permission and ran.
**Tests** (`src/tests/incomplete-tools.test.ts`):
- **#1339's test for v1 now asserts the fix:** a cycle's command gets
Claude Code's interrupted result.
- **New:** the live scenario, where the Agent call gets Claude Code's
result and the subagent's command is closed; and a cycle that ends at an
idle with no result, where its call is closed at the idle and Claude
Code's later result is dropped.
- **#1336's "no turn" fixture** launched the background subagents in a
cycle it never ended before the cancel, so v1 now delivered Claude
Code's real result there. The fixture now ends that cycle, which is the
"cancel while nothing runs" case the tests mean.
- **Mutation checks:** each of these fails at least one test:
- the v1 rule without the cycle;
- no cycles on v1;
- no foreground tracking on v1;
- a separate closing for a held turn's follow-up.
`npm run check`, build and the full suite (2979 tests) pass, with no
golden changes.
## Not covered
- A cycle that ends normally with a `tool_use` that Claude abandoned
keeps that call open.
- A subagent that completes after a cancel keeps its calls open.
## Problem
A permission request is abandoned when Claude Code withdraws it: its
`signal` is raced against the client's answer
(`requestPermissionFromClient`), because the SDK only sends
`$/cancel_request` and keeps waiting for the client's reply, which a
client that ignores the cancel never sends. An elicitation is not raced.
A question that the client leaves open after Claude Code cancels it
never settles, and its request stays open on our side:
- **The session** keeps the question in `openUserInputs`
(`withPendingUserInput`) for good. Steering stays non-interrupting
(`priority: later`) for the rest of the session, and on v2 the next turn
starts as `requires_action` though nothing is open.
- **A child** that asked keeps its `openRequests` up. When it is resumed
later, `resumeChild` reports `requires_action` instead of `running`.
Live, on `main` (Claude Code 2.1.296, v2): the main conversation asks
with AskUserQuestion, the client holds the elicitation and ignores
`$/cancel_request`, the user cancels, then sends a second prompt, "Reply
with just the word hi.":
| | States of the second turn |
| --- | --- |
| `main` | `running`, **`requires_action`**, `idle end_turn` (the answer
"hi" streams while it waits) |
| This PR | `running`, `idle end_turn` |
## Change
One helper, `elicitFromClient`, sends the elicitation and races it
against the callback's `signal`, as `requestPermissionFromClient` does.
The three places that send an elicitation for a callback of Claude Code
use it:
- AskUserQuestion (`handleAskUserQuestion`), the one that a child can
send;
- MCP elicitations (`onElicitation`, `handleMcpElicitation`);
- the refusal-fallback dialog (`onUserDialog`, `handleUserDialog`).
They had the same defect, each tracks its request with
`withPendingUserInput`, and their handlers already read an abort as a
cancel (`{ action: "cancel" }`, `{ behavior: "cancelled" }`, "Tool use
aborted"), so only the wait changes.
Nothing else in the flow needs the answer to arrive. After the
elicitation, a question's tool call ends with Claude Code's own
`tool_result`. A url-mode elicitation completes with the SDK's
`elicitation_complete`, not with the answer. A client that does reply to
the cancel still settles it first, to the same outcome as before.
AIR is unchanged, and the golden files do not change.
## Tests
All of them fail without the helper (checked by removing the race, and
then by reverting each of the three call sites alone):
- `acp-agent.test.ts`, "does not wait for … when its client ignores
cancellation": each of the three paths ends as aborted and leaves
nothing open.
- `acp-agent.test.ts`, "uses priority:'now' again once … is withdrawn":
the existing table of every request that waits for the user (permission,
AskUserQuestion, MCP elicitation, refusal dialog, and a child's
permission request and question), with a client that never settles. The
permission rows are controls that already passed. I moved the table into
a constant so both tests use it.
- `acp-agent.test.ts`: a child's question that Claude Code withdraws,
and a SendMessage resume after its end, reports `running`.
- `acp-v2.test.ts`: the live scenario above: the next turn does not
report `requires_action`.
Removal checks: no race in the helper (9 tests fail), the
AskUserQuestion site reverted (5), the MCP site (2), the dialog site
(2).
`npm run check`, `npm run build` and `npm run test:run` pass (2935
tests).
## Not covered
- **A child's question live.** Claude Code 2.1.296 does not give
subagents AskUserQuestion: a general-purpose subagent, and a custom
agent with `tools: AskUserQuestion`, both reported that they could not
ask. So the child's path is covered by the unit test only. The root's
question runs the same `handleAskUserQuestion`, which the live run above
covers.
- **The root session at a cancel.** Now that the question settles at the
abort, the root reports `requires_action`, `running`, `idle cancelled`
for it, as it already does for a permission request (live, v2). That
flicker comes from `syncAwaitingUser`, and is not changed here.
- A signal that already aborted when the elicitation is sent still sends
it, and cancels it at once. A permission request checks first. Nothing
depends on it.
- The URL elicitation of an MCP server's sign-in
(`authenticateMcpServer`) keeps its own race against the authentication,
and is not a tracked request.
Related, and independent: #1337 reports no `running` for a child's
request that a cancel withdraws. The two PRs touch the same call site
and merge cleanly in either order (checked with `git merge-tree`).
## Problem
For a subagents RFD client, a subagent's child session reports
`requires_action` while one of its permission or question requests is
open, and `running` again once its last open request ends (#1322,
`NativeSubagentRuntime.awaitingUser`). A request that ends because the
work was **stopped** is not an answer, but it still reported `running`.
On `main`, with Claude Code 2.1.296, a foreground child whose Bash
permission request is open, and a cancel on the parent:
| What stops the work | States the child reported |
| --- | --- |
| `session/cancel` (v1, and v2 on the child's own stream) | `running`,
`requires_action`, **`running`**, `idle cancelled` |
| `session/close` | `running`, `requires_action`, **`running`**, and
then nothing: a closed session reports no `idle` |
Claude Code's interrupt withdraws the request, so the SDK aborts the
signal of the `canUseTool` call, the adapter sends `$/cancel_request`,
and the request's `finally` reports `running`. The SDK's own report of
the child's end (`task_updated killed`) comes a few ms later (3 to 4 ms
in these runs), so the client shows a child that is being stopped as
working. After a `session/close` nothing corrects it.
## Cause
`awaitingUser` reported `running` whenever the last open request ended,
whatever ended it. A request ends in two ways, the user answers it or
Claude Code withdraws it, and a withdrawal alone does not say whether
the work was stopped. Claude Code also withdraws a request when
something else answers it, and then the child runs on. I ran one such
case, a `PermissionRequest` hook that allows the command after 3 s: the
child worked for 9 more seconds after the withdrawal, and `running` was
right. (The CLI also re-checks a pending ask when its permission context
changes, and withdraws it if that now allows the call. I did not manage
to trigger that: `session/set_mode` to `bypassPermissions` left the
request open in my run.) So "a withdrawn request reports no `running`"
is wrong: that child would sit on `requires_action` for the rest of its
run. Waiting for the child's next update instead does not help either:
in that run the child's first update after the withdrawal came 8 s
later, with the tool's result.
## Change
A request reports no `running` when it was **withdrawn after a cancel
that came while it was open**. Then Claude Code's interrupt withdrew it
as it stopped the child, and the SDK's events report the child `idle`.
- `NativeSubagentRuntime.parentCancelled` (called for `session/cancel`,
and by the teardown of `session/close`) counts the cancels in the RFD
form. It still reports nothing, so #2308 is unchanged: a child that
keeps running keeps its requests and its state.
- `awaitingUser` takes the request's `signal`, which the agent passes
for permission requests and AskUserQuestion (`withChildAwaitingUser`). A
request records the count when it opens. If its signal aborted and the
count changed, its end reports no `running`.
- Everything else is as before: a request that the user answers, also
after the cancel, reports `running`; a withdrawal without a cancel
reports `running`; two overlapping requests report once, when the last
one ends, by how that one ended.
- README: one clause in the work-state bullet of "Subagent sessions".
AIR is unchanged: `awaitingUser` only runs in the RFD form, and the AIR
golden files do not change.
## Evidence
Live runs against Claude Code 2.1.296 (Sonnet), driving `dist/index.js`
over stdio with a client that holds the child's permission request,
validating every update and request against the SDK's JSON schema (0
violations in all runs):
| Run | `main` | This PR |
| --- | --- | --- |
| v1, `session/cancel` | `running`, `requires_action`, `running`, `idle
cancelled` | `running`, `requires_action`, `idle cancelled` |
| v2, `session/cancel` (child's stream) | `running`, `requires_action`,
`running`, `idle cancelled` | `running`, `requires_action`, `idle
cancelled` |
| v1, `session/close` | `running`, `requires_action`, `running` |
`running`, `requires_action` |
| v1, hook allows after 3 s, no cancel | `running`, `requires_action`,
`running`, `idle end_turn` | the same |
Tests (all fail without the rule, as checked by removing it):
- `native-subagents.test.ts`: the cancel withdrawal (and the child's
`idle cancelled` after it); a withdrawal without a cancel (the hook
case, which a simpler "abort means stopped" rule fails); a request that
outlives a cancel and is answered later; a cancel that came before the
request opened; two overlapping requests, in each order.
- `acp-agent.test.ts`: through `canUseTool`, with `agent.cancel` and
`agent.closeSession` aborting the request as Claude Code does, and the
hook case.
- `acp-v2.test.ts`: the child's own `state_update` stream and the
parent's copy.
Removal checks, each run against the three test files: no rule (6 tests
fail), the cancel not counted (6), the agent not passing the signal (3:
agent cancel and close, v2), and the simple "any withdrawal" rule (3:
the hook cases).
`npm run check`, `npm run build` and `npm run test:run` pass (2935
tests; the scenario golden files do not change).
## Not covered
- **A stream end without a cancel.** If Claude Code exits by itself, the
SDK's cleanup aborts every request before the consumer reads the end of
the stream, and nothing at that moment tells it from a hook's
withdrawal. Live (`kill -9` of the CLI): `running`, then `idle`, 1 ms
apart. The session is dead right after. A rule for it would be a timing
one: report `running` for a withdrawal with no cancel one event-loop
turn later, so that `finishAll` goes first. I tried it (`await new
Promise((resolve) => setImmediate(resolve))` before the check in
`awaitingUser`'s `finally`): the `kill -9` run then reports `running`,
`requires_action`, `idle`, and the hook run still reports `running` 1 ms
after the withdrawal. I did not include it. It only works when the end
of the stream reaches `finishAll` in the same turn (a worker shutdown
publishes its failure notice first, for one), and it hides an ordering
assumption about the consumer. Your call.
- **Claude Code stopping a child on its own** (the model's TaskStop)
while its request is open: the same shape, no cancel.
- **The root session on v2** has the same flicker for its own request:
`requires_action`, `running`, `idle cancelled` (live, v2). It comes from
`syncAwaitingUser`, not from this runtime, and is not changed here.
- A background child that outlives a cancel and whose still-open request
a hook then withdraws would report no `running`. Claude Code stops
background children at an interrupt today, so it does not arise.
Related, and independent: a child's AskUserQuestion is not abandoned on
an abort when its client ignores `$/cancel_request` (#1338). The two PRs
touch the same call site and merge cleanly in either order (checked with
`git merge-tree`).
## Problem
On ACP v2, a model cycle that Claude Code starts on its own, such as its
follow-up after a background command finished, is foreground work:
`state_update` `running`, then `idle`. When a cancel stops such a cycle,
the tool calls that it left open can stay `pending` after `idle`
`cancelled`.
Claude Code answers each tool of the main conversation with an
interrupted result, and the adapter delivers it before the cycle's
`idle`. It sends nothing for what a foreground subagent of the cycle
ran, nor for a tool call that Claude abandoned before it ran. No turn
settles at the cycle's end, so `closeCancelledToolCalls` (#1327, #1221)
never runs for it.
Example, live (Claude Code 2.1.296, Sonnet): a background `sleep 6` ends
its turn. When it finishes, Claude Code's follow-up runs a foreground
subagent, which runs a 60 s command, and the client cancels while it
runs:
```
root state_update running <- Claude Code's own cycle
child tool_call gKT4K4 (the subagent's command) pending
... session/cancel ...
root tool_call_update PLh9rB (Agent call) cancelled <- Claude Code's result
child state_update idle cancelled
root state_update idle cancelled
child gKT4K4: still pending, for good
```
## Change
- `closeCancelledCycleToolCalls` ends the open tool calls with the
cancelled report before the cycle's end is reported, at the cycle's
result and at the idle that ends it when no result comes. The calls are
the ones the turn's closing takes: every open call except those of a
background subagent that still runs.
- It applies when a cancel is in effect (`session.cancelled`) and the
cycle is the foreground work (`runsAutonomousCycle`). A turn that took
the cycle over closes its own calls when it settles.
- The loop of `closeCancelledToolCalls` is now `closeOpenToolCalls`, and
its filter is named `closedAtCancel`. These two hunks are the same as in
#1336, so that the PRs merge in any order.
- The follow-up cycle of a turn that v1 holds for its background
subagents is a cycle on v2, and its closing now comes before its `idle`.
It came at the held turn's settle, after it.
## Evidence
**Tests** (6 new):
- `acp-v2.test.ts`: the command of the cycle's foreground subagent ends
`cancelled` in the child's session, after the child's idle and before
the cycle's, once; a tool call that Claude abandoned in the cycle ends
before `idle` `cancelled`; so does one at the idle that ends a cycle
without a result; the follow-up cycle of a held turn closes before
`idle` `cancelled`, and a background subagent that keeps running keeps
its command open; a cycle that the SDK aborted without a cancel is left
to Claude Code's result, which still reaches the client.
- `incomplete-tools.test.ts`: on v1, which reports no cycle, a cancelled
cycle's tool call is not closed (see below).
**Removal checks.** Each of these fails at least one test: no closing at
the result (3), none at the idle (1), closing a cycle that no cancel
stopped (1), without the cycle being the foreground work (2), closing a
running background subagent's calls (1), closing after the cycle's end
is reported (3), the turn's closing taking those calls too (5).
**Live**, every update validated against the SDK's v2 JSON schema (0
violations):
| cancel while Claude Code's cycle runs | `main` | this PR |
| --- | --- | --- |
| a foreground subagent's command | `pending` in the child's session,
after the root's `idle cancelled` | `cancelled` in the child's session,
after the child's idle and before the root's |
| a command of the cycle itself | Claude Code's result, `cancelled`,
before `idle` | the same, unchanged |
`npm run check`, `npm run build` and `npm run test:run` (2930 tests)
pass. No golden file changes. With #1335 and #1336 merged into it, in
any of the six orders, the branches merge without conflicts and all 2948
tests pass.
## Not covered, and a decision for the maintainer
- **v1.** Nothing tracks a cycle on v1, and with no turn active every
result after the cancel is dropped, Claude Code's for the cycle's own
commands too. In the same live run on v1 the Agent call and the
subagent's command both stay `pending`. Closing at the cycle's cancelled
result there would end both, with a made-up status for the Agent call
too. I left it: it changes what v1 clients see for a cancel while idle,
and one existing test (a held turn that the consumer closes while a
cancel settles it inline) fails once the cycle check is removed, so it
is not only a gate. It also touches the post-cancel window of #1061,
which another change owns.
- A cycle that ends without a cancel keeps an abandoned `tool_use` open.
`settleActive` closes that for a turn, and no turn owns a cycle.
- A session that ends or closes with a cycle running ends the cycle as
cancelled without closing its calls.
## Problem
After `session/cancel`, the tool call of a **background** subagent's
command stays `pending` for good when no turn is left to settle.
Example, live (Claude Code 2.1.296, Sonnet): a background subagent runs
`python3 -c "import time; time.sleep(60)"`, and the client cancels while
it runs. Either the session is idle, or v1 holds the prompt open for the
subagent and the cancel settles it at once. Claude Code's interrupt
stops the subagent: the SDK reports `task_updated` `killed` and
`task_notification` `stopped`, and the RFD form reports the child `idle`
`cancelled`. The command's call is never closed, in the root session or
in the child's.
## Cause
#1327 closes a cancelled turn's open tool calls when the turn settles
(`closeCancelledToolCalls`), and leaves a background subagent's calls
open, because the interrupt may not stop it. Here the turn is already
settled (the cancel settled the held turn before the interrupt) or there
is none, and the stop comes after that. Nothing closes the calls then.
Claude Code does send the command's interrupted result. It comes after
the stop reports, so it is output after the work's end, and the
`session.cancelled` check of the user/assistant case drops it, as it
drops everything after that. The raw stream, in the order Claude Code
sends it:
```
task_updated agent patch killed
task_notification agent stopped
task_notification the command's task stopped
user (ptu=agent) tool_result for the command, is_error <- dropped
```
## Change
- **A subagent's stop closes its open tool calls**
(`closeStoppedSubagentToolCalls`), at `task_notification` `stopped` and
at `task_updated` `killed`, after `finishTask` has reported the child
idle. It closes the calls whose recorded parent is that subagent's Agent
call (`Session.toolCallParents`) with the cancelled report that #1327
sends, naming the subagent so that every client form routes it like the
call's other updates.
- **Only where nothing else will end the calls**: a cancel is in effect
(`session.cancelled`), and the client was told that the work ended
(`workEndReported`: the prompt response on v1, `idle` on v2). While the
work runs, a stopped subagent's calls get Claude Code's own result or
`closeCancelledToolCalls` at the work's end, as before.
- The loop of `closeCancelledToolCalls` is now `closeOpenToolCalls`,
which takes the filter for the calls: the turn's closing, named
`closedAtCancel`, skips a running background subagent's calls, and this
closing takes one subagent's. These hunks are the same as in #1339,
which closes the calls of a cycle that Claude Code started, so that the
PRs merge in any order.
- README: one sentence on when such a call ends.
Nothing is closed twice: a closing forgets the call before it reports
it, so a later closing, and the result that Claude Code sends after the
stop, find nothing. The cancel settles a held turn and closes its calls
before it interrupts Claude Code, so the stop reports always come after
that closing.
## Per client form
- **v1 without subagents:** the call goes to the root session, after the
response when the cancel settled a held turn.
- **RFD:** the call ends in the child's session right after the child's
`idle` `cancelled`, as #1327 does at a turn's settle.
- **AIR:** the cancel already ended every child, so the runtime drops
the report (`ignoring late update for terminal subagent`). The call's
state is released, which it was not before.
- **v2:** as RFD. The root reports nothing, since it had no work.
## Evidence
**Tests** (10 new):
- `incomplete-tools.test.ts`: for a held turn and for no turn, the
command ends once with the cancelled report, after the cancel's
response, and the other subagent's command stays open; each of the two
reports ends it alone; a subagent that completed after the cancel is
left alone; one that stopped without a cancel, and one that stopped
while the work still runs, get Claude Code's result, not a made-up
report.
- `acp-agent.test.ts`: the RFD form (the child's session, after its
idle, after the response) and AIR (nothing reaches the ended child).
- `acp-v2.test.ts`: the child's command ends `cancelled` in its session
after its `idle cancelled`, and the root reports nothing more.
**Removal checks.** Each of these fails at least one test: no closing at
the notification (2), none at the patch (1), closing without a cancel
(1), before the work's end is reported (2), at any status of the
notification (1), of the patch (1), every subagent's calls (4), calls of
another parent (7), the turn's closing no longer skipping a running
background subagent (7), the report without the subagent's name (7), and
the closing before the child reports idle (2).
**Live**, 60 s command in a background subagent, cancel 4 s after its
permission request was answered, every update validated against the
SDK's JSON schema (0 violations):
| client | cancel while | `main` | this PR |
| --- | --- | --- | --- |
| v1, no capabilities | the held turn waits for the subagent |
`pending`, response `cancelled` | `failed` 4 ms after the response |
| v1, no capabilities | no turn runs | `pending` | `failed` after the
SDK's first stop report |
| v1, RFD | no turn runs | `pending` in the child's session | `failed`
in the child's session, after its `idle` `cancelled` |
| v1, RFD | the held turn | not run on `main` | `failed` in the child's
session, after the response |
| v1, AIR | the held turn | not closed | report dropped by the runtime,
state released |
| v2 | root idle | `pending` in the child's session | `cancelled` in the
child's session, after its `idle cancelled` |
`npm run check`, `npm run build` and `npm run test:run` (2934 tests)
pass. No golden file changes. With #1335 and #1339 merged into it, in
any of the six orders, the branch merges without conflicts and all 2948
tests pass.
## For the maintainer
- **Closing, not delivering.** Claude Code 2.1.296 sends the result, so
delivering it after the work's end would also end the call, with Claude
Code's text. I closed instead: 2.1.293 sent none for a subagent's call
(#1327), the result comes after the response in the window #1313 closes,
and closing works for both. The cost is the made-up text ("The turn was
cancelled before this tool call returned a result.") in place of Claude
Code's.
## Not covered
- A background subagent that the interrupt does not stop keeps running,
and its calls stay open. Its output after a cancel is dropped until the
next prompt, as before.
- A subagent that completes after a cancel: Claude Code's results for
its calls were dropped, and the calls stay open. Nothing says they were
cancelled, so none is reported. Delivering those results would end them.
- A subagent that a SendMessage resumed: its calls carry the id of the
call that launched it, while the registry holds the SendMessage id.
`runsInBackground` has the same limit.
- The calls of a cycle that Claude Code started on its own are #1339.
## Problem
A tool call that ends without a tool result is closed by a report that
only sets its status (`AcpToolCallRenderer.unfinished`). That happens
after `session/cancel`, for a subagent's command (Claude Code sends no
result for it) or a call that Claude abandoned, and when a turn ends
with a call that has no result (`closeUnfinished` in `settleActive`).
A client that renders terminals (the `terminal_output` /
`terminal_output_delta` extension, and the display terminals of ACP v2)
holds a terminal for a Bash command, which its `tool_call` started with
`_meta.terminal_info`. The closing report did not end it, so the call
shows as ended next to a terminal that never exits.
Example, live (Claude Code 2.1.296, Sonnet): a foreground Agent call
whose subagent runs `python3 -c "import time; time.sleep(45)"`, and
`session/cancel` while it runs. Claude Code answers the Agent call and
sends nothing for the subagent's command, so the adapter closes that
call itself:
- v1 client with `_meta.terminal_output`: `tool_call_update` `failed`,
with no `terminal_exit`.
- v2 client: `terminal_update` with the command, then `tool_call_update`
`cancelled`, and no `terminal_update` that carries an exit.
## Change
- `closeToolCall` is the one function that every closing report goes
through (the cancelled-turn closing and the end-of-turn closing today,
and any closing added later). It now also ends the call's terminal, in
the same update, as the result of a command does. It reads the tool from
the tool use cache before it drops the entry.
- The closings that #1336 and #1339 add go through `closeToolCall` too,
so they end the terminal as well once merged.
- `AcpToolCallRenderer.terminalExit` decides whether the call has a
terminal. It uses the rule that `toolCall` uses to start one, a command
on a client that renders terminals, which is now one private method
(`hasTerminal`) that `toolCall`, `toolUseContent` and `terminalExit`
share.
- The exit code is unknown, since the command ended without a result:
`exit_code: null`, as `endBackgroundTerminal` sends for a background
command. AIR always gets a number and reads 1 for a command that did not
succeed (#1252), so it gets 1. A v2 client gets `terminal_update` with
an empty `exitStatus`.
- `docs/air-extensions.md`: one line in the terminal conventions.
## Evidence
**Tests** (8 new):
- `incomplete-tools.test.ts`: the cancel's closing of a subagent's
command ends its terminal, still names the subagent, and sends
`exit_code: null`; AIR gets `exit_code: 1`; a client without terminals
gets no exit; a subagent's `Read` gets none; a command that ran but got
no result by the end of the turn gets the exit; so does one that Claude
abandoned before it ran.
- `tools.test.ts`: `terminalExit` for Bash, PowerShell, v2, AIR, a
client without terminals, and tools that are not commands.
- `acp-v2.test.ts`: the stopped subagent's terminal exits in the child's
session, after the command's terminal started and before the root's
`idle cancelled`, and the call ends `cancelled`.
**Removal checks.** Each of these fails at least one test: no exit in
`closeToolCall` (5), AIR gets null (2), an exit for a client without
terminals (2), an exit for a tool that is not a command (3), another
terminal id (5), the exit replacing the parent meta (1), the tool read
after the cache entry is dropped (5).
**Live**, each update validated against the SDK's JSON schema (v1
`SessionNotification`, v2 `session/update`), 0 violations. The Agent
call and the subagent's command from the example, cancelled 4 s after
the command's permission request was answered:
| client | `main` | this PR |
| --- | --- | --- |
| v1, `_meta.terminal_output` | closing report `failed`, no
`terminal_exit` | the same update carries `terminal_exit {exit_code:
null, signal: null}` |
| v1, AIR with `terminal_output` | not run on `main` (same code path) |
`terminal_exit` with `exit_code: 1` |
| v2 | `cancelled`, no terminal update | `terminal_update` with
`exitStatus: {}`, then `cancelled`, before the root's `idle cancelled` |
`npm run check`, `npm run build` and `npm run test:run` (2932 tests)
pass. No golden file changes. With #1336 and #1339 merged into it, in
any of the six orders, the branch merges without conflicts and all 2948
tests pass.
## Not covered
- A call that only a permission request announced, whose tool use never
streamed before it was closed, has no entry in the tool use cache. Its
tool is unknown here, so its terminal stays open. This is the lookup
that `AsyncTaskRuntime` uses too (`toolUseCache`, then
`resolvedToolNames`). Covering it needs the tool name where the
permission request emits the call.
- The fallback for a tool result without a tool use
(`toAcpNotifications`) still reports the status only, with no exit.
- The end-of-turn closing is covered by a test only: Claude Code does
not end a turn with an unanswered call on demand.
Closes#1061.
## Where #1061 stands
The incident in #1061 was tool starts streamed after `session/cancel`
that never got a final status, so a client's ledger of open tool calls
kept them forever. Since that report:
- **#1313** drops streamed text, thinking and tool calls of the stopped
work once the client has been told that the work ended (the cancelled
response on v1, `idle cancelled` on v2), while the window after the
cancel is open.
- **#1327** and **#1221** close the tool calls that streamed before that
report, before it is sent.
So a late streamed tool start no longer reaches the client. This PR adds
regression tests for that, and closes the one path that still produced
such a tool call. #1313 named it as not changed: a tool call that the
stopped work creates outside the stream.
## The remaining path
Example: the user sends a second prompt while the first runs, then
cancels. Claude Code had already taken the second prompt off its queue,
so it still runs it, and its answer writes a file. The consumer drops
the stream and the messages of that answer (#1313). But Claude Code asks
for the Write's permission on its control channel:
- **`canUseTool`** created the tool call (`ensureToolCallEmitted`) and
sent the permission request. AskUserQuestion's elicitation goes the same
way.
- **The v2 PreToolUse preview hook** created the tool call with the
Write's patch.
The tool's result is dropped too, so that tool call never ended: the
ghost of #1061, now for tools that need a permission.
## The fix
- **The consumer records each tool use it reaches,** at its streamed
start or, for one that did not stream, at its complete message, with
whether it dropped it. The condition is the stream's existing one, now
`dropsStoppedWorkOutput`: the client was told that the stopped work
ended, and the window after the cancel is open.
- **`canUseTool` denies a dropped tool use without showing anything:**
no tool call, no permission request, no elicitation. The model gets "The
user cancelled this prompt." The **preview hook** sends nothing for it.
- **The control channel runs ahead of the consumer,** which is why #1313
left this open. While a cancel's window may be open, `canUseTool` and
the hook wait until the consumer reaches the tool use. Claude Code
streams the tool use before it asks, so the consumer is usually there
within a few ticks. Example: the next prompt's tool asks while the
session still looks cancelled, because the consumer has not reached that
prompt's echo yet. The wait sees the consumer reach the echo, which
closes the window, and then the tool use, which it shows, so the request
goes out.
- **The wait is bounded:** 2 s, or until Claude Code withdraws the
request. The stream never shows some tool uses, such as
SandboxNetworkAccess's, and those then go out as before.
- **Without a cancel, nothing changes,** not even timing: the check
answers synchronously and adds no tick before the permission request.
## Evidence
**Tests** (`src/tests/acp-agent.test.ts`, "output after a cancel";
`src/tests/acp-v2.test.ts`):
- An abandoned prompt's Write: nothing reaches the client, and the tool
is denied. Claude Code asks before the consumer reaches the tool use,
between its streamed start and its message, after its message, or for a
tool use that did not stream. The same on v2, with Claude Code running
the registered PreToolUse hooks and then `canUseTool`.
- The next prompt's tool, asked while the window still looks open: its
request goes out once the consumer reaches it.
- A tool use the stream never shows: the wait ends when the request is
withdrawn (before it asked, or while it waits), or after the bound, and
then the request goes out.
- **Mutation checks:** removing each of the 11 rules fails at least one
test. That covers the `canUseTool` check, the hook check, the wait,
waiting instead of denying, the stream record, the message record, the
stream's dropped flag, the abort exit, the aborted-signal guard, the
timeout, and the synchronous answer.
**Live, against Claude Code** (v1 and v2, `default` permission mode,
every update checked against the schema):
- After a cancel, the next prompt's Writes asked for their permissions
at once and ran. Nothing was denied, and no tool call stayed open; on v2
the turn went `idle cancelled`, `running`, `requires_action`, `running`,
`idle end_turn`. No schema violations.
- The abandoned prompt's race did not happen live: Claude Code folded
the queued prompt into the cancelled request, and the cancel stopped
both. #1313 could not reproduce it either. The tests follow the order a
direct CLI probe recorded for #1309.
`npm run check`, build and the full suite (2931 tests) pass, with no
golden changes.
## Not covered
- On CLIs without `request_marker_lists_v1`, the window still lasts
until the next prompt's echo, as before.
- A tool that runs without a permission, in `acceptEdits` or
`bypassPermissions` mode, still runs for an abandoned prompt. Nothing of
it reaches the client, since its output is dropped. Stopping such tools
would need the adapter to block tools it is not asked about, which this
PR does not do.
After `session/load` or `session/resume`, Claude Code can resume an
agent that ran before the reload: a SendMessage to it runs it again from
its transcript. The adapter did not know that agent, so it was never
exposed, and its activity was dropped. Now it runs in its session from
before, the agent id, for every subagents RFD client: v1 clients that
declare `subagents` and are not AIR, and every v2 client.
## What Claude Code sends
From a live run, after a resume in a new adapter process:
- `task_started` with the agent id, the **SendMessage** call's id as
`tool_use_id`, and the message as `prompt`.
- The resumed run's messages under `parent_tool_use_id` = the agent's
**original Agent launch id**, from before the reload (the `toolUseId` in
`subagents/agent-<id>.meta.json`), not the SendMessage id.
- The SendMessage result with `resumedAgentId`, then `task_updated` /
`task_notification` as usual.
The runtime found no child for the agent id, and a SendMessage call
establishes no parent, so the child waited for a parent that never came
and was withdrawn when it ended.
## What changes
- **The signal:** an agent that the runtime does not know, resumed by a
SendMessage call that it saw. A new launch never counts: its
`task_started` names an Agent or Task call.
- **`subagentLineage`** (`subagent-history.ts`) reads the agent and its
ancestors from the session's history, root first. The metadata names
each launch call but not who made it, so a launch's parent is the
session whose transcript has the call: the root's, or an agent's. That
is the rule the replay (#1328) uses, so live restore and replay agree.
An agent or ancestor the history cannot place gives an empty lineage.
- **The runtime** (`NativeSubagentRuntime.restore`) registers the agent
and its ancestors under their agent ids and their launch ids. Then it
announces, parent before child, each ancestor that the client was not
told about in this connection, as the RFD requires before the agent's
traffic. An ancestor is announced with no work state, since nothing says
that it runs. Then the agent, as `running`. From there the resume goes
through the existing path (#1321): the SendMessage text is the child's
`session_message`, and its end is `idle`.
- **Unchanged:** an agent the history cannot place stays unexposed, as
the RFD forbids guessing a parent.
- **Load and replay:** after `session/load`, the replay has already
announced the agent. The live resume announces it once more, as
`running`, which repeats an association the client has (the RFD allows
it).
- **Refactor:** `subagentLaunchIds` moves from `acp-agent.ts` to
`subagent-history.ts`, so the replay and the lineage find launches the
same way.
## Evidence
**Live, against Claude Code, with every update checked against the
schema** (no violations):
| Run | Result |
|---|---|
| v1, `session/resume`, SendMessage to a root-level agent |
`subagent_update` running under its old id, the message from the root,
its `PING` in its own session, `idle end_turn` |
| v1, `session/load`, same | The replay announces it; the live resume
after the response runs in the same session |
| v1, `session/resume`, root → coordinator → echoer, SendMessage from
the root to echoer | coordinator announced under the root with no state,
then echoer under coordinator as running, its run in its session, its
`idle` on coordinator |
| v2, `session/resume` without replay, same nested session | as above;
echoer also reports `running` and `idle` as its own `state_update`,
coordinator has none |
Before this change, the first run showed no `subagent_update` at all,
and the child's `PING` was dropped.
**Tests:**
- `native-subagents.test.ts`: restore under the agent id, with routing
by the launch id; ancestors first and with no state; an ancestor
announced once for two agents; output that waited is delivered; restore
at the SendMessage result alone; an agent the history cannot place or
read stays unexposed; no history read for a new launch or a known child.
- `subagent-history.test.ts` (real transcripts on disk): a root-level
agent, a nested agent next to a sibling, an agent whose launch no
transcript has, a nested agent whose ancestor no transcript placed, an
agent without metadata.
- `acp-agent.test.ts`: the agent's own runtime restores an agent from a
history on disk, from the stream Claude Code sends.
- **Mutation checks:** removing each of the 12 rules fails at least one
test.
`npm run check`, build and the full suite (2922 tests) pass, with no
golden changes.
## Not covered
- **AIR** is unchanged: this PR changes only the RFD form, so on AIR an
agent from before a reload still stays unexposed.
- **A fork** cannot resume an agent of the original session, since the
SDK's `forkSession` copies no `subagents/` history.
Bumps the minor group with 14 updates:
| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.293` | `0.3.296` |
|
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript)
| `0.132.1` | `0.133.0` |
|
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
| `26.6.4` | `26.6.5` |
| [prettier](https://github.com/prettier/prettier) | `3.9.9` | `3.9.10`
|
| @anthropic-ai/claude-agent-sdk-darwin-arm64 | `0.3.293` | `0.3.296` |
| @anthropic-ai/claude-agent-sdk-darwin-x64 | `0.3.293` | `0.3.296` |
| @anthropic-ai/claude-agent-sdk-linux-arm64 | `0.3.293` | `0.3.296` |
| @anthropic-ai/claude-agent-sdk-linux-arm64-musl | `0.3.293` |
`0.3.296` |
| @anthropic-ai/claude-agent-sdk-linux-x64 | `0.3.293` | `0.3.296` |
| @anthropic-ai/claude-agent-sdk-linux-x64-musl | `0.3.293` | `0.3.296`
|
| @anthropic-ai/claude-agent-sdk-win32-arm64 | `0.3.293` | `0.3.296` |
| @anthropic-ai/claude-agent-sdk-win32-x64 | `0.3.293` | `0.3.296` |
| [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) |
`8.3.3` | `8.3.4` |
Updates `@anthropic-ai/claude-agent-sdk` from 0.3.293 to 0.3.296
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.296</h2>
<h2>What's changed</h2>
<ul>
<li>Added <code>claude_code_version</code> to the
<code>initialize</code> control response so clients know the CLI version
before the first turn</li>
<li>Added <code>autoCompactWindow</code> to
<code>AgentDefinition</code>, so a subagent can auto-compact earlier
than the main conversation's window</li>
<li>Fixed the <code>sandbox</code> option discarding an inline
<code>settings.sandbox</code> block: the two now merge, the option's
values win, and deny and credential lists from both sides are
combined</li>
<li>Changed the default limit on MCP tool descriptions sent up front and
on MCP server instructions, in-process SDK servers included, from 2,048
to 4,096 characters</li>
<li>Changed permission answers that arrive after a restart to be parsed
like live ones: over 4,096 <code>updatedPermissions</code> entries count
as a denial, and a malformed list is ignored as a whole</li>
<li>Updated to parity with Claude Code v2.1.296</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.296
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.296
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.296
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.296
</code></pre>
<h2>v0.3.295</h2>
<h2>What's changed</h2>
<ul>
<li>Added <code>overageEnabled</code> to <code>SDKRateLimitInfo</code>:
on usage-limit warnings, whether the account has extra usage turned
on</li>
<li>Fixed an MCP server added with <code>mcp_set_servers</code>
sometimes keeping an outdated tool list when another server in the same
request connected later</li>
<li>Fixed assistant text blocks losing their <code>citations</code> in
streamed responses</li>
<li>Fixed Claude being told "disabled by the user" about an
in-process MCP server that was switched off with
<code>toggleMcpServer()</code></li>
<li>Fixed <code>rate_limit_event</code> with status
<code>allowed_warning</code> omitting <code>overageStatus</code>,
<code>overageResetsAt</code> and <code>overageDisabledReason</code>,
which <code>allowed</code> and <code>rejected</code> events already
carry</li>
<li>Changed MCP tool descriptions the model loads through tool search,
including those from in-process SDK servers, to be cut at 16,384
characters instead of 2,048</li>
<li>Changed a permission answer whose <code>updatedPermissions</code>
holds over 4,096 updates, rules and directories to count as a
denial</li>
<li>Changed <code>tool_result_meta[].non_execution_kind</code> to be
absent when a mod withheld the result of a tool that ran without error;
it was <code>permission-rule</code></li>
<li>Changed <code>pasted_content</code> on user messages to be ignored
when it holds over 1,000 entries and blocks in all</li>
<li>Changed how the SDK passes option values to Claude Code: the values
of its named options are now sent in the same argument as their flag
(<code>--flag=value</code>)</li>
<li>Changed <code>tool_use_result</code> for MCP Apps tools:
<code>structuredContent</code> or <code>_meta</code> over 8,388,608 JSON
characters is left off, and <code>_meta.ui</code> with no
<code>ui://</code> resource no longer lifts the ordinary caps</li>
<li>Changed <code>tool_use_result</code> for MCP tools: when a long
result is saved to a file, or cut because it could not be, the text kept
past 500,000 characters is dropped, with a note of how much</li>
<li>Changed <code>tool_use_result</code> for MCP tools: a result
<code>_meta</code> over 1,048,576 JSON characters is left off, except
for SDK-server tools; so is text blocks' <code>_meta</code> that totals
over 65,536</li>
<li>Updated to parity with Claude Code v2.1.295</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.295
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.295
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.295
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.295
</tr></table>
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.296</h2>
<ul>
<li>Added <code>claude_code_version</code> to the
<code>initialize</code> control response so clients know the CLI version
before the first turn</li>
<li>Added <code>autoCompactWindow</code> to
<code>AgentDefinition</code>, so a subagent can auto-compact earlier
than the main conversation's window</li>
<li>Fixed the <code>sandbox</code> option discarding an inline
<code>settings.sandbox</code> block: the two now merge, the option's
values win, and deny and credential lists from both sides are
combined</li>
<li>Changed the default limit on MCP tool descriptions sent up front and
on MCP server instructions, in-process SDK servers included, from 2,048
to 4,096 characters</li>
<li>Changed permission answers that arrive after a restart to be parsed
like live ones: over 4,096 <code>updatedPermissions</code> entries count
as a denial, and a malformed list is ignored as a whole</li>
<li>Updated to parity with Claude Code v2.1.296</li>
</ul>
<h2>0.3.295</h2>
<ul>
<li>Added <code>overageEnabled</code> to <code>SDKRateLimitInfo</code>:
on usage-limit warnings, whether the account has extra usage turned
on</li>
<li>Fixed an MCP server added with <code>mcp_set_servers</code>
sometimes keeping an outdated tool list when another server in the same
request connected later</li>
<li>Fixed assistant text blocks losing their <code>citations</code> in
streamed responses</li>
<li>Fixed Claude being told "disabled by the user" about an
in-process MCP server that was switched off with
<code>toggleMcpServer()</code></li>
<li>Fixed <code>rate_limit_event</code> with status
<code>allowed_warning</code> omitting <code>overageStatus</code>,
<code>overageResetsAt</code> and <code>overageDisabledReason</code>,
which <code>allowed</code> and <code>rejected</code> events already
carry</li>
<li>Changed MCP tool descriptions the model loads through tool search,
including those from in-process SDK servers, to be cut at 16,384
characters instead of 2,048</li>
<li>Changed a permission answer whose <code>updatedPermissions</code>
holds over 4,096 updates, rules and directories to count as a
denial</li>
<li>Changed <code>tool_result_meta[].non_execution_kind</code> to be
absent when a mod withheld the result of a tool that ran without error;
it was <code>permission-rule</code></li>
<li>Changed <code>pasted_content</code> on user messages to be ignored
when it holds over 1,000 entries and blocks in all</li>
<li>Changed how the SDK passes option values to Claude Code: the values
of its named options are now sent in the same argument as their flag
(<code>--flag=value</code>)</li>
<li>Changed <code>tool_use_result</code> for MCP Apps tools:
<code>structuredContent</code> or <code>_meta</code> over 8,388,608 JSON
characters is left off, and <code>_meta.ui</code> with no
<code>ui://</code> resource no longer lifts the ordinary caps</li>
<li>Changed <code>tool_use_result</code> for MCP tools: when a long
result is saved to a file, or cut because it could not be, the text kept
past 500,000 characters is dropped, with a note of how much</li>
<li>Changed <code>tool_use_result</code> for MCP tools: a result
<code>_meta</code> over 1,048,576 JSON characters is left off, except
for SDK-server tools; so is text blocks' <code>_meta</code> that totals
over 65,536</li>
<li>Updated to parity with Claude Code v2.1.295</li>
</ul>
<h2>0.3.294</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.294</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="85d8f8e077"><code>85d8f8e</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="da321bbe62"><code>da321bb</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="799dc78749"><code>799dc78</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.293...v0.3.296">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/sdk` from 0.132.1 to 0.133.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/releases">@anthropic-ai/sdk's
releases</a>.</em></p>
<blockquote>
<h2>sdk-v0.133.0</h2>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add types for the Chat and Cowork unified
analytics metrics</li>
<li><strong>api:</strong> add workflows, multiagent configuration and
thread status filtering to Managed Agents</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>internal:</strong> remove the next branch rule from
CLAUDE.md</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/sdk's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.132.1...sdk-v0.133.0">0.133.0</a>
(2026-10-09)</h2>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add types for the Chat and Cowork unified
analytics metrics</li>
<li><strong>api:</strong> add workflows, multiagent configuration and
thread status filtering to Managed Agents</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>internal:</strong> remove the next branch rule from
CLAUDE.md</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="2979ed5cef"><code>2979ed5</code></a>
release: . 0.133.0</li>
<li><a
href="8486d9bd22"><code>8486d9b</code></a>
Merge pull request <a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/908">#908</a>
from anthropics/synced/published</li>
<li><a
href="e0995e4bde"><code>e0995e4</code></a>
feat(api): add workflows, multiagent configuration and thread status
filterin...</li>
<li><a
href="31eb3bea68"><code>31eb3be</code></a>
codegen metadata</li>
<li><a
href="5127b320bd"><code>5127b32</code></a>
codegen metadata</li>
<li><a
href="f702a46d87"><code>f702a46</code></a>
codegen metadata</li>
<li><a
href="d64e976b4e"><code>d64e976</code></a>
codegen metadata</li>
<li><a
href="9f754653fd"><code>9f75465</code></a>
codegen metadata</li>
<li><a
href="6ec2ea17ac"><code>6ec2ea1</code></a>
chore(internal): remove the next branch rule from CLAUDE.md</li>
<li><a
href="373c33dedf"><code>373c33d</code></a>
codegen metadata</li>
<li>Additional commits viewable in <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.132.1...sdk-v0.133.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `@types/node` from 26.6.4 to 26.6.5
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
Updates `prettier` from 3.9.9 to 3.9.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/releases">prettier's
releases</a>.</em></p>
<blockquote>
<h2>3.9.10</h2>
<ul>
<li>Markdown: Update <code>micromark-extension-gfm-table</code> to fix
the table parse issue on performance (<a
href="https://redirect.github.com/prettier/prettier/pull/20266">#20266</a>
by <a href="https://github.com/fisker"><code>@fisker</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.9.10/CHANGELOG.md#3910">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md">prettier's
changelog</a>.</em></p>
<blockquote>
<h1>3.9.10</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.9.9...3.9.10">diff</a></p>
<h4>Markdown: Update <code>micromark-extension-gfm-table</code> to fix
the table parse issue on performance (<a
href="https://redirect.github.com/prettier/prettier/pull/20266">#20266</a>
by <a href="https://github.com/fisker"><code>@fisker</code></a>)</h4>
<p>See <a
href="4f43ead37b</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1172b82c29"><code>1172b82</code></a>
Release 3.9.10</li>
<li><a
href="d0142273af"><code>d014227</code></a>
Update <code>micromark-extension-gfm-table</code> to fix the table parse
issue on perfor...</li>
<li><a
href="953b908432"><code>953b908</code></a>
Bump Prettier dependency to 3.9.9</li>
<li><a
href="ad8a6bf4fa"><code>ad8a6bf</code></a>
Clean changelog_unreleased</li>
<li>See full diff in <a
href="https://github.com/prettier/prettier/compare/3.9.9...3.9.10">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.3.293 to
0.3.296
Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.3.293 to
0.3.296
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.3.293 to
0.3.296
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.3.293
to 0.3.296
Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.3.293 to
0.3.296
Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.3.293 to
0.3.296
Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.3.293 to
0.3.296
Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.3.293 to
0.3.296
Updates `express` from 5.2.1 to 5.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/expressjs/express/releases">express's
releases</a>.</em></p>
<blockquote>
<h2>v5.3.0</h2>
<h2>Highlights</h2>
<h3>🐞 Bug fixes</h3>
<ul>
<li>
<p>Fixed HTTP header conflict between Content-Length and
Transfer-Encoding in res.send - by <a
href="https://github.com/YuryShkoda"><code>@YuryShkoda</code></a> in <a
href="https://redirect.github.com/expressjs/express/pull/4893">#4893</a></p>
<p>Fixed the behavior of <code>res.send()</code> to prevent conflicts
between <code>Content-Length</code> and <code>Transfer-Encoding</code>
HTTP headers in responses. The <code>Content-Length</code> header in
<code>res.send()</code> is now only added when a
<code>Transfer-Encoding</code> header is not present, complying with the
HTTP specification that states both headers should not coexist in the
same response. ETag generation is unaffected by the presence of a
<code>Transfer-Encoding</code> header - by <a
href="https://github.com/cuishuang"><code>@cuishuang</code></a> in <a
href="https://redirect.github.com/expressjs/express/pull/7459">#7459</a></p>
</li>
</ul>
<ul>
<li>
<p>Upgrade <code>qs</code> to <code>^6.16.0</code>, which fixes <a
href="https://www.cve.org/CVERecord?id=CVE-2026-2391">CVE-2026-2391</a>
(<a
href="https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883">GHSA-w7fw-mjwx-w883</a>),
<a
href="https://www.cve.org/CVERecord?id=CVE-2026-82417">CVE-2026-82417</a>
(<a
href="https://github.com/advisories/GHSA-4mjr-xmp4-gh2g">GHSA-4mjr-xmp4-gh2g</a>)
and <a
href="https://www.cve.org/CVERecord?id=CVE-2026-82562">CVE-2026-82562</a>
(<a
href="https://github.com/advisories/GHSA-x5fp-wj9c-mxmx">GHSA-x5fp-wj9c-mxmx</a>):
<code>arrayLimit</code> bypasses in comma parsing and a denial of
service via an attacker-controlled <code>isBuffer</code> - by <a
href="https://github.com/davetashner"><code>@davetashner</code></a> in
<a
href="https://redirect.github.com/expressjs/express/pull/7057">#7057</a>
and <a
href="https://redirect.github.com/expressjs/express/pull/7478">#7478</a>,
and <a
href="https://github.com/cyphercodes"><code>@cyphercodes</code></a> in
<a
href="https://redirect.github.com/expressjs/express/pull/7305">#7305</a></p>
</li>
<li>
<p>Upgrade <code>proxy-addr</code> to <code>^2.0.8</code>, which fixes
<a
href="https://www.cve.org/CVERecord?id=CVE-2026-90711">CVE-2026-90711</a>
- by <a href="https://github.com/lazerg"><code>@lazerg</code></a> in <a
href="https://redirect.github.com/expressjs/express/pull/7474">#7474</a></p>
</li>
</ul>
<h3>🚀 Improvements</h3>
<ul>
<li>
<p>Allow conditional revalidation for QUERY requests.
<code>req.fresh</code> previously only validated freshness for GET and
HEAD requests, so QUERY responses never returned 304 despite a matching
validator. Since QUERY is a safe, idempotent, and cacheable method that
supports conditional requests, it is now included in the freshness check
- by <a href="https://github.com/Cherry"><code>@Cherry</code></a> in <a
href="https://redirect.github.com/expressjs/express/pull/7366">#7366</a></p>
<pre lang="js"><code>// QUERY /reports with If-None-Match:
"12345"
app.query('/reports', (req, res) => {
res.set('ETag', '"12345"');
res.send(results); // now responds 304 Not Modified
});
</code></pre>
</li>
<li>
<p>Improve HTML structure in <code>res.redirect()</code> responses when
HTML format is accepted by adding <code><!DOCTYPE html></code>,
<code><title></code>, and <code><body></code> tags for
better browser compatibility - by <a
href="https://github.com/Bernice55231"><code>@Bernice55231</code></a>
in <a
href="https://redirect.github.com/expressjs/express/pull/5167">#5167</a></p>
</li>
<li>
<p>When calling <code>app.render</code> with options set to null, the
locals object is handled correctly, preventing unexpected errors and
making the method behave the same as when options is omitted or an empty
object is passed - by <a
href="https://github.com/AkaHarshit">AkaHarshit</a> in <a
href="https://redirect.github.com/expressjs/express/pull/6903">#6903</a></p>
<pre lang="js"><code>app.render('index', null, callback); // now works
as expected
</code></pre>
</li>
<li>
<p>Upgrade <code>content-type</code> to <code>^2.0.0</code>, bringing a
faster parser (~1.5x quicker <code>Content-Type</code>
parsing/formatting in <code>res.send()</code>) along with a behavior
change: <code>res.send()</code> now keeps any existing parameters when
adding the charset and no longer throws on a <code>Content-Type</code>
that fails to parse. <code>type-is</code> is upgraded to
<code>^2.1.0</code> as part of the same change - by <a
href="https://github.com/blakeembrey"><code>@blakeembrey</code></a> in
<a
href="https://redirect.github.com/expressjs/express/pull/7234">#7234</a></p>
<pre lang="js"><code>res.set('Content-Type', 'text/plain;
foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
</code></pre>
</li>
<li>
<p>The default error handler now logs the full error object instead of
only its stack trace, so nested details such as <code>Error.cause</code>
and library-specific properties (e.g. Sequelize's
<code>parent</code>/<code>original</code>) are no longer swallowed - by
<a
href="https://github.com/Nitin-Mohapatra"><code>@Nitin-Mohapatra</code></a>
in <a
href="https://redirect.github.com/expressjs/express/pull/6464">#6464</a></p>
</li>
<li>
<p>Upgrade <code>content-disposition</code> to <code>^2.0.1</code>,
which changes the <code>Content-Disposition</code> header emitted by
<code>res.download()</code>, <code>res.attachment()</code>, and
<code>res.sendFile()</code>: file names that are valid HTTP tokens are
no longer wrapped in quotes. This is equivalent per RFC 6266, but
applications asserting on the exact header bytes should update their
expectations - by <a
href="https://github.com/blakeembrey"><code>@blakeembrey</code></a> in
<a
href="https://redirect.github.com/expressjs/express/pull/7233">#7233</a></p>
<pre lang="js"><code>res.attachment('user.html');
// before -> Content-Disposition: attachment;
filename="user.html"
// after -> Content-Disposition: attachment; filename=user.html
</code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/expressjs/express/blob/master/History.md">express's
changelog</a>.</em></p>
<blockquote>
<h1>5.3.0</h1>
<h2>🐞 Bug fixes</h2>
<ul>
<li>
<p>Fixed HTTP header conflict between Content-Length and
Transfer-Encoding in res.send - by <a
href="https://github.com/YuryShkoda"><code>@YuryShkoda</code></a> in <a
href="https://redirect.github.com/expressjs/express/pull/4893">#4893</a></p>
<p>Fixed the behavior of <code>res.send()</code> to prevent conflicts
between <code>Content-Length</code> and <code>Transfer-Encoding</code>
HTTP headers in responses. The <code>Content-Length</code> header in
<code>res.send()</code> is now only added when a
<code>Transfer-Encoding</code> header is not present, complying with the
HTTP specification that states both headers should not coexist in the
same response. ETag generation is unaffected by the presence of a
<code>Transfer-Encoding</code> header - by <a
href="https://github.com/cuishuang"><code>@cuishuang</code></a> in <a
href="https://redirect.github.com/expressjs/express/pull/7459">#7459</a></p>
</li>
</ul>
<ul>
<li>
<p>Upgrade <code>qs</code> to <code>^6.16.0</code>, which fixes <a
href="https://www.cve.org/CVERecord?id=CVE-2026-2391">CVE-2026-2391</a>
(<a
href="https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883">GHSA-w7fw-mjwx-w883</a>),
<a
href="https://www.cve.org/CVERecord?id=CVE-2026-82417">CVE-2026-82417</a>
(<a
href="https://github.com/advisories/GHSA-4mjr-xmp4-gh2g">GHSA-4mjr-xmp4-gh2g</a>)
and <a
href="https://www.cve.org/CVERecord?id=CVE-2026-82562">CVE-2026-82562</a>
(<a
href="https://github.com/advisories/GHSA-x5fp-wj9c-mxmx">GHSA-x5fp-wj9c-mxmx</a>):
<code>arrayLimit</code> bypasses in comma parsing and a denial of
service via an attacker-controlled <code>isBuffer</code> - by <a
href="https://github.com/davetashner"><code>@davetashner</code></a> in
<a
href="https://redirect.github.com/expressjs/express/pull/7057">#7057</a>
and <a
href="https://redirect.github.com/expressjs/express/pull/7478">#7478</a>,
and <a
href="https://github.com/cyphercodes"><code>@cyphercodes</code></a> in
<a
href="https://redirect.github.com/expressjs/express/pull/7305">#7305</a></p>
</li>
<li>
<p>Upgrade <code>proxy-addr</code> to <code>^2.0.8</code>, which fixes
<a
href="https://www.cve.org/CVERecord?id=CVE-2026-90711">CVE-2026-90711</a>
- by <a href="https://github.com/lazerg"><code>@lazerg</code></a> in <a
href="https://redirect.github.com/expressjs/express/pull/7474">#7474</a></p>
</li>
</ul>
<h2>🚀 Improvements</h2>
<ul>
<li>
<p>Allow conditional revalidation for QUERY requests.
<code>req.fresh</code> previously only validated freshness for GET and
HEAD requests, so QUERY responses never returned 304 despite a matching
validator. Since QUERY is a safe, idempotent, and cacheable method that
supports conditional requests, it is now included in the freshness check
- by <a href="https://github.com/Cherry"><code>@Cherry</code></a> in <a
href="https://redirect.github.com/expressjs/express/pull/7366">#7366</a></p>
<pre lang="js"><code>// QUERY /reports with If-None-Match:
"12345"
app.query('/reports', (req, res) => {
res.set('ETag', '"12345"');
res.send(results); // now responds 304 Not Modified
});
</code></pre>
</li>
<li>
<p>Improve HTML structure in <code>res.redirect()</code> responses when
HTML format is accepted by adding <code><!DOCTYPE html></code>,
<code><title></code>, and <code><body></code> tags for
better browser compatibility - by <a
href="https://github.com/Bernice55231"><code>@Bernice55231</code></a>
in <a
href="https://redirect.github.com/expressjs/express/pull/5167">#5167</a></p>
</li>
<li>
<p>When calling <code>app.render</code> with options set to null, the
locals object is handled correctly, preventing unexpected errors and
making the method behave the same as when options is omitted or an empty
object is passed - by <a
href="https://github.com/AkaHarshit">AkaHarshit</a> in <a
href="https://redirect.github.com/expressjs/express/pull/6903">#6903</a></p>
<pre lang="js"><code>app.render('index', null, callback); // now works
as expected
</code></pre>
</li>
<li>
<p>Upgrade <code>content-type</code> to <code>^2.0.0</code>, bringing a
faster parser (~1.5x quicker <code>Content-Type</code>
parsing/formatting in <code>res.send()</code>) along with a behavior
change: <code>res.send()</code> now keeps any existing parameters when
adding the charset and no longer throws on a <code>Content-Type</code>
that fails to parse. <code>type-is</code> is upgraded to
<code>^2.1.0</code> as part of the same change - by <a
href="https://github.com/blakeembrey"><code>@blakeembrey</code></a> in
<a
href="https://redirect.github.com/expressjs/express/pull/7234">#7234</a></p>
<pre lang="js"><code>res.set('Content-Type', 'text/plain;
foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8
</code></pre>
</li>
<li>
<p>The default error handler now logs the full error object instead of
only its stack trace, so nested details such as <code>Error.cause</code>
and library-specific properties (e.g. Sequelize's
<code>parent</code>/<code>original</code>) are no longer swallowed - by
<a
href="https://github.com/Nitin-Mohapatra"><code>@Nitin-Mohapatra</code></a>
in <a
href="https://redirect.github.com/expressjs/express/pull/6464">#6464</a></p>
</li>
<li>
<p>Upgrade <code>content-disposition</code> to <code>^2.0.1</code>,
which changes the <code>Content-Disposition</code> header emitted by
<code>res.download()</code>, <code>res.attachment()</code>, and
<code>res.sendFile()</code>: file names that are valid HTTP tokens are
no longer wrapped in quotes. This is equivalent per RFC 6266, but
applications asserting on the exact header bytes should update their
expectations - by <a
href="https://github.com/blakeembrey"><code>@blakeembrey</code></a> in
<a
href="https://redirect.github.com/expressjs/express/pull/7233">#7233</a></p>
<pre lang="js"><code>res.attachment('user.html');
// before -> Content-Disposition: attachment;
filename="user.html"
// after -> Content-Disposition: attachment; filename=user.html
</code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="cf6722bf89"><code>cf6722b</code></a>
5.3.0 (<a
href="https://redirect.github.com/expressjs/express/issues/7468">#7468</a>)</li>
<li><a
href="8c2fcfcb7d"><code>8c2fcfc</code></a>
docs: fix typos and a stale API reference in lib comments (<a
href="https://redirect.github.com/expressjs/express/issues/7512">#7512</a>)</li>
<li><a
href="9efc29e280"><code>9efc29e</code></a>
docs: fix pass-through typos (<a
href="https://redirect.github.com/expressjs/express/issues/7509">#7509</a>)</li>
<li><a
href="2717ae3cbf"><code>2717ae3</code></a>
build(deps): bump the github-actions group with 3 updates (<a
href="https://redirect.github.com/expressjs/express/issues/7499">#7499</a>)</li>
<li><a
href="de777714df"><code>de77771</code></a>
build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (<a
href="https://redirect.github.com/expressjs/express/issues/7500">#7500</a>)</li>
<li><a
href="9169cbe112"><code>9169cbe</code></a>
docs: add missing apostrophe in example (<a
href="https://redirect.github.com/expressjs/express/issues/7483">#7483</a>)</li>
<li><a
href="7ef98448f8"><code>7ef9844</code></a>
build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (<a
href="https://redirect.github.com/expressjs/express/issues/7493">#7493</a>)</li>
<li><a
href="3b7e39fe74"><code>3b7e39f</code></a>
deps: bump qs minimum to 6.16.0 (<a
href="https://redirect.github.com/expressjs/express/issues/7478">#7478</a>)</li>
<li><a
href="98bd4cd96b"><code>98bd4cd</code></a>
deps: proxy-addr@^2.0.8 (<a
href="https://redirect.github.com/expressjs/express/issues/7474">#7474</a>)</li>
<li><a
href="9a34acf03c"><code>9a34acf</code></a>
fix(res.send): preserve ETag generation with Transfer-Encoding (<a
href="https://redirect.github.com/expressjs/express/issues/7459">#7459</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/expressjs/express/compare/v5.2.1...v5.3.0">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for express since your current version.</p>
</details>
<br />
Updates `vite` from 8.3.3 to 8.3.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>v8.3.4</h2>
<h3>Features</h3>
<ul>
<li><strong>bundled-dev:</strong> support
<code>import.meta.hot.acceptExports</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23463">#23463</a>)
(<a
href="bc0f21c56a">bc0f21c</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>avoid mutating hmr defaults (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23575">#23575</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23576">#23576</a>)
(<a
href="574d5e3519">574d5e3</a>)</li>
<li><strong>build:</strong> correct preloads when chunkImportMap is
enabled with non-root base (<a
href="https://redirect.github.com/vitejs/vite/issues/23698">#23698</a>)
(<a
href="2a8c0f05c7">2a8c0f0</a>)</li>
<li><strong>build:</strong> wait for in-flight stylesheets in preload
helper (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23652">#23652</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23662">#23662</a>)
(<a
href="036b74599b">036b745</a>)</li>
<li><strong>bundled-dev:</strong> serve <code>/@vite/client</code> and
stub <code>@vite/env</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23664">#23664</a>)
(<a
href="5afc5a8876">5afc5a8</a>)</li>
<li><strong>client:</strong> skip rewriting unchanged adopted styles (<a
href="https://redirect.github.com/vitejs/vite/issues/23697">#23697</a>)
(<a
href="fa7146938b">fa71469</a>)</li>
<li><strong>css:</strong> resolve imported preprocessors from their file
path with lightningcss (<a
href="https://redirect.github.com/vitejs/vite/issues/23688">#23688</a>)
(<a
href="cf52011c46">cf52011</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23648">#23648</a>)
(<a
href="8a4c19cfc0">8a4c19c</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23649">#23649</a>)
(<a
href="794516d50c">794516d</a>)</li>
<li><strong>dev:</strong> a restart requested during a restart used to
be dropped (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23392">#23392</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23484">#23484</a>)
(<a
href="70d56ea184">70d56ea</a>)</li>
<li>don't treat modules ending with js-like query as js (<a
href="https://redirect.github.com/vitejs/vite/issues/23687">#23687</a>)
(<a
href="fcb6f1252a">fcb6f12</a>)</li>
<li><strong>html:</strong> avoid adding filesystem root to watcher (<a
href="https://redirect.github.com/vitejs/vite/issues/23689">#23689</a>)
(<a
href="3a7f2aea75">3a7f2ae</a>)</li>
<li><strong>html:</strong> skip caching CSS of chunks in a cycle (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23628">#23628</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23636">#23636</a>)
(<a
href="15d82f7dc6">15d82f7</a>)</li>
<li><strong>optimizer:</strong> scan deep imports with custom extensions
(<a
href="https://redirect.github.com/vitejs/vite/issues/23678">#23678</a>)
(<a
href="8579189bae">8579189</a>)</li>
<li>remove input option unescaping for now (<a
href="https://redirect.github.com/vitejs/vite/issues/23694">#23694</a>)
(<a
href="facc2fb1ff">facc2fb</a>)</li>
<li><strong>server:</strong> match static aliases on path boundaries (<a
href="https://redirect.github.com/vitejs/vite/issues/23643">#23643</a>)
(<a
href="b28db28e9e">b28db28</a>)</li>
<li><strong>watcher:</strong> normalize file before root check in
<code>ensureWatchedFile</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23673">#23673</a>)
(<a
href="12bb28c223">12bb28c</a>)</li>
</ul>
<h3>Performance Improvements</h3>
<ul>
<li><strong>module-runner:</strong> skip cloning call sites that have no
source map (<a
href="https://redirect.github.com/vitejs/vite/issues/23646">#23646</a>)
(<a
href="3d674869a5">3d67486</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li><strong>bundled-dev:</strong> import CSS HMR helpers from
<code>/@vite/client</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23674">#23674</a>)
(<a
href="182f5b2a65">182f5b2</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.3.3...v8.3.4">8.3.4</a>
(2026-10-08)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li><strong>bundled-dev:</strong> support
<code>import.meta.hot.acceptExports</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23463">#23463</a>)
(<a
href="bc0f21c56a">bc0f21c</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>avoid mutating hmr defaults (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23575">#23575</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23576">#23576</a>)
(<a
href="574d5e3519">574d5e3</a>)</li>
<li><strong>build:</strong> correct preloads when chunkImportMap is
enabled with non-root base (<a
href="https://redirect.github.com/vitejs/vite/issues/23698">#23698</a>)
(<a
href="2a8c0f05c7">2a8c0f0</a>)</li>
<li><strong>build:</strong> wait for in-flight stylesheets in preload
helper (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23652">#23652</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23662">#23662</a>)
(<a
href="036b74599b">036b745</a>)</li>
<li><strong>bundled-dev:</strong> serve <code>/@vite/client</code> and
stub <code>@vite/env</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23664">#23664</a>)
(<a
href="5afc5a8876">5afc5a8</a>)</li>
<li><strong>client:</strong> skip rewriting unchanged adopted styles (<a
href="https://redirect.github.com/vitejs/vite/issues/23697">#23697</a>)
(<a
href="fa7146938b">fa71469</a>)</li>
<li><strong>css:</strong> resolve imported preprocessors from their file
path with lightningcss (<a
href="https://redirect.github.com/vitejs/vite/issues/23688">#23688</a>)
(<a
href="cf52011c46">cf52011</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23648">#23648</a>)
(<a
href="8a4c19cfc0">8a4c19c</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23649">#23649</a>)
(<a
href="794516d50c">794516d</a>)</li>
<li><strong>dev:</strong> a restart requested during a restart used to
be dropped (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23392">#23392</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23484">#23484</a>)
(<a
href="70d56ea184">70d56ea</a>)</li>
<li>don't treat modules ending with js-like query as js (<a
href="https://redirect.github.com/vitejs/vite/issues/23687">#23687</a>)
(<a
href="fcb6f1252a">fcb6f12</a>)</li>
<li><strong>html:</strong> avoid adding filesystem root to watcher (<a
href="https://redirect.github.com/vitejs/vite/issues/23689">#23689</a>)
(<a
href="3a7f2aea75">3a7f2ae</a>)</li>
<li><strong>html:</strong> skip caching CSS of chunks in a cycle (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23628">#23628</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23636">#23636</a>)
(<a
href="15d82f7dc6">15d82f7</a>)</li>
<li><strong>optimizer:</strong> scan deep imports with custom extensions
(<a
href="https://redirect.github.com/vitejs/vite/issues/23678">#23678</a>)
(<a
href="8579189bae">8579189</a>)</li>
<li>remove input option unescaping for now (<a
href="https://redirect.github.com/vitejs/vite/issues/23694">#23694</a>)
(<a
href="facc2fb1ff">facc2fb</a>)</li>
<li><strong>server:</strong> match static aliases on path boundaries (<a
href="https://redirect.github.com/vitejs/vite/issues/23643">#23643</a>)
(<a
href="b28db28e9e">b28db28</a>)</li>
<li><strong>watcher:</strong> normalize file before root check in
<code>ensureWatchedFile</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23673">#23673</a>)
(<a
href="12bb28c223">12bb28c</a>)</li>
</ul>
<h3>Performance Improvements</h3>
<ul>
<li><strong>module-runner:</strong> skip cloning call sites that have no
source map (<a
href="https://redirect.github.com/vitejs/vite/issues/23646">#23646</a>)
(<a
href="3d674869a5">3d67486</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li><strong>bundled-dev:</strong> import CSS HMR helpers from
<code>/@vite/client</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23674">#23674</a>)
(<a
href="182f5b2a65">182f5b2</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b6c20f6a81"><code>b6c20f6</code></a>
release: v8.3.4 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23702">#23702</a>)</li>
<li><a
href="b28db28e9e"><code>b28db28</code></a>
fix(server): match static aliases on path boundaries (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23643">#23643</a>)</li>
<li><a
href="bc0f21c56a"><code>bc0f21c</code></a>
feat(bundled-dev): support <code>import.meta.hot.acceptExports</code>
(<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23463">#23463</a>)</li>
<li><a
href="fa7146938b"><code>fa71469</code></a>
fix(client): skip rewriting unchanged adopted styles (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23697">#23697</a>)</li>
<li><a
href="2a8c0f05c7"><code>2a8c0f0</code></a>
fix(build): correct preloads when chunkImportMap is enabled with
non-root bas...</li>
<li><a
href="3a7f2aea75"><code>3a7f2ae</code></a>
fix(html): avoid adding filesystem root to watcher (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23689">#23689</a>)</li>
<li><a
href="facc2fb1ff"><code>facc2fb</code></a>
fix: remove input option unescaping for now (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23694">#23694</a>)</li>
<li><a
href="70d56ea184"><code>70d56ea</code></a>
fix(dev): a restart requested during a restart used to be dropped (fix
<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23392">#23392</a>...</li>
<li><a
href="cf52011c46"><code>cf52011</code></a>
fix(css): resolve imported preprocessors from their file path with
lightningc...</li>
<li><a
href="fcb6f1252a"><code>fcb6f12</code></a>
fix: don't treat modules ending with js-like query as js (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23687">#23687</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite/commits/v8.3.4/packages/vite">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Refs #1061.
> Reworked on top of #1327, which merged in the meantime and already
closes a cancelled turn's open tool calls in the consumer. This PR now
covers the one path #1327 does not reach. The original description is
kept at the end.
## What it fixes
When a cancel lands on a turn that already has its result, `cancelTurns`
settles the turn itself instead of leaving it to the consumer:
- a turn held open for its background subagents, while the session is
idle;
- a turn waiting on its checkpoint preview.
That path skipped #1327's `closeCancelledToolCalls`, so a tool call
still open there stayed `pending` after the cancelled response.
`cancelTurns` now runs the same closing before it responds.
## Changes
- **One rule for both paths.** The consumer exposes its closing as
`Session.closeCancelledToolCalls`, the way it already exposes
`nativeSubagentDeliver`. Every open call ends with
`AcpToolCallRenderer.unfinished`, except a background subagent's calls,
which the cancel did not stop.
- **The closing runs once per turn** (`Turn.closingCancelledToolCalls`).
Example: a first cancel lands during a held turn's follow-up cycle, so
the consumer settles the turn at the idle and starts closing its calls.
A second cancel then settles the turn inline. It waits for the
consumer's closing instead of starting its own, so each call gets one
report and the response comes after all of them.
- **`cancelTurns`** marks the turn settled before it waits for the
reports, so the consumer cannot settle it again. If a report fails, it
logs the error and still responds and interrupts.
- **Removed:** this PR's original consumer-side branch and its `failed`
report, which #1327's closing replaces.
## Tests
- **Kept from this PR:** inline settles of a deferred turn and of a
checkpoint turn, overlapping and simultaneous cancels, a failed report,
a checkpoint that finishes during the closing.
- **Changed:** the deferred fixture's background shell had no tool
result, though Claude Code answers a `run_in_background` call when it
starts. It is now a background subagent whose own command stays open.
- **Removed:** `terminates a tool whose start streams in after the
cancel`, which #1327 covers.
- **New:** a second cancel that settles a held turn while the consumer
is closing its calls.
- **Removal checks:** removing the inline closing fails 6 tests, the
once-per-turn closing 1, settling before the wait 2, and the error
handling 1.
`npm run check`, build and the full suite (2909 tests) pass, with no
golden changes.
## Not covered
A tool start that streams in after the turn has settled (the incident in
#1061) still opens a tool call that nothing closes. Neither this PR nor
#1327 changes that.
<details>
<summary>Original description</summary>
Refs #1061. This closes part of the issue, not all of it; the part it
leaves open is described below.
## What it fixes
`settleActive` already fails every unfinished foreground tool when a
turn ends as `end_turn` ("Claude ended the turn without returning a
result for this tool"). It did nothing when the turn settled as
`cancelled`, so a tool start that never got a `tool_result` stayed in
`emittedToolCalls` and the client was left with an open `tool_call`
forever.
How a start can end up with no terminal: the `stream_event` case has no
`session.cancelled` gate, so `content_block_start` for a `tool_use`
keeps becoming a `tool_call` after `cancel()`. The consolidated
`user`/`assistant` path, which is where `tool_result`-derived terminals
come from, drops everything at its `session.cancelled` guard.
This adds a `cancelled` branch next to the `end_turn` one. It reuses the
same selection (this turn's `foregroundToolCallIds` still in
`emittedToolCalls`, minus confirmed background tasks) and sends one
`tool_call_update` with `status: "failed"` per tool ("The turn was
cancelled before this tool call finished."). ACP's `ToolCallStatus` has
no cancelled value, so `failed` is the available terminal. Unlike
`end_turn`, cancellation is expected, so there is no session failure and
no early return.
## What it does not fix
A tool start that arrives **after** the turn has already settled (the
reporter's incident: starts streaming in minutes after the cancel).
There is no unsettled turn to attach it to, and I could not find an
exact gate: stream events carry no `origin` or turn attribution (the
existing comment on `emittedAssistantText` says as much), so such a
start cannot be told apart from an autonomous cycle or from the next
turn's pre-echo events. Gating on `session.cancelled` has the inverse
problem the reporter described. If maintainers see an attribution signal
I missed, a lifecycle-scoped gate would be the complement to this
change.
## Test changes
- `preserves cancellation and does not attribute its unfinished tool to
the next turn` asserted that the cancelled turn's tool gets **no**
`failed` update. That encoded the old behaviour, so it now asserts
exactly one cancellation terminal that the next turn neither repeats nor
reports as `incomplete_tool_call`. The cancel-then-next-prompt
assertions are unchanged.
- New: `terminates a tool whose start streams in after the cancel`
(start arrives between `cancel()` and the trailing idle).
Both fail without the change and pass with it. Full suite (2127 tests),
`npm run check` and `build` pass. One unrelated timeout in
`acp-scenarios` (`schema check`) showed up under load in one full run
and passes when run on its own.
## Live check
Against the built adapter (real credentials), I asked for `sleep 45`,
cancelled once the `tool_call` appeared, and listed every tool call and
its statuses at the end. Before and after the change the result is the
same: one tool call, `pending > ... > failed`, nothing open. So in the
plain cancel-mid-tool case the SDK already delivers an interrupted
result and there is no ghost to remove; I could not reproduce the
reporter's leak live, only in the unit fixture above. What the live run
does show is that the new branch does not send a duplicate terminal for
a tool that was already terminated.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_019vH6BXrsYQN3MqQ93JgStf
</details>
---------
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
A replay now restores subagents for a client on the [subagents
RFD](https://github.com/agentclientprotocol/agent-client-protocol/blob/main/docs/rfds/subagents.mdx)
form: a v1 client that declares `subagents` and isn't AIR, and every v2
client. Until now, its replay left children out. **AIR's replay is
unchanged.**
## The rules
The RFD asks that replayed children keep their original session ids and
known parentage, and that announcements come before child traffic. It
forbids guessing a parent or inventing an id, and asks that known gaps
be made apparent. It also requires all selected history before the
response.
- **Ids:** each child replays under the session id it had live, the SDK
agent id. Claude Code's `subagents/agent-<id>.meta.json` names the Agent
or Task call that launched agent `<id>`.
- **Order:**
- The child is announced on the session that made the launch, right
after the launch, with the same labels as live: the `name` and the role
as `title`, and the short `description`.
- Its own transcript then goes to the child session.
- A nested child is announced on the child that launched it.
- **Incoming messages:** the child's prompt is a `session_message` with
the launch's id and the parent as sender, as live. A message that a
SendMessage call delivered (`origin.kind: "coordinator"`) is matched to
its call by the call's text. Claude Code frames it with a preface and an
instruction, so the match checks that the delivered text contains the
call's message. It then has the SendMessage's id, text, and sender, as
live; without a match, its transcript id and the delivered text.
- **Harness text:** other user text in a child's transcript, such as
"[Request interrupted by user for tool use]", isn't shown, as the live
child session doesn't show it. Tool results stay.
- **Ends:** every child's end is an `idle` before the response. The end
comes from the first of these that applies:
1. its last persisted task notification (its task id is the agent id)
2. `cancelled`, if `meta.json` says the user stopped it
3. its foreground launch's result (a background launch's result is only
its launch)
4. otherwise, `idle` with no stop reason
- **Gaps:**
- A launch without metadata has no known id, so it isn't announced; its
Agent call stays an ordinary tool call of the parent. A child whose
transcript can't be read replays only its association, as the RFD
allows.
- Either case adds one notice for a client that takes notices: "Some
subagent history is not available".
- A subagent message that the session transcript stores inline is left
out, since the child's history comes from its own transcript. Current
Claude Code doesn't store such messages.
- **v2:** a replayed child's messages are cleared before their first
replayed chunk, as the parent's already are. A v2 client may still hold
them.
## Changes in the code
- **`src/subagent-replay.ts` (new):** `RfdSubagentReplay` holds the
replay's children, deliveries, and ends. The replay loop in
`acp-agent.ts` calls it at the launch, for each child message, and at
the end.
- **`subagentHistory`:** returns each launch's whole metadata record
(name, role, description, background, stopped by the user). AIR and the
RFD form share `readSubagentMessages`.
- **The v2 bridge:** registers a child that a replay announces as
replaying too.
## Evidence
- **Live, v1:** I loaded a real Claude Code session from a live run: a
foreground `scout` resumed once by SendMessage, and a background
`sleeper` that a cancel stopped.
- Both children replay under their live agent ids, with their labels.
- `scout`'s prompt and its SendMessage delivery have exactly the ids and
senders the live run used (`toolu_…HvPNZm` and `toolu_…cB3K9t`, from the
root).
- `scout` ends `end_turn`, and `sleeper` ends `cancelled`, from
`stoppedByUser`.
- **Live, v2:** the same session over v2 with replay. There were no v2
schema violations, each child's state is mirrored on its own stream, and
all of it comes before the resume response.
- **Tests:**
- v1: a full replay order with a nested child, a matched delivery,
dropped harness text, the ends, and the notice for a launch without
metadata; ends for a stopped child and for one with no known end; inline
subagent messages left out.
- v2: a child's replayed message is cleared on the child session.
- **Mutation checks:** removing any of the rules fails a test:
- the v2 child registration
- the RFD replay
- the delivery match
- the inline skip
- `stoppedByUser`
- ignoring a background launch's result
- dropping harness text
- the notice
- **Golden files:** only the v2 `session-load-replay` changes. It gains
the notice, because its Task launch has no metadata. The AIR golden
files are unchanged.
- **Checks:** `npm run check`, build and all 2886 tests pass.
## Not in this PR
- **A SendMessage after a reload:** a SendMessage to an agent from
before a reload still finds no known child in the live runtime, so the
agent stays unexposed. A follow-up registers the replayed children, and
the children of a resume without replay, in the runtime.
## Release
Titled `feat:`, since a v1 client on the RFD form gets new replay
output. Retitle it if you'd rather not release it.
## Problem
After `session/cancel`, a tool call that was still running never gets a
final status. On `main` (Claude Code 2.1.293, a v1 client that declares
no capabilities) all three of these stay `pending` for good:
- the root's own Bash call, cancelled while its command runs;
- a foreground Agent call;
- the Bash call of that Agent's subagent, which this client sees as a
root tool call with `_meta.claudeCode.parentToolUseId`.
v2 has the same problem, and so does the subagents RFD form: the
subagent's call stays pending in the child's session after the child
reports `idle cancelled`. Found in the live run of #1257.
## Cause
I recorded the raw SDK stream (`emitRawSDKMessages`) and the session
transcripts of a live run on `main`. There are two gaps.
1. **The window drops Claude Code's interrupted result.** For the root
Bash and the Agent call, Claude Code does send a result, inside the
post-cancel window of #1309 and #1313, before the turn's `result`: a
`tool_result` with `is_error: true`, stamped `non_execution_kind:
"user-rejected"`, then `[Request interrupted by user for tool use]`,
then the aborted result. The `if (session.cancelled) break;` in the
`user`/`assistant` case drops it.
2. **The subagent's call gets no result at all.** Claude Code writes its
interrupted result only to the subagent's own transcript
(`<session>/subagents/agent-*.jsonl`). The stream never carries it,
before or after the response, so no change to what the window delivers
can reach it.
Nothing else closes these calls. `closeUnfinished` runs only at
`end_turn`, over the turn's `foregroundToolCallIds`, and that set holds
none of the three: `task_started` removes a Bash or Agent call from it
(`registerLiveTask`), and a subagent's call is never in it.
## Change
Two rules, in the stream consumer:
- **Deliver the real result.** Until the client is told that the stopped
work ended (the prompt response on v1, `idle` on v2), the window
delivers the `tool_result` of a tool call that the client holds open,
with Claude Code's own text and `nonExecutionKind`. Only the tool call
is updated. The other effects of a tool result (async tasks, plan state,
the ExitPlanMode flow) stay dropped, and so does everything after that
report, which is what #1313 closed.
- **Close what has no result.** When a turn settles `cancelled` because
of `session/cancel`, the adapter closes every tool call still open with
`AcpToolCallRenderer.unfinished`, before it resolves the turn. That
covers the subagent's call, a `tool_use` that Claude abandoned before it
ran, and every call when the stream gives no results (the force-cancel
backstop). Both protocols end the work at `turn.resolve`, so one rule
serves v1 and v2.
Supporting pieces:
- The closing report names the subagent that made the call
(`Session.toolCallParents`, bounded like `dispatchedToolCalls`), so the
subagent runtime routes it with the call's other updates: to the child
session in the RFD form (an idle child still takes updates), to no child
that AIR ended, to the root for a client without subagents.
- A **background** subagent that the SDK has not reported ended keeps
its calls open. The RFD form lets a child run on through a cancel
(`NativeSubagentRuntime.parentCancelled`). Two tests merged with #1320
failed against my first version, which closed those calls, and that is
why the registry exists. A foreground subagent ends with the work that
waits on it.
- For a v2 client, an error result in the window is `cancelled`,
whichever kind Claude Code stamps. CLI 2.1.293 stamps a command that the
interrupt killed `user-rejected`, which `isAbortedToolResult` reads as a
refusal (`failed`). A tool that finished as the cancel landed stays
`completed`. A v1 client gets `failed`, as before, since v1 has no
`cancelled`.
- `unfinished` gets a `cancelled` variant: "The turn was cancelled
before this tool call returned a result."
- The rule applies to `session/cancel` only (`session.cancelled`), not
to the ExitPlanMode "keep planning" outcome, which also ends a turn
`cancelled`.
- README: one sentence on what an RFD client gets at a cancel.
## Why both rules
| | root Bash | Agent call | subagent's Bash |
| --- | --- | --- | --- |
| Deliver the real result only | fixed | fixed | **still pending** (no
result in the stream) |
| Close every open call only | fixed, made up | fixed, made up | fixed,
made up |
| Both (this PR) | Claude Code's result | Claude Code's result | made up
|
Closing alone would fix all three, but it throws away a result that
Claude Code already sent: its text, and the `nonExecutionKind` that lets
a client tell a rejection from an interruption. So the real result goes
out where one exists, and the adapter makes up a status only for what
Claude Code never reports. The Agent call ends first, then its
subagent's call, in the same turn and before the response.
## What does not change
- Output after the report stays dropped. A test pins that the tool of a
prompt the cancel abandoned, which a permission request announces after
the response, gets no result (it fails with the `workEndReported` check
removed).
- A result for a call the client does not hold open sends nothing and
logs nothing.
- AIR ends every child at the cancel, and the runtime drops every later
update to an ended child. The closing reports go through the same
routing and are dropped there, so nothing reaches an ended child (the
live AIR run logs one `ignoring late update for terminal subagent`).
- No golden file changes. None has a cancel, and the diff touches none.
## Evidence
**Live** (Claude Code 2.1.293, Sonnet, each tool call's statuses before
and after the prompt response; the probe allows each permission request
after 1.5 s and cancels 4 s later, with `python3 -c "import time;
time.sleep(30)"` so the command runs; every update is checked against
the SDK's v1 schema):
| | root Bash | Agent call | subagent's Bash | after the response |
| --- | --- | --- | --- | --- |
| `main`, plain v1 | `pending` | `pending` | `pending` | 0 updates |
| this PR, plain v1 | `failed`, Claude Code's text | `failed`, Claude
Code's text | `failed`, closed here | 0 updates, 0 schema violations |
| this PR, RFD client | `failed` | `failed` | `failed`, in the child's
session after its `idle cancelled` | 0 updates, 0 violations |
| this PR, AIR | `failed` | hidden, as before | none: the child ended,
and the runtime dropped the closing update | 0 updates |
| this PR, v2 | `cancelled` | `cancelled` | `cancelled`, in the child's
session, before the root's `idle cancelled` | 0 updates |
The plain and v2 runs are on this commit. The RFD and AIR runs were on
this change before it was rebased onto #1324 and #1325, which change the
v2 subagent surface and the routing of a subagent's hook update, and not
the cancel path. In the raw stream, the subagent's Bash has
`task_notification stopped` and no result. Its transcript has the
`is_error` result.
**Tests** (16 new, one rewritten, one extended), scripted in the order
recorded live:
- `incomplete-tools.test.ts`, plain client: the real result of a running
tool; an Agent call and its subagent's call; the force-cancel backstop;
a start that streams in after the cancel; a result after the response; a
stray result; an abandoned prompt's tool; a background subagent's call
left open; a call that a permission request announced and a later update
attributed; the registry's cleanup.
- `acp-agent.test.ts`: the RFD form (the stopped child's call closed in
its session, the running child's left open, the Agent call's result) and
AIR (nothing to an ended child, including a permission-announced call).
- `acp-v2.test.ts`: `cancelled` for the Agent call and its subagent's
call before `idle cancelled`, `completed` for a tool that finished, and
a cycle that Claude Code started.
- `preserves cancellation and does not attribute its unfinished tool to
the next turn` asserted that the cancelled turn's tool gets no `failed`
update, which is the behavior this PR changes. It now asserts one
report, before the cancelled response and not attributed to the next
turn.
**Mutation checks.** Each of these fails at least one test: no delivery
of the real result (8), no closing at the settle (10), delivery after
the report (1), delivery for calls the client does not hold open (1),
closing a running background subagent's calls (3), no parent on the
report (3), v2 real result not `cancelled` (2), `unfinished` not
`cancelled` on v2 (1), the closing text (4), `ran` ignored (2), the
registry kept after a call ends (1, added after the first run showed
that nothing caught it), the parent recorded only from a `tool_call`
(1), the v1 end-of-work signal on v2 (3), AIR's drop of updates to an
ended child removed (5).
`npm run check`, `npm run build` and `npm run test:run` (2898 tests)
pass.
## Related, and not covered
- #1221 closes the turn's `foregroundToolCallIds` at a cancelled settle
with a made-up `failed`. It overlaps with this change in `settleActive`
and in the test above, so the two will conflict. As far as I can tell
from `registerLiveTask`, it would not have closed the three calls here.
Its scenario, a start that streams in after the cancel, is covered by a
test here. #1221 also hooks the inline settle of a held turn in
`cancelTurns`, which this PR does not touch.
- Not covered: a background subagent's calls when a cancel stops it
while no turn settles (a cancel while idle, or of a held turn that
`cancelTurns` settles inline); the calls of a v2 cycle that Claude Code
started get Claude Code's results, but nothing closes the ones it sends
none for.
- The closing report carries no terminal exit, so a client that shows
command output sees the command's call end without one.
`closeUnfinished` does the same at `end_turn`.
- A background subagent whose end the SDK reports only after the turn's
result keeps its calls open. Claude Code 2.1.293 reports it before.
Adds subagents to the experimental [ACP
v2](https://agentclientprotocol.com/protocol/v2/overview) surface. With
them, it covers v2's baseline session model, so this is the `feat:` that
announces v2 support. The README gains a section on how to enable it and
what it serves.
Based on #1324, a v1 fix that this PR's golden scenarios exposed. Merge
#1324 first; this PR then retargets to `main`.
## Experimental ACP v2
Started with `CLAUDE_AGENT_ACP_EXPERIMENTAL_V2=1`, the adapter serves
the draft ACP v2 to a client that asks for protocol version 2 or later
in `initialize`, and v1 to every other client, as before.
- **Served on v2:**
- the session baseline (`session/new`, `list`, `resume` with replay,
`close`, `prompt`, `cancel`)
- `session/delete`, `session/fork`, and additional directories
- config options (the mode is one), plans, notices, compaction
- display terminals for commands
- permission requests, elicitation, providers, auth
- and now subagents
- **v1 only for now:** steering and the AIR extensions.
The draft can still change, and the surface changes with it.
## What changes
The [subagents
RFD](https://github.com/agentclientprotocol/agent-client-protocol/blob/main/docs/rfds/subagents.mdx)
makes subagent updates part of v2's baseline: "support is assumed rather
than negotiated".
- **Every v2 client gets subagents.** The v2 bridge declares `subagents`
in the v1 request it makes for a v2 client (`v1InitializeRequest`), so
the agent reports each Agent or Task subagent in the RFD form from
#1320–#1322.
- **The updates pass through:** `subagent_update`, `session_message` and
`session_message_chunk` have the same shape in v1 and v2.
- **The child's state goes to its own stream too.** v2 reports a child's
work state on the child's own stream, mirrored on the parent. So a
`subagent_update` with a `state` also becomes the child's
`state_update`, sent right after the parent's copy
(`v2ChildStateUpdate`). The announcement thus comes first, and both
copies of a state come before any later one, as the RFD requires. This
covers `requires_action`, and a failed child's `idle`/`error` with its
JSON-RPC `error`.
- **A state the RFD doesn't define throws,** as an update kind the
surface doesn't translate already does. The SDK types the open members
of v1's and v2's `StateUpdate` apart, so the bridge checks each state
against the RFD's before passing it on.
- **Replay doesn't flatten a child's inline text onto the root.** On
replay, a subagent's text goes to the root only for a client that gets
it there live: one without native subagent sessions that asked for the
flattened transcript. Before, an RFD client (v1, and now v2) got the
inline subagent text of a transcript replayed on the root, though the
RFD form doesn't replay children yet. Current Claude Code keeps subagent
messages in `subagents/`, not inline, so only the `session-load-replay`
scenario's inline message showed it. AIR's replay is unchanged.
## Live run
Against real Claude Code (Sonnet), with a v2 client that checks every
`session/update` and permission request against the SDK's v2 schema,
there were no schema violations:
- **Launch:**
- the child is announced on the root, then reports its own `running`,
then gets its prompt as a `session_message` from the root
- its tool calls arrive on its session, each with a title on its first
report
- the Agent call's 35-second heartbeat stays on the root
- **Permission:**
- `requires_action` appears on the child's stream and on the parent's
copy, and on the root, whose turn waits on the child
- the request goes to the child's session
- then the child is back to `running`
- **SendMessage resume:**
- the same child session runs again, with the root as sender
- the root turn goes idle while the resumed child keeps running, and the
child reports `idle`/`end_turn` later, which v2 allows for background
work
- **Cancel:** the child is `idle`/`cancelled` on both streams, then the
root is `idle`/`cancelled`.
- A tool call still running at the cancel never gets a final status.
That's a known bug on `main` for every client, fixed in a separate PR.
## Tests
- **End to end on v2:** an Agent call whose child fails with an SDK
error. Traffic arrives in order on both streams, and the child's `idle`
carries `error: { code: -32603, message }`.
- **Unit:**
- the pass-through of the three updates
- the child's `state_update`, and no copy for an association update
without a state
- the throw for a state and a stop reason the RFD doesn't define
- **v2 golden files:**
- the six subagent scenarios now show the RFD form: announcements,
prompts, child sessions, both copies of each state, and permission
requests on the child session
- `session-load-replay` is unchanged from `main`
- the scenarios also check every message against the v2 schema, and that
each tool call's first report has a title (that check found #1324)
- **Mutation checks:** each of these fails tests:
- not declaring `subagents`
- dropping the child's copy
- sending it before the parent's
- dropping the state check
- dropping the replay rule
- **v1 golden files:** unchanged.
- **Checks:** `npm run check`, build and all 2882 tests pass. CI runs
only on PRs to `main`, so I ran `ci.yml` on this branch by hand.
## Release
Titled `feat:`, so its title becomes the release note that announces v2.
## Problem
A PostToolUse hook update skipped the subagent router, for every client
with native subagent sessions (AIR's draft and the subagents RFD form):
- **A child's Edit or Write:** its final diff went to the **root**
session, with `parentToolUseId` set. All its other reports go to the
child session, so the client got an update for a tool call it doesn't
have on the root, and the child's tool call never got its final diff.
The RFD forbids moving a tool call between sessions.
- **AIR's hidden Agent/Task call:** AIR's draft hides the Agent/Task
tool call, but its hook update reached AIR anyway, for a tool call AIR
never received.
AIR's golden files had recorded both.
## Cause
`toAcpNotifications` registers a tool's PostToolUse hook the first time
it sees the `tool_use`, with the client passed to it. Claude Code
streams, so that first time is a stream event, and the stream path
passed `this.client` instead of the routed client that every other path
uses. The hook's update then went straight to the client.
## Change
The stream path passes the routed client, so a hook update goes through
`sendUpdate` and the subagent router like every other update. That
client is the only one the stream path uses.
Clients without native subagent sessions are unchanged: the router
passes their updates through as they are.
## Evidence
- **New test:** a child's Edit that is streamed, completed, and then
gets its PostToolUse hook. All the Edit's reports, including the hook's
diff, go to the child session. Without the fix, the hook's report goes
to the root (`Set{ 'agent-42', 'test-session' }`).
- **AIR golden files**, both intended:
- `subagent-task-legacy`: the child Edit's hook update (`locations`)
moves from `<session>` to `agent_1`, and the hidden Task call's hook
update is gone.
- `subagent-agent-async`: the hidden Agent call's hook update is gone.
In both cases it was the only report AIR got for that tool call.
- **How it was found:** declaring subagents for ACP v2 clients (the next
PR) runs the RFD form through the v2 golden scenarios, whose check that
a tool call's first report has a title caught the root-session diff.
- **Checks:** `npm run check`, build and all 2878 tests pass.
The third of three stacked PRs that replace #1257. It's based on #1321,
so its diff shows only the `requires_action` part. Merge #1320 and #1321
first; this PR then retargets to `main`.
1. #1320: the RFD form for a v1 client that declares `subagents` and
isn't AIR.
2. #1321: a child keeps its session across SendMessage resumes.
3. **This PR:** `requires_action` while a child's request is open.
**AIR is unchanged.**
## What changes
The [subagents
RFD](https://github.com/agentclientprotocol/agent-client-protocol/blob/main/docs/rfds/subagents.mdx)
reports a child that waits for the user as `requires_action`.
- **While a request is open:** a child whose permission or question
request is open reports `requires_action` on its parent, then `running`
again when its last open request ends
(`NativeSubagentRuntime.awaitingUser`). The agent wraps the permission
and elicitation requests of a child session in it
(`withChildAwaitingUser`).
- **Overlapping requests** keep `requires_action` until the last one
ends. A child that ended while it waited doesn't report `running` again.
- **A resume while a request is open** reports `requires_action`, not
`running`.
## Live run
Against real Claude Code (Sonnet), a child's Bash permission request
showed `running` → `requires_action` while the request was open →
`running` once it was answered. No schema violations.
## Follow-ups (low severity, not in this PR)
- **Brief `running` after a withdrawal:** after a cancel withdraws a
child's request, the child briefly reports `running` before the SDK's
stop event. The same happens at a stream end, whose cleanup aborts every
pending request.
- **Ignored cancel requests:** AskUserQuestion's `createElicitation` is
not raced against the abort. If a client ignores `$/cancel_request`, the
child's open-request count stays up, and a later resume reports
`requires_action`.
## Tests
- **End to end:** `requires_action` around a child's permission request.
The cancel test now also expects the background child's
`requires_action` before the cancel.
- **Runtime:** overlapping requests, a child that ended while it waited,
and a resume with an open request.
- **Checks:** `npm run check`, build and all 2877 tests pass on this
branch, whose tree is #1257's with `main` merged in. CI runs only on PRs
to `main`, so I ran `ci.yml` on this branch by hand.
The second of three stacked PRs that replace #1257. It's based on #1320,
so its diff shows only the resume part. Merge #1320 first; this PR then
retargets to `main`.
1. #1320: the RFD form for a v1 client that declares `subagents` and
isn't AIR.
2. **This PR:** a child keeps its session across SendMessage resumes.
3. #1322: `requires_action` while a child's permission or question
request is open.
**AIR is unchanged:** it keeps a new session per generation, as in its
draft.
## What changes
The [subagents
RFD](https://github.com/agentclientprotocol/agent-client-protocol/blob/main/docs/rfds/subagents.mdx)
gives a child one session id across every delegation to it. With #1320
alone, a resumed child stays `idle`.
| RFD | With #1320 | Now |
| --- | --- | --- |
| One session id per child, across delegations | a resumed child stays
`idle`, and its resumed work isn't shown | the child runs again in the
same session, under the SDK agent id. The CLI runs a resumed agent under
the SendMessage call's tool id, so that call becomes the child's current
delegation: the resumed run's output and end reach the child |
| The parent's message to the child is an incoming `session_message` |
only the launch prompt | each SendMessage that resumes the child is a
`session_message` with the SendMessage tool use's id. Its sender is the
session that made that call, or left out when unknown. A repeated resume
signal doesn't repeat it |
Out-of-order events, from the reviews of #1257:
- **Late end:** the end of an earlier delegation ends nothing
(`isStaleEnd`). It also no longer settles the resumed run's live task at
the agent level.
- **Late result:** a SendMessage result that arrives after its run ended
resumes nothing (`isEndedDelegation`).
- **Early output:** a resume's output that arrives before its
`task_started` is buffered, then delivered to the child.
- **Reused id:** a run under an id the child used before ends the run,
since the SDK falls back to it.
- **Running patch:** a `task_updated` running patch reports `running`
without its guessed prompt or call.
## Live run
Against real Claude Code (Sonnet), a SendMessage to a finished child ran
it again in the same session. Its message arrived with the SendMessage's
id and the root as sender, and the turn waited for the resumed run. No
schema violations.
## Tests
- **End to end:**
- a SendMessage resume under the SendMessage's tool id: one session, two
prompts, the resumed output in the child, a stale end ignored
- the resumed run's live task kept when an earlier delegation's end
arrives late
- a late SendMessage result
- **Runtime:**
- reuse and resume
- a resume's output buffered before its `task_started`
- the sender of a resume's prompt: the root, a child, or unknown
- a run under a reused id
- a running patch
- a result without a text
- **Mutation checks during #1257's reviews:** removing any of these
rules fails tests.
- **Checks:** `npm run check`, build and all 2873 tests pass on this
branch. CI runs only on PRs to `main`, so I ran `ci.yml` on this branch
by hand.
The first of three stacked PRs that replace #1257, split for review.
Together they bring v1 clients the [subagents
RFD](https://github.com/agentclientprotocol/agent-client-protocol/blob/main/docs/rfds/subagents.mdx),
as revised by agentclientprotocol/agent-client-protocol#2281 and #2308.
**AIR is unchanged**: its golden files don't change.
1. **This PR:** the RFD form for a v1 client that declares `subagents`
and isn't AIR.
2. #1321: a child keeps its session across SendMessage resumes.
3. #1322: a child reports `requires_action` while its permission or
question request is open.
Merge them in that order. Each later PR is based on the previous branch,
so its diff shows only its own part.
## Who gets what
- **AIR** (any client that declares `_meta.jetbrains.air`): the earlier
draft it implements, exactly as before. That's `subagent_spawned`,
`subagent_state_update`, a session per generation, the hidden Agent/Task
tool call, and draft replay. AIR keeps it whichever signal it declares.
- **A v1 client with `clientCapabilities.subagents` that isn't AIR:**
the RFD form below. SDK 1.8.0 types it (`subagent_update`,
`session_message`, the v1 `StateUpdate`).
- **Without either signal:** nothing changes.
`subagentForm` (`src/acp-subagents.ts`) picks the form.
`NativeSubagentRuntime` keeps the routing, buffering and nested lineage,
and renders either form.
## The RFD form
| RFD | Before | Now |
| --- | --- | --- |
| Announce the child before any of its traffic | `subagent_spawned {
name, task, prompt }` | `subagent_update { sessionId, title,
description, state: { state: "running" } }` |
| `description` is the role or purpose, "not a transcript of
instructions" | `task` was the prompt | `title`: the agent's `name`,
with its role (`subagent_type`) after it, else the role. `description`:
the Agent input's short `description` |
| The parent's message to the child is an incoming `session_message` |
`prompt` on the announcement | a `session_message` in the child's
transcript, with the Agent/Task tool use's id and the session that made
the call as sender |
| Delegation tools stay tool calls | the Agent/Task tool call was hidden
| it stays a tool call of the session that made it, with the report its
model got. Its heartbeats and result stay there too |
| Work-state snapshots, not a terminal lifecycle | `completed`,
`failed`, `cancelled`, `disconnected` | `running`; `idle` with
`end_turn`, `cancelled`, or `error` with the SDK's error text as its
JSON-RPC `error`; `idle` with no stop reason for work that ended without
a known reason (a worker restart, or still running when the stream ends)
|
| `idle` isn't terminal | later updates were dropped | an idle child
still gets its updates, such as its background work's |
| A cancel stops the work it waits on; other descendants are up to the
Agent (#2308) | `session/cancel` ended every child as cancelled | the
adapter ends no child itself. Claude Code's interrupt stops the
foreground children, and currently background ones too; each reports
`idle`/`cancelled` from the SDK's events, and the foreground ones'
requests are withdrawn |
| Never guess a parent | a child that ended before its spawning frame
was announced under the root | it stays unexposed. A nested child waits
for its parent's announcement |
| Never move a tool call | | a tool call that a permission request
emitted on the root before its child was announced stays on the root
after a cancel. AIR keeps the cancel's cleanup, since its draft ends
every child there |
| No agent-side capability | `sessionCapabilities.subagents` for every
client | for AIR only |
## Not in this PR
- **SendMessage resumes** (#1321). Until then a resumed child stays
`idle`. Requests find a child by its agent id, so only the permission
and question requests of the resumed run appear in its session. A resume
never opens a second session for the child, which the RFD forbids, and a
test pins that.
- **`requires_action`** (#1322).
- **Replay** doesn't expose children yet. Today's replay invents
`<session>:replay-subagent:<id>` ids, and the RFD requires the original
ones. The RFD makes child replay a SHOULD, so an RFD client's replay
leaves children out until the replay PR.
## Settled during the review of #1257
- **Cancel cascade:** the RFD leaves background children to the Agent
(#2308). An agent-level test pins #2308's validation scenario.
- **Session ids across forks:** the raw SDK agent id stays the session
id. The SDK's fork copies no subagent history, so a fork can't repeat an
id under another root. The reasoning is on `nextChildSessionId`.
- **Held turns:** the adapter holds a v1 prompt open while a background
subagent the turn started runs. A cancel still settles the prompt.
## Live run
Against real Claude Code (Sonnet), with a v1 client that declares
`subagents` and checks every update and permission request against the
SDK's v1 schema, there were no schema violations:
- **Launch:** `running` with the title (`scout (general-purpose)`) and
description, the prompt as a `session_message` from the root, and the
child's tool calls in its session. Then `idle`/`end_turn` before the
Agent call completes on the root.
- **A 40-second child:** the Agent call's heartbeat and result stay on
the root. Before the fix, they moved to the child, because the heartbeat
named the Agent call as its own parent.
- **Cancel:** a foreground child is `idle`/`cancelled` 15 ms after
`session/cancel`, and the prompt returns `cancelled`. Claude Code
stopped a background child too (its metadata says `stoppedByUser`).
- **Found on `main`, for every client, and fixed separately:** after a
cancel, a tool call that was running never gets a final status.
## Tests
- **AIR:** the end-to-end tests of the earlier draft run with an AIR
client that declares `nativeSubagentSessions` (`AIR_NATIVE_SUBAGENTS`).
The AIR golden files are unchanged.
- **RFD, end to end:**
- announcement and prompt
- a failure with the SDK's error, also when the error arrives after the
failure
- a stop, and a worker-restart orphan
- no draft updates
- the cancel per #2308
- the raced tool call after a cancel, kept on the root, with AIR's
cleanup kept
- the Agent call's heartbeat
Every update is checked against the SDK's v1 schema.
- **RFD, runtime:**
- the visible control tool call, also nested
- labels, also from a late frame
- an unparented child staying unexposed, and a nested child announced
only after its parent
- nothing reported at the parent's cancel
- the end of the stream, and `unknown`
- a resume opening no second session
- **Plain/Zed comparison with origin/main:** it now allows the missing
agent capability, which `compare.ts` documents.
- **Mutation checks during #1257's reviews:** removing any of these
rules fails tests.
- **Checks:** `npm run check`, build and all 2863 tests pass.
## Release
Titled `feat:`, because it changes what a v1 client that declares
`subagents` receives.
### Summary
Addresses [IJAI-2956](https://youtrack.jetbrains.com/issue/IJAI-2956).
- Recognize Central only when the active key source is `apiKeyHelper`
and its effective helper command contains the whole word `central` and
the word sequence `proxy start`, case-insensitively, allowing multiple
whitespace characters.
- Read the effective command through the existing `SettingsManager`/SDK
settings resolution, including project/managed overrides, rather than
reimplementing configuration merging or executing helpers.
- Return `kind: gateway` and the exact label `JetBrains Air Gateway`,
without `detail` or invented account identity. URL, flags, routes, and
endpoint ownership are intentionally not checked: this is an agreed weak
display heuristic, not proof of provenance or entitlement.
- Render ordinary helpers as `API key helper` instead of raw
`apiKeyHelper`; do not expose unknown key-source identifiers. Preserve
external backend and client-owned configuration priority, CLI/SDK
merging, stale-probe protection, and duplicate suppression.
- Add mapper and ACP-agent regression coverage for positive/negative
commands, overrides, CLI/SDK results, and source changes; update
`docs/air-extensions.md`.
Examples matching the heuristic include `central proxy start` and
`/opt/bin/CeNtRaL PrOxY StArT --arbitrary-flag`. `decentralized proxy
start`, `central start`, and an inactive helper do not match.
### Sanitized auth status
```json
{
"kind": "gateway",
"label": "JetBrains Air Gateway"
}
```
No helper command, key, header, private route, or invented account
information is sent.
### Verification
Based on fresh upstream `main` at `0724b17`, rechecked immediately
before publication. Changes and rebuilt `dist` are available in the main
local clone; the user confirmed the local adapters work.
```bash
npm run build
npm run lint
npm run test:run
```
- Build and lint passed.
- Full test suite: **2484 passed, 30 existing skipped** across 44 passed
test files and 4 skipped files.
- No new skip flags or disabled tests were used.
### Scope
No AIR UI, provisioning, personal configuration migration, effort/mode
changes, or new ACP protocol. Plan files and personal configurations are
not committed.
---------
Co-authored-by: Junie <junie@jetbrains.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Andrey Bragin <andrey.bragin@jetbrains.com>
## Problem
A v1 report's `_meta` belongs to that report, and the agent gives each
report its own `_meta.claudeCode` keys. A v2 client stores a tool call's
`_meta`, and any report that carries `_meta` replaces it
(`tool-calls.mdx`; the migration guide since
agentclientprotocol/agent-client-protocol#2355). So a v2 client kept
only the last report's keys. For example, a result's `{ toolName }`
replaced the denial reason that came before it. On top of that, a
PostToolUse hook stored the whole `tool_response` in `_meta`, which for
a Write is the whole file text.
## Change
All of this is v2 only. No v1 or AIR output changes, and no v1 golden
changes.
- **Stored `_meta` (`src/v2/tool-call-meta.ts`).** The v2 bridge keeps
each tool call's `_meta` the way the client stores it. `claudeCode` keys
merge one by one, and every other key replaces whole, the same model
`ToolCallFieldTracker` uses.
- A report that changes the stored `_meta` carries all of it.
- A report that changes nothing carries no `_meta`, which leaves the
stored value unchanged.
- A permission request's subject always carries the stored `_meta`,
since a client can show the request on its own.
- The tool call's first report starts from nothing.
- **`toolName` becomes `name`.** `claudeCode.toolName` repeats the
tool's name, which v2 has a field for. It becomes the `name` of a tool
call that has none yet, and is left out otherwise. A memory recall gets
a `name` this way. Subagent routing still reads `toolName` on the
agent's v1 reports, before the bridge.
- **The `toolResponse` AIR gets.** A v2 client also keeps `_meta`, so it
gets AIR's trimmed `toolResponse`:
- a hook carries only the `status` and `isAsync` markers, not output the
content already shows;
- a denial carries the SDK message only when it differs from the reason.
## Evidence
- **v2 goldens:** 28 change. Most only lose `toolName`. Hook reports
lose the repeated stdout or file text. Memory recall gains `name`. The
denial keeps its reason type and message. Subagent tool calls and their
permission subjects keep `parentToolUseId`.
- **Live, CLI 2.1.293 on Haiku, v2:** a Write and a Bash command arrived
with `name` on their first report and no `_meta` at all.
- **Tests:** 7 unit tests for the stored `_meta`.
- **Mutation checks:** removing any of these 9 rules fails at least one
test:
- naming once;
- leaving `toolName` out;
- merging with earlier `claudeCode` keys, which also fails the
`subagent-late-child-update` golden;
- keeping other keys;
- omitting unchanged `_meta`;
- starting fresh;
- the subject's stored `_meta`;
- the bridge wiring;
- the trimmed `toolResponse`.
Forgetting a closed session's tool calls is memory cleanup that no test
observes, like `V2Terminals.forget`. A limit of 2048 tool calls also
bounds the memory.
- `npm run check`, build and all 2820 tests pass.
## Problem
The v1 schema says a forked session is active once the agent responds,
and can be prompted without `session/load` or `session/resume`
(agentclientprotocol/agent-client-protocol#2359). `session/fork` only
copied the transcript, so prompting the new id failed with "Session not
found" until the client loaded or resumed it.
## Change
- **The fork starts the new session the way a resume does.** It starts
from the copied transcript, with the model and the permission mode that
transcript records, and with the request's `cwd`, MCP servers,
additional directories and `_meta`. The response carries the session's
`modes` and `configOptions`, and the available commands follow it, as
for `session/new`.
- **A client that loads or resumes after a fork keeps working.** A later
`session/load` replays the history into the running session, and a later
`session/resume` returns it. Neither starts a second Claude Code
process. A load or resume with other settings restarts the session, as
for any loaded session. The fingerprint that decides this ignores the
AIR fork point in `_meta`.
- **Cost:** each fork now starts a Claude Code process. That added about
0.65 s to the fork response in the live run.
- **v2:** the v2 fork used to resume the forked session itself. It now
uses the session that the v1 fork starts, so the v2 bridge drops its own
resume.
- **AIR docs:** `docs/air-extensions.md` now says, under the session
fork point, what a load or resume after a fork does.
## Evidence
**Live, CLI 2.1.293 on Haiku, over v1:**
1. A new session answered "Remember the codeword PELICAN" with `OK`.
2. `session/fork` returned the fork with mode `auto` and the `mode`,
`model` and `effort` config options.
3. Prompting the fork right away returned `PELICAN`, with no load or
resume in between.
4. A `session/load` of the fork then replayed its history and was ready
in 4 ms. The timing log shows one session start for the fork and none
for the load, and a further prompt still answered.
**Tests:**
- New: the fork can be prompted at once, and its response carries modes
and config options; a later resume and load reuse the session; and the
fork fails when its session can't start.
- The existing fork tests now also check that the session starts from
the fork, with the request's additional directories.
- The v2 fork tests pass unchanged.
- **Mutation checks:** removing the start, the response's `modes`, or
the additional directories each fails a test.
- `npm run check`, build and all 2813 tests pass, with no golden
changes.
## Summary
When the user approves a plan through ExitPlanMode, a v2 client now gets
it as the session's markdown plan. The update uses the draft's unstable
plan operations:
```json
{ "sessionUpdate": "plan_update", "plan": { "type": "markdown", "planId": "plan-mode", "content": "# Plan…" } }
```
Until now a v2 client saw the plan only in the "Approve Plan" tool call
and its permission request.
## Behavior
- **Its own plan id.** The approved plan has the id `plan-mode`, and the
TodoWrite checklist keeps `plan`, so the client shows both. Claude Code
keeps one plan file per session and rewrites it on a later plan mode, so
each approval replaces the plan before it. Nothing removes it.
- **A normal approval** is a successful ExitPlanMode result. The plan
follows the tool call's result, live and on replay.
- **Live:** the plan comes from the tool's structured output, which
includes edits the user made to the plan.
- **Replay:** the SDK's `getSessionMessages` drops the structured
output, but the transcript keeps the `plan` that Claude Code adds to the
tool's input.
- **An approval that clears the context** ends the tool with an error
result. The restart into the fresh context publishes that plan, after
the new mode and config options and before the fresh context runs. It
does so only once that context exists, so a cancel or a failed restart
leaves no plan behind that was never carried out.
- **Not published:** a rejected plan, a subagent's plan
(`parent_tool_use_id` or `isAgent`), a plan still waiting for its team
lead, and an empty plan. Plans are trimmed.
- **Who gets it.** The agent sends plan operations only to a client that
advertises v1's draft `plan` capability, as the v1 draft requires. The
v2 bridge advertises it for every v2 client and passes `plan_update` and
`plan_removed` through unchanged, since the shapes match. No v1 client
advertises `plan` today, so v1 behavior doesn't change.
## Replay limits
- **After a "clear context" approval, replay doesn't show that plan.**
It reads the transcript from before the clear, where the approval is the
deny, so it shows the plan approved before that, or none. Replay never
reaches the conversation after a clear, so this is part of an existing
gap.
- **A plan approved before a compaction boundary isn't replayed**, like
the rest of the history before it.
- **Replay can't apply the subagent and team-lead checks**, since they
come from the structured output that `getSessionMessages` drops. A
subagent's transcript still carries its `parent_tool_use_id`, so it's
skipped.
## Evidence
**Live, CLI 2.1.293 on Haiku, through the adapter on v2 in plan mode:**
- **Normal approval:** the plan arrived right after "Exited Plan Mode",
and resuming with replay republished it.
- **"Clear context":** the plan arrived after the switch to auto mode,
before the fresh context's first tool call.
- **Raw SDK probe:** the structured result carries `plan`, `isAgent` and
`filePath`, and the transcript's tool use keeps `plan` and
`planFilePath`.
**Tests and checks**
- **Result path:** unit tests for each rule and for the order. They
include structured output versus input, input-only as on replay, and
structured output with no plan.
- **Restart path:** coordinator tests check that the plan comes after
the session state and before the continuation, that a client without the
capability gets none, and that a failed restart publishes none.
- **Agent:** a client that advertises `plan` gets the restart's plan,
and one that doesn't gets nothing.
- **v2:** a replay test and translation tests. The v2
`exit-plan-approve` golden gains the plan update. `exit-plan-reject` and
every v1 golden are unchanged.
- **Mutation checks:** removing any rule on either path fails at least
one test. That covers both capability checks, the agent's capability
wiring, success only, structured output first, the order, trimming, and
the `plan_removed` pass-through.
- `npm run check`, build and all 2810 tests pass.
## Problem
After a cancel, the consumer drops the main conversation's consolidated
`assistant`/`user` messages until Claude Code starts a model request
that serves none of the cancelled prompts (#1309). `stream_event` frames
skipped that check. Claude Code always streams, so when it had already
taken an abandoned prompt off its queue, the prompt's answer still
streamed to the client as deltas. Only the consolidated copy was
dropped.
That output arrives after the cancel has been reported: on v1 after the
turn's `cancelled` response, and on v2 after `idle cancelled`, outside
any cycle. Both protocol versions require an agent's updates to come
before that report. Streamed tool calls leaked the same way.
#1309's tests missed this because they scripted only consolidated
messages.
## Change
- **After the client has been told the stopped work ended**, while the
window is still open, streamed text, thinking and tool calls are dropped
like the consolidated messages they belong to. On v1 that report is the
turn's prompt response (no active turn). On v2 it's the idle state (no
open foreground work). The v2 signal also covers cycles that Claude Code
starts on its own and turns that v1 holds for their subagents.
- **Before that report**, what the interrupt flushes still streams, as
it does today. Both drafts allow updates between the cancel and the
cancelled report, and the text is in Claude Code's transcript, so a
reload shows it anyway. Existing tests pin this: v2's queued-prompt
cancel, a held turn cancelled mid-follow-up, and a cancel that arrives
during a buffered backlog.
- **A prompt that is merely queued no longer keeps the window open.**
#1309 held the window while any queued prompt was unsettled. So a
follow-up that Claude Code ran ahead of a prompt sent after the cancel
lost its consolidated copy, and with this change it would have lost its
streamed copy too. Now a request holds the window only when:
- the stopped turn is still unsettled;
- an abandoned prompt's result is still expected;
- the request names a cancelled prompt; or
- the request names an unsettled prompt. That covers one that arrived
while the cancel was still awaiting, before the cancel records it.
- **Per-block drop latch.** Where the consolidated message delivers the
text, a stream that loses a delta keeps dropping until its streamed-text
record resets: at the next message, or when a consolidated message
consumes the record. If a window closes mid-block (an older CLI's late
prompt echo), the record holds nothing, so the consolidated message
delivers the whole block once. Without the latch the record would hold
only the tail, which isn't a prefix of the text, and the client would
get the tail and then the whole text again. A client that gets subagent
text only streamed has no consolidated copy to fall back on, so its
subagent streams don't latch.
- Bookkeeping for dropped events (message id, usage, compaction
heartbeat) is unchanged.
## Evidence
**Tests**
- The "output after a cancel" suite now streams every answer the way
Claude Code does, with Claude Code's follow-up in two chunks. Without
the fix, 9 of its tests leak the streamed copy.
- New v1 tests:
- a follow-up that runs ahead of a prompt sent after the cancel;
- a prompt sent during the cancel whose request arrives before the
cancel abandons it;
- an echo in the middle of a two-block answer;
- a subagent stream for a client that gets subagent text only streamed.
- New v2 tests:
- an abandoned prompt's streamed answer;
- what the interrupt flushes of a cycle that Claude Code started;
- a held turn's follow-up that the cancel stopped before it showed
anything.
- **Mutation checks:** each of these fails at least one test:
- removing any of the window's four rules, or restoring #1309's hold for
any queued prompt;
- removing the drop;
- dropping the flushed tail before the report too;
- using the v1 signal on v2;
- removing the latch, either of its record resets, or the subagent
condition.
The exception is clearing the latch when a subagent finishes. That's
memory cleanup that no test can observe, like the
`streamedBlocksByParent.delete` beside it.
- `npm run check`, build and all 2796 tests pass, with no golden
changes.
**Live, CLI 2.1.293 on Haiku, v1 and v2**
- A plain cancel mid-answer, and cancels with a background command
finishing during or after the cancelled turn.
- Nothing of the cancelled turn arrived after its report.
- Claude Code's follow-up after the cancel streamed in full. On v2 it
came in its own `running` … `idle end_turn` cycle.
- An abandoned prompt that Claude Code had already dequeued is a narrow
race through the adapter, so I didn't reproduce it live. The tests
follow the order a direct CLI probe recorded for #1309.
## Not changed
- A dropped prompt that runs a tool can still surface it after the
cancel, through `canUseTool` (tool call plus permission request) and the
PreToolUse preview hook. Neither checks the cancel. A check there would
read the consumer's state, which lags the CLI's control channel, so this
needs its own design.
- On CLIs without `request_marker_lists_v1`, the window still lasts
until the next prompt's echo. Claude Code's own follow-ups in that
window now lose their streamed copy as well as the consolidated one. The
bundled CLI has the marker.
A Bash call that sends its command to the background returns as soon as
the command detaches, and its tool result carried `terminal_exit`. So a
client that renders terminals, whether Zed's terminal extension or a v2
display terminal, showed the command's terminal as exited, with no code,
at launch, while the command ran on.
## What changes
For a client that renders terminals and isn't AIR:
- **At launch:** the tool result of a command in the background leaves
the exit out (`withRunningTerminal`). The tool call still completes; the
v2 draft keeps "Terminal exit and tool call status are independent".
- **When the command's task ends:** the consumer sends `terminal_exit`.
It does so at the task's `task_notification`, or at its terminal
`task_updated` if that comes first. The update is routed like the tool
call, so a subagent's command ends in the subagent's session.
- **No exit code.** Claude Code names the code only in the
notification's summary text ("…failed with exit code 3"), which the
adapter doesn't parse. `completed` doesn't mean 0 either: Claude Code
accepts some non-zero codes as a success, such as grep's 1.
The terminal still exits at the tool result, as before, in four cases:
- **A fast command** whose task ended before its tool result.
- **A task that started after the tool result.** Claude Code sends
`task_started` first, but the existing `bash-background` scenario
scripts the reverse, so its goldens don't change.
- **AIR,** which shows the command through its async tasks.
- **Replay,** where the command from before the reload no longer runs,
and the structured tool result isn't available anyway.
## Evidence
- **Live, CLI 2.1.293, through the built adapter over ACP:**
- **v2:** the terminal stays running when the Bash call completes and
the turn goes idle. `terminal_update` with `exitStatus: {}` arrives when
`sleep 5` finishes, before Claude Code's follow-up.
- **v1 with `terminal_output`:** no exit at the Bash result;
`terminal_exit` with code `null` arrives when the command finishes.
- **Recorded, CLI 2.1.293:**
- the order is `task_started` (`local_bash`, `is_backgrounded: true`),
then the Bash result with `tool_use_result.backgroundTaskId`, then
`task_updated` and `task_notification` when the command ends;
- neither event carries a structured exit code.
- **Tests:**
- v2: the terminal runs until the task ends, with one exit after the
turn's `idle`; and a task that ended before the result exits at the
result.
- v1 with Zed's terminal extension: the exit comes after the prompt's
answer. AIR keeps its exit at the result.
- Unit tests for `withRunningTerminal`, including dropping a `_meta`
that would be left empty, since an empty `_meta` would clear what a v2
client stores.
- **Mutations:** removing the strip, the end-of-task exit, the liveness
guard, or the AIR guard each fails a test.
- `npm run check`, build and the full suite pass, with no golden file
changes.
A follow-up to #1310, from its review, which found no regressions but
two wrong answers. Both come from one choice in #1310: a request from an
agent without a `liveBackgroundTasks` record put v2's foreground work in
`requires_action`.
**When an agent has no record:**
- **A teammate:** it never gets one.
- **A settled subagent:** settling deletes its record, and settling
didn't re-check open requests.
- **A foreground subagent nested in a background one:** Claude Code
leaves it out of `background_tasks_changed`, so the level reconciliation
prunes it after two activations.
The main conversation waits on none of them. A background subagent's
request that the consumer read before its `task_started` also flickered
from `requires_action` to `running`.
## What changes
- **An agent without a record no longer blocks the foreground work.** A
subagent the main conversation waits on has a record by the time it
asks: its `task_started` comes first on the wire, and nothing prunes it
while the main turn waits. When the consumer reads the request first,
the `task_started` checks again, so `requires_action` comes slightly
later instead of a flicker for background subagents.
- **Settling a task re-checks** the open requests.
- **The comment on `nativeSubagentParentByToolUseId`** no longer claims
`parent_task_id` is unread.
## Tests
- **Replaced:** "stops waiting for a request once its subagent turns out
to run in the background". The new test checks that a request read
before its `task_started` doesn't block, then blocks once the
`task_started` says foreground.
- **New:** a foreground subagent's open request stops blocking once
Claude Code stops that subagent.
- **Mutations:** restoring "no record blocks" fails both tests; dropping
the re-check at settle fails the second.
- `npm run check` and the full suite pass, with no golden file changes.
v2's foreground work reported `requires_action` whenever any permission
request or question in the session was open, including a background
subagent's. The draft keeps `requires_action` for foreground work that
is blocked on user action, and a background subagent asks without
blocking the main conversation. So a v2 client saw a running turn as
waiting on the user while it kept working.
## What changes
A request blocks the foreground work when it is:
- the main conversation's own request, or
- the request of a subagent that runs in the foreground of the main
conversation, so the tool call that spawned it waits on it. This applies
up a chain of such subagents.
A request from a subagent in the background, or from one nested inside
it, no longer counts.
- **Where each task runs.** The adapter records this per task:
- from `task_started.is_backgrounded` and `parent_task_id`;
- from a later `task_updated` patch that moves the task to the
background;
- Claude Code always resumes a subagent in the background.
- **Unknown subagents.** A subagent without a record still counts,
because its request can arrive before its `task_started`. Registering a
task, or moving one to the background, checks the open requests again.
- **Requests that name no agent** still count: MCP elicitations and
dialogs.
- **Steering is unchanged.** It still treats any open request as
blocking. `Session.pendingUserInputCount` becomes
`Session.openUserInputs`: the open requests, each with the subagent that
asked.
- **v1 is unchanged.**
## Evidence
- **Live, CLI 2.1.293 via the SDK with a logging `canUseTool`:**
- `task_started` carries `is_backgrounded: true` for a background
subagent and `false` for a foreground one.
- A subagent's `canUseTool` call carries `agentID` equal to its
`task_started.task_id`.
- `task_started` arrived before the subagent's request in both cases.
- `parent_task_id` for nested subagents was not checked live; it's
documented in the SDK types and covered by a test.
- **6 new v2 tests:**
- a background subagent's permission request leaves the turn `running`,
and so does its question;
- a foreground subagent's request reports `requires_action`;
- a foreground subagent launched by a background one doesn't block;
- a request that arrives before its subagent's `task_started` stops
blocking once the subagent turns out to run in the background;
- a request stops blocking once Claude Code moves its subagent to the
background.
- **Mutation checks.** Removing each rule in turn fails at least one
test. That includes passing the subagent through for permission requests
and for questions, the recheck at registration and at `task_updated`,
and the walk up the chain.
- `npm run check`, build and the full suite pass, with no golden file
changes. Two resume tests now expect the resumed task to be recorded as
backgrounded.
After a cancel, Claude Code ends the interrupted turn with an aborted
result, then keeps working through its queue, and reports `idle` once at
the end. The queue can hold a prompt it had already taken off it, then
its own follow-ups, such as the summary of a background command that
finished. The adapter settled a cancelled turn only at that final
`idle`, and dropped everything in between until the next prompt
activated. As a result:
- **v1:** a cancelled `session/prompt` waited for any follow-up queued
behind it to finish.
- **v2:** a follow-up after a cancel streamed as text with no `running`
or `idle`.
This PR ends the cancel where Claude Code's own messages say the stopped
work ends.
## What changes
- **Where a cancelled turn settles.** It now settles at the result of
the work the interrupt stopped: its own result, or, for a turn held open
for its subagents, its follow-up's aborted result.
- The `idle`, the next echo's hand-off and the force-cancel backstop
still settle a turn whose result never comes.
- That result owes its trailing `idle` like any settling result, a
steered turn's included.
- **When the cancel ends.** The cancel records the prompts it stopped:
the unsettled turns and their steers when it arrives, and whatever it
abandons when it sweeps the queue.
- With `request_marker_lists_v1`, every `status: requesting` frame lists
the prompts its model request serves. A cycle Claude Code starts on its
own lists none.
- The cancel ends at the first request that serves none of the recorded
prompts, once no turn is unsettled and no orphan result is outstanding.
Compaction updates resume there too.
- A prompt Claude Code had already dequeued names itself, so its answer
stays dropped even when the interrupt receipt leaves it out.
- Without the capability, the cancel ends at the next activation, as
before.
- **Abandoned prompts' results.** A result that names a cancelled prompt
never promotes the next queued prompt, so a prompt sent after the cancel
can't take an abandoned prompt's result.
- **Held turns.** Since CLI 2.1.270, Claude Code reports `running` for
as long as background agents live. So with request markers, a held
turn's follow-up counts as live only when a model request has started
since the turn's result. A cancel while only the subagent runs settles
the held turn at once.
- **v2: aborted cycles.** A cycle whose result is aborted
(`terminal_reason` `aborted_streaming` or `aborted_tools`) ends
`cancelled`.
## Evidence
**What CLI 2.1.293 sends.** I recorded the stream live with a probe that
drives the SDK the way the adapter does. After an interrupt:
1. The interrupted turn's aborted result comes first.
2. Next, any prompt Claude Code had already taken off its queue runs.
Its request names it.
3. Then its own follow-ups run. Their requests name no prompt.
4. Finally, one `idle`.
The interrupt stops background agents, but not background commands.
**An audit of the bundled CLI** found exactly one source of `status:
requesting` frames: one per main query-loop iteration. Subagents,
compaction, side queries, hooks and retries emit none, or only a named
one.
**The adapter, end to end over ACP against the live CLI**, this branch
against `main`:
| Scenario | `main` | This PR |
| --- | --- | --- |
| v1: a background command finishes while the turn the user cancels
streams | `session/prompt` answered 14.1 s after the cancel | answered 4
ms after the cancel; the follow-up's text arrives after |
| v2: same | follow-up text with no `running`; `idle cancelled` 14.8 s
after the cancel | `idle cancelled` 10 ms after the cancel, then
`running`, the follow-up, `idle end_turn` |
| v2: a background command finishes after the cancelled turn | `idle
cancelled`, then text with no `running` or `idle` | `idle cancelled`,
then `running`, the follow-up, `idle end_turn` |
| v2: cancel while idle, then a background command finishes | text with
no `running` or `idle` | `running`, the follow-up, `idle end_turn` |
| v1: cancel while a background subagent holds the prompt open | (not
compared) | answered 2 ms after the cancel |
## Tests
- **20 new tests, scripted on the recorded orders.**
- v1 suite "output after a cancel" (12): a cancelled turn and a cancel
while idle; a dequeued prompt the receipt leaves out; a steer; a prompt
that Claude Code folds into its own follow-up; a prompt sent while the
cancel is still in progress; a repeated cancel; trailing idles after a
cancelled turn and after a steered one; older CLIs without request
markers.
- Held turns (3): a cancelled held turn settles at its follow-up's
aborted result, not at a placeholder result, and at once when only its
subagent runs.
- v2 (5): the follow-up after a cancelled turn as its own cycle; a
cancel while idle; a later cycle after a cancelled one; a cycle Claude
Code started before the cancel arrived; a follow-up's compaction.
- **Mutation checks.** Removing each rule in turn fails at least one
test. Two exceptions:
- Clearing the record at activation can't be observed.
- Holding for any unsettled turn, not only a recorded one, can't be told
apart from activation.
- `npm run check`, build and the full suite pass, with no golden file
changes.
## Review
The design went through two rounds of independent review.
- **The first attempt, rejected.** It judged "the stopped work is over"
from the adapter's own bookkeeping. Review found that the interrupt
stops what Claude Code is running, which the adapter may not have seen
yet. That attempt is not in this PR.
- **This design.** A second round audited the CLI's signals and the
state machine. This PR fixes what it found:
- a prompt sent after a cancel could take an abandoned prompt's result;
- a held turn could settle at a placeholder result;
- the window could close while an abandoned prompt that Claude Code
folds into its own follow-up was still due;
- a prompt sent during the cancel's awaits wasn't recorded;
- a held turn's follow-up was misread as live on CLI 2.1.270+.
## Known limitations
- **The cancelled turn's last streamed text still arrives after the
cancel**, as on `main`: the cancel never held streamed text back.
- **If the cancel lands just after Claude Code started its own
follow-up**, the interrupt stops that follow-up, and its partial output
gets through. On v2 it ends `cancelled`.
- **Trailing-idle debt can be over-counted by one in a drain run.** The
next `running` transition sweeps it, as before.
Stacked on #1304, which this targets; it retargets to `main` once #1304
merges. Together they replace #1303.
## What a v2 client gets now
**`idle` at a turn's result,** also when v1 holds the turn's answer for
the background subagents it spawned (`Turn.deferredSettle`).
- The subagents' output and permission requests arrive while the session
is idle. The draft allows that: background activity may send updates
while idle, and they don't change the state.
- A background request while idle no longer shows `requires_action`,
which the draft reserves for foreground work.
- The hold itself is unchanged. It now only delays v1's answer, with no
v2 branch in the hold logic.
**Model cycles that Claude Code starts on its own** are foreground work:
the follow-up after a background subagent or command finished, or its
answer to a message from another session.
- A cycle reports `running` before its first output, `requires_action`
while it waits, then `idle` with its own stop reason, usage and
`_meta.quota`.
- An error result gives `idle` with the `error` stop reason, and a
cancel gives `idle cancelled`.
- Before this, such a cycle streamed while v2 said `idle`.
**Take-overs:** a prompt that Claude Code takes in during a cycle takes
it over, with no new `running` and no `idle` in between. So do a steer
that resumes a held turn, and the continuation of an accepted
clear-context plan. In both, the final `idle` carries the turn's usage,
not just the last cycle's.
v1 and AIR clients are unchanged.
## How
All of this builds on #1304's `ForegroundEvents`:
- **A turn's work ends at its result:** `endForeground` in the defer
branch of `settleOrDefer`, and where the steer idle lane re-applies a
hold.
- **A cycle starts** (`startAutonomousCycle`) at model output of the
main conversation while no work runs.
- Subagent output doesn't count.
- Without command lifecycles, output while a prompt is queued stays that
prompt's, since its output can come before its echo. With lifecycles
(`msg_lifecycle_v1`), a prompt Claude Code hasn't started has no output
yet, so a cycle starts. This narrows the gap that #1303 left.
- **A cycle ends:**
- at a result no turn took, except a placeholder result (`num_turns:
0`);
- with `cancelled` at the diagnostic of an ExitPlanMode answer, as a
turn does, unless a held turn continues the accepted plan;
- at an SDK `idle` that no earlier result owes;
- when the stream ends or fails;
- before `session/close` answers.
- **Starting work while a request is open** reports `requires_action` at
once.
- **The cycle's stop reason** comes from its result, as for a turn
(`autonomousCycleEnd`). Its `_meta.quota` uses the same builder as a
turn's (`quotaMeta`, extracted from `turnQuotaMeta`).
## Checks
- `npm run check`, `npm run build` and all 2756 tests pass. No golden
file changes against #1304: no recorded scenario has a held turn or
output while no turn is active.
- New tests:
- **14 v2 tests:** #1303's eleven, plus a held turn reporting `idle` at
its result with its follow-up as a cycle and a background request while
idle, output before a queued prompt that Claude Code reports it hasn't
started, and `session/close` during a cycle;
- **agent:** a steer resuming a held turn's work; the follow-up that
ExitPlanMode's "keep planning" interrupts ending `cancelled`; the
clear-context continuation taking the cycle over, with the turn's usage;
- **turn events:** work that starts while a request is open waits at
once.
- I made 20 mutations, one per rule above, and each failed a test. The
take-overs for a steer and for the clear-context restart first survived,
since a cycle stood in for the turn with the same states. The tests now
check the usage of the final `idle` too.
## Not covered
- No recorded scenario has such a cycle. The start signal (the first
main-thread output) is chosen from the agent's side, not confirmed
against a live CLI.
- After a cancel, the agent drops main-thread output until the next
prompt (`session.cancelled` stays set). So a follow-up that Claude Code
runs after a cancel is still lost, for v1 and v2. That predates this PR,
and I'll fix it separately.
The first of two PRs that replace #1303, after a design review. This one
restructures how the agent reports v2's state, with two small changes in
behavior (below). The next PR makes v2 report `idle` at a turn's result
and adds model cycles that Claude Code starts on its own.
## Why
The agent reported each turn's v2 states (`running`, `requires_action`,
`idle`) through the prompt's `TurnEvents`, the same events that answer
the prompt. That ties v2's state to when **v1** gets its answer. The
clearest case is the hold (`Turn.deferredSettle`): v1 holds a turn open
while the background subagents it spawned run, because a v1 client stops
listening at the prompt response. So v2 stays `running` too.
Making v2 report `idle` at the turn's result in that design would need a
v2 branch inside the hold logic. That's the most intricate code in the
adapter: steering, cancel, the echo hand-off, ExitPlanMode, idle debts.
And a cycle that Claude Code starts on its own would need a second
source of v2 state beside the turn's (#1303).
## What changes
- **`TurnEvents` only answer the prompt:** `inserted`, `ended`,
`failed`. v1 answers at `ended` or `failed`. v2 answers at `inserted`,
and uses `ended`/`failed` only to reject a prompt before insertion.
- **New `ForegroundEvents`** (`src/turn-events.ts`): the session's
foreground work, meaning what a client would wait for before sending the
next prompt. Events: `running`, `awaitingUser`, `ended`, `failed`.
- Only the v2 surface supplies them, through the new `foreground`
option. They map to `state_update` in `v2Foreground`.
- A prompt's turn is the foreground work from its insertion until it
ends, exactly as before. So `idle` still waits for a held turn's
subagents; the next PR changes that.
- **The work is keyed by the session id the client knows,** not stored
on a `Session`. A clear-context restart (an accepted ExitPlanMode with a
fresh context) replaces the Claude Code session behind that id and moves
the running turn to it. Work stored on the old `Session` would stay
behind.
- **Requests report through the work** (`syncAwaitingUser`), not through
the active turn.
## Observable changes on v2
1. **The `session/prompt` response now comes before `running`, not after
it.**
- The 38 v2 golden files change by exactly that, and nothing else; I
checked every file with a script.
- The old order was not guaranteed: the SDK's `notify` writes after
`waitUntilInitialized(...).then(...)`, and the response is written once
the handler's promise resolves. The old code won that race by sending
`running` before resolving.
- The draft lets clients receive the updates before or after the
response.
2. **A request that Claude Code opens for a prompt it started, before
the prompt's echo, now reports `requires_action` when it opens,** rather
than at the echo. The prompt's work is already running then.
v1 and AIR clients are unchanged.
## Checks
- `npm run check`, `npm run build` and all 2739 tests pass.
- Every v2 state test in `acp-v2.test.ts` passes unchanged.
- `turn-events.test.ts` now reads the waiting events from the
foreground.
- New tests:
- a request opened before the echo;
- the work staying with the session id across a clear-context restart,
with a permission request in the continuation.
- I made six mutations and each failed a test: no `running` at
insertion, no end on `resolve`, no end on `reject`, waiting never
reported, waiting only for the active turn, and the work tied to the
`Session` object.
IDEs can pass their own Claude hooks through
`_meta.claudeCode.options.settings.hooks` on `session/new` and
`session/load`. Before this change, any session settings replaced
`CLAUDE_MODEL_CONFIG` entirely, so adding a single hook dropped the
deployment's `modelOverrides` / `availableModels`. The two are now
merged, and the session settings win per key.
The wrapper does not merge hooks itself: Claude Code already runs the
hooks of every settings tier, so user and project hooks keep running
next to the session ones. Hooks stay scoped to their session, and a
`session/load` with different settings recreates the query, which
replaces or removes them.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
#1289 made a v2 client get `cancelled` for a run that Claude Code
aborted, when Claude Code reports it as an error result with
`non_execution_kind`. Claude Code has a second way to report an aborted
command: a **successful** Bash result whose structured output says
`interrupted: true`. A v2 client got `completed` for that. With this PR
it gets `cancelled` too, so the rule is the same however Claude Code
reports the abort.
## When Claude Code sends that result
I read the CLI that SDK 0.3.293 bundles. I didn't reproduce these cases
live.
| What stops the command | What the adapter receives | v2 before | v2
after |
| --- | --- | --- | --- |
| The client cancels (`session/cancel`) | an error result,
`non_execution_kind: "interrupted"` | `cancelled` (#1289) | same |
| A timeout | an error, "Command timed out after …", **not**
`interrupted` (or the command is backgrounded) | `failed` | same |
| The output limit or a replaced output file | an error with `Exit code
137`, not `interrupted` | `failed` | same |
| A `now`-priority message such as `_session/steering`, landing just
before the command starts, or while the output limit kills it | a
successful result, `interrupted: true` | `completed` | **`cancelled`** |
A successful `interrupted` result needs the abort reason `interrupt`,
which a `now`-priority message causes. That abort doesn't kill a running
command, so this result only comes from the races in the last row.
Clients will rarely see it. The point of the change is that v2's status
follows what Claude Code reports, however it reports it.
v1 and AIR clients are unchanged: `completed` with no exit code, and AIR
still gets exit code 1.
## How
- `AcpToolCallRenderer.resultStatus` takes the command's `interrupted`
fact alongside `nonExecution`.
- `result()` used to call `resultFields`, which drops the command facts.
It now computes the facts once (`resultFacts`) and builds the fields
from them (`fieldsOfResult`). That lets it pass `interrupted` without
adding a field to `RenderedResult`, which the public
`toolUpdateFromToolResult` returns.
- The agent's checks for a finished tool call already count `cancelled`
(`isFinalToolCallStatus`, #1289).
## Checks
- `npm run check`, `npm run build` and all 2730 tests pass. No golden
file changes: no recorded scenario has an interrupted command.
- New tests:
- **renderer:** an interrupted command on v2, v1 and AIR, and one that
isn't interrupted on v2;
- **v2 surface:** a v2 client receives `cancelled`, and the turn still
ends `end_turn`.
- I made four mutations and each failed a test: the rule ignores
`interrupted`, every client gets `cancelled`, `result()` doesn't pass
the fact, and `result()` inverts it.
v2 has a `cancelled` tool call status ("the tool call was cancelled
before it completed"), which v1 doesn't. #1289 started using it for a
run that Claude Code aborted. This PR uses it for the other tool call
that never ran: one that Claude dropped before running it.
## What changes
When a turn ends with `end_turn` and a streamed `tool_use` never reached
a complete assistant message, Claude dropped that tool call before it
ran, for example when it switched to a steering message. The agent
closes it at the end of the turn with "Claude stopped this tool call
before it ran." The turn itself still succeeds.
| Case | v2 client | v1 and AIR clients |
| --- | --- | --- |
| Dropped before it ran | `cancelled` (was `failed`) | `failed`, as
before |
| Ran, but Claude Code returned no result | `failed`, as before, and the
turn fails with `incomplete_tool_call` | same |
The content text is unchanged in both cases.
## How
- **The renderer builds both closing reports**
(`AcpToolCallRenderer.unfinished`), and picks the status from
`ClientCapabilities.v2`, as `resultStatus` does since #1289. Before, the
agent built the report inline with a hardcoded `failed`.
- **The agent** passes whether the tool ran. Its closing step
(`failToolCall`, now `closeUnfinished`) already removes the call from
all of its tracking itself, so no "is this status final" check needed
changing.
## Checks
- `npm run check`, `npm run build` and all 2728 tests pass. No golden
file changes: no recorded scenario drops a tool call.
- New tests:
- **renderer:** dropped and ran-without-result, on v2, v1 and AIR;
- **v2 surface:** a v2 client receives `pending` then `cancelled` for a
dropped tool call, and the turn ends `end_turn`.
- The existing v1 tests in `incomplete-tools.test.ts` are unchanged and
still pass.
- I made five mutations and each failed a test: the renderer never
cancels, the renderer cancels a tool that ran, the agent marks a dropped
call as having run, the agent marks a no-result call as dropped, and the
agent's renderer ignores the client's capabilities.
A v2 diff can't hold the snippet of an Edit's input (it needs line
numbers and the operation), so on v2 an auto-approved Edit or Write
showed its change only once the PostToolUse hook reported it, after the
tool had already run. Only an asked one showed its approval patch first.
## What changes, v2 only
The tool call shows the exact patch before the tool runs, auto-approved
or not.
## How
- **A PreToolUse hook for Edit and Write** (`fileChangePreviewHook`),
registered only on v2 connections. Claude Code runs the tool only after
the hook returns, so the file is still unchanged when the hook reads it.
That's the same guarantee the approval patch in `canUseTool` relies on.
The hook sends the same patch (`previewPatchContent`):
- **Stream already showed the tool call:** a `tool_call_update` through
the session's stream router, pinned like an approval patch.
- **Hook came first:** the SDK dispatches hook callbacks as soon as it
reads them, ahead of the message queue the agent consumes. The hook then
emits the tool call with the patch via `ensureToolCallEmitted`, the
permission flow's fix for the same race (#851).
- **Subagent tools** are attributed exactly as in `canUseTool`. That
rule moves into `toolUseOwner`, which both use, with no behavior change.
- **Safe failure:** the hook makes no permission decision, and any
failure only leaves the preview out.
- **v1 and AIR** register no PreToolUse hook, so Claude Code waits on
nothing new there and their output is unchanged.
I first tried hanging the preview on the per-tool-use hook registry that
PostToolUse uses. That fails when the hook comes before the stream, so
the hook lives on the agent instead.
## Golden files
The scenario harness now runs PreToolUse before each tool, as Claude
Code does, and applies each hook's `matcher`. The v2 golden files of the
four file-change scenarios change:
- **`write-existing`** (auto-approved): the patch now arrives before the
tool completes, and the final hook report no longer repeats it, because
the tracker sees no change.
- **`write-new`, `edit-with-permission`, `edit-rejected`:** the tool
call gets the patch just before the permission request, which carries
the same patch.
No v1, AIR or plain golden file changes.
## Checks
- `npm run check`, `npm run build` and all 2497 tests pass.
- A new v2 test runs an auto-approved Edit with the hook both after and
before the streamed tool use. It checks that the patch is computed from
the file before the edit, arrives before the result, and isn't replaced.
- A new test checks that only a v2 session registers the hook, with the
`Edit|Write` matcher.
- Mutations that fail tests: no hook on v2, the hook on v1 too, the
hook-first path doing nothing, the already-shown path sending nothing,
and Edit only.
- Not pinned by any test: the pin itself. On v2 nothing later in the
stream carries content for an Edit or Write, so it's only there for
consistency with the approval patch.
## Follow-up
AIR has the same gap for an auto-approved Write: it shows no diff until
the hook. That's out of scope here, since it changes AIR's output.
Two findings of the 2026-10-10 night perf run on a 5,000-session home
(findings 8 and 9).
## Rename push (finding 9)
The run measured "no push within 10 s" after `_session/rename`. The
cause was the harness, not the adapter. The bench renames the newest
session to `"Night renamed"`, and an earlier bench run on the same home
had already given it that title. The transcript shows that pair of title
records twice. A rename to the current title appends nothing, so there
was nothing to push. On a fresh home, the same bench gets the push. The
hypotheses checked:
- The metadata cache is not updated by a rename. The appended records
change the transcript's size, and the watcher re-reads it.
- The sidecar lies outside the non-recursive watch, but so does every
rename. Each one also appends to the transcript, which is watched.
Still, the push depended on `fs.watch` plus its 150 ms quiet period. Now
a rename, archive, unarchive or delete through this connection publishes
at once. `ListSubscriptions.sessionWritten` stats the session's
transcripts and reads its row, the way a transcript event would, without
waiting. The event that follows finds the row unchanged and sends
nothing. Renames by other processes still arrive through the watcher.
The 1 s per-session interval of a subscription still applies.
## Listing every page (finding 8)
Profiling `SessionIndex.list` showed where a page's time goes. The full
enumeration and stat of 5,000 transcripts takes about 20 ms per page.
Most of the remaining ~380 ms was the SDK `getSessionInfo`, called once
per row read: its lookup runs a `readdir` of the whole project directory
(5,000 entries) on every call.
- A metadata read no longer calls the SDK. Titles come from the head and
tail the index already reads, by the same rule (`sdkTitles`). The tail
is searched as the SDK searches it, cut first line included.
- The pages after a cursor reuse the list's enumeration. It is keyed by
the cursor and kept for at most 30 s, at most 8 lists. It is dropped as
soon as a directory of the scope adds or removes an entry, through the
`DirListings` identity check. Such a page stats only the transcripts it
reads (each with its session's other copies) right before reading them.
A transcript that changed since either keeps its order key (no new
prompt) or moves up before the cursor, so the page is as fresh as one
from a new enumeration. The first page always enumerates.
## Measurements
Real adapter (`dist/index.js`), driven as AIR drives it by
`acp-perf-harness/air-ui/night/acp-adapter-bench.mjs`. Fixture: 5,000
sessions from `gen-night-data.mjs`.
| | before | after |
|---|---|---|
| Listing every page (25 × 200) | 10.1–16.3 s | 0.92–1.16 s |
| First page (51) | 156–472 ms | 46–62 ms |
| Show more (50) | 117–283 ms | 13–23 ms |
| Push after archive | ~170 ms | 3–4 ms |
| Push after a rename | ~170 ms | 3–5 ms |
## Tests
- A rename, archive, unarchive and delete each push within 500 ms while
the watcher's quiet period is 60 s (fails without the fix). A rename by
another process is pushed through the watcher.
- Paging:
- one enumeration for all pages;
- between pages, a transcript emptied, one with a new prompt, and one
with only a new answer give the same pages as a new enumeration;
- an older copy of a session that got a prompt hides it on later pages;
- adding or removing a transcript enumerates again.
- A custom title whose record starts before the tail window matches the
SDK.
- Read-count assertions use the new `SessionIndex.transcriptsRead`
counter instead of SDK call counts.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
## Summary
Adds the opt-in AIR `sessionIndex` extension. With it, an AIR client can
show the latest sessions of a project quickly, with their state, and can
rename, archive and unarchive them over ACP. The full contract is in
`docs/air-extensions.md` ("Session index").
The extension follows ACP RFDs. The transport differs: it uses
`_meta.jetbrains.air` request options and row fields, `_session/*`
methods, and AIR capabilities that are not advertised under ACP v2. The
`archived` list filter also differs (see below).
- **Session list extensions**
(agentclientprotocol/agent-client-protocol#2323):
- `limit`, ordered by last user activity (`lastPromptAt ?? updatedAt`),
and `includeWorktrees`.
- Row fields `lastPromptAt`, `model` and `forkedFrom`.
- `state`: `running`, `idle`, `requires_action`, and `error`, which the
RFD lacks.
- `lastTurnEndedAt`.
- `cost`: the SDK's `total_cost_usd` for a session that runs on this
connection only. No cost is read from transcripts.
- Live updates come from an AIR list subscription (below).
- **Session archive** (agentclientprotocol/agent-client-protocol#2161):
- `archived` is on every row, `session_info_update` is sent on a change,
and an unknown session is `-32002`.
- The `archived` list filter has three values: `"unarchived"` (the
default), `"archived"` (archived sessions only) and `"all"` (both, in
one order). #2161 has a boolean here. Its `false` is `"unarchived"`, its
`true` is `"all"`, and `"archived"` has no counterpart.
- **Capabilities**: an AIR client that declares `sessionIndex` gets
these in `_meta.jetbrains.air.capabilities`. The client declares only
`sessionIndex`.
- `sessionIndex`.
- `sessionArchive`: `_session/archive` and `_session/unarchive`. The RFD
capability is `archive` (#2161).
- `sessionRename`: `_session/rename`. The RFD has capability `setTitle`
and method `session/set_title`
(agentclientprotocol/agent-client-protocol#1987).
- `sessionListSubscribe`: `_session/list/subscribe`,
`_session/list/unsubscribe` and `_session/list/changes`. No RFD
counterpart.
### Clients without `sessionIndex`
Clients that don't declare `sessionIndex`, which means non-AIR clients
and released AIR builds, keep the current behaviour. They get the same
SDK `listSessions` path, page size, cursor and initialize capabilities,
with no watchers and no notifications. There are two deliberate
deviations, both strictly safer:
1. **`session/delete` from an AIR client without `sessionIndex`.**
Released AIR builds use delete as "Done". Instead of deleting the
transcript (data loss), the adapter archives the session in AIR's own
Claude format (below). Archived sessions are hidden from that client's
list, so "Done" looks the same and nothing is lost. An unknown session
keeps the SDK's error. Other clients get the SDK delete, as before.
2. **`session/close`** of a session that is not loaded here returns `{}`
instead of throwing.
### Sessions open in another process
`session/load`, `session/resume` and `session/prompt` work on a session
that another live Claude Code process has open, for every client, as the
Claude CLI does. Rename, archive, unarchive and delete also go ahead,
writing records or deleting transcripts as the CLI's `/rename` and
delete do. The other process keeps running.
### Archive format and rule
The archive state uses AIR's native Claude archive format
(`ClaudeStoreThreadBackend.appendTitleRecords`, ADR 0140), so AIR's
native path and the adapter read and write the same state.
- **Archive** appends `{"type":"custom-title","customTitle":"[archived]
<title>",…}` and `{"type":"agent-name","agentName":"[archived]
<title>",…}` to every transcript copy. **Unarchive** appends the same
pair without the prefix. Titles are cut to the CLI's 200 characters.
- **Archived is decided by the agent name first**, as in AIR's native
Claude provider. A session's name is its last top-level `agentName`,
else the custom title the SDK reports. The session is archived exactly
when that name starts with `[archived] `. The listed title comes from
the same source, shown without the prefix.
- Title records are metadata: `updatedAt` and the list order do not
move.
### Rename, archive and delete
- **Rename** writes the same title pair. An archived session keeps its
prefix. A session running here is renamed through its CLI's
`rename_session` control request, serialised with auto-titling. Other
sessions get the records plus the `custom-title.json` sidecar the CLI
writes. No generated title replaces a client title, but a title stored
later by someone else (a `/rename`) is still adopted.
- **Archiving stops the running session.** `_session/archive` of a
session loaded on this connection does four things:
1. It interrupts the running turn.
2. It retitles the session through its CLI. The adapter also appends the
matching `agent-name` record to the CLI's transcript, because the CLI
writes that record only later.
3. It closes the session as `session/close` does.
4. It archives the transcripts once more if the closed CLI left them
unarchived.
The client then gets `session_info_update` with `archived: true`.
Unarchive does not reopen the session. A session that is not loaded here
is archived by writing the title records.
- **Delete** for a `sessionIndex` client deletes every copy of the
session and its `<sessionId>/` directories. A session running here is
closed first.
### Implementation (`src/session-index/`)
- **Index**:
- Reads the project dirs with `readdir` + `stat`, and keeps a 2000-entry
metadata LRU keyed by (path, mtime, size).
- Cache misses are read in parallel through `getSessionInfo`, plus a
growing tail read (64 KB → 4 MB) for the last prompt, last message, turn
end and agent name.
- SDK semantics are kept: sidecar titles, `continued-in`, long-path
hashes, darwin case, and first-prompt extraction (ported, and
fuzz-compared with the SDK).
- The `cwd` scope follows the SDK `listSessions`. Worktrees expand to
the same relative subdirectory, and a session copied to several project
directories is listed from its newest copy.
- The keyset cursor is bound to `cwd`, `archived` and
`includeWorktrees`. Session ids match exactly.
- **State**:
- For sessions of this process, the SDK state.
- For other sessions, the Claude Code live registry
(`~/.claude/sessions/<pid>.json`, with pid + procStart liveness and
Claude Desktop's rules) or the transcript tail. The registry is read
only for the row state.
- `error` means the session is not running and its last turn ended with
an error, not a cancel.
Documented in `docs/air-extensions.md`, with an extension → RFD mapping
table and the remaining differences.
### Measured on a real `~/.claude` (233 transcripts, read-only)
| Case | New path | Old SDK path |
|---|---|---|
| cwd, limit 50, cold process | ~80 ms | 78–156 ms (all rows) |
| cwd, limit 50, warm | 1.3–4 ms | — |
## Session list subscription
Replaces polling the first page. It is only for a client that declared
`sessionIndex`; the agent advertises `sessionListSubscribe` with it,
never under ACP v2.
- **Subscribe**: `_session/list/subscribe { cwd }` returns `{
subscriptionId }`. `cwd` must be absolute, else `-32602`; other params
are ignored.
- The scope is `cwd` and the same subdirectory in every linked worktree,
in any archive state, without sidechains.
- **Changes**: `_session/list/changes { subscriptionId, sessions,
removed }`.
- `sessions` holds the full `session/list` row of each session that
appeared, or whose title, `lastPromptAt`, `state`, `lastTurnEndedAt`,
`cost`, `model`, `forkedFrom` or `archived` changed since the last row
sent.
- The first change of a session after subscribe is sent in full. After
that, a change of `updatedAt` alone sends nothing.
- `removed` lists sessions that were deleted or moved out of scope.
- Archive and unarchive are row changes.
- A session is sent at most once a second, with one notification per
subscription per pass.
- **Unsubscribe**: `_session/list/unsubscribe { subscriptionId }`
returns `{}` and is idempotent.
- A subscription lives until unsubscribe or until the connection closes.
- A connection has at most 128 subscriptions. The 129th is `-32602` with
`data.reason: "too_many_subscriptions"`.
- Subscriptions of the same `cwd` share one watch and are notified
independently.
- **Delivery** is best effort, with no resync and no sequence numbers. A
rescan every 10 s (and 1 s after a project directory watch opens) sends
whatever differs.
- **Implementation** (`list-subscriptions.ts`, `session-info.ts`):
- A non-recursive `fs.watch` on the scope's project dirs, the registry
and the projects root.
- A transcript event re-reads only that transcript, and a registry event
reads only that `<pid>.json`. Sessions running here push their SDK state
at once.
- Subscribe reads no session row. The rescan reads only transcripts
whose stat changed or whose read failed.
### Measured: one subscription on the 5,200-session project (Docker
`node:22`, 2 CPU, 2 GB, shared host)
300 s of churn: 20 sessions appending 10/s each (updatedAt-only),
registry status flips every 200 ms, and a session created every 2 s and
deleted 10 s later.
| | Old `list_changed` watcher | Subscription |
|---|---|---|
| Agent CPU p50 / max | 19% / — | 12.9% / 49% |
| Event loop p99 (p50 / max of 1 s windows) | — | 16 / 31 ms; worst
single delay 87 ms |
| Change latency p50 / p95 | 950 ms (hint) | create 291 / 570 ms, delete
279 / 506 ms; registry state 902 / 990 ms* |
| Notifications / min | — | 90 (896 rows, 0 rows for updatedAt-only
appends) |
| RSS | flat ~160 MB | 159 → 198 MB (heap flat ~50 MB) |
\* The registry flips the same 5 sessions every 200 ms, so each is held
to the once-a-second limit. Latency is measured from the first unsent
change.
These numbers were measured with an earlier subscribe that read every
row up front. Subscribe now reads no rows, so that one-off cost no
longer occurs. The lazy subscription has not been re-measured yet.
## Load test: 10,000 sessions (Docker, 2 CPU, 2 GB)
Calibrated data: 10k transcripts, 15 GB, 36k subagent files, and one
5,200-session project. Sizes match a real profile (p50 311K / p90 2.67M
/ p99 20.5M).
| Scenario (limit 50) | Before | After |
|---|---|---|
| Big project, first page cold / warm p50 | out of memory | 225 / 19 ms
|
| No cwd, cold / warm p50 | 1,722 / 178 ms | 209 / 45 ms |
| Page through 4,637 rows | 457 s | 11.4 s cold, 2.9 s warm |
| Delete p50 / 100 concurrent | 23.8 ms / 4.4 s | 7.8 ms / 0.8 s |
| 300 s of churn (60k changes) | out of memory after 3 s | list p50 54
ms, 0 stalls >50 ms, RSS flat ~160 MB |
## Streaming: keep the event loop responsive under a backlog
Under a backlog of buffered SDK messages, the adapter could freeze its
event loop for seconds. Every `query.next()` on a non-empty SDK queue
resolves in a microtask, so `runConsumer` forwarded the whole backlog
without reaching a macrotask boundary. Incoming JSON-RPC, including
`session/cancel`, waited until the backlog drained.
1. **Consumer yields to the event loop.** A shared `EventLoopYielder`
(`src/utils.ts`) gives the event loop a turn via `setImmediate` once the
current iteration has run for 8 ms. Order, content and cancel semantics
are unchanged.
2. **No per-message copy in `nodeToWebWritable`** for byte streams.
Object-mode streams keep the copy.
3. **Diff memo.** The approval preview and the PostToolUse patch no
longer diff the same texts twice. Timed-out diffs are not remembered.
4. **Prefix guards** in `parseMcpCommand` and `sanitizeTitle`. Both give
identical output.
5. **Replay yields between history messages**, with the same budget.
With 10 sessions × 1 MB, the max event-loop delay went from 4205 ms to
1626 ms, and ping p95 from 2793 ms to 262 ms (interleaved A/B, Docker
`node:22`, 2 CPU). Single-stream throughput is unchanged. Remaining
stalls are inside the Claude SDK and GC.
## Test plan
- [x] Rebased on `origin/main`. `npm run check`, `npm run build` and
`npm run test:run` pass.
- [x] Regression tests for the unchanged non-`sessionIndex` paths.
- [x] Regression tests for every review finding.
- [x] Reviews: Codex (gpt-6-astra) and a Claude review subagent, run as
independent passes against `origin/main` until a round found nothing of
normal or higher severity.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The v2 draft lets the `session/new`, `session/resume`, and
`session/fork` responses carry `availableCommands`
([agent-client-protocol#2259](https://github.com/agentclientprotocol/agent-client-protocol/pull/2259)),
so a client can show a session's commands without waiting for an update.
The v2 surface now fills it.
## Before and after, for a v2 client
- **Before:** the setup response, then an `available_commands_update`
with the list, from a `setTimeout` after the response.
- **Now:** the list is in the response itself, for `session/new`,
`session/resume` with and without replay, and `session/fork`. The field
is left out when the list is empty, as the draft asks.
- **No duplicate:** on a v2 connection the agent no longer sends that
post-setup update (`afterSetupResponse`). Later changes still arrive as
`available_commands_update`, for example the terminal-bound filtering
after Claude Code's first init frame, or `commands_changed`.
- v1 and AIR are unchanged.
## Cost
None. The commands come from `Query.supportedCommands()`, which in the
SDK is `this.latestCommands ?? (await this.initialization).commands`:
the cached initialization result that setup already awaited. So the
response doesn't wait any longer.
## Code
- `ClaudeAcpAgent.availableCommands(sessionId)` returns the session's
command list, factored out of `sendAvailableCommandsUpdate`.
- The three post-setup `setTimeout` blocks become one
`afterSetupResponse`, which skips the command update on v2.
- `setupCommands` in `src/v2/agent.ts` adds the list in v2 form. A
failure to read the commands is logged and leaves them out, since
they're optional and the session already exists.
## Title
`refactor:`, like the earlier v2 surface additions (#1253, #1255,
#1256), so no release note announces v2 yet. Retitle it if you'd rather.
## Checks
- `npm run check`, `npm run build` and all 2494 tests pass.
- The 40 v2 golden files each move the list from the post-setup
notification into the setup response, and nothing else changes; I
checked every diff with a script. No v1 or AIR golden file changes.
- New v2 tests cover each setup response (new, resume, resume with
replay, fork) and check that no post-setup update follows.
- I removed each part in turn, and each removal fails tests: the agent
still sending the update on v2, and the commands missing from new, from
resume, or from fork.
- Not covered: the empty-list case, because the adapter always adds its
`/mcp` command.
v2 has a `cancelled` tool call status ("the tool call was cancelled
before it completed"), which v1 doesn't. Until now a v2 client got
`failed` for a tool call the user interrupted, the same as a real
failure.
## What changes
Claude Code stamps a tool result that carries no tool output with
`tool_result_meta.non_execution_kind`. For a **v2 client**:
| Kind | Meaning (set in the bundled CLI) | Status |
| --- | --- | --- |
| `interrupted` | the turn was interrupted while the tool ran |
`cancelled` |
| `cancelled` | the call's own run was stopped (aborted, or moved to the
background) | `cancelled` |
| `user-rejected`, `permission-rule`, `automode-*` | the tool was
refused | `failed`, as before |
v1 and AIR clients are unchanged: `failed`, with the kind in
`_meta.claudeCode.nonExecutionKind`. v2 clients still get that `_meta`
too.
## How
- **The renderer decides the status**
(`AcpToolCallRenderer.resultStatus`), from `ClientCapabilities.v2`.
That's the same pattern the agent uses for v2 diffs: the value travels
as a v1 status (`V2_CANCELLED`, with a cast, since v1's `ToolCallStatus`
is closed), and the v2 surface passes it through. The v2 translation
still doesn't read `_meta`. The rule covers the regular result and the
two fallback reports in `toAcpNotifications`: an untracked tool call,
and a TodoWrite/Task tool call that only a permission request surfaced.
- **The agent's own "finished" checks** now use `isFinalToolCallStatus`,
which counts `cancelled`. Two places compared against
`completed`/`failed`: one removes a finished call from the turn's
foreground work, the other drops its eager-session and dispatched-call
entries. Without this, a cancelled call would have leaked those entries.
## Not covered
Replay doesn't have `tool_result_meta`, so a replayed interrupted call
stays `failed`, just as v1 replay has no `nonExecutionKind`.
## Checks
- `npm run check`, `npm run build` and all 2493 tests pass. No golden
file changes: no recorded scenario has an interrupted tool.
- New tests:
- **renderer:** each kind, for v2, v1 and AIR clients, plus the
permission-surfaced fallback;
- **agent:** a cancelled call is released from the dispatched-call
bookkeeping;
- **v2 surface:** a v2 client receives `cancelled`.
- I removed each part of the change in turn, and each removal fails a
test: never cancelled, cancelled for v1 too, refusals cancelled too, the
bookkeeping ignoring `cancelled`, and the fallback branches keeping
`failed`.
Follow-up to #1287 (SDK 1.8.0). A v2 turn that fails after its prompt
was taken in now ends with the standard `error` stop reason from
[agent-client-protocol#2281](https://github.com/agentclientprotocol/agent-client-protocol/pull/2281),
in place of the stand-ins we used while the SDK didn't have it.
## Before and after
Before, on the v2 surface only:
1. an error `notice`, titled with the failure;
2. `idle` with the custom stop reason `_error`, and the JSON-RPC error
in `_meta.claudeCode.error`.
Now, one update:
```json
{ "sessionUpdate": "state_update", "state": "idle", "stopReason": "error",
"error": { "code": -32603, "message": "Internal error: API Error: 529 Overloaded" } }
```
- `error` is the JSON-RPC error that v1 rejects the prompt with: same
code, message and data. A client can show `message` and handle `code` as
for an error response, so `-32000` (auth required) can start its sign-in
again, which `_error` couldn't.
- The notice is gone. The v2 draft's
[Failures](https://agentclientprotocol.com/protocol/v2/draft/prompt-lifecycle)
section reports a failure that ends the work through the stop reason,
and keeps notices for failures the agent recovers from.
- v1 and AIR are unchanged.
## Also
- `TurnEvents.failed` loses its `title` parameter. Only the v2 notice
read it, and v1's prompt already ignored it. Its pass-through in
`Turn.reject` and `failActive` goes too. AIR's session failures still
get the title, through their own path.
- The v2 scenario harness treats an `error` stop reason as a failed
turn, and reports its message.
## One visible difference
The old notice showed the failure title, for example `API Error: 529
Overloaded`. The error's message is v1's, `Internal error: API Error:
529 Overloaded`, which v1 clients already show. If we'd rather v2
clients see the shorter text, the alternative is to use the title as the
error's `message` and keep v1's code and data. That would make v2's
message differ from v1's.
## Checks
- `npm run check`, `npm run build` and all 2489 tests pass. No golden
file changes: no recorded scenario fails a turn after insertion.
- The two v2 failure tests pin the new update and the auth code. Putting
`_error` back fails both.
Bumps `@agentclientprotocol/sdk` from 1.7.0 to 1.8.0. The release is one
change: the protocol schema moves to v1.25.0 and v2.0.0-alpha.8.
## What changed in the SDK
Comparing the generated types of 1.7.0 and 1.8.0, the only type change
in v1 and v2 is the `error` stop reason from
[agent-client-protocol#2281](https://github.com/agentclientprotocol/agent-client-protocol/pull/2281):
`IdleStateUpdate` gains `ErrorStopReason & { stopReason: "error" }`, and
`ErrorStopReason` (an optional JSON-RPC `error`) is new. The v2 index no
longer exports `StopReason`; the adapter doesn't import it.
## The one code change
`idle()` in `src/v2/prompt.ts` built the v2 `state_update` for an ended
turn by spreading the turn's stop reason into a `SessionUpdate`. With
the larger `IdleStateUpdate` union, TypeScript can no longer match a
union of stop reasons against it (it falls through to the custom and
unknown members). The state is now typed as the members for the agent's
own stop reasons (`Extract<IdleStateUpdate, { stopReason: StopReason
}>`). A stop reason that v2 doesn't know is still a compile error, which
I checked with a throwaway probe. The output is unchanged.
## Not in this PR
The adapter doesn't use the new `error` stop reason yet. Two stand-ins
stay until a follow-up switches them, which changes behavior and golden
files:
- a failed v2 turn's `_error` stop reason with `_meta.claudeCode.error`,
and its error `notice` (`src/v2/prompt.ts`);
- a failed subagent's `_meta.claudeCode.error` in the RFD form (#1257,
not merged yet).
## Checks
- `npm run check`, `npm run build`, and all 2489 tests pass.
- The scenario suites validate every message against the schemas that
1.8.0 ships (`schema/schema.json`, `schema/v2/schema.unstable.json`),
loaded from the installed SDK. No golden file changes.
## What
ACP `logout` cleared `providerConfig` and the gateway credentials but
left live queries running. Provider and gateway routing is baked into
each query's env, so open sessions kept using the old route after
logout.
`logout` now recreates every live session through the same path as
`providers/disable` (`enqueueProviderUpdate`), but only when a provider
or gateway override was active. It waits for active turns, then resumes
each session under its id with native routing. This also runs when
`claude auth logout` fails, because the override is already cleared by
then.
A plain CLI-login logout does not touch live sessions: the running CLI
picks up the logout by itself.
## Behavior change
With an override active, `logout` now waits for running turns before it
returns, like `providers/disable`. Under `--hide-claude-auth`, a session
that cannot be recreated signed out is dropped, as with
`providers/disable`.
Bumps the minor group with 12 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.287` | `0.3.289` |
| [eslint](https://github.com/eslint/eslint) | `10.11.0` | `10.12.0` |
| @anthropic-ai/claude-agent-sdk-darwin-arm64 | `0.3.287` | `0.3.289` |
| @anthropic-ai/claude-agent-sdk-darwin-x64 | `0.3.287` | `0.3.289` |
| @anthropic-ai/claude-agent-sdk-linux-arm64 | `0.3.287` | `0.3.289` |
| @anthropic-ai/claude-agent-sdk-linux-arm64-musl | `0.3.287` |
`0.3.289` |
| @anthropic-ai/claude-agent-sdk-linux-x64 | `0.3.287` | `0.3.289` |
| @anthropic-ai/claude-agent-sdk-linux-x64-musl | `0.3.287` | `0.3.289`
|
| @anthropic-ai/claude-agent-sdk-win32-arm64 | `0.3.287` | `0.3.289` |
| @anthropic-ai/claude-agent-sdk-win32-x64 | `0.3.287` | `0.3.289` |
|
[@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk)
| `1.31.0` | `1.32.1` |
| [hono](https://github.com/honojs/hono) | `4.13.12` | `4.13.13` |
Updates `@anthropic-ai/claude-agent-sdk` from 0.3.287 to 0.3.289
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.289</h2>
<h2>What's changed</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.289</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.289
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.289
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.289
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.289
</code></pre>
<h2>v0.3.288</h2>
<h2>What's changed</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.288</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.288
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.288
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.288
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.288
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.289</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.289</li>
</ul>
<h2>0.3.288</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.288</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="16cf0a7831"><code>16cf0a7</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="36836f000b"><code>36836f0</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.287...v0.3.289">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@anthropic-ai/claude-agent-sdk</code> since your
current version.</p>
</details>
<br />
Updates `eslint` from 10.11.0 to 10.12.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.12.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="4618052eed"><code>4618052</code></a>
feat: handle astral letters in <code>new-cap</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21357">#21357</a>)
(sary)</li>
<li><a
href="4ec5168d6d"><code>4ec5168</code></a>
feat: allow <code>SourceCode#getText()</code> to accept tokens and
comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21340">#21340</a>)
(electrohyun)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="bc51eee6e3"><code>bc51eee</code></a>
fix: <code>prefer-arrow-callback</code> false positive in conditional
test (<a
href="https://redirect.github.com/eslint/eslint/issues/21373">#21373</a>)
(Daniel Pinto)</li>
<li><a
href="bbff86c415"><code>bbff86c</code></a>
fix: skip lines with multiple comments in
<code>max-lines-per-function</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21332">#21332</a>)
(xbinaryx)</li>
<li><a
href="efc4d6bdc4"><code>efc4d6b</code></a>
fix: astral letters in <code>consistent-return</code>,
<code>no-eval</code>, <code>no-invalid-this</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21360">#21360</a>)
(lumir)</li>
<li><a
href="93de066d41"><code>93de066</code></a>
fix: prefer-exponentiation-operator autofix for async function base (<a
href="https://redirect.github.com/eslint/eslint/issues/21322">#21322</a>)
(Vladimir Babin)</li>
<li><a
href="02e34ffba6"><code>02e34ff</code></a>
fix: add missing space after <code>else</code> in <code>curly</code>
autofix (<a
href="https://redirect.github.com/eslint/eslint/issues/21355">#21355</a>)
(Pixel)</li>
<li><a
href="b14b8bc213"><code>b14b8bc</code></a>
fix: correct <code>id-length</code> message for long private names (<a
href="https://redirect.github.com/eslint/eslint/issues/21348">#21348</a>)
(Pixel)</li>
<li><a
href="69aac01d89"><code>69aac01</code></a>
fix: support <code>TSFunctionType</code> in
<code>getFunctionHeadLoc</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21335">#21335</a>)
(xbinaryx)</li>
<li><a
href="686630eb34"><code>686630e</code></a>
fix: <code>no-loss-of-precision</code> false positive with
<code>0.e5</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21337">#21337</a>)
(sethamus)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="67eb586e2e"><code>67eb586</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="5370d7ee35"><code>5370d7e</code></a>
docs: clarify <code>one-var</code> <code>separateRequires</code> matches
any <code>require()</code> call (<a
href="https://redirect.github.com/eslint/eslint/issues/21192">#21192</a>)
(sethamus)</li>
<li><a
href="8816c1ddfc"><code>8816c1d</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="3d2e7cedb7"><code>3d2e7ce</code></a>
docs: fix typo in no-unused-expressions documentation (<a
href="https://redirect.github.com/eslint/eslint/issues/21346">#21346</a>)
(bytedoe)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="152067f0f8"><code>152067f</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21362">#21362</a>)
(ESLint Bot)</li>
<li><a
href="b56d58e0b1"><code>b56d58e</code></a>
chore: update github/codeql-action action to v4.38.2 (<a
href="https://redirect.github.com/eslint/eslint/issues/21376">#21376</a>)
(renovate[bot])</li>
<li><a
href="bfaea12ddc"><code>bfaea12</code></a>
perf: cache normalized config globals per languageOptions (<a
href="https://redirect.github.com/eslint/eslint/issues/21364">#21364</a>)
(James Ross)</li>
<li><a
href="322209ef16"><code>322209e</code></a>
ci: avoid Nx cache in ecosystem tests and disable failing test (<a
href="https://redirect.github.com/eslint/eslint/issues/21369">#21369</a>)
(Francesco Trotta)</li>
<li><a
href="d166567901"><code>d166567</code></a>
chore: update dependency prettier to v3.9.9 (<a
href="https://redirect.github.com/eslint/eslint/issues/21371">#21371</a>)
(renovate[bot])</li>
<li><a
href="29585ceba7"><code>29585ce</code></a>
chore: update dependency eslint-plugin-expect-type to ^0.7.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21359">#21359</a>)
(renovate[bot])</li>
<li><a
href="39d79ba965"><code>39d79ba</code></a>
chore: update github/codeql-action action to v4.38.1 (<a
href="https://redirect.github.com/eslint/eslint/issues/21354">#21354</a>)
(renovate[bot])</li>
<li><a
href="182a6e993a"><code>182a6e9</code></a>
chore: update dependency prettier to v3.9.8 (<a
href="https://redirect.github.com/eslint/eslint/issues/21352">#21352</a>)
(renovate[bot])</li>
<li><a
href="f995127230"><code>f995127</code></a>
chore: remove CLAUDE.md in favor of AGENTS.md (<a
href="https://redirect.github.com/eslint/eslint/issues/21339">#21339</a>)
(Jarren)</li>
<li><a
href="b95fb6cb33"><code>b95fb6c</code></a>
chore: update dependency prettier to v3.9.7 (<a
href="https://redirect.github.com/eslint/eslint/issues/21347">#21347</a>)
(renovate[bot])</li>
<li><a
href="3782dd458f"><code>3782dd4</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21342">#21342</a>)
(ESLint Bot)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a438ec3951"><code>a438ec3</code></a>
10.12.0</li>
<li><a
href="32a73f1441"><code>32a73f1</code></a>
Build: changelog update for 10.12.0</li>
<li><a
href="bc51eee6e3"><code>bc51eee</code></a>
fix: <code>prefer-arrow-callback</code> false positive in conditional
test (<a
href="https://redirect.github.com/eslint/eslint/issues/21373">#21373</a>)</li>
<li><a
href="bbff86c415"><code>bbff86c</code></a>
fix: skip lines with multiple comments in
<code>max-lines-per-function</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21332">#21332</a>)</li>
<li><a
href="152067f0f8"><code>152067f</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21362">#21362</a>)</li>
<li><a
href="b56d58e0b1"><code>b56d58e</code></a>
chore: update github/codeql-action action to v4.38.2 (<a
href="https://redirect.github.com/eslint/eslint/issues/21376">#21376</a>)</li>
<li><a
href="67eb586e2e"><code>67eb586</code></a>
docs: Update README</li>
<li><a
href="bfaea12ddc"><code>bfaea12</code></a>
perf: cache normalized config globals per languageOptions (<a
href="https://redirect.github.com/eslint/eslint/issues/21364">#21364</a>)</li>
<li><a
href="322209ef16"><code>322209e</code></a>
ci: avoid Nx cache in ecosystem tests and disable failing test (<a
href="https://redirect.github.com/eslint/eslint/issues/21369">#21369</a>)</li>
<li><a
href="d166567901"><code>d166567</code></a>
chore: update dependency prettier to v3.9.9 (<a
href="https://redirect.github.com/eslint/eslint/issues/21371">#21371</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.11.0...v10.12.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.3.287 to
0.3.289
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@anthropic-ai/claude-agent-sdk-darwin-arm64</code>
since your current version.</p>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.3.287 to
0.3.289
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@anthropic-ai/claude-agent-sdk-darwin-x64</code>
since your current version.</p>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.3.287 to
0.3.289
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@anthropic-ai/claude-agent-sdk-linux-arm64</code>
since your current version.</p>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.3.287
to 0.3.289
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for
<code>@anthropic-ai/claude-agent-sdk-linux-arm64-musl</code> since your
current version.</p>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.3.287 to
0.3.289
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@anthropic-ai/claude-agent-sdk-linux-x64</code>
since your current version.</p>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.3.287 to
0.3.289
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@anthropic-ai/claude-agent-sdk-linux-x64-musl</code>
since your current version.</p>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.3.287 to
0.3.289
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@anthropic-ai/claude-agent-sdk-win32-arm64</code>
since your current version.</p>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.3.287 to
0.3.289
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@anthropic-ai/claude-agent-sdk-win32-x64</code>
since your current version.</p>
</details>
<br />
Updates `@modelcontextprotocol/sdk` from 1.31.0 to 1.32.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/typescript-sdk/releases">@modelcontextprotocol/sdk's
releases</a>.</em></p>
<blockquote>
<h2>1.32.1</h2>
<h2>What's Changed</h2>
<ul>
<li>[v1.x] docs: state the principles in CLAUDE.md by <a
href="https://github.com/claude"><code>@claude</code></a>[bot] in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2939">modelcontextprotocol/typescript-sdk#2939</a></li>
<li>[v1.x] docs: point the README at v2 and say what v1.x supports by <a
href="https://github.com/claude"><code>@claude</code></a>[bot] in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2942">modelcontextprotocol/typescript-sdk#2942</a></li>
<li>chore: bump version to 1.32.1 by <a
href="https://github.com/claude"><code>@claude</code></a>[bot] in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2954">modelcontextprotocol/typescript-sdk#2954</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/1.32.0...1.32.1">https://github.com/modelcontextprotocol/typescript-sdk/compare/1.32.0...1.32.1</a></p>
<h2>1.32.0</h2>
<h2>Upgrade notes</h2>
<ul>
<li><strong>Redirects:</strong> the HTTP client transports now follow a
redirect only when it stays on the same origin (same scheme, host and
port; http to https on the same host is allowed). A deployment whose
endpoint redirects to another host or port either configures the final
URL or sets <code>redirectPolicy: 'follow'</code> on
<code>StreamableHTTPClientTransport</code> or
<code>SSEClientTransport</code>. In browsers, a redirected request fails
unless that option is set.</li>
<li><strong>New options, both off unless you set them:</strong>
<code>maxToolInputElements</code> on <code>McpServer</code> limits the
number of array elements and object members in a tool call's arguments.
<code>expectedResource</code> on <code>requireBearerAuth</code> accepts
only tokens issued for this server (the token's audience).</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>[v1.x] fix(client): follow redirects only within the endpoint's
origin by <a
href="https://github.com/claude"><code>@claude</code></a>[bot] in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2902">modelcontextprotocol/typescript-sdk#2902</a></li>
<li>docs: point SECURITY.md at GitHub Security Advisories (v1.x) by <a
href="https://github.com/claude"><code>@claude</code></a>[bot] in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2910">modelcontextprotocol/typescript-sdk#2910</a></li>
<li>[v1.x] examples: close idle sessions and cap the session map by <a
href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2914">modelcontextprotocol/typescript-sdk#2914</a></li>
<li>[v1.x] fix(tasks): keep tasks of the in-memory task store within the
session that created them by <a
href="https://github.com/claude"><code>@claude</code></a>[bot] in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2925">modelcontextprotocol/typescript-sdk#2925</a></li>
<li>[v1.x] feat(server): add maxToolInputElements option to limit the
number of elements in tool-call arguments by <a
href="https://github.com/claude"><code>@claude</code></a>[bot] in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2927">modelcontextprotocol/typescript-sdk#2927</a></li>
<li>[v1.x] fix(server): accept tools/call and prompts/get requests that
omit arguments by <a
href="https://github.com/raashish1601"><code>@raashish1601</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2045">modelcontextprotocol/typescript-sdk#2045</a></li>
<li>[v1.x] feat(auth): add expectedResource to requireBearerAuth by <a
href="https://github.com/claude"><code>@claude</code></a>[bot] in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2930">modelcontextprotocol/typescript-sdk#2930</a></li>
<li>[v1.x] test(e2e): cover tools/call and prompts/get without arguments
by <a href="https://github.com/claude"><code>@claude</code></a>[bot] in
<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2931">modelcontextprotocol/typescript-sdk#2931</a></li>
<li>chore: bump version to 1.32.0 by <a
href="https://github.com/claude"><code>@claude</code></a>[bot] in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2935">modelcontextprotocol/typescript-sdk#2935</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/raashish1601"><code>@raashish1601</code></a>
made their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2045">modelcontextprotocol/typescript-sdk#2045</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/1.31.0...1.32.0">https://github.com/modelcontextprotocol/typescript-sdk/compare/1.31.0...1.32.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ff07b00119"><code>ff07b00</code></a>
chore: bump version to 1.32.1 (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2954">#2954</a>)</li>
<li><a
href="8a74d504a9"><code>8a74d50</code></a>
[v1.x] docs: point the README at v2 and say what v1.x supports (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2942">#2942</a>)</li>
<li><a
href="a8cf50360f"><code>a8cf503</code></a>
[v1.x] docs: state the principles in CLAUDE.md (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2939">#2939</a>)</li>
<li><a
href="32549b00a9"><code>32549b0</code></a>
chore: bump version to 1.32.0 (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2935">#2935</a>)</li>
<li><a
href="588d51dbe3"><code>588d51d</code></a>
[v1.x] test(e2e): cover tools/call and prompts/get without arguments (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2931">#2931</a>)</li>
<li><a
href="5a0724d14c"><code>5a0724d</code></a>
[v1.x] feat(auth): add expectedResource to requireBearerAuth (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2930">#2930</a>)</li>
<li><a
href="0ca0b62d93"><code>0ca0b62</code></a>
[v1.x] fix(server): accept tools/call and prompts/get requests that omit
argu...</li>
<li><a
href="fd26801b3b"><code>fd26801</code></a>
[v1.x] feat(server): add maxToolInputElements option to limit the number
of e...</li>
<li><a
href="727075b5bb"><code>727075b</code></a>
[v1.x] fix(tasks): keep tasks of the in-memory task store within the
session ...</li>
<li><a
href="0ff63772da"><code>0ff6377</code></a>
[v1.x] examples: close idle sessions and cap the session map (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2914">#2914</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/1.31.0...1.32.1">compare
view</a></li>
</ul>
</details>
<br />
Updates `hono` from 4.13.12 to 4.13.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.13.13</h2>
<h2>Mount Middleware</h2>
<p><code>app.mount()</code> is now available as the Mount Middleware,
<code>hono/mount</code>. It is just a handler, so you register it with
<code>app.all()</code>:</p>
<pre lang="ts"><code>import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
<p>const ittyRouter = IttyRouter()<br />
ittyRouter.get('/hello', () => new Response('Hello from
itty-router'))</p>
<p>const app = new Hono()<br />
app.all('/itty-router/*', mount(ittyRouter.handle))<br />
</code></pre></p>
<p><code>app.mount()</code> still works in v4 but is deprecated and will
be removed in v5. Migrating is a one-line change:</p>
<pre lang="diff"><code>- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))
</code></pre>
<h2>What's Changed</h2>
<ul>
<li>test(client): simulate network error for undefined route in
parseResponse test in <a
href="https://redirect.github.com/honojs/hono/pull/5439">honojs/hono#5439</a></li>
<li>docs(request): fix jsdoc comments for some getters in <a
href="https://redirect.github.com/honojs/hono/pull/5445">honojs/hono#5445</a></li>
<li>fix(jsx): allow JSXNode function component results in <a
href="https://redirect.github.com/honojs/hono/pull/5476">honojs/hono#5476</a></li>
<li>feat(mount): introduce Mount Middleware and deprecate
<code>app.mount</code> in <a
href="https://redirect.github.com/honojs/hono/pull/5221">honojs/hono#5221</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.13.12...v4.13.13">https://github.com/honojs/hono/compare/v4.13.12...v4.13.13</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="08a023cbfd"><code>08a023c</code></a>
4.13.13</li>
<li><a
href="ae595de8ae"><code>ae595de</code></a>
feat(mount): introduce Mount Middleware and deprecate
<code>app.mount</code> (<a
href="https://redirect.github.com/honojs/hono/issues/5221">#5221</a>)</li>
<li><a
href="f23b146afc"><code>f23b146</code></a>
fix(jsx): allow JSXNode function component results (<a
href="https://redirect.github.com/honojs/hono/issues/5476">#5476</a>)</li>
<li><a
href="6d73a74f97"><code>6d73a74</code></a>
docs(request): fix jsdoc comments for some getters (<a
href="https://redirect.github.com/honojs/hono/issues/5445">#5445</a>)</li>
<li><a
href="deff529656"><code>deff529</code></a>
test(client): simulate network error for undefined route in
parseResponse tes...</li>
<li>See full diff in <a
href="https://github.com/honojs/hono/compare/v4.13.12...v4.13.13">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
## Motivation
A prompt sent while Claude Code runs a turn it started on its own, for
example after a background task finished, is folded into that turn. The
turn's result keeps `origin: task-notification` but lists the prompt in
`user_message_uuids`. The adapter routed results by origin only, so
`session/prompt` was never answered and the client stayed in a running
state. A JetBrains AIR session stayed "running" for hours this way.
## Change
A task-notification result that names a pending prompt now answers it. A
turn held for its subagents still waits for them. Results without the
uuids behave as before.
## Tests
Unit tests in `acp-agent.test.ts` and a replay of the session in
`folded-prompt-scenario.test.ts`. Both hang without the fix.
Bumps the minor group with 2 updates:
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
and [ip-address](https://github.com/beaugunderson/ip-address).
Updates `@types/node` from 26.6.3 to 26.6.4
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
Updates `ip-address` from 10.7.2 to 10.7.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/beaugunderson/ip-address/releases">ip-address's
releases</a>.</em></p>
<blockquote>
<h2>v10.7.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Reject an in-addr.arpa name longer than 32 characters before
splitting it by <a
href="https://github.com/beaugunderson"><code>@beaugunderson</code></a>
in <a
href="https://redirect.github.com/beaugunderson/ip-address/pull/228">beaugunderson/ip-address#228</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/beaugunderson/ip-address/compare/v10.7.2...v10.7.3">https://github.com/beaugunderson/ip-address/compare/v10.7.2...v10.7.3</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c7f838eeca"><code>c7f838e</code></a>
10.7.3</li>
<li><a
href="09b8072f5e"><code>09b8072</code></a>
Reject an in-addr.arpa name longer than 32 characters before splitting
it (<a
href="https://redirect.github.com/beaugunderson/ip-address/issues/228">#228</a>)</li>
<li>See full diff in <a
href="https://github.com/beaugunderson/ip-address/compare/v10.7.2...v10.7.3">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
It affects AIR clients with the `asyncTasks` capability.
## Problem
- A subagent can start a background Bash or Monitor and then end its
turn. The task ends after the subagent finished. The route of the task
dropped every update of a finished child generation, so the client never
got the terminal `async_task_state_update`. The task stayed running in
the client forever. One AIR log held 440 such dropped updates.
- The `Monitor` tool streams the stdout of a background command to the
model only. The SDK reports its task as `local_bash`, so the client
showed it as a background shell. In one real session, 18 of 18 Monitor
tasks had no output file, no progress and no result. The Stop button
only broke the agent's wait.
- The adapter read a task id from the text of a Bash tool result. A
foreground `sed`, `strings` or `python3` that printed adapter source,
test fixtures or CLI strings became a background task, for example with
the id `";\n const start = text` or `${e}`. The client got a spawn and a
`backgrounded` marker on a foreground call, and the task never ended.
- Claude Code 2.1.287 reports a background command in four texts, and
only one gave an output path. A subagent tool result almost never has
`tool_use_result` (0 of 48 in one session). So a subagent command that
hit its timeout got no output path (9 of 10).
## Fix
- `NativeSubagentRuntime.routeOfToolCall` still sends
`async_task_spawned`, `async_task_progress` and
`async_task_state_update` to the child generation that owned the tool
call after that child finished. It never sends them to a later
generation. Every other late update is dropped as before. The spawn is
in the list because a held task can get its tool call id after the
subagent finished.
- `AsyncTaskRuntime` takes a `toolNameOf` lookup. A task of a `Monitor`
tool call is ignored, like a subagent task: no spawn, no progress, no
state, and no stop. A held task that gets its tool call id later goes
through the same check. A `local_monitor` task is ignored too. The
`Monitor` tool call stays in the transcript.
- A task comes only from structured data:
`tool_use_result.backgroundTaskId` or the SDK task events. The text id
parser is gone.
- The output path of a known task can come from the result of its own
tool call. The path ends with `tasks/<id>.output` and starts after the
nearest `": "` on the same line, so a path with spaces works, for
example under `C:\Users\John Doe\AppData\Local\Temp`. It must be
absolute (POSIX, a Windows drive or UNC), and it never holds the end of
another path. The parse is linear in the text length. All four texts
give the path in both event orders: the tool result before or after the
SDK names the task. The memory is bounded. A structured path still wins,
and the terminal `output_file` reaches the client also after a level
close.
- The `backgrounded` marker comes only from structured data: the
structured task, a known background task of the tool call, or a
`run_in_background` input. The "both event orders" above holds for the
path, not for this marker. The marker rides the tool result update, so a
command that the SDK names only after its tool result gets the marker
only from a `run_in_background` input. A command that the user moved to
the background by hand gets no marker in that order.
- The replay behaves the same in each case.
## Tests
- Native subagent and agent tests: a task update and a late spawn after
the child finished go to `worker-1`; a held task of a subagent gets its
spawn and state in the child session after the subagent finished; a late
message chunk is still dropped; a subagent's background Bash ends after
the subagent and the client gets the terminal state in the child
session.
- Monitor: runtime, live and replay tests, also a task that names its
tool call after the tool result. A Monitor task cannot be stopped.
- Structured ids: foreground output with each marker text creates no
task; each of the four texts gives the path in both orders, also a
Windows and a POSIX path with spaces and a UNC path; no path of another
task, another tool call, `.outputs`, a relative path, a path without a
`": "` boundary, or a path across a line; two paths on one line are not
glued; a 2 MB text without `": "` parses in milliseconds; a structured
path wins. An agent test covers a subagent without `tool_use_result`,
and a replay test takes the path from the tool result.
- The new tests fail without the change. Build, lint, format and all
tests pass.
## Abandoned streamed tool calls
This part affects every client, Zed included.
**Problem.** The adapter opens a tool call at the `content_block_start`
of a streamed `tool_use`. Claude can abandon that block before it is
complete, for example for a steering message. The tool then never runs.
At end_turn the settle check reported the session failure "Claude ended
the turn without returning results for tool calls"
(`incomplete_tool_call`). A real AIR session showed a red service error
after 27 minutes of normal work, for a call that never had input.
**Fix.**
- The session records the tool calls that Claude Code sent to the tool
runner: the `tool_use` blocks of a complete assistant message, and the
tool calls of a permission request. The record is bounded and is dropped
when the call ends.
- At end_turn, an open foreground call without that record is abandoned.
The adapter closes it as failed with "Claude stopped this tool call
before it ran." and reports no session failure. The turn ends as
`end_turn`.
- An open call with that record keeps the old behaviour: the old failure
text and the `incomplete_tool_call` session failure.
- The cleanup and the cancellation checks are the same for both groups.
- The replay does not change, because the history holds no partial
`tool_use`. No scenario golden file changes, for AIR, plain or Zed.
**Tests.** A partial `tool_use` and then text ends as `end_turn` with
the neutral close. A mixed turn still fails for the unfinished call. A
steering message during a partial `tool_use` gives no failure. The
existing incomplete-tool tests now send the complete `tool_use` and keep
their failure. The new tests fail without the change.
Step 6 of opt-in ACP v2 support, option (b) as decided in review.
Stacked on #1255: both change the `initialize` line of every v2 golden
file. Once #1255 merges, I'll merge `main` into this branch so the diff
shows fork alone. Nothing changes on ACP v1.
## Why fork, then resume
The agent's v1 fork copies the transcript into a new session and returns
only its id. Until a client resumes or loads the fork, a prompt to it
fails with "Session not found", and the request's `mcpServers` go
unused. AIR, the only v1 client that forks, loads the fork right away.
The fork RFD describes the response as "the same as `session/new`", with
config options, and the request as taking `session/load`'s options. So
on v2 the client gets a session it can prompt at once:
- `v1ForkSessionRequests` (`src/v2/session.ts`) builds the v1 fork, then
a v1 resume of the fork without replay, with the request's `cwd`,
`additionalDirectories` and `mcpServers`. The request's `_meta` goes to
the fork alone.
- The response is the new `sessionId` plus the resume's `configOptions`.
The available commands follow as an update, as for `session/new` and
`session/resume`.
- `capabilities.session.fork: {}` is advertised.
Each fork starts its own Claude Code process, as `session/new` does. The
draft doesn't say whether a fork must be live, so that's recorded as
feedback for it.
## Verification
- An end-to-end test forks a session with an HTTP MCP server, checks the
forked Claude Code session resumes the copied transcript with that
server, and prompts the fork without a `session/resume`.
- Removing the resume, the MCP servers or the capability fails tests.
- Every v2 golden file changes on its `initialize` line only, which
gains `session.fork`.
- Build, lint and all 2411 tests pass.
Step 6 of opt-in ACP v2 support. Stacked on #1254: both change the
`initialize` line of every v2 golden file. GitHub retargets this PR to
`main` once #1254 merges. Nothing changes on ACP v1.
## Change
- The v2 surface serves `providers/list`, `providers/set` and
`providers/disable` through the agent's unstable v1 methods. Every
provider type is identical in v1 and v2, so requests and responses pass
through unchanged.
- The v2 `initialize` response advertises `capabilities.providers: {}`,
a constant like `capabilities.session`, since the agent serves the
methods for every client.
## Verification
- An end-to-end test lists the provider, sets a gateway and lists it,
gets `invalid_params` for an unknown provider, and disables the provider
back to the native routing.
- The handshake test checks the capability. Removing the capability or a
handler fails tests.
- Every v2 golden file changes on its `initialize` line only, which
gains `providers: {}`.
- Build, lint and all 2410 tests pass.
Found while reviewing what's left of opt-in ACP v2 support. Nothing
changes on ACP v1.
## Problem
The agent advertises `_session/steering` in the top-level `_meta` of its
v1 `initialize` response (`steering: { supported: true }`), and the v2
handshake passed that `_meta` through. The v2 surface doesn't register
`_session/steering`, so a v2 client that steered got "method not found".
## Change
The v2 `initialize` response leaves out the top-level `_meta` keys that
advertise an extension the v2 surface doesn't serve
(`UNSERVED_EXTENSION_KEYS` in `src/v2/initialize.ts`), which is
`steering` alone today. That sits next to the existing rule that keeps
the unstable `providers` capability unadvertised.
Whether v2 serves steering is left to the plan for the unstable and
extension surfaces. The protocol has no steering RFD yet, and steering
may need a different design on v2, which answers a prompt as soon as
it's accepted.
## Verification
- The handshake test checks that the v2 response has no
`_meta.steering`. The v1 handshake tests still check that v1 advertises
it.
- Every v2 golden file changes on its `initialize` line only. The line
loses its `_meta` and is otherwise identical.
- Build, lint and all 2409 tests pass.
Part of step 6 of opt-in ACP v2 support. Compaction and session notices
are both Preview features of the v2 draft that are expected to stabilize
soon, and v2 requires no client capability for either. Nothing changes
on ACP v1.
## Compaction
The agent already implements the compaction RFD for v1 clients that
declare `clientCapabilities.session.compaction`, live and on replay. A
v2 client got the legacy "Compact conversation" tool call instead,
because the v2 surface didn't declare it.
- `v1InitializeRequest` now tells the agent that every v2 client takes
compaction updates, as it already did for notices.
- `v2SessionUpdate` passes `compaction_update` and
`compaction_summary_chunk` through: their v1 and v2 shapes are
identical.
So a v2 client now gets:
- **live:** `compaction_update` `in_progress`, the summary as
`compaction_summary_chunk`, then `completed` (or `failed` with the
standard `error`);
- **on replay:** one completed `compaction_update` with the summary, at
the summary's position in the transcript. That's the materialized form
the v2 draft asks for, without the start/chunk/finish sequence.
The token counts and duration that the tool call's `rawOutput` carried
have no v2 field. Only AIR gets them, in `_meta`.
## Notices
These were already sent to every v2 client, but no test covered one on
v2. A new end-to-end test sends Claude Code's `informational` warning as
a live `notice`. The agent sends notices only live, never during replay,
which matches the draft's "SHOULD NOT be replayed".
## Not changed
**A replayed compaction's id differs from its live id.** Live, the id is
the uuid of Claude Code's `compacting` status, which the transcript
doesn't keep. Replay uses the summary message's uuid. The draft and the
RFD ask for the original, stable ids. As with replayed message ids, a
client that kept its view would see the compaction twice. Matching them
needs Claude Code to persist the live id.
## Verification
- The 3 compaction scenarios change their v2 golden files: the tool call
becomes the compaction entity. The scenario names still say `legacy`
because they're named for the v1 capability.
- Unit tests cover the pass-through and the capability. End-to-end tests
cover the live notice, and the replayed compaction between the messages
around it.
- Removing the capability or the pass-through fails tests.
- Build, lint and all 2409 tests pass.
Found while mapping commands to ACP v2 display terminals (#1240). It
affects Zed and plain ACP v1 terminal clients and the v2 surface. **AIR
is unchanged.**
## Problem
The agent reported every command's exit with a number, even when it
didn't know the code:
- **any failure as 1.** A command that exited with 2, or a denied
command that never ran, showed "Exited with code 1".
- **a backgrounded command as 0 when it launched**, though it's still
running.
- **an interrupted command as 1**, and a non-zero code that Claude Code
accepted as a success (grep with no matches) as 0.
## Change
`CommandOutput.exitCode` is now optional. `BashReporter` sets it only
when the tool result says it. I checked each source against the Claude
Code 2.1.287 binary:
- **a failure:** the `Exit code N` line that starts Claude Code's text
of a command that exited with a failing code (`rE`/`JPr` for a
`ShellError`). A failure that names none, such as a denial or a spawn
error, has no code.
- **a success:** 0, unless the structured `BashOutput` says otherwise.
Claude Code accepts a non-zero code as a success only with a
`returnCodeInterpretation`, such as grep's "No matches found" or diff's
"Files differ". An interrupted command (an Esc interrupt returns a
success with `interrupted: true`) and a backgrounded one have no code
either.
- **the code-execution block:** its `return_code`, as before.
An unknown code goes out as:
- **v1, Zed and plain clients:** `_meta.terminal_exit.exit_code: null`.
The v1 `TerminalExitStatus` allows null. Zed (`as_u64()` → `None`) and
Delta's v1 adapter (`Option<u32>`) read it as an optional code. Zed then
shows a failed command as failed, without the "Exited with code N"
tooltip, and every other exit as before. `compare.ts` allows the null
code against the origin/main baseline, a documented difference like the
`mcp` command in #1218.
- **v2:** `exitStatus` without `exitCode`, which the v2 schema treats
the same as null.
- **AIR:** the numbers it always got (1 for a failed or interrupted
command, else the code, or 0). Whether AIR accepts a null code is
unchecked, so this stays out of AIR's contract. The command fact carries
`interrupted` for that. The AIR golden files and
`docs/air-extensions.md` don't change.
## For review
- **Interrupted commands** no longer show as failed in Zed, since the
tool call completes and no code is known. Their output still ends with
"[Command was aborted before completion]".
## Not changed
- **A backgrounded command's terminal still exits at launch**, now
without a code. It could stay running until the task's
`task_notification`. That needs the task's end routed to the terminal,
also on replay, so it's a separate change.
- **Replay has no `tool_use_result`** (the same gap as replayed diffs),
so a replayed success still reports 0 when Claude Code interpreted the
code or backgrounded the command.
## Verification
A table test pins, for each kind of exit, the code Zed gets and the
number AIR gets: a success, a failure that names its code, one that
names none, an interrupted, a backgrounded, and an interpreted command.
A unit test covers the v2 `exitStatus` without a code. Removing any one
of the rules, including AIR's, fails tests. Golden files change for 3 v2
scenarios, each on its exit line only. Build, lint and all 2399 tests
pass.
## Why
#1112 removed the main-thread agent picker on the assumption that ACP
clients don't use it. That was wrong: Zed exposes the `Agent` config
option and users rely on it daily to start sessions with a custom agent
(see the feedback on #1112). It is also still the only way to pick a
main-thread agent for enterprise Claude Code setups.
Restoring it has no meaningful cost: `supportedAgents()` reads from the
already-awaited initialization response, so session creation doesn't
gain a round-trip.
## Summary
Reverts #1112:
- restore the `agent` session config option (shown only when custom
agents are configured) and custom-agent discovery
- restore live agent switching via `applyFlagSettings({ agent })`
- forward `_meta.claudeCode.options.agent` again and keep it across
context resets
- restore the exports `DEFAULT_AGENT_ID`, `AGENT_CONFIG_ID`,
`BUILTIN_AGENT_NAMES`, `discoverCustomAgents`
Conflicts with later changes on `main` (MCP command import, initial
permission mode / bypass resolution, context-window refresh after model
switch, effort settings) were resolved keeping the newer code.
## Testing
- npm run check
- npm run build
- npm run test:run (2399 passed)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Found while writing the test for #1242. It affects ACP v1 and v2.
## Problem
When Claude Code wedges after a cancel (issue #680), the force-cancel
backstop aborts the consumer's cancel signal, so the consumer settles
the turn as `cancelled`. The consumer races each next message against
that signal by adding an `abort` listener on each iteration. But a
listener added to an already-aborted signal never fires.
So if the backstop fired while the consumer was busy outside the race,
such as sending an update to a slow client, the consumer missed it. It
then waited for a message from the wedged Claude Code that never came,
and the cancelled `session/prompt` was never answered (v2: no `idle
cancelled`). Teardown aborts the same signal, which is how #1242's test
ran into it.
## Change
The race also wakes for a signal that's already aborted:
- The consumer re-arms its signal after each abort it handles, so an
aborted signal there is always an unhandled abort. It can't loop.
- A message that's already waiting still wins the race, since
`Promise.race` checks it first, so no message is dropped.
## Verification
A new turn-events test has Claude Code stream an answer and then wedge.
The client takes the chunk slowly, the user cancels, and the backstop
(10 ms in the test) fires while the consumer is still sending. The turn
ends `cancelled`; without the change it never ends. Build, lint and all
2389 tests pass.
Found while planning the permission requests of opt-in ACP v2 support
(step 5 of the v2 plan). It affects ACP v1 clients that show native
subagent sessions (`subagents` capability, or AIR's native subagent
sessions).
## Problem
For such a client, a native subagent's permission request or
AskUserQuestion goes to the subagent's child session. The agent counted
the open request on that session id, but child sessions aren't in
`sessions`, so `withPendingUserInput` counted nothing:
- **Steering:** a message steered while the subagent's request was open
didn't see it, so it went out with interrupting priority instead of
`later`, the priority used while the user has a prompt open.
- **Turn state:** the turn didn't report that it awaits the user. That's
`requires_action` in ACP v2, though the v2 surface doesn't show child
sessions today, so v2 isn't affected yet.
## Change
The request is still sent to the child session, but it now counts
against the owner session, whose turn and steering it blocks. Both paths
take the owner id: `requestPermissionFromClient` already had it
(`ownerSessionId`), and `handleAskUserQuestion` gets it next to the
session it sends the elicitation to.
## Verification
The existing "uses priority:'later' while … is pending" test gains two
cases: a subagent's permission request and a subagent's AskUserQuestion,
both sent to an announced child session. Each fails when its half of the
fix is reverted. Build, lint and all 2390 tests pass.
Found while reviewing the ACP v2 prompt lifecycle (#1226). It affects
ACP v1 and v2.
## Problem
`session/close` tears the session down: `teardownSession` cancels its
turns, wakes the consumer, and closes the query. It returned without
waiting for the cancelled turns to end, so the close could answer first:
- **v1:** the `session/prompt` response arrived after the
`session/close` response.
- **v2:** the turn's `idle cancelled` arrived after the close response.
v2's `session/close` cancels "as if `session/cancel` had been called",
then frees the session.
It happens when the consumer settles the turn late: for example, while
it's still sending an update to a slow client, or when it settles the
turn only at the end of the stream that the close ends.
## Change
`teardownSession` now returns once the turns it cancels have ended (each
turn's `completion`), for at most `TEARDOWN_TURN_END_TIMEOUT_MS` (5 s),
which it logs if a wedged consumer hits it. Its other callers get the
same order too: `session/delete`, the recreation of a session whose
parameters changed on resume or load, and `dispose()`.
## Found along the way, not changed here
The consumer's abort race adds an `abort` listener to the cancel signal
on each iteration. A listener added to an already-aborted signal never
fires, so an abort that lands while the consumer is busy, such as
sending an update, is missed. In production the close still ends the
turn, through the end of the stream, which is the path this PR waits
for. But the same gap can defeat the force-cancel backstop for a wedged
Claude Code (issue #680). That gets its own PR next.
## Verification
A new turn-events test has the client accept an answer chunk slowly,
closes the session while the consumer is still sending it, and checks
that the turn's end comes before the close returns. It fails without the
change: the close returns first. Build, lint and all 2389 tests pass.
Third part of step 4 of opt-in ACP v2 support (after #1231, #1232,
#1237): a v2 client now sees each command the agent runs in an
Agent-owned display terminal, instead of its output as a code block.
Nothing changes on ACP v1.
## Why a mapping
The agent already reports commands through the terminal extension of ACP
v1 clients, as codex-acp does:
- `_meta.terminal_info` names a terminal, which the tool call's content
references;
- `terminal_output` (a snapshot) or `terminal_output_delta` (a chunk)
carries the output;
- `terminal_exit` carries the exit.
v2 standardizes exactly this as display terminals: the same `{ type:
"terminal", terminalId }` content, plus `terminal_update` and
`terminal_output_chunk` for the terminal's state. So the v2 surface maps
the extension rather than adding new agent types. Unlike the agent's
private `_meta.claudeCode` keys, these keys are a cross-agent protocol
extension, so this maps one protocol form to another.
## Change
- `ToolCallClientCapabilities.from` reports a v2 client as taking the
extension.
- `V2Terminals` (`src/v2/terminal.ts`), one per connection, turns the
extension's keys into v2 updates, sent before the tool call report
without those keys:
- `terminal_info` → `terminal_update` naming the terminal;
- `terminal_output` → `terminal_update` with an `output` snapshot,
base64-encoded;
- `terminal_output_delta` → `terminal_output_chunk`;
- `terminal_exit` → `terminal_update` with `exitStatus`.
- **The command:** the extension names none, so the terminal gets the
command from the tool call's `rawInput` once a report carries it. The
first report of a streamed tool use has no input yet. `V2Terminals`
remembers each running command's terminal for that, and forgets it at
exit or `session/close`.
- **A report that carried only the output is dropped.** Its remaining
`_meta` (the `parentToolUseId` stamp, for a subagent's command) would
replace the tool call's stored `_meta` in v2.
- Terminal content passes through the tool call translation. A v2 client
has no client terminals, so these are the agent's only terminals.
The 8 v2 scenarios that run a command change their golden files:
`terminal_update`s in place of the code block, the terminal referenced
in the permission request, and the exit before the tool call's status.
## Not changed here
The agent reports a backgrounded command as exiting with 0 when it
launches, and a failure whose exit code it doesn't know as 1. v1
terminal clients get the same values, since the extension requires a
number. v2 can leave the exit status out, or say it's unknown, but that
needs the agent's command fact to carry it, and it affects v1 too, so
it's left for its own PR.
## Verification
- Unit tests cover output chunks and snapshots, signals, the command
arriving once, the dropped output report, a report without terminal keys
passing untouched, and forgetting a closed session.
- Each rule fails a test when removed.
- Build, lint and all 2388 tests pass.
Step 4's last session piece for opt-in ACP v2 support (after #1237,
#1238). The v2 surface now serves the whole v2 session baseline, so its
`initialize` response advertises `capabilities.session`. Until now a
conforming v2 client wouldn't call the session methods. Nothing changes
on ACP v1, and the v2 surface stays behind
`CLAUDE_AGENT_ACP_EXPERIMENTAL_V2`.
## Change
`V2_SESSION_CAPABILITIES` is a constant, since it describes what the v2
surface serves:
- **the session baseline:** `session/new`, `list`, `resume` (with replay
since #1237), `close`, `prompt`, `cancel`, and `update`;
- **`session/delete` and `additionalDirectories`.** Not `session/fork`
yet, which v1 advertises but the v2 surface doesn't serve;
- **prompt content and MCP transports,** as the agent's v1 `initialize`
lists them: images and embedded context; stdio and HTTP servers. v2 has
no SSE transport.
The top-level `_meta` (`promptQueueing`, `authStatus`) passes through as
before. `providers` stays unadvertised.
Every v2 golden file changes on its `initialize` line only.
## Release
Titled `refactor:` like the other v2 PRs, so it triggers no release on
its own. This is the point where the v2 surface becomes usable by a
conforming client, so `feat:` would also fit if you want the next
release to be a minor one.
## Verification
The handshake test pins the advertised capabilities, the schema check
validates every recorded `initialize` response, and build, lint and all
2386 tests pass.
Fixes a bug in #1237 on the opt-in ACP v2 surface. Nothing changes on
ACP v1.
## Problem
A v2 `session/resume` with `replayFrom` failed with an internal error on
any session that contains a Write:
- A replay has no approval preview and no PostToolUse hook, so the Write
reporter builds a diff from the input for every client on replay.
- That's a v1 diff. It even claims a creation, since the input doesn't
say whether the file existed.
- The v2 surface rejects v1 diffs (#1232), so the replay threw and the
resume failed.
`session-load-replay` has an Edit but no Write, so the scenario suite
didn't catch it.
## Change
A v2 client gets no diff from a Write's input, live or replayed: a v2
diff names the operation (`add` or `modify`), which the input doesn't
tell. Replayed Writes and Edits show no diff on v2 yet; building them
needs the tool's structured result, which the SDK's transcript reader
leaves out (see the follow-up discussion).
## Verification
A new test replays a transcript with a Write through a v2
`session/resume`: it failed with "Internal error" before the change and
passes after. The v1 golden files are unchanged. Build, lint and all
2386 tests pass.
Last part of step 4's session baseline for opt-in ACP v2 support (after
#1231–#1235): a v2 `session/resume` can now replay the session's
history. Nothing changes on ACP v1.
## Change
- **Routing.** v2 restores a session with `session/resume` and replays
only when `replayFrom` asks for it. v1 splits that into
`session/resume`, which never replays, and `session/load`, which replays
everything before it responds. That's exactly what v2 requires of
`replayFrom: { type: "start" }`. So `v1RestoreSessionRequest` maps the
v2 request to one of the two. A cursor that starts elsewhere is
rejected, since v1 can only replay from the start.
- **Clearing replayed messages.** The agent replays messages as chunks,
and chunks append. A v2 client may still hold a replayed message, so
before the first replayed chunk of each message, the v2 surface sends
that message with `content: []`. The draft requires that of a message
replayed as chunks. It happens only while that session replays
(`V2ClientConnection.replaying`), and the clear and the chunk go to the
connection together, so nothing comes between them.
- **Prompt ids.** The draft requires a prompt's user message to replay
under the id its `session/prompt` response returned. Since #1226 that id
is the user message's uuid, which Claude Code keeps in the transcript,
so no new code is needed. A test checks it end to end.
## Scenario suite
`session-load-replay` passes, so every scenario now passes on v2. The
status table becomes `V2_STOPS`: the scenarios that stop on v2, which is
empty today and stays as the place for a scenario v2 can't run yet. The
replay golden file shows each message cleared before its chunks, and the
`session/resume` response after the last replayed update.
A replayed Edit or Write shows no diff yet on v2: replay has no
PostToolUse hook. Building it from the transcript is the next PR.
## Verification
- **Replay test:** a live prompt, then resume with replay from a
transcript holding the uuid Claude Code saved. The replayed user message
carries the prompt response's id, each message is cleared before its
chunks, everything arrives before the response, and a live prompt
afterwards gets no clears.
- **Mutations:** each rule fails a test when removed: no clears, clears
that stay on after the replay, a replay served as a plain resume, and
one clear per id rather than per message.
- Build, lint and all 2385 tests pass.
Second part of step 5 of opt-in ACP v2 support (after #1234): the v2
surface now sends the agent's plan. Nothing changes on ACP v1.
## Change
- v1 `plan` becomes v2 `plan_update` with an items plan: `{ type:
"items", planId, entries }`. Plan entries are identical in both
versions, and a v2 items plan is replaced whole on each update, as a v1
plan is. The update's `_meta` passes through.
- **One plan id per session** (`SESSION_PLAN_ID`). v1 has one plan per
session, which every update replaces, whether it comes from TodoWrite or
from the Task tools. Several plans, such as one per subagent (a
subagent's TodoWrite replaces the session's plan today, marked by
`_meta.claudeCode.parentToolUseId`), and v2's unstable markdown plans
wait for step 6.
## Scenario suite
`todo-write` and `task-create-update` pass, with golden files. That
leaves only `session-load-replay` in the status table.
## Verification
A unit test covers the mapping; build, lint and all 2383 tests pass.
First part of step 5 of opt-in ACP v2 support (after #1231, #1232): the
v2 surface now sends the agent's permission requests. Nothing changes on
ACP v1: no v1 golden file changes.
## What differs in v2
A v1 request asks about a tool call, and clients show the tool call's
title as the prompt. A v2 request gives the prompt a required `title`
and an optional `description` of its own, apart from the tool call. It
asks about a `subject`, which can be a tool call or a command.
## Change
- **Prompt text.** The agent already computes the prompt's heading and
explanation, but only AIR gets them, in
`_meta.jetbrains.air.permission`. The agent's request type,
`AcpPermissionRequest`, now carries them as `title` and `description`
for a v2 client. It's the same rule #1232 uses for diffs: build what v1
can't express only for a v2 client. So v1 requests are byte-identical,
and the v1 scenario golden files, which record what the agent hands
`requestPermission`, don't change. The v2 surface fails on a request
without a title, so a missed site fails loudly.
- **Subject.** Always `{ type: "tool_call", toolCall }`, where
`toolCall` is the same patch a `tool_call_update` carries
(`v2ToolCallPatch`). The `command` subject would suit Bash once display
terminals exist, since its `terminalId` refers to one.
- **Approval preview.** The exact patch before an Edit or Write runs is
now built in v2 form for a v2 client, and the request shows it. This
fixed a real gap: the agent pins the preview as content the client
holds, but only AIR's request shape included it. Without the fix, a v2
client saw no diff at all, because the hook's identical patch was then
dropped as unchanged.
- **Answer.** v2's outcomes map back unchanged. An outcome v1 doesn't
know, which the draft says is no approval, becomes `cancelled`, and the
agent reads that as an aborted tool use.
- **`requires_action`** while a request is open was already in place
since #1226.
## Scenario suite
All 12 scenarios that stopped at a permission request now pass: Bash,
Edit (approved and rejected), Write, NotebookEdit, WebFetch, MCP,
network, ExitPlanMode (approved and rejected), and two subagent
scenarios. Each recording shows `requires_action`, the request, then
`running`. Now only replay and the two plan scenarios remain.
## Verification
- **End to end:** a new test drives the agent's real `canUseTool`
through a v2 client. Allow, reject, and an unknown outcome become allow,
deny, and an aborted tool use.
- **Unit tests:** the prompt's title is separate from the tool call's
(ExitPlanMode: "Ready to code?" vs "Approve Plan"), the preview shows in
the request, the v2 preview fallback works, and the title guard rejects
a missing title.
- **Mutations:** each rule fails a test when removed. Sending
`title`/`description` to every client fails 37 tests, including v1
golden files.
- Build, lint and all 2380 tests pass.
Second part of step 4 of opt-in ACP v2 support (after #1231): the v2
surface now sends file changes as v2 diffs. Nothing changes on ACP v1:
no v1 golden file changes.
## Why the agent builds them
A v2 diff names each change's operation (`add`, `modify`, …) and can
carry a `git_patch`. A v1 diff is a path with `oldText`/`newText`, and
the agent often fills those with a snippet: an Edit's
`old_string`/`new_string`, or one display hunk. So a v1 diff can't be
translated. It says neither the operation (`oldText: null` can mean a
new file, or a hunk with no old lines) nor where the lines are.
So the agent builds v2 diffs itself, at the sites that build v1 diffs
and know the change. The v2 surface creates the agent with `{ v2: true
}`, which becomes `ToolCallClientCapabilities.v2`. A v1 client can't set
it. This follows how the renderer already picks a form by capability, as
it does for AIR's `diffPatch`.
## What a v2 client gets
- **Live Edit and Write tool calls show no diff,** as a Write already
does for AIR. The input holds a snippet, or doesn't say whether the file
exists.
- **The PostToolUse hook sends the exact patch** built from the written
file. That's the existing AIR `diffPatch` path, which now produces
either form. When it can't be exact, it falls back to a patch from the
toolResponse:
- a created file: `add` with its whole text;
- an update: `modify` with the display hunks, which are fine for v2's
renderable patch;
- an update without hunks (previous content too large): the change
alone;
- an Edit with an empty `old_string`: no diff, since the response looks
the same for a created file and a filled empty one.
- **`git_patch` headers use absolute paths** without git's `a/` and `b/`
prefixes, as the draft's example does: `diff --git /p/a.ts /p/a.ts`.
## Plumbing
- The exported `toAcpNotifications` and `streamEventToAcpNotifications`
take the agent's tool call capabilities (`toolCallCapabilities`) next to
the ACP ones, which can't carry the v2 flag. External callers are
unchanged.
- The v2 diff travels through the agent as v1-typed content, with one
documented cast in `v2DiffContent`. Nothing in the agent reads inside a
diff item.
- The v2 surface passes v2 diffs through and rejects a v1 diff, so a
missed site fails loudly. That's how the scenario suite found the
notification functions on the first run.
- The approval preview stays AIR-only until v2 serves permission
requests (step 5).
## Scenario suite
`write-existing` passes, with an exact patch (golden file added).
`write-new`, `edit-with-permission` and `edit-rejected` now stop at
their permission request (step 5). No scenario stops at a diff any more.
## Verification
- Unit tests cover the absolute-path headers, the live tool calls, the
exact patch, and each fallback.
- Each new rule fails a test when removed: git-style paths in a v2
patch, the v1 snippet for a v2 Edit, the AIR path for a v2 hook result,
the notification functions ignoring the agent capabilities, and the
missing guard for an Edit that created or filled a file.
- Build, lint and all 2362 tests pass.
First part of step 4 of opt-in ACP v2 support (#1217, #1219, #1226,
#1230): the v2 surface now sends the agent's tool calls. Nothing changes
on ACP v1.
## Change
`src/v2/tool-call.ts` maps the agent's v1 tool call reports to v2:
- **One message.** v1 reports a new tool call with `tool_call` and
changes it with `tool_call_update`. v2 has one `tool_call_update` that
upserts by `toolCallId`, so both become that.
- **`null` is left out.** Both versions leave an omitted field unchanged
and replace `content` and `locations` as whole arrays. They differ on
`null`: in v1 it leaves a field unchanged (v1's `name` docs say so
explicitly), in v2 it clears it. The agent doesn't send `null` fields
today; a unit test pins the rule.
- **Content blocks pass through.** v2's content blocks are a superset of
v1's.
- **Diff and terminal content still throw**, until their own parts of
step 4.
## Scenario suite
Of the 30 scenarios that stopped at their first `tool_call`:
| Status now | Scenarios |
|---|---|
| passes | 17: `read`, `grep-and-glob`, `bash-error`, `bash-background`,
`skill`, `ask-user-question`, `memory-recall`, `permission-denied`,
`tool-progress`, `task-output-and-stop`, four subagent scenarios, the
three compaction scenarios |
| stops at a permission request (step 5) | 9 |
| stops at diff content (next part of step 4) | 4 |
The 17 new golden files are in
`src/tests/acp-scenarios/__snapshots__/v2/`.
**One new check.** In v1, a `tool_call_update` for an id the client
hasn't seen is an orphan, and clients drop it. In v2 the same message
creates a tool call. A stray update would show up as a blank tool call,
and the schema can't catch that. So every scenario recording, including
those that stop, must give each tool call a title in its first report.
It passes everywhere; making the first report lose its title fails it in
30 scenarios.
## Noted for later, not changed here
- **`_meta` becomes stored state.** In v1, a report's `_meta` belongs to
that report. In v2 it's stored on the tool call, and a concrete value
replaces it. So a v2 client keeps only the last report's
`_meta.claudeCode`: in `permission-denied`, the denial's `toolResponse`
is replaced by the result's `{ toolName }`. No v2 client reads these
keys yet.
- **v2 has a `cancelled` tool status.** v1 reports an interrupted tool
as `failed` with `_meta.claudeCode.nonExecutionKind`. Mapping it to
`cancelled` means deciding where that fact lives.
## Verification
Build, lint and all 2353 tests pass.
Last part of step 3 of opt-in ACP v2 support (#1222, #1226): the
scenario suite now also runs on the v2 surface. It's test-only.
## What
`src/tests/acp-scenarios-v2.test.ts` runs all 40 scenarios of the ACP
scenario suite the way `serveAcp` serves v2: through the protocol
router, driven by the SDK's own v2 client. Per scenario:
- `initialize`, then `session/new`, or `session/resume` with
`replayFrom` for a transcript;
- one `session/prompt` per turn, waiting for the turn's `idle`.
The agent's JSON-RPC messages are recorded off the wire, so a message
the client would reject is still recorded and checked.
Three checks:
1. **Status table.** A scenario passes when every turn ends with a stop
reason other than `_error`. Otherwise it records why it stopped: the
rejected request's error, or the failed turn's notice.
| Status today | Scenarios |
|---|---|
| passes | 7: `session-setup`, `text-and-thinking`, `goal`,
`rate-limit-and-origin`, the three async-task scenarios |
| `tool_call` not translated yet (step 4) | 30 |
| `plan` not translated yet (step 5) | 2 |
| replay not supported yet (step 4) | 1 |
Each step that translates more updates must flip its entries to
`passes`, so the table is that step's checklist.
2. **Schema.** Every recorded message, including those of scenarios that
stop, validates against the SDK's draft v2 JSON schema. The definition
is looked up from the method and side the schema itself names
(`x-method`/`x-side`). One test checks that the validator rejects a
chunk without `messageId`, so the check can't pass vacuously.
3. **Golden files** for the passing scenarios, in
`src/tests/acp-scenarios/__snapshots__/v2/`. For example,
`text-and-thinking.jsonl` shows the prompt lifecycle from #1226:
`user_message`, `running`, the `session/prompt` answer, the chunks with
their `messageId`, and `idle end_turn` with usage.
`harness.ts` gains `runScenarioV2` next to `runScenario`, sharing the
scripted Claude Code, the id normalization and the elicitation answer.
`schema.ts` gains `validateV2Message` next to `validateRecorded`.
## Testing
- Dropping `messageId` from the v2 chunk translation fails both the
schema check and the golden files of the scenarios with chunks.
- The v2 file is stable across repeated runs and takes about 1.3 s; the
full suite stays at about 4.4 s.
`npm run build`, `npm run check`, `npm run test:run` (2293 passed).
Found while reviewing #1226. It affects ACP v1 and v2.
## Problem
A turn held open for its background subagents (`Turn.deferredSettle`,
issues #864–#866) was settled `cancelled` inside `cancel()`, before the
interrupt. The followup cycle can be live at that point, writing the
subagents' summary or blocked on a permission request. The interrupt
still flushes that cycle's output, so:
- **v1:** the output arrives after `session/prompt` has answered
`cancelled`, when many clients have stopped listening.
- **v2 (#1226):** the output arrives after `idle cancelled`. The v2
draft says updates after a cancel MUST come before it.
## Change
`cancel()` now settles inline only where the consumer can't:
- **a settling turn,** blocked in its checkpoint preview, which can't
process the interrupt's trailing idle (unchanged);
- **a held turn whose session sits idle,** or has reported no state yet:
the interrupt emits nothing, so no trailing idle comes (unchanged).
**A held turn with a live followup** (`running` or `requires_action`) is
now left to the consumer, like any live turn. It ends at the interrupt's
trailing idle, or at the next prompt's echo if that idle lags, after the
output the interrupt flushed. The force-cancel backstop is armed for it
meanwhile.
Two consequences, both handled:
- **The trailing-idle debt:** the interrupted followup's result is
autonomous, so it records its trailing idle as owed. When that idle ends
the cancelled held turn, it now also pays the debt. Otherwise the debt
would absorb a later issue-#825 signal.
- **Usage:** a held turn can now be ended by the trailing idle, the echo
hand-off, stream end or the backstop, not only by `cancel()`. All of
them take the outcome from one rule, `cancelledOutcome`: a turn that
already has its result keeps that result's usage and `_meta`, as the
inline settle did (issue #844). Today the session's tally equals that
recorded outcome anyway, since followup results aren't accumulated.
Stream end already treats the stored one as authoritative.
## Testing
- **New:** `src/tests/turn-events.test.ts` cancels a held turn
mid-followup. The interrupt flushes more of the summary, then the
followup's result and idle arrive. It asserts:
- the flushed output comes before the turn ends `cancelled`;
- a wedged next turn still fails at its un-owed idle (issue #825), so no
trailer debt leaked.
- **Updated:** the two existing tests that cancel a held turn in a live
cycle (running, and blocked on a permission request) expected the prompt
to resolve at `cancel()`. Their scripts send the interrupt's trailer
only after the next prompt's echo, so the turn now ends at that echo
hand-off. They keep their issue #825 assertion, and one now also checks
the usage the turn keeps (issue #844).
- **Unchanged:** the tests for an idle hold, which settles at `cancel()`
without pre-counting a trailer, pass as before.
- **Mutations:** settling a live held turn inline again, settling an
idle one at an idle that never comes, or skipping the debt payment each
fail at least one test.
`npm run build`, `npm run check`, `npm run test:run` (2244 passed).
Found while reviewing #1226: a prompt that `session/cancel` reports as
cancelled still runs in Claude Code. It affects ACP v1 and v2.
## Problem
`cancel()` settles every queued prompt as `cancelled`, but each was
already pushed to Claude Code. Claude Code keeps queued messages through
an interrupt and runs them next. The SDK documents the interrupt
receipt's `still_queued` as "messages that WILL still run unless
cancelled first". So:
- Claude Code answers prompts the client was told were cancelled, and
they stay in the conversation, and in the model's context, for later
turns.
- The orphan accounting skips their results, and a cancelled session
drops consolidated `assistant` frames, but their streamed deltas still
reach the client after the cancel.
- In v2 (#1226), such a prompt is answered `-32800` ("not inserted"),
then its output arrives anyway.
## Change
`cancel()` now sends `cancel_async_message` for each queued message it
abandons, before the interrupt. That covers queued prompts and pending
steers. This is the pattern the SDK's own docs describe for a wrapper
that wants per-uuid control, rather than `cancel_queued` on the
interrupt, which would also sweep a prompt the client sends right after
the cancel.
- **Before the interrupt**, because once the interrupt stops the running
turn, Claude Code starts the next queued message right away.
- **Not awaited.** The SDK writes control requests to Claude Code in
call order, so the drops still arrive before the interrupt, and a wedged
CLI can't hold up the cancel, or the teardown that uses it.
- **No new accounting.** A dropped message gets a `cancelled` lifecycle
frame and is missing from the interrupt receipt's `still_queued`, and
the orphan accounting already handles both.
- **Residual window:** a message Claude Code had already dequeued, or
one the SDK hadn't written yet, still runs as an orphan, exactly as
before.
The SDK implements the request as `Query.cancelAsyncMessage` (0.3.287)
but doesn't type it, so it's looked up. A mocked query without it skips
the drop. A CLI that doesn't know the request rejects it, which is
logged.
## Testing
A new test in `src/tests/turn-events.test.ts` scripts Claude Code's
queue: a queued prompt runs after the interrupt unless it was dropped
first, as the real CLI does. It asserts:
- the drop goes out before the interrupt;
- the queued turn ends `cancelled`;
- the cancelled prompt's answer never reaches the client.
Without the drop, the test fails with the leaked answer (`chunk Answer
to a cancelled prompt` after `first ended cancelled`). Sending the drop
after the interrupt also fails it. The rest of the suite passes
unchanged. `npm run build`, `npm run check`, `npm run test:run` (2243
passed).
Part of opt-in ACP v2 support. It fixes the first issue the review of
#1226 found in the agent's turn reporting. It's independent of #1226 and
changes nothing for ACP v1.
## Problem
A turn reported `inserted` (#1222) at activation: the prompt's echo, or
for an echo-less command, its result. The echo can come after the turn's
first output; the agent already handles deltas that stream before it
(see `injectSessionEchoAt` in the tests). With #1226's v2 mapping, that
means a v2 client sees:
- a turn's output before its `user_message` and before `running`;
- `/compact`'s `session/prompt` answered only after the whole command.
## Change
On CLIs that report command lifecycles (`msg_lifecycle_v1`), the
`command_lifecycle` "started" frame now reports the turn inserted.
**Why that frame is early enough.** I read the order in the CLI bundled
with SDK 0.3.287 rather than in a live capture:
- **A command that starts a fresh turn:** the engine pushes "started"
into its lifecycle buffer at turn start (`C.push(W(w.uuid,"started"))`,
before `[engine] turn N start`). The turn's message loop then flushes
that buffer before it yields anything the turn produced
(`if(C.length>0)yield*te()`), including its echo and first
`stream_event`.
- **A prompt folded into a running turn:** its `queued_command`
attachment (the echo) is yielded before "started", so activation at the
echo already comes first and this frame changes nothing.
**One guard.** While another turn is still active, insertion still waits
for the echo. That covers a turn held for its background work, a steered
turn, and a cancelled turn awaiting its trailing idle. The echo's
hand-off ends that turn first, so a turn is never reported inserted
before the previous one ends.
**Older CLIs** without lifecycle frames keep insertion at activation.
Only the time `inserted` is reported changes. Activation, output
attribution and settlement don't, and ACP v1 ignores `inserted`.
## Testing
`src/tests/turn-events.test.ts`:
- a fresh turn whose answer streams between "started" and its echo is
reported inserted before that output;
- a prompt that starts while the turn before it is held is reported
inserted only after that turn ended.
Removing the new insertion point fails the first test, and removing the
guard fails the second. The rest of the suite passes unchanged,
including the recorded v1 scenario traffic. `npm run build`, `npm run
check`, `npm run test:run` (2231 passed).
Second part of step 3 of opt-in ACP v2 support (#1217, #1219, #1222).
The v2 surface now serves `session/prompt` and `session/cancel`. It
still doesn't advertise `capabilities.session`; that waits for tool
calls and replay (step 4).
## What
`src/v2/prompt.ts` serves a v2 prompt through the agent's turn events
(#1222), instead of translating it into a v1 prompt:
| Turn event | v2 |
|---|---|
| `inserted(messageId)` | `user_message` (the prompt as received, under
the uuid Claude Code echoed), `state_update: running`, then the answer
`{ messageId }` |
| `awaitingUser()` / `resumed()` | `requires_action` / `running` |
| `ended(outcome)` | `idle` with the stop reason, `usage`, and `_meta` |
| `ended` before insertion | `-32800`: a queued prompt that a cancel
ended |
| `failed` before insertion | the error as the JSON-RPC answer |
| `failed` after insertion | an error `notice` that shows it, then
`idle` with the custom stop reason `_error` and v1's JSON-RPC error in
`_meta.claudeCode.error` |
The last row is a gap in the draft: the idle `state_update` has no
error, its stop reasons are all non-error ones, and a notice "must not
carry … fatal-error reporting". So the failure travels on `idle` as a
`_`-prefixed custom stop reason, which the draft allows, with the error
in `_meta`; `auth_required`'s code survives there. The notice shows the
agent's own failure title ("API Error: 529 Overloaded");
`TurnEvents.failed` gains an optional `title` for it. That's going back
to the v2 draft as feedback.
- `session/cancel` maps to the v1 cancel.
- **Ordering:** the turn's state updates and the agent's own updates go
through one `ctx.notify` path in call order, so `idle` comes after the
turn's last output. The tests check the order.
- **Message chunks** (`agent_message_chunk`, `agent_thought_chunk`,
`user_message_chunk`) are translated with the `messageId` v2 requires,
and fail loudly without one.
- **Prompt content:** blocks that v1 can't express (a custom or future
type) are rejected with `-32602`. Audience roles that v1 doesn't know
are dropped from annotations, which the agent doesn't read.
- Tool call and plan updates still fail loudly until their step.
## The one change on v1
The agent built three message chunks without a `messageId`: local
command output, a result forwarded as the answer (a local-only command,
or the issue #453 fallback), and a refusal explanation. Each now carries
the uuid of the SDK message it came from, the id `messageIdForGrouping`
already uses for non-assistant messages. It's an additive field on v1.
None of the recorded v1 scenario baselines contain these chunks, so they
don't change.
## Testing
`src/tests/acp-v2.test.ts` drives the router with the SDK's v2 client,
which validates every message against the v2 schema. Its mocked Claude
Code now answers prompts: each turn echoes its prompt, then runs a
script. New tests:
- a prompt is answered with the echoed uuid while its turn still runs,
then `agent_message_chunk` and `idle end_turn` with usage;
- a queued prompt stays unanswered until the turn before it ends, then
is answered with its own echoed uuid;
- an MCP elicitation during the turn gives `requires_action`, then
`running`;
- `session/cancel` follows a real interrupt: output Claude Code sends
after it arrives before `idle cancelled`, and a queued prompt is
answered `-32800`;
- a turn whose result is an API error gives an error `notice` with the
agent's title, then `idle _error` with the error code; a missing login
keeps `auth_required`'s code;
- a queued prompt whose stream ends before insertion is answered with
the error;
- a refusal explanation carries the refusing result's uuid;
- local command output and a forwarded result each arrive with their SDK
message's uuid as `messageId`;
- a prompt with a `_acme/widget` block is rejected and never reaches
Claude Code;
- a chunk without a `messageId` fails translation, and audience roles v1
doesn't know are dropped.
Mutation check: answering at the end or at queueing instead of at
insertion, dropping `user_message`, answering a cancelled queued prompt,
dropping the failure notice or its title, ending a failure with
`end_turn` or without the error, dropping `requires_action`, removing
any of the three new `messageId`s, accepting any content block, or
swallowing a failure before insertion each fails at least one test.
`npm run build`, `npm run check`, `npm run test:run` (2240 passed).
## Not in this PR
A review of this PR found these in the agent's turn reporting and
cancellation, outside the mapping. They're tracked for their own PRs
before the v2 surface is advertised; the first three also affect v1:
- insertion is reported at the echo, which can lag the turn's first
output;
- a cancelled queued prompt's streamed output still reaches the client;
- cancelling a held turn settles it before the interrupt's remaining
output;
- `session/close` answers before the active turn's `idle cancelled`;
- whether a held turn should delay `idle` in v2 at all.
## Summary
In an ACP client, `/mcp` showed the CLI text "… Use `/mcp` in the
terminal for details." The user of an ACP client has no terminal. In SDK
mode, Claude Code also refuses `/mcp reconnect|enable|disable` with
"Reconnect, enable, and disable aren't available in this session." and
changes nothing.
- `/mcp` and `/mcp reconnect|enable|disable [<server>|all]` still run as
a normal Claude Code turn. The adapter replaces the text of the local
command, through the same hook that `/usage` uses. Prompt order, cancel,
and the provider update stay with the turn.
- For an action, the adapter runs it in that turn through the SDK
control API (`reconnectMcpServer`, `toggleMcpServer`). It shows one
result line for each server, then the status list.
- The status list comes from `query.mcpServerStatus()`. It has a summary
line and groups by status: failed, needs authentication, connecting,
connected, and disabled on one line. A failed server shows a short
cleaned error. A list is used and not a table, because a table breaks
words in narrow columns.
- Useful CLI sentences stay, for example "There's no MCP server named
…". Sentences that point to the terminal are removed.
- After an explicit reconnect, a server from the ACP session that needs
authentication starts the existing MCP OAuth flow, when the client
supports URL elicitation.
- `/mcp` is advertised with the input hint `[reconnect|enable|disable
[<server>|all]]` and is hidden on history replay.
## Other commits in this branch
This branch also carries commits of other work: skill command metadata
for AIR, a faster `session/load` replay, and the resumed permission
mode. They can move to separate PRs if preferred.
## Tests
- `src/tests/mcp-command.test.ts` (61 tests). The fake CLI answers with
the real SDK-mode texts and message shapes (synthetic assistant +
result) and does not change any status.
- A live run through the adapter with a broken and a working stdio
server: `/mcp`, `/mcp disable good`, `/mcp enable good`, `/mcp reconnect
broken`, `/mcp reconnect nosuch`.
- `compare.ts` allows one new difference against the origin/main
baseline: the `mcp` command in `available_commands_update`. The baseline
files are unchanged.
- `npm run check` and `npm run test:run` pass.
## Summary
- Bumps `@anthropic-ai/claude-agent-sdk` to 0.3.287 (Claude Code
2.1.287). No compile or test fixes were needed.
## Review notes for 0.3.287
- **WebFetch/WebSearch keep running when a steer arrives: not active for
the adapter.** In 2.1.287, a human-origin `priority: 'now'` steer no
longer cancels WebFetch or WebSearch. The call keeps running, and its
tool_result is a "[Still running…]" notice for the model with
`tool_use_result: {detachedToolCall: true}`. The steer gets its own
result, and the CLI holds back idle. When the fetch finishes, Claude
starts a follow-up turn on its own. That turn has no user message and
its result carries no uuid, and idle only arrives after it. I checked
this against the live CLI. However, the CLI only does this when no
PostToolUse, PostToolUseFailure or PostToolBatch hook applies to the
tool. The adapter's PostToolUse hook has no matcher, so it applies to
every tool, and through the adapter the steer still cancels the fetch,
as before. I also checked that end to end. Turning the new behavior on
needs three changes: limit the hook to
Write/Edit/NotebookEdit/EnterPlanMode, render the card while the call
keeps running, and close the card at the follow-up turn. That is left
for a follow-up PR.
- **No changes needed:**
- the `includePartialMessages` late or missing `message_stop` fix (the
adapter's `message_stop` handling can safely run more than once)
- the `commands_changed`-before-`init` fix
- the clearer revoked-OAuth error text (it still arrives as an
`authentication_failed` error)
- MCP `structuredContentOmitted` (the adapter doesn't read
`structuredContent`)
- the `alwaysLoad: false` semantics (unused)
- the remote-only `first_text_post_*` result fields
- `get_task_output` (in the types, but `Query` has no method for it)
- the fix for a model fallback repeating on every later message
## Test plan
- [x] `npm run build`
- [x] `npm run test:run` (2142 passed)
- [x] `npm run check`
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Fixes an intermittent failure of "replays a subagent from its own
transcript file", and with it a broader leak: the unit suite was running
the real Claude CLI hundreds of times per run.
## Cause
The agent runs `claude auth status --json` in the background, without
awaiting it, on every `initialize` and prompt. The scenario suite stubs
it (`CLAUDE_CODE_EXECUTABLE=/usr/bin/false`), but other files didn't.
Logging the probe's executable over one `vitest run` showed about 670
runs of the real CLI:
| File | Real CLI runs |
|---|---|
| `acp-agent.test.ts` | 375 |
| `create-session-options.test.ts` | 14 |
| `incomplete-tools.test.ts` | 12 |
| `session-titles.test.ts` | 8 |
| `file-change-audit-integration.test.ts` | 5 |
Each run uses the machine's own Claude config, unless a test points
`CLAUDE_CONFIG_DIR` elsewhere.
That flaky test points `CLAUDE_CONFIG_DIR` at a temp dir. The CLI it
started then wrote `.claude.json`, `.claude.json.lock` and `backups/`
into that dir about a second later, after the test body had finished.
Under full-suite load, that overlapped the `rm` in the test's `finally`,
which failed with `ENOTEMPTY`. Its assertions always passed.
## Change
`vitest.config.ts` sets `CLAUDE_CODE_EXECUTABLE=/usr/bin/false` in
`test.env`:
- It's the override `claudeCliPath()` already honors, and the value the
scenario suite already uses, so production code doesn't change.
- `test.env` is the base environment, so it survives the
`vi.unstubAllEnvs()` that three files call.
- Runs that exercise the real CLI keep it: with `RUN_INTEGRATION_TESTS`
(`npm run test:integration`) or `RUN_LIVE_CAPABILITY_AUDIT=true`, the
variable is left unset.
Tests that mock `execFile` or set their own executable are unaffected.
## Evidence
- After the change, the same logging shows 0 runs of the real CLI: 688
probes run `/usr/bin/false`, and 108 hit files that already mock
`execFile`.
- The flaky test's temp dir now holds only the test's own `projects/`
after the test, with no `.claude.json`.
- Before the change, it failed in about 2 of 6 full runs on my machine.
After, 8 of 8 full runs passed.
- A full run takes about 4.8 s instead of 8.4 s.
- The variable is `/usr/bin/false` in a default run and unset with
either opt-in flag.
- `npm run build`, `npm run check`, `npm run test:run`.
First part of step 3 of opt-in ACP v2 support (step 1: #1217, step 2:
#1219). It's independent of #1219. It changes no ACP v1 behavior, apart
from one failure-only case noted below.
## Why
ACP v2 changes the prompt lifecycle. `session/prompt` is answered when
the prompt is *inserted* into the conversation, and progress and the
stop reason arrive as `state_update`s. In v1, the response comes at the
end of the turn. The agent only exposed the v1 shape: `prompt()` returns
at the end of the turn. So v2 can't be mapped from the outside.
Following the discussion on #1219, the adapter gets its own view of a
turn, and each ACP version maps to it, instead of v2 being translated
into v1.
## What
`src/turn-events.ts` defines the adapter's own turn lifecycle:
- `inserted(messageId)`: Claude Code took the prompt in as this user
message. At most once, and never after the turn ends.
- `awaitingUser()` / `resumed()`: a permission request or question is
open in the session / none is open any more.
- `ended(outcome)`: with a `TurnOutcome` (`stopReason`, `usage`,
`_meta`).
- `failed(error)`.
The agent calls these synchronously while it updates its own state, so
handlers must not throw or call back into the agent.
In the agent:
- `startTurn(params, events)` starts a turn. It resolves once the prompt
is queued for Claude Code, and rejects only if the prompt is refused
before that. Events can arrive before it resolves. `prompt()` is now the
v1 view of it: it awaits the turn's outcome.
- **inserted** is reported in `activateTurn`, the single place a queued
turn becomes active. That's when Claude Code takes the prompt in: its
echo, or for an echo-less command, its result. Two guards:
- a clear-context restart re-activates the same turn in the fresh
session, so it's reported once;
- a turn that a cancel settled during the previous turn's hand-off isn't
reported at all.
- **awaiting user / resumed** follow one session-level rule: the active
turn awaits the user exactly while any request in the session is open,
rechecked when a turn activates. A request carries no prompt id, and
Claude Code can ask for a queued prompt before the consumer reaches its
echo. So tying a request to the turn that was active when it opened
would misattribute it.
- **ended / failed** come from the existing settle points, each guarded
by `settled`, so a turn reports exactly one of them.
- `TurnOutcome` and `StopReason` are the adapter's own types. A turn's
outcome is field for field a v1 prompt response, so `PromptResponse` now
only appears at the v1 boundary.
**The one v1 difference:** a prompt that sets a goal publishes it to AIR
clients after the prompt is queued. If that notification fails,
`startTurn` now logs it rather than rejecting, because the turn is
already running. For v1 this only matters on a dead connection:
`prompt()` waits for the outcome instead of rejecting with the write
error.
## Notes for the v2 step
- A prompt sent while another turn is running is inserted only when
Claude Code takes it in, after the running turn. The open question about
queued prompts is going back to the v2 draft.
- An echo-less command (such as `/compact`) is inserted at its result,
after its output. On `msg_lifecycle_v1` CLIs, the `command_lifecycle`
"started" frame may be an earlier insertion point.
- A queued turn that a cancel ends before insertion may still be run by
Claude Code (the orphan accounting).
- Any open request counts towards `requires_action`, a background task's
included; `agentID` could refine that in the permission step.
## Testing
`src/tests/turn-events.test.ts` covers:
- a normal turn: inserted under the uuid of the message Claude Code
received, then ended;
- a permission request: awaiting user, then resumed;
- a request open from before the turn: the turn awaits the user from
insertion, through its own answered request, until the earlier one is
answered too;
- a cancel during the hand-off from the previous turn: the queued turn
ends as cancelled and is never inserted;
- cancelling while a second prompt is queued: the active turn is
inserted, then ended as cancelled, and the queued turn ends as cancelled
without being inserted;
- the stream ending with a turn queued: it fails without being inserted;
- a prompt for an unknown session: `startTurn` rejects and reports
nothing.
The existing clear-context restart test also checks that the restarted
turn is inserted once.
Each guard is checked by mutation: removing the `insertedReported`
guard, the `settled` guard, the activation recheck, or the change-only
dedupe; tying `resumed` to the request's own turn; or reporting
insertion at enqueue each fails at least one test.
The existing suite passes unchanged, including the 474 scenario tests
that compare outbound v1 traffic with recorded baselines. `npm run
build`, `npm run check`, `npm run test:run`.
Step 2 of opt-in ACP v2 support (step 1: #1217). Behind
`CLAUDE_AGENT_ACP_EXPERIMENTAL_V2=1`, the v2 surface now serves
`session/new`, `session/list`, `session/resume` (without replay),
`session/close`, `session/delete`, and `session/set_config_option`. ACP
v1 is unchanged.
`capabilities.session` is still not advertised. Under v2, advertising it
commits the agent to the whole baseline, including `session/prompt` and
`replayFrom: start` replay, and those come in later steps. Until then
these methods are served but not advertised.
## Translation
As in step 1, each v2 request becomes the v1 request that
`ClaudeAcpAgent` already serves, and each v1 response or update becomes
its v2 form (`src/v2/session.ts`, `src/v2/session-update.ts`):
- **MCP servers:** v2 requires a `type` on every transport, but the
agent recognizes a v1 stdio server by its *missing* `type`. A v2 `type:
"stdio"` config passed through as is would be silently skipped, so the
tag is dropped. The lists v1 requires (`args`, `env`, `headers`) are
defaulted. A transport v1 can't express is rejected with invalid params
instead of being left out of the session.
- **Config options:** `id` → `configId`, a select group's `group` →
`groupId`. A select value in `session/set_config_option` drops its v2
`type: "id"`, and value types v1 can't express are rejected.
- **Modes:** responses drop `modes`, and `current_mode_update` is
dropped. The agent always lists the mode as the `mode` config option,
and every mode change also reaches the client as a
`config_option_update` or in the `set_config_option` response.
- **Commands:** `available_commands_update` inputs gain `type: "text"`.
- **Notices, session info, usage:** passed through unchanged. v2 needs
no capability for notices, so a v2 client is reported to the agent as
taking them, and advisories arrive as `notice` instead of transcript
messages.
- **Elicitation:** the same in v1 and v2, so it's forwarded. MCP OAuth
at `session/new` works.
- Update kinds that aren't translated yet (messages, tool calls, plans,
extensions) throw, so a gap shows up as an error, not a missing update.
- `replayFrom` is rejected until replayed history can be translated.
Also bumps `@agentclientprotocol/sdk`:
- to 1.6.1, whose router types `closed` as always present, so `serveAcp`
drops its `closed!`;
- to 1.7.0, which type-checks the v2 extensible-union values the adapter
builds, at any depth
([typescript-sdk#268](https://github.com/agentclientprotocol/typescript-sdk/pull/268)).
The v2 translations compile unchanged. The exception is
`createElicitation`, which relays the v1 request: v1 types a property
schema's tag as any string, and an MCP server's schema passes through
unchecked, as on v1. It gets a cast with a comment saying so.
## Testing
- `src/tests/acp-v2.test.ts` drives the router with the SDK's v2 client
app, which validates every response, session update, and elicitation
against the v2 schema. New cases cover session creation with v2 MCP
servers, config options, and commands; rejected MCP transports;
list/close/resume/delete and rejected `replayFrom`; setting the mode
with no `current_mode_update` reaching the client; notice support; MCP
OAuth through URL elicitation; and unit tests for grouped options,
rejected value types, and untranslated updates. Breaking the stdio or
command-input translation makes the tests fail.
- Ran the built binary over stdio against a real Claude Code session: v2
`initialize`, `session/new`, `list`, setting the mode, and `close` all
passed the v2 client's validation, and the 52 real commands arrived with
`type: "text"` inputs. `session/new` took ~0.7 s, the same as over v1.
- `npm run build`, `npm run check`, `npm run test:run`.
First step toward optional support for the [draft ACP v2
protocol](https://agentclientprotocol.com/protocol/v2/draft/overview).
ACP v1 stays the default and is unchanged.
## What it does
Set `CLAUDE_AGENT_ACP_EXPERIMENTAL_V2=1` and the adapter routes each
connection by the protocol version the client requests in `initialize`
(via the SDK's `AgentProtocolRouter`):
- A client that requests version 2 or later gets the draft ACP v2
`initialize`, `auth/login`, and `auth/logout`, plus the
`_auth/status_update` push.
- Every other client gets ACP v1, served by the same handlers as today.
Without the variable, the adapter never builds the router and serves ACP
v1 exactly as before.
The v2 response does not advertise `capabilities.session` yet. A v2
agent that advertises it must serve the whole session baseline
(`session/new`, `list`, `resume`, `close`, `prompt`, `cancel`,
`update`), which follow-up PRs add. So for now a v2 client can
initialize and authenticate, but cannot open a session.
## How
`ClaudeAcpAgent` keeps speaking ACP v1 types. The v2 surface in
`src/v2/` is a thin translation layer around it, so v1 and v2 share one
implementation:
- `v2AgentApp` registers the v2 methods and translates each request to
the v1 request the agent already serves, and each response back. For
`initialize` that means `info`/`capabilities` instead of
`agentInfo`/`agentCapabilities`, and auth methods with `methodId` and a
required `type`, with terminal `env` as `{ name, value }` pairs. A v2
client gets no client `fs` or terminals, and boolean config options are
baseline.
- `V2ClientConnection` is the `AcpClient` of a v2 connection. It sends
the agent's v1-shaped messages in their v2 form. Only connection-level
messages can reach it so far; session-scoped methods reject until v2
sessions land.
- `v1AgentApp` is the existing v1 handler registration, pulled out of
`runAcp` so the router can reuse it. Each surface now creates the agent
of its connection in `onConnect`, because under the router the
connection opens only after `initialize` has been read. `runAcp` (a
public export) behaves as before.
Also bumps `@agentclientprotocol/sdk` to 1.6.0 (schema v2.0.0-alpha.7).
The bump changes nothing for v1: the full suite passes unchanged on it.
## Testing
- `src/tests/acp-v2.test.ts` drives the real router over in-memory
streams with the SDK's own v1 and v2 client apps (the v2 client
validates every response against the v2 schema). It covers the v1
handshake through the router, the v2 handshake, method-not-found for v2
session methods, the `_auth/status_update` push, and gateway
`auth/login` followed by `auth/logout`.
- Ran the built binary over stdio: v2 client with the flag, v1 client
with the flag, v2 client without the flag (gets the unchanged v1
response), and stdin EOF before `initialize` (exits 0).
- `npm run build`, `npm run check`, `npm run test:run`.
## Summary
- `teardownSession` sends the interrupt but does not await its reply
- `query.close()` follows at once and ends the CLI process
- `session/cancel` still awaits the interrupt reply
On a fresh session, the background `getContextUsage` request from
`refreshContextWindowInBackground` is still in flight. The SDK
serializes control requests, so the CLI answered the interrupt only
after it. With a real CLI, `session/close` took 2.5 s in an empty
directory and 3.2 s in a large repository. ACP clients with a 3 s close
timeout timed out. With this change, close answers in about 2 ms, and
the CLI process exits.
## Tests
- `npm run test:run -- src/tests/create-session-options.test.ts`
- `npx tsc --noEmit`
- `npm run check`
When a background task stops, the CLI persists a `<task-notification>`
user record. Live, the adapter hides it and handles the SDK task
lifecycle frame; replay previously showed the raw XML as a user prompt.
Replay now hides notification records and removes embedded notification
XML while preserving adjacent user text and delivered prompts with an
origin `subkind`. It restores known non-agent tasks through
`AsyncTaskRuntime`, including `killed` → `stopped` and duplicate
terminal-event suppression. Agent notifications override the launch
result's terminal state. Unknown tasks remain hidden without creating a
task card.
Task launches are recognized in `tool_use`, `server_tool_use`, and
`mcp_tool_use` blocks. Async task updates use the session that owns the
launching tool call, even when another session receives the
notification. History has no `task_started` frame, so tasks without a
persisted stop notification cannot be reconstructed.
The large Write patch test now uses a fixed clock to check patch
correctness independently of CI speed; a separate advancing-clock test
verifies the existing timeout fallback. The production 100 ms budget
remains unchanged.
Validation on current main (SDK 0.3.286):
- `npm run build`: passed.
- `npm run check`: passed.
- `env -u ANTHROPIC_BASE_URL npm run test:run`: 2119 passed, 29 skipped.
The local gateway environment otherwise changes the expected default URL
in four provider tests.
- Regression coverage includes origin/text notifications, adjacent user
text, unknown and repeated tasks, killed tasks, background Agents,
delivered subkind prompts, alternate tool block types, task session
ownership, and patch timeout fallback.
Released AIR versions, such as 262.air/release-09, read the custom
answer companion only from the root key
_meta._askUserQuestionCustomAnswer. The adapter sent only
_meta.jetbrains.air.customAnswer, so these versions showed the companion
as a separate question.
For an AIR client the companion now carries both keys with the same
value. Other clients get no key, as before. Remove the root key when the
ACP registry no longer serves AIR versions that read only that key.
IJAI-2892
## Summary
- Bumps `@anthropic-ai/claude-agent-sdk` to 0.3.286 (Claude Code
2.1.286). No compile or test fixes were needed.
- Updates the steer comments for a CLI behavior change. A `priority:
'now'` steer that lands during a foreground tool call (Bash, Agent, MCP)
now moves the tool to the background instead of stopping the turn.
Depending on timing, the CLI then either:
- adds the steer to the running cycle, which ends in **one** result
stamped with both the prompt's and the steer's uuids, or
- ends the cycle early and runs the steer as a second cycle.
During plain text output it still stops the turn, as before.
- Adds a test for the case where the steer joins the running cycle, with
and without an echo of the steer. The case where the steer runs as a
second cycle was already covered.
I checked all of this against the live CLI 2.1.286. In each case the
result that answered the steer carried the steer's uuid, so the existing
steer settlement logic handles it without code changes.
## Review notes for 0.3.285 and 0.3.286
- **Raw XML in subagent replay:** `getSubagentMessages()` now returns
delivered `<task-notification>` rows as plain user messages (`origin:
{kind: "task-notification"}`, `isQueuedCommand: true`, no `is_meta`).
They reach child replay and show up as raw XML user messages. #1205
already hides this exact shape, so it fixes the subagent case once
merged.
- **Omitted `permissionMode`:** the SDK now leaves it to the CLI. The
adapter always passes an explicit mode, so this has no effect.
- **No changes needed:** the `fallback_credit` type, Artifact pin/unpin,
`provider_not_allowed`, the SDK MCP manifest fields, the background Bash
timeout (its stop notice goes through the existing task-stopped path),
and the `setModel` output-limit fix.
## Test plan
- [x] `npm run build`
- [x] `npm run test:run` (2095 passed)
- [x] `npm run check`
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Follow-ups to the SDK 0.3.284 / CLI 2.1.284 bump (#1189), which landed
with only package changes.
## Replay showed messages from other agents and sessions as user text
Since 0.3.284, `getSessionMessages()` returns `is_meta` user messages
from other agents, sessions and channels (`origin.kind` peer, channel,
observer, observer-activity, slack-ping). Their content is the full
harness framing: the `<cross-session-message>` envelope plus the "not
typed by your user" preamble. `replayMessage` sent them as
`user_message_chunk`, while the live prompt loop never shows them.
Replay now skips them. Other `is_meta` messages (compact summaries)
still replay.
Verified against a live 0.3.284 transcript: the enveloped peer turn is
gone, and the user's own prompts still replay.
Fixes#1203. Complements #1205, which hides `task-notification` records
the same way. The two cover different origin kinds and merge with only a
trivial test-file conflict.
## Effort applies turned ultracode off
CLI 2.1.284 turns ultracode off when an `applyFlagSettings` call changes
`effortLevel` without an `ultracode` key. The adapter applies effort at
session start (recommended-value clients), after a model switch and from
the effort picker, so a settings-enabled `ultracode: true` was silently
cleared. The CLI's own `/effort` control now keeps ultracode on at any
level, so all three applies send `ultracode: true` when the settings
request it (`effortFlagSettings`).
## Checked, no change needed
Elicitation-hook `decision: 'block'`, the background-agent stdin fix
(the adapter never hit it; keep
`CLAUDE_CODE_EMIT_SESSION_STATE_EVENTS=1`), MCP startup waits, Sonnet
5.5 (natively 1M, already covered by the background context-window
refresh), malformed-image handling (now done by the CLI), and notice
rewording (the adapter matches none of the changed strings).
## Testing
- New tests for both helpers, replay of the probe's peer-message shape,
and a session test checking that the startup and picker applies keep
ultracode.
- `npm run build`, `npm run check` and `npm run test:run` (2093 passed)
all pass.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Bumps [diff](https://github.com/kpdecker/jsdiff) from 8.0.4 to 9.0.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/kpdecker/jsdiff/blob/master/release-notes.md">diff's
changelog</a>.</em></p>
<blockquote>
<h2>9.0.0</h2>
<p>(All changes part of PR <a
href="https://redirect.github.com/kpdecker/jsdiff/pull/672">#672</a>.)</p>
<ul>
<li>
<p><strong>ES5 support is dropped</strong>. <code>parsePatch</code> now
uses <code>TextDecoder</code> and <code>Uint8Array</code>, which are not
available in ES5, and TypeScript is now compiled with the
"es6" <code>target</code>. From now on, I intend to freely use
any features that are deemed "Widely available" by <a
href="https://web.dev/baseline">Baseline</a>. Users who need ES5 support
should stick to version 8.</p>
</li>
<li>
<p><strong>C-style quoted strings in filename headers are now properly
supported</strong>.</p>
<p>When the name of either the old or new file in a patch contains
"special characters", both GNU <code>diff</code> and Git quote
the filename in the patch's headers and escape special characters using
the same escape sequences that are used in string literals in C,
including octal escapes for all non-ASCII characters. Previously, jsdiff
had very little support for this; <code>parsePatch</code> would remove
the quotes, and unescape any escaped backslashes, but would not unescape
other escape sequences. <code>formatPatch</code>, meanwhile, did not
quote or escape special characters at all.</p>
<p>Now, <code>parsePatch</code> parses all the possible escape sequences
that GNU diff (or Git) ever output, and <code>formatPatch</code> quotes
and escapes filenames containing special characters in the same way GNU
diff does.</p>
</li>
<li>
<p><strong><code>formatPatch</code> now omits file headers when
<code>oldFileName</code> or <code>newFileName</code> in the provided
patch object are <code>undefined</code></strong>, regardless of the
<code>headerOptions</code> parameter. (Previously, it would treat the
absence of <code>oldFileName</code> or <code>newFileName</code> as
indicating the filename was the word "undefined" and emit
headers <code>--- undefined</code> / <code>+++ undefined</code>.)</p>
</li>
<li>
<p><strong><code>formatPatch</code> no longer outputs trailing tab
characters at the end of <code>---</code>/<code>+++</code>
headers.</strong></p>
<p>Previously, if <code>formatPatch</code> was passed a patch object to
serialize that had empty strings for the <code>oldHeader</code> or
<code>newHeader</code> property, it would include a trailing tab
character after the filename in the <code>---</code> and/or
<code>+++</code> file header. Now, this scenario is treated the same as
when <code>oldHeader</code>/<code>newHeader</code> is
<code>undefined</code> - i.e. the trailing tab is omitted.</p>
</li>
<li>
<p><strong><code>formatPatch</code> no longer mutates its input</strong>
when serializing a patch containing a hunk where either the old or new
content contained zero lines. (Such a hunk occurs only when the hunk has
no context lines and represents a pure insertion or pure deletion, which
for instance will occur whenever one of the two files being diffed is
completely empty.) Previously <code>formatPatch</code> would provide the
correct output but also mutate the <code>oldLines</code> or
<code>newLines</code> property on the hunk, changing the meaning of the
underlying patch.</p>
</li>
<li>
<p><strong>Git-style patches are now supported by
<code>parsePatch</code>, <code>formatPatch</code>, and
<code>reversePatch</code></strong>.</p>
<p>Patches output by <code>git diff</code> can include some features
that are unlike those output by GNU <code>diff</code>, and therefore not
handled by an ordinary unified diff format parser. An ordinary diff
simply describes the differences between the <em>content</em> of two
files, but Git diffs can also indicate, via "extended
headers", the creation or deletion of (potentially empty) files,
indicate that a file was renamed, and contain information about file
mode changes. Furthermore, when these changes appear in a diff in the
absence of a content change (e.g. when an empty file is created, or a
file is renamed without content changes), the patch will contain no
associated <code>---</code>/<code>+++</code> file headers nor any
hunks.</p>
<p>jsdiff previously did not support parsing Git's extended headers, nor
hunkless patches. Now <code>parsePatch</code> parses some of the
extended headers, parses hunkless Git patches, and can determine
filenames (e.g. from the extended headers) when parsing a patch that
includes no <code>---</code> or <code>+++</code> file headers. The
additional information conveyed by the extended headers we support is
recorded on new fields on the result object returned by
<code>parsePatch</code>. See <code>isGit</code> and subsequent
properties in the docs in the README.md file.</p>
<p><code>formatPatch</code> now outputs extended headers based on these
new Git-specific properties, and <code>reversePatch</code> respects them
as far as possible (with one unavoidable caveat noted in the README.md
file).</p>
</li>
<li>
<p><strong>Unpaired file headers now cause <code>parsePatch</code> to
throw</strong>.</p>
<p>It remains acceptable to have a patch with no file headers whatsoever
(e.g. one that begins with a <code>@@</code> hunk header on the very
first line), but a patch with <em>only</em> a <code>---</code> header or
only a <code>+++</code> header is now considered an error.</p>
</li>
<li>
<p><strong><code>parsePatch</code> is now more tolerant of
"trailing garbage"</strong></p>
<p>That is: after a patch, or between files/indexes in a patch, it is
now acceptable to have arbitrary lines of "garbage" (so long
as they unambiguously have no syntactic meaning - e.g. trailing garbage
that leads with a <code>+</code>, <code>-</code>, or <code> </code> and
thus is interpretable as part of a hunk still triggers a throw).</p>
<p>This means we no longer reject patches output by tools that include
extra data in "garbage" lines not understood by generic
unified diff parsers. (For example, SVN patches can include
"Property changes on:" lines that generic unified diff parsers
should discard as garbage; jsdiff previously threw errors when
encountering them.)</p>
<p>This change brings jsdiff's behaviour more in line with GNU
<code>patch</code>, which is highly permissive of
"garbage".</p>
</li>
<li>
<p><strong>The <code>oldFileName</code> and <code>newFileName</code>
fields of <code>StructuredPatch</code> are now typed as <code>string |
undefined</code> instead of <code>string</code></strong>. This type
change reflects the (pre-existing) reality that <code>parsePatch</code>
can produce patches without filenames (e.g. when parsing a patch that
simply contains hunks with no file headers).</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ed13aca03a"><code>ed13aca</code></a>
Update version in package.json and in release notes (<a
href="https://redirect.github.com/kpdecker/jsdiff/issues/683">#683</a>)</li>
<li><a
href="7a49317b50"><code>7a49317</code></a>
Bump dependencies again (<a
href="https://redirect.github.com/kpdecker/jsdiff/issues/682">#682</a>)</li>
<li><a
href="afe5aecad1"><code>afe5aec</code></a>
Add Git support, and otherwise variously improve & fix parsePatch
(and other ...</li>
<li><a
href="2e46779d88"><code>2e46779</code></a>
Fix a typo (<a
href="https://redirect.github.com/kpdecker/jsdiff/issues/679">#679</a>)</li>
<li>See full diff in <a
href="https://github.com/kpdecker/jsdiff/compare/8.0.4...v9.0.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
## Summary
One PR with separate commits (the earlier stack #1168 and #1169 is
folded back in).
### Exact git patches
- `src/diff.ts` builds exact git patches for Edit and Write: real line
numbers, file modes, CRLF, the final-newline marker, a size limit
(including a bound for `replace_all`), binary detection, and an
asynchronous diff with a time budget. The approval preview mirrors the
input normalisation of the bundled CLI.
- No creation patch over an existing file or for an Edit of an existing
empty file, and no patch for a Write that changed nothing.
### For every client
Clients that do not declare `_meta.jetbrains.air` (Zed, plain ACP
clients) get the same information as on `main`.
- A `tool_call_update` omits top-level fields that did not change since
the last report of the same tool call (ACP merge semantics). The `_meta`
of each report stays complete.
- Bug fixes: a failed approval preview no longer blanks the approval
diff; a permission denial replaces a pinned approval patch; the
compaction summary is not repeated when the streamed text is identical;
streamed subagent text is not sent twice; async task fields are recorded
only after a successful send; late updates of a finished native subagent
are dropped; the updates of a fresh Claude context after a clear-context
restart reach the ACP session.
### For AIR only
- One fact in one field: input in `rawInput`, the file text of an edit
only in the diff (`diffPatch`), output once, no display copies of the
input (`rawInputRendering`), `_meta.claudeCode` reduced to `toolName`,
`parentToolUseId` and the `toolResponse` markers, per-key `_meta`
filtering.
- Plan file mode (`planFile`): ExitPlanMode carries only
`rawInput.planFilePath`; AIR follows the file that Claude writes.
- AIR-only keys move under `_meta.jetbrains.air.*` and are no longer
sent to other clients.
### Structure and docs
- `src/tool-calls/`: one reporter per tool, one `ClientCapabilities`,
one `AcpToolCallRenderer`, the field tracker and the changed-meta
filter.
- `docs/air-extensions.md` replaces the per-extension AIR docs.
## Tests
- `npm run build`, `npm run check`, `npm run test:run`: 1995 passed.
- Scenario tests for plain, Zed, and AIR clients: the SDK mock honours
the adapter's session id, every update must reach its ACP session, every
message is validated against the ACP JSON schema with all formats
checked, plain and Zed are compared with a recorded `main` baseline, AIR
keeps compact golden recordings.
Authentication failures now use the ACP authRequired error only. The
adapter does not send a second access failure or login text as a chat
message. Provider verification and cloud credential errors use the
service category because signing in cannot resolve them. Checks: npm run
check; npm run build; npm run test:run (1468 passed, 28 skipped).
### Summary
Fixes#1158.
When a native subagent session is resumed for subsequent turn execution
(`task_started`), `this.parentByToolUse.get(task.toolUseId)` returns
`undefined` because `finishTask` deletes the mapping at the completion
of earlier generations. Because `knownParentSessionId` evaluated to
`undefined`, `if (knownParentSessionId || !task.toolUseId)` evaluated to
`false`, postponing the subagent announcement until `finishTask`.
### Changes
- In `src/native-subagents.ts`: Added fallback `const
knownParentSessionId = this.parentByToolUse.get(task.toolUseId) ??
previous?.parentSessionId;` so resumed subagents recognize their
existing session parent at `task_started`.
- In `src/tests/native-subagents.test.ts`: Added unit test confirming
`subagent_spawned` is emitted immediately upon `taskStarted` for resumed
sessions.
### Verification
- `npm test src/tests/native-subagents.test.ts` (all 8 tests passing).
- `npx tsc --noEmit` (clean, 0 type errors).
---------
Co-authored-by: shobhitagnihotri69 <shobhitagnihotri69@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Fixes#1167.
## Problem
In plan mode the model often runs Explore agents in the background. The
user turn's result then comes back while those agents are still running,
so `session/prompt` is held open (#864/#866). When an agent finishes,
the model writes the plan and calls `ExitPlanMode` in the
**task-notification followup**. The user accepts it with a clear-context
option.
The interrupted cycle's `[ede_diagnostic] … stop_reason=tool_use` result
carries that cycle's `task-notification` origin. That sends it into the
autonomous-result branch, which:
1. sends the `usage_update` with `_claude/origin: task-notification`.
This is the "background task finished at the same time" update from the
report; it's actually the same cycle.
2. settles the held turn with `end_turn` and returns early, before the
ExitPlanMode restart check runs.
The plan is never continued, the mode stays `plan`, and nothing tells
the client.
## Fix
- The diagnostic match now lives in one shared function,
`isExitPlanInterruptionResult()` in `exit-plan.ts`. Both the user-result
path and the new check call it; the user path behaves as before.
- In the autonomous branch, when the active turn is held and the result
is the recorded ExitPlanMode interruption:
- **Clear-context option:** drop the held turn's stored outcome, then
run the usual fresh-context restart. The fresh query doesn't have the
old background tasks, so the stale hold would otherwise settle the moved
turn with `end_turn` before the plan runs. The continuation's own result
settles the turn.
- **"No, keep planning":** settle `cancelled` with the user turn's own
usage, through `settleOrDefer`, so the turn stays open while other
spawned subagents are still running.
## Tests
There are two new tests in the deferred-settlement block. Each runs a
held turn whose task-notification followup calls `ExitPlanMode`: one for
the clear-context restart, one for keep-planning. The restart test also
fails if the held outcome isn't dropped.
## Known limitations (unchanged by this PR)
- **Background agents are killed by the restart.** Upstream `/clear`
keeps background agent tasks running (`hasAgentTaskSurvivingClear`). The
adapter's restart closes the old query, so any other running subagents
are killed, just as on the existing user-turn restart path.
- **Plans approved after the turn has ended are still dropped.** If
`ExitPlanMode` runs after the turn has already settled, there's no open
turn to continue, and the plan is dropped as before. A client-visible
notice for that case would be a follow-up.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
## Summary
- include the current assistant model id on `usage_update` notifications
as `model`
- mirror the same value in `_meta["_claude/model"]` so clients that
prefer extension metadata can consume it
- preserve existing `_meta` entries such as `_claude/origin` and
rate-limit metadata
Fixes#1021
## Verification
- `npm run build`
- `npm run check`
- `npm run test:run -- src/tests/acp-agent.test.ts -t
'usage_update|effective model|origin handling'`
- `npm run test:run` *(fails only in existing root-environment
`resolve-permission-mode` expectations: `bypassPermissions` falls back
to `default` when run as root; unrelated to usage updates)*
---------
Signed-off-by: Emre Koca <110906681+kocaemre@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A warm `session/resume` or `session/load` currently ignores changed
`maxTurns` and `maxBudgetUsd`: the session fingerprint compares only cwd
and MCP servers, so the SDK query retains its old options. A client can
request a tighter limit and receive success while the old limit remains
active.
Include these two SDK execution limits in the session fingerprint.
Adding, changing or removing a limit recreates the query with the
supplied options and the same session ID. Identical limits reuse the
existing query; object key order does not trigger recreation. Budget
accounting across recreated SDK processes remains the client's
responsibility.
Validation:
- Four regression cases failed before the fix; six new cases cover both
methods, both limits, tightening/removal, and unchanged reuse.
- `npm run check` and `npm run build` passed.
- Focused suites: 551 passed, 9 skipped.
- Full suite with `--maxWorkers=2`: 1,240 passed, 27 skipped. An initial
unrestricted run hit one existing provider-switch test's 5s timeout and
macOS `EMFILE` watcher errors; bounding workers passed without changing
tests or timeouts.
Prepared while integrating typed runtime limits in
BinaryBourbon/fountain#1732. No live SDK budget-enforcement claim is
made by these adapter tests.
---------
Signed-off-by: Jake Gaylor <jhgaylor@gmail.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Synthetic usage-limit frames from the Claude SDK carry an all-zero usage
object. When one follows a real assistant response, the ACP bridge
currently overwrites the latest context measurement and emits a final
`usage_update` with `used: 0`.
Keep the previous measurement for a synthetic usage-limit frame when one
exists. A fresh quota-limited turn remains zero.
Includes a regression test covering a 170,910-token context followed by
a synthetic spend-limit frame.
Verified with:
- `npx vitest run src/tests/acp-agent.test.ts`
- `npm run check`
- `npm run build`
---------
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
## Summary
- keep `ANTHROPIC_VERTEX_BASE_URL` unset when `providers/set` selects
Vertex's native default endpoint
- retain explicit `ANTHROPIC_VERTEX_BASE_URL` only for custom Vertex
gateways/endpoints
- add a regression test for the default Vertex endpoint env mapping
Closes#1087
## Test Plan
- `npm run test:run -- src/tests/providers.test.ts` — passed (21 tests)
- `npm run check` — passed (`eslint src --ext .ts` + `prettier --check
.`)
- `npm run build` — passed (`tsc`)
- `git diff --check origin/main..HEAD` — passed
Note: `claude -p` delegation was attempted for candidate discovery but
this cron shell's Claude Code auth is not logged in (`Not logged in ·
Please run /login`), so the implementation/validation above was done
directly with local tests.
Signed-off-by: Emre K <110906681+kocaemre@users.noreply.github.com>
## Summary
- Fixes#1092 by treating `Please run /login` in a `success` result as
auth-required only when the result is actually error-shaped.
- Applies the same error-state guard to goal-command failure detection
so quoted login text in a normal answer does not roll back the active
goal.
- Adds a regression test for a successful model answer that mentions
`/login` without publishing a session failure.
## Test Plan
- [x] `npm run test:run -- src/tests/acp-agent.test.ts -t
'login|auth_required'`
- [x] `npm run build`
- [x] `npm run check`
- [ ] `npm run test:run` (blocked locally by pre-existing root
permission-mode assertions: `resolvePermissionMode("bypassPermissions")`
and `resolvePermissionMode("bypass")` resolve to `default` when running
as root)
Signed-off-by: Emre K <110906681+kocaemre@users.noreply.github.com>
## Summary
- allow the scheduled-wakeup live audit to wait through the full
minute-alignment window
- keep a small buffer for the autonomous model turn to complete
- raise the Vitest case timeout accordingly
`ScheduleWakeup(delaySeconds=60)` is persisted as a minute-aligned cron
entry. Depending on where scheduling lands within a minute, delivery can
take close to two minutes. The previous 75-second predicate timeout can
therefore fail even though the idle ACP stream delivers the wakeup
correctly. I reproduced both outcomes against current `main`: one run
timed out at 75 seconds, while a second run delivered `LIVE_WAKE_OK`
through the idle ACP stream.
Related: #838
## Verification
- `npm run check`
- `npm run build`
- `npm run test:run` (971 passed, 27 skipped)
- live SDK/ACP probe on Agent SDK 0.3.238 observed `SCHEDULED` followed
by autonomous `LIVE_WAKE_OK` while idle
## Summary
- reconstructs marker-only model-bound slash skill prompts during
history replay
- keeps client/local command metadata hidden when local stdout/stderr is
present
- adds regression coverage for both string and content-array transcript
shapes
Closes#998.
## Verification
- `npm run test:run -- src/tests/acp-agent.test.ts -t
'stripLocalCommandMetadata'`
- `npm run test:run -- src/tests/acp-agent.test.ts`
- `npm run build`
- `npm run check`
- `git diff --check`
I also ran `npm run test:run`. It completed with 965 passing tests, 27
skipped, and the same two root-environment `resolve-permission-mode`
failures seen when running as root: `bypassPermissions` is intentionally
downgraded to `default` in that environment. The changed replay/metadata
tests passed.
Signed-off-by: Emre Koca <1328630750+kocaemre@users.noreply.github.com>
Co-authored-by: Emre Koca <1328630750+kocaemre@users.noreply.github.com>
## Summary
- include normalized Claude SDK `skills` in the resumed-session
fingerprint
- preserve the distinct semantics of omitted, `'all'`, empty, and
explicit skill selections
- avoid unnecessary Query recreation for reordered or duplicate skill
names
- keep unrelated `_meta.claudeCode.options` fields out of the
fingerprint
- recreate the Query with the same native session ID when skills change
- merge the latest `origin/main` so the change is validated against the
current session logic and SDK 0.3.238
## Testing
- clean Linux Node 22 environment with
`@anthropic-ai/claude-agent-sdk@0.3.238`
- `npm run build`
- `npm run lint`
- `npm run check`
- targeted lifecycle tests: `425 passed, 9 skipped`
- full test suite: `978 passed, 27 skipped`
- successful lifecycle case: `newSession(['pdf']) ->
resumeSession(['docx'])`
Closes#955
Fixes#1114.
## Problem
A steered turn settles only at an SDK `idle`, and only once the steer's
echo has been replayed and an outcome recorded. Two ways that never
happens, both from #1114:
- **Missing echo.** If the CLI never replays the steered message, every
idle is swallowed and `session/prompt` parks until cancel or the next
prompt.
- **Owed-idle debt eats the settling idle.** If the steer aborts an
autonomous followup, that followup's result counts a trailing idle, but
the abort folds it into the one idle that spans both cycles. The debt
lane absorbs that idle and the steered turn never settles.
## Fix
1. **Exact lane: settle on the result that answers the steer.** A result
whose `user_message_uuids` (falling back to `user_message_uuid`) names
one of the turn's steers retires that steer's echo, even if the CLI
never replayed it. Once no steer is outstanding, the turn leaves the
steer lane and settles at that result through the ordinary lanes,
including the subagent hold and failure lanes. It owes its trailing idle
like any other settling result. No timer.
2. **Idle fallback, for producers that don't stamp results: count only a
result recorded after the last echo.** Before this, the outcome of the
cycle the steer interrupted (or a held turn's outcome that `steer()`
moved over) made the turn look ready as soon as the echo landed.
`steeredAwaitingResult` is set when an echo drains and cleared when a
result is recorded.
3. **A ready steered turn takes the idle ahead of owed-idle debt.** Its
outcome is final, so whichever idle arrives settles it correctly. The
debt is left standing: a separate trailing idle still absorbs the idle
it belongs to, and one that never comes is cleared by the existing sweep
at the next `running` transition. A steered turn that isn't ready still
goes through the debt lane first, so an earlier turn's late idle can
never settle a steered cycle that's still running.
## Live verification (CLI 2.1.280, SDK 0.3.280)
A probe with the adapter's query options (`replay-user-messages`,
partial messages) steered a running turn three ways: mid-generation at
`now`, mid-tool-call at `now`, and mid-tool-call at `later`. All three
had the same frame order:
```
RESULT stamp=ORIG stamps=[ORIG] <- interrupted (or finished) original cycle
lifecycle ORIG cancelled|completed
lifecycle STEER started
ECHO STEER
RESULT stamp=STEER stamps=[STEER] <- steered cycle
lifecycle STEER completed
STATE idle <- the only idle
```
So the interrupted cycle's result never names the steer, and the steered
cycle's result always does. `later` doesn't fold the steer into the
running turn either; it runs as its own cycle after the original
finishes, with no idle in between.
## Tests
Three new tests in `turn steering (_session/steering)`:
- **Echo missing, stamped result:** the turn settles at the result
before any idle, and the idle that follows is absorbed. Hangs on `main`.
- **Steer aborts an autonomous followup, only one idle:** the turn
settles. Hangs on `main`.
- **Owed idle arrives after the echo but before the steered result:**
the turn must not settle on it, and it ends with both cycles' usage.
Passes on `main`, but fails with the post-echo readiness check removed,
so it guards against settling early on a pre-steer outcome.
`npm run build`, `npm run test:run` and `npm run check` pass.
## Remaining gap
If the echo never replays and the result carries no stamp (older
producers), the turn still waits for cancel or the next prompt, as
documented before.
Supersedes #1115 and #1063. Thanks to @KlausUllrich for the #1114
analysis and the result-acknowledgement idea, which this builds on.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
## Problem
Claude Code refuses `bypassPermissions` when any settings tier sets
`permissions.disableBypassPermissionsMode` to `"disable"`. The adapter
ignored the setting: it still listed the Bypass mode, passed
`allowDangerouslySkipPermissions`, and accepted `defaultMode:
"bypassPermissions"` as the starting mode.
## Change
Fold the setting into `allowBypass` at session creation. That single
value already drives the mode catalog, the SDK flag and the spawn-time
mode clamp, so all three now agree with the CLI. Like the CLI, the
setting is honored from any tier. It can only take away a permission, so
project settings are trusted for it.
## Validation
- `npm run build`, `npm run check` and `npm run test:run` pass.
- New tests set the option in user settings and in project settings.
Both fail without the fix.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Supersedes #1140 by @s-cork. Their commit is kept as-is (rebased onto
`main`), plus one follow-up commit. The fork is org-owned, so
maintainers can't push to it.
## Problem
ExitPlanMode always led with Auto and dropped bypass, even when the
session advertised `bypassPermissions`. Clients that deliberately run in
full-access mode lost that choice at plan approval.
Claude Code itself offers one elevated choice and prefers bypass over
Auto. It can do that because the CLI only offers bypass to users who
launched with it. The adapter advertises bypass for every non-root
session, so copying that priority would hide Auto for almost everyone.
## Change
- Offer both Auto and bypass whenever the session advertises them
(@s-cork's commit).
- Follow-up: remember the mode the session left when it entered plan
mode (`SessionModeManager.syncConfig`, which every mode change goes
through, including plan approval since #1163). If that was
`bypassPermissions`, bypass comes first and is also what the
clear-context option uses. Otherwise Auto leads, as before. A remembered
bypass mode is ignored if the session no longer advertises it.
This also fills the gap where the clear-context choice only ever came in
the Auto flavour.
Partially addresses #1077.
## Validation
- `npm run build`, `npm run check` and `npm run test:run` pass.
- New tests cover the pre-plan mode tracking and the option order with
and without a pre-plan bypass mode, including the clear-context row.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: stu <stucork@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
## Summary
- tag SDK `informational` notices with `_meta.claudeCode.kind =
"informational"`
- include the notice `level` so clients can separate hook/status notices
from model text
- keep the existing rendered text unchanged for clients that ignore
`_meta`
Fixes#1042
## Test plan
- `npm test -- --run src/tests/acp-agent.test.ts -t informational`
- `npm run build`
- `npm run check`
- `IS_SANDBOX=1 npm run test:run`
- `git diff --check`
---------
Signed-off-by: Emre Koca <110906681+kocaemre@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Fixes#1124.
## The defect
`src/index.ts` awaited `resolveSettings` at module scope with nothing
around it:
```ts
const policy = await resolveSettings({ settingSources: [] });
for (const [key, value] of Object.entries(policy.effective.env ?? {})) {
process.env[key] = value;
}
```
That is a top-level `await` in an ESM entry point, so a rejection aborts
module evaluation and the process exits before serving any ACP traffic.
The client only sees a process that exited 1 with no protocol messages.
Two neighbours make this the only call that can do it, and both are
still true on \`main\`:
- `SettingsManager.loadAllSettings` (`src/settings.ts:105-113`) wraps
the same SDK call in `try`/`catch` and falls back to `{}`.
- The `process.on("unhandledRejection", ...)` handler is registered at
\`src/index.ts:62\`, after this await, so it does not cover it.
Reading the managed tier is best-effort by nature — on a host with no
MDM and no managed policy the result is empty and the agent behaves
identically — so a transient `EINTR`/`EMFILE`/`EAGAIN` while reading it
should leave the agent running with no policy env rather than stop it
from starting.
## The change
The guard lives in a new `src/managed-policy.ts` rather than inline, for
one reason: `src/index.ts` is an ESM entry point with top-level side
effects, so nothing in it can be imported by a test. Extracting the tier
read makes the failure path testable, which is what the regression test
below exercises.
`applyManagedPolicyEnv` mirrors `loadAllSettings`: it takes the SDK call
through a parameter defaulting to `resolveSettings` and a target env
defaulting to `process.env`, reports the failure on stderr, and returns
without applying anything. `src/index.ts` becomes:
```ts
await applyManagedPolicyEnv();
```
`console.error` is correct here: this runs before stdout is redirected,
so the ACP stream stays clean.
## Verification
Four tests in `src/tests/managed-policy.test.ts` cover the applied case,
an empty tier, a tier with no `env` table, and the failure path — the
last one asserts the promise **resolves** rather than rejects, with the
target env untouched, which is the property the entry point depends on.
```
before after
tests 17 failed | 1366 passed 17 failed | 1370 passed
```
The 17 failures are pre-existing in this checkout and untouched by this
change; the four added tests account for the difference. `eslint src
--ext .ts`, `tsc`, and `prettier --check` (with the repository's
`.prettierrc.json`) are clean on the three files.
## Note
I have not established whether those 17 pre-existing failures are
host-specific or real, so I am not claiming anything about them or
changing anything for them.
Supersedes #1139 by @s-cork. Their commit is kept as-is (rebased onto
`main`), plus one follow-up commit. The fork is org-owned, so
maintainers can't push to it.
## Problem
Approving a plan through ExitPlanMode changes the SDK permission mode,
but ACP clients keep showing Plan. When Auto isn't available for the
current model, clients should also see the fallback mode that actually
applies.
## Change
- After an ExitPlanMode permission is allowed, send
`current_mode_update` and `config_option_update` with the session mode
as it stands after `applyPermissionFallback`. Rejection and
clear-context handling don't change.
- Follow-up: wrap those two notifications in a try/catch. The plan is
already approved at that point, so a rejected `sessionUpdate` is logged
and no longer turns the approval into a failed permission request. This
matches `publishFallbackWarning`.
Partially addresses #1077. It doesn't fix session restoration after a
clear-context approval.
## Validation
- `npm run build`, `npm run check` and `npm run test:run` pass.
- Regression tests cover the ordinary default, bypass and Auto
approvals, plus Auto falling back to acceptEdits. They check both the
stored mode and both ACP notifications.
- A new test rejects the mode notification and checks that the approval
still returns `allow` with the `setMode` update. It fails without the
follow-up fix.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: stu <stucork@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude Code 2.1.280 (SDK 0.3.280, bumped in #1157) now accepts Write
calls where the model sends `path` instead of `file_path`, or
`file_text`/`file_content` instead of `content`. The CLI renames these
for its own validation, but the streamed `tool_use` block keeps the
model's original field names. So we showed the call as "Preparing file…"
with no diff or location, even though the write went through.
`toolInfoFromToolUse` now reads those fields the same way the CLI does.
When both spellings are present, the canonical fields win.
Nothing else in the 0.3.280 / 2.1.280 changelog needed an adapter
change. I checked Opus 5.5 model rows, the hand-back frame header,
`requires_action` during MCP elicitation, and headless elicitation
cancellation.
## Test plan
- New `toolInfoFromToolUse - Write input aliases` tests
- `npm run build`, `npm run check`, `npm run test:run`
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
## Summary
Close unfinished ACP compactions before interrupted prompts settle.
Previously, force cancellation could return `stopReason: cancelled`
while leaving the compaction `in_progress`; SDK stream teardown and
conversation reset had similar cleanup gaps.
- Add shared, idempotent interruption cleanup for cancellation,
force-cancel recovery, provider failures, SDK EOF/errors, and
conversation reset.
- Close compactions before resolving echo-less `/compact` commands,
which may still be queued while their compaction is running.
- Discard abandoned pending summaries and ignore late compaction
openings, completions, chunks, and hooks until an identified live turn
resumes.
- Preserve normal early-summary buffering across ordinary result
boundaries.
- Add regression coverage for terminal-before-response ordering,
echo-less cancellation, late SDK events, fresh-turn recovery,
EOF/errors, reset, and best-effort delivery failures.
After interruption, hooks without a command identity are conservatively
omitted until a new live turn is identified, rather than risking
attribution to the wrong compaction. Older echo-less commands without
dispatch identity may likewise omit the ambiguous compaction lifecycle
until turn activation.
This fixes an implementation gap found while auditing the [Session
Compaction
RFD](https://github.com/agentclientprotocol/agent-client-protocol/blob/main/docs/rfds/session-compaction.mdx).
No protocol or RFD changes are included.
## Validation
- [x] `npm run test:run` — 1,397 passed, 28 skipped
- [x] `npm run build`
- [x] `npm run check` — ESLint and Prettier
- [x] `git diff --check`
Tests use mocked SDK streams; no live provider calls were made.
Bumps the minor group with 11 updates:
| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.274` | `0.3.276` |
|
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
| `26.5.1` | `26.6.1` |
| [prettier](https://github.com/prettier/prettier) | `3.9.7` | `3.9.8` |
| @anthropic-ai/claude-agent-sdk-darwin-arm64 | `0.3.274` | `0.3.276` |
| @anthropic-ai/claude-agent-sdk-darwin-x64 | `0.3.274` | `0.3.276` |
| @anthropic-ai/claude-agent-sdk-linux-arm64 | `0.3.274` | `0.3.276` |
| @anthropic-ai/claude-agent-sdk-linux-arm64-musl | `0.3.274` |
`0.3.276` |
| @anthropic-ai/claude-agent-sdk-linux-x64 | `0.3.274` | `0.3.276` |
| @anthropic-ai/claude-agent-sdk-linux-x64-musl | `0.3.274` | `0.3.276`
|
| @anthropic-ai/claude-agent-sdk-win32-arm64 | `0.3.274` | `0.3.276` |
| @anthropic-ai/claude-agent-sdk-win32-x64 | `0.3.274` | `0.3.276` |
Updates `@anthropic-ai/claude-agent-sdk` from 0.3.274 to 0.3.276
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.276</h2>
<h2>What's changed</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.276</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.276
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.276
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.276
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.276
</code></pre>
<h2>v0.3.275</h2>
<h2>What's changed</h2>
<ul>
<li>Fixed a deferred tool call's result being emitted with internal keys
such as <code>toolUseResult</code> instead of
<code>tool_use_result</code> when the tool re-runs at the start of a
resumed turn</li>
<li>Fixed <code>getSessionMessages()</code> and
<code>forkSession()</code> sometimes missing a turn's assistant message
when called right after the turn's <code>result</code> message</li>
<li>Fixed <code>forkSession({ upToMessageId })</code> rejecting a
client-supplied <code>SDKUserMessage.uuid</code> that is not in UUID
format</li>
<li>Fixed <code>forkSession</code> rejecting the id that
<code>getSessionMessages</code> returns for a message sent while Claude
was working, and a fork showing a re-run prompt twice</li>
<li>Fixed <code>getSessionMessages()</code> omitting a task notification
or other queued message that Claude read while running a tool; it now
comes back where Claude read it</li>
<li>Updated to parity with Claude Code v2.1.275</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.275
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.275
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.275
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.275
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.276</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.276</li>
</ul>
<h2>0.3.275</h2>
<ul>
<li>Fixed a deferred tool call's result being emitted with internal keys
such as <code>toolUseResult</code> instead of
<code>tool_use_result</code> when the tool re-runs at the start of a
resumed turn</li>
<li>Fixed <code>getSessionMessages()</code> and
<code>forkSession()</code> sometimes missing a turn's assistant message
when called right after the turn's <code>result</code> message</li>
<li>Fixed <code>forkSession({ upToMessageId })</code> rejecting a
client-supplied <code>SDKUserMessage.uuid</code> that is not in UUID
format</li>
<li>Fixed <code>forkSession</code> rejecting the id that
<code>getSessionMessages</code> returns for a message sent while Claude
was working, and a fork showing a re-run prompt twice</li>
<li>Fixed <code>getSessionMessages()</code> omitting a task notification
or other queued message that Claude read while running a tool; it now
comes back where Claude read it</li>
<li>Updated to parity with Claude Code v2.1.275</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4919e0693e"><code>4919e06</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="e51cd0b1ba"><code>e51cd0b</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.274...v0.3.276">compare
view</a></li>
</ul>
</details>
<br />
Updates `@types/node` from 26.5.1 to 26.6.1
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
Updates `prettier` from 3.9.7 to 3.9.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/releases">prettier's
releases</a>.</em></p>
<blockquote>
<h2>3.9.8</h2>
<ul>
<li>Markdown: Don't let Liquid objects interrupt paragraphs (<a
href="https://redirect.github.com/prettier/prettier/pull/20087">#20087</a>
by <a href="https://github.com/seiyab"><code>@seiyab</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.9.8/CHANGELOG.md#398">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md">prettier's
changelog</a>.</em></p>
<blockquote>
<h1>3.9.8</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.9.7...3.9.8">diff</a></p>
<h4>Markdown: Don't let Liquid objects interrupt paragraphs (<a
href="https://redirect.github.com/prettier/prettier/pull/20087">#20087</a>
by <a href="https://github.com/seiyab"><code>@seiyab</code></a>)</h4>
<!-- raw HTML omitted -->
<pre lang="markdown"><code><!-- Input -->
If `module` is not a
[`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module)
object instance, a
{{jsxref("TypeError")}} is thrown.
<p><!-- Prettier 3.9.7 -->
If <code>module</code> is not a <a
href="https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module"><code>WebAssembly.Module</code></a>
object instance, a</p>
<p>{{jsxref("TypeError")}} is thrown.</p>
<p><!-- Prettier 3.9.8 -->
If <code>module</code> is not a <a
href="https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module"><code>WebAssembly.Module</code></a>
object instance, a
{{jsxref("TypeError")}} is thrown.
</code></pre></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4f2ab6765d"><code>4f2ab67</code></a>
Release 3.9.8</li>
<li><a
href="3d82af8b15"><code>3d82af8</code></a>
Update Regex related dependencies (<a
href="https://redirect.github.com/prettier/prettier/issues/20082">#20082</a>)</li>
<li><a
href="5ec8db1745"><code>5ec8db1</code></a>
[3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs (<a
href="https://redirect.github.com/prettier/prettier/issues/20087">#20087</a>)</li>
<li><a
href="5b142ed2bc"><code>5b142ed</code></a>
Release Release <code>@prettier/plugin-hermes</code><a
href="https://github.com/0"><code>@0</code></a>.2.3,
<code>@prettier/plugin-oxc</code><a
href="https://github.com/0"><code>@0</code></a>.2.3, an...</li>
<li><a
href="0df8eb86b5"><code>0df8eb8</code></a>
Bump Prettier dependency to 3.9.7</li>
<li><a
href="3cf6c8c058"><code>3cf6c8c</code></a>
Clean changelog_unreleased</li>
<li>See full diff in <a
href="https://github.com/prettier/prettier/compare/3.9.7...3.9.8">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.3.274 to
0.3.276
Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.3.274 to
0.3.276
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.3.274 to
0.3.276
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.3.274
to 0.3.276
Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.3.274 to
0.3.276
Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.3.274 to
0.3.276
Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.3.274 to
0.3.276
Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.3.274 to
0.3.276
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
When a client advertises terminal_output_delta, send Bash output through
that channel. Keep the completion update free of duplicate raw output
while preserving the existing terminal_output fallback.\n\nTracks
IJAI-2376.
## Summary
- use the canonical tool-call title for permission prompts, so shell
approvals show the exact command instead of the model-authored
description
- map `PowerShell` through the same shell presentation path as `Bash`
- complete the PowerShell terminal lifecycle with matching
`terminal_info`, `terminal_output`, and `terminal_exit` metadata,
including failed commands
- add focused regression coverage without changing the existing Bash
lifecycle tests
Fixes#1068
## PowerShell input and result contract
`PowerShell` is a distinct tool name, but its documented input fields
match `Bash`: the executable command is in `command`, while
`description` is an optional human-readable summary. The Claude Code
hooks reference documents the shared `command`, `description`,
`timeout`, and `run_in_background` fields, and the tools reference
likewise states that PowerShell hooks receive the command in
`tool_input.command`.
Anthropic closed
[claude-code#83647](https://github.com/anthropics/claude-code/issues/83647#issuecomment-5310033500)
after documenting this equivalence. Reusing the SDK's exported
`BashInput` shape for the common input fields is therefore intentional;
the SDK currently does not export a separate `PowerShellInput` type.
PowerShell results do not need a PowerShell-specific output assumption
here. The result mapper first shape-checks structured stdout/stderr and
otherwise falls back to the standard raw `tool_result` string or
content-block array. Routing PowerShell through that existing mapper
preserves this fallback while completing the adapter's capability-gated
terminal sequence:
1. initial `tool_call` with `terminal_info`
2. `tool_call_update` with `terminal_output`
3. final `tool_call_update` with `terminal_exit`
All three events use the original tool-use ID, so the client can
reconcile and close the terminal. Failed PowerShell results also bypass
the generic error renderer and finish the terminal with a non-zero
display exit code.
The permission presentation introduced in #1004 already handled `Bash`
and `PowerShell` together when choosing a description-based permission
title, but the canonical tool presentation and terminal result paths
only handled `Bash`. This PR completes both paths.
References:
- [Claude Code hooks: PowerShell
input](https://code.claude.com/docs/en/hooks#powershell)
- [Claude Code tools reference: PowerShell
tool](https://code.claude.com/docs/en/tools-reference#powershell-tool)
- [Anthropic schema
confirmation](https://github.com/anthropics/claude-code/issues/83647#issuecomment-5310033500)
## Verification
- `npm run check`
- `npm run build`
- `npm run test:run -- src/tests/tools.test.ts -t "PowerShell terminal
output"` (1 passed)
- full suite with an empty temporary Claude config:
`CLAUDE_CONFIG_DIR=<empty temporary directory> npm run test:run` (1070
passed, 27 skipped)
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
## Summary
- replace the hidden model-authored file audit turn with Claude native
file checkpointing
- preview changed paths with rewindFiles at the terminal turn boundary
while preserving the existing AIR metadata contract
- enable checkpointing only for clients that negotiate
agentFileChangeReport and fail open after two seconds
- retain legacy audit filtering so persisted sessions do not replay old
hidden audit turns
This follows Claude Code checkpoint semantics. It tracks changes made
through supported Claude file tools; Bash and most subagent changes may
not be included.
Reference: https://code.claude.com/docs/en/checkpointing
## Validation
- npm run build
- npm run check
- env -u ANTHROPIC_BASE_URL npm run test:run (1368 passed, 28 skipped)
Claude supplies structured patches for Edit and Write, but ACP diff
blocks previously carried only the reconstructed texts. AIR had to
compare those texts again to display added and removed counts.
Count patch operations in the existing conversion loop and publish
`_meta.jetbrains.air.diffStats` on each diff block. This uses the same
contract as https://github.com/agentclientprotocol/codex-acp/pull/501.
Each block has its own counts. No extra traversal, full file comparison,
or navigation calculation is needed.
Omit statistics when patches are absent or inconsistent, so clients
retain their existing fallback. Exclude EOF markers from the displayed
texts. Document the extension and cover per-block counts, Edit and Write
hooks, EOF changes, and fallback behavior.
Validation:
- `npm run build`
- `npm run check`
- `env -u ANTHROPIC_BASE_URL npm run test:run` (the local endpoint
override affects unrelated provider tests)
## Summary
For a single-select `AskUserQuestion`, a non-empty custom-answer field
(`question_<n>_custom`) replaced the selected option. A client that
renders that box as a notes step (as in #1050, seen via Devin/Windsurf)
therefore returned only the typed text and the selection never reached
the model.
- The pick now stays in `answers`, and the typed text travels beside it
as the tool's own per-question `annotations[question].notes`. That is
the slot the CLI itself uses for free text attached to a selection and
renders to the model as `"Q"="A" notes: ...`, so no new answer format is
invented.
- Custom text with no pick is still the answer on its own (the CLI's
"Other").
- Multi-select folding from #1031 is unchanged: the text still joins the
checked options with CLI-style quoting.
- `annotations` is only added to `updatedInput` when non-empty.
- The single-select field description now says the box can also add a
note to the chosen option.
Supersedes #1054, which conflicted with #1031 and glued label and text
into one string.
The "empty notes field won't submit" part of #1050 is client-side:
nothing in the requested schema is marked required.
Closes#1050
## Test plan
- `npm run check`
- `npm run build`
- `npm run test:run` (1325 passed, 27 skipped)
- New test: pick + custom text yields `answers: { Q: "A" }` and
`annotations: { Q: { notes } }`
- New test: custom text alone on a single-select stays the answer
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
## Summary
Closes#1119. Supersedes #1120 by @amansk (their commits are included on
this branch; the fork does not allow maintainer edits, so review fixes
landed here instead).
Hosts that never use `bypassPermissions` can opt a session out by
sending `_meta.claudeCode.options.allowDangerouslySkipPermissions:
false` on `session/new` (and again on `session/load`). When omitted or
`true`, behavior is unchanged: bypass is available on non-root sessions.
## Design
Bypass availability is decided once per session in `createSession`:
```ts
const allowBypass =
ALLOW_BYPASS && sessionMeta?.claudeCode?.options?.allowDangerouslySkipPermissions !== false;
```
and threaded to the three places that must agree:
- the SDK `allowDangerouslySkipPermissions` flag (the actual
enforcement; the CLI refuses bypass without it)
- the spawn-time mode clamp in `resolvePermissionMode`, so a
`permissions.defaultMode` of `bypassPermissions` (or a mode carried
across a clear-context restart) becomes `default` before `query()`
rather than failing at spawn
- the session mode catalog in `SessionModeManager.initialize`, so the
client is never offered a mode the CLI would reject
## Changes from #1120
- Fold the host opt-out into `resolvePermissionMode` via an
`allowBypass` parameter instead of a second inline clamp; drop the
separate `resolveAllowDangerouslySkipPermissions` helper
- Make `allowBypass` a required `initialize` parameter and remove the
module-global `ALLOW_BYPASS` fallback from `session-mode.ts`
- Fix `tsc` errors in the new tests (`modes` is optional on
`NewSessionResponse`), which broke the CI build job
- Move the settings-driven clamp test onto the shared
`acp-agent-settings` fixture (isolated cwd, no double module reload,
passes as root)
- Document the opt-out in `docs/permission-extension.md`
## Testing
- `npm run check`, `npm run build` — pass
- `npm run test:run` — pass (the branch is based before #1123, so the
SDK version guard in `model-presentation.test.ts` only passes with the
pinned 0.3.257; it clears on rebase)
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Amandeep Khurana <amansk@gmail.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
## Summary
`applyAskElicitationResponse` drops a multi-select question's checked
options as soon as
that question's custom-answer field is non-empty: the typed text
replaces the selection
instead of joining it, so the checked options never reach the model.
Versions: reproduced on v0.69.0, code unchanged on v0.70.0 and current
`main` (996d488);
`@agentclientprotocol/sdk` 1.3.0; Node 22. Noticed through Zed 1.16.1,
which does return
both fields, but the repro below is adapter-local and needs no client.
## Where the two fields diverge
`askUserQuestionsToCreateRequest` publishes, per question, two
**independent optional**
fields: `question_<n>` and `question_<n>_custom`. Neither is `required`,
and nothing in
the schema makes them exclusive. The
`_meta._askUserQuestionCustomAnswer` marker from #929
identifies the companion field's role (`{ questionId, isCustomAnswer }`)
— it doesn't ask a
client to clear the selection when the box is filled. So a client that
returns both is
doing nothing wrong, and the fold has no ground to keep only one of
them.
Before #774 the two coexisted: selections in `answers`, the custom text
in a separate
top-level `response` field. Scoping the custom answer per question
(fixing #770) turned
that coexistence into an overwrite:
```js
const custom = content[questionCustomFieldKey(index)];
if (typeof custom === "string" && custom.trim() !== "") {
answers[question.question] = custom.trim();
return; // <- selections discarded
}
```
For a **single-select** question replacing is right — the user typed an
answer instead of
picking one — and that stays. For a **multi-select** question the
options were never
mutually exclusive, so the typed answer should join them.
Restoring `response` isn't the alternative: it is a single form-level
field, so using it
for per-question custom answers would reintroduce exactly the collapse
#770 reported.
## Reproduction (no client, no model, no network)
```js
import { applyAskElicitationResponse } from "@agentclientprotocol/claude-agent-acp/dist/elicitation.js";
const q = [{ question: "Which features?", header: "F", multiSelect: true,
options: [{ label: "Alpha" }, { label: "Bravo" }] }];
const fold = (content) =>
applyAskElicitationResponse({ action: "accept", content }, { questions: q }, q)
.updatedInput.answers;
fold({ question_0: ["Alpha", "Bravo"] }); // { "Which features?": "Alpha, Bravo" } (control)
fold({ question_0: ["Alpha", "Bravo"], question_0_custom: "Charlie" });
// actual: { "Which features?": "Charlie" }
// expected: { "Which features?": "Alpha, Bravo, Charlie" }
```
## Change
Multi-select questions join the custom answer onto their selections;
single-select keeps
replacing. The selection normalization is deliberately untouched, so a
multi-select
question with a non-empty custom answer is the only input that folds
differently than
before. Comma-joining follows the documented shape of `answers`
("multi-select answers are
comma-separated"), which also means a label containing a comma stays
exactly as ambiguous
as it already was.
The `"Other"` box described itself as *"Type your own answer instead of
choosing an option
above"*; it now describes both roles, since for a multi-select question
it is no longer an
either/or.
---------
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
## Summary
- Replace the ambiguous regex used to parse textual `TaskList` output
with linear string parsing.
- Preserve support for owners, multiple dependencies, and malformed
suffixes treated as subject text.
- Add a regression test covering adversarial input.
This addresses a potential ReDoS reported by CodeQL without changing the
structured JSON path.
Closes#1005.
## Testing
- `npm run test:run`
- `npm run build`
- `npm run check`
## Summary
- strip `<system-reminder>` blocks from replayed user messages, through
the marker scanner that already handles the local-command tags
- what the user actually typed is preserved; a reminder-only message
strips to nothing and is skipped
- regression coverage for the string shape, the content-array shape, and
`replaySessionHistory` end to end
## Why
`stripLocalCommandMetadata` exists for a stated reason: *"The live
prompt loop drops them; replay must strip them too or they leak into the
UI on session/load."* Injected reminders are the same class of leak and
are not covered by it.
The CLI appends `<system-reminder>` blocks to a user turn to steer the
model — a worktree that was deleted, a background task that started
elsewhere. They are persisted in the same text block as the prose the
user typed, and they are not `isMeta`, so `getSessionMessages` returns
them. Live, nothing reaches the client: the prompt loop's user-message
skip covers the whole message. On `session/load` the block is replayed
verbatim, so a client renders a paragraph of instructions the user never
wrote, followed by their one-line prompt.
Reproduced against `main` with a real transcript: a reminder about a
deleted worktree, followed by a five-word prompt, arrives as a single
`user_message_chunk` containing both. With this change the chunk is the
five words.
## Not included, deliberately
- **`<task-notification>` envelopes.** They still replay as user
messages, but #1028 is already doing that properly, keyed on the
SDK-provided `origin.kind` rather than the text — the better trust
boundary, since a user can type the tag themselves.
- **`[Request interrupted by user]`.** Also still replayed as a user
message. It is untagged prose and it is the only trace a cancelled turn
leaves, so whether it should be dropped, typed, or marked in `_meta`
reads as your product call rather than a bug fix. Happy to open a
follow-up if you want it handled.
The exported name `stripLocalCommandMetadata` is left alone — it is part
of `lib.ts` — so only the shared marker list and the doc comment grew.
## The one false positive
A user who literally types `<system-reminder>…</system-reminder>` in a
prompt loses that span on replay, while seeing it live. It is the same
trade already accepted for `<command-name>`, the surrounding prose still
survives, and text is the only signal available here — unlike task
notifications, reminders carry no `origin` to key on. Flagging it rather
than leaving it for review to find.
## Verification
- `npm run build`
- `npm run check`
- `env -u ANTHROPIC_BASE_URL npm run test:run` — 974 passed, 27 skipped
- the three new tests fail on `main` and pass with the change
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
## Why
The main-thread agent option is a rarely used, provider-specific
parameter. It is not used by ACP clients or their settings, and
maintaining a public picker for it adds config state, discovery calls,
restart propagation, and live-switch handling for functionality that
clients do not need.
Removing it keeps the session configuration contract focused on settings
that ACP clients actually use. This does not remove ACP subagent
sessions or the Agent/Task tool behavior; it only removes the unused
main-thread agent selector and parameter plumbing.
## Summary
- remove the main-thread Agent session config picker and custom-agent
discovery
- remove live agent switching and session state used only by that picker
- ignore claudeCode.options.agent and stop restoring it during context
resets
- document agent as ignored in the exported NewSessionMeta contract
- preserve ACP subagent sessions and Agent/Task tool behavior
## Breaking change
BREAKING CHANGE: claudeCode.options.agent is no longer forwarded to
Claude Code, and the agent-picker exports DEFAULT_AGENT_ID,
AGENT_CONFIG_ID, BUILTIN_AGENT_NAMES, and discoverCustomAgents are
removed. Consumers relying on main-thread agent selection must stop
passing that option.
## Testing
- npm run check
- npm run build
- npx vitest run src/tests/create-session-options.test.ts (62 passed)
Clients that negotiate the AIR `recommendedValue` capability receive
concrete model and effort choices instead of ambiguous default rows. The
SDK's default model is mapped only to an exact selectable model
(including equivalent context suffix spellings); unavailable
recommendations retain the legacy default. Recommendations remain
independent of explicit selections.
The adapter applies the displayed effort to the SDK at startup and on
model switches, preserving supported user pins and re-reading per-model
settings for automatic choices. Permission modes and clients without the
capability retain their existing configuration behavior. Model and
effort configuration logic is extracted into dedicated modules.
Terse SDK model labels are enriched with concrete versions from model
metadata: for example, `Fable` becomes `Fable 5.1`, `Sonnet` becomes
`Sonnet 5`, and `Opus (1M context)` becomes `Opus 5`. Custom names are
preserved, and collisions fall back to the original labels. An SDK
version guard requires review on upgrades, and an opt-in live
initialization test verifies the upstream model contract without sending
a prompt.
Validation:
- `npm run check`
- `npm run build`
- `env -u ANTHROPIC_BASE_URL npm run test:run` — 1253 passed, 28 skipped
- `RUN_INTEGRATION_TESTS=true npx vitest run
src/tests/model-presentation.test.ts` — 4 passed
- Regression coverage for unavailable model generations/context windows,
startup effort, per-model settings, unsupported effort pins, and
duplicate Opus labels
Today nothing reaches npm between two release-please releases, so trying
a merged
but unreleased change means building from source. This adds a
continuously
published preview channel.
Every CI-green push to `main` that is not a release merge publishes
`<package.json version, patch bumped>-preview.N` under the `preview`
dist-tag,
tags the commit `v<version>`, and dispatches the same agent registry
update a
stable release does. With `main` at 0.73.0 that gives
`0.73.1-preview.1`,
`0.73.1-preview.2`, and so on; `N` restarts at 1 whenever a release
moves the
base. `latest` is untouched.
## Approach
- **Added to `publish.yml` rather than a new workflow.** npm binds a
trusted
publisher to one repo + workflow filename, and a package gets only one.
A
separate file would fail OIDC and cost the stable path its publisher.
- **Gated on the `CI` workflow succeeding** (`workflow_run`), so a red
commit is
never published. release-please's release merge is excluded by the head
commit's author and subject — its `releases_created` output is not
reachable
from a different workflow run.
- **`N` is the max of the npm registry and local git tags.** npm
reserves
versions forever, even after `unpublish`, so a reused `N` is a hard
failure;
but the registry is CDN-served and lags, which the tags cover. A
registry read
failure aborts rather than guessing.
- **Base is patch+1, not release-please's prediction**, which moves
mid-flight
and would reset `N` under already-published previews.
- **The version is applied to the CI working tree only**, never
committed —
`package.json` and the release-please manifest stay release-please's to
own.
- **`--tag preview` is mandatory:** `npm publish` defaults to `latest`
even for a
semver prerelease.
- **Three jobs.** `publish-npm-preview` mirrors `publish-npm` and only
publishes
(no repo write access); `publish-tag-preview` only tags, so a failed tag
is
retryable with _Re-run failed jobs_ without re-publishing an immutable
version;
`trigger-registry-update` is shared with the stable path. Both
downstream jobs
gate on a `published` output the publish step sets, not on job status —
the tag
push happens after the publish, so a red job can still mean npm has the
version.
## Next step
The publish is `npm publish --dry-run` for now. The `workflow_run`
trigger and
the `release` environment's protected-branch policy mean this job cannot
run off
the default branch at all, so merging this is the only way to exercise
the
trigger, the gate and the version calculation — and with `published`
unset, the
rehearsal neither tags nor touches the registry.
Once one run looks right, a follow-up drops `--dry-run` and adds
`echo "published=true" >> "$GITHUB_OUTPUT"` to that step. Nothing else
changes.
## Summary
- resolve AIR fork points from the complete persisted transcript when
the target is outside the active parent chain
- support message fingerprints and repeated assistant content when
resolving persisted fork points
- restore resumed models from the same local assistant transcript record
Claude Code uses
- remove all automatic `getContextUsage` control requests; use
`compact_metadata.post_tokens` after compaction
- add structured timing logs for fork, load, replay, and session
creation phases
## Performance
Cold-loading the reproduced 69-message forked session dropped from 20–29
seconds to 1.9 seconds. Transcript model lookup took 5 ms and replay
took 14 ms; the remaining time was SDK initialization.
## Tests
- `env -u ANTHROPIC_BASE_URL npm run test:run` (1230 passed, 27 skipped)
- `npm run build`
- `npm run lint`
- Prettier check for all changed files
- real ACP cold-load probe against the reproduced forked session
## Summary
- recognize Claude Code local /usage output
- render subscription limits and MCP contributions as structured
Markdown with progress bars
- keep usage parsing and rendering in a dedicated module with unit
coverage
- preserve existing handling for other local commands and unknown future
usage formats
## Testing
- npm run check
- npm run build
- env -u ANTHROPIC_BASE_URL npm run test:run (1210 passed, 27 skipped)
## Summary
- surface Claude context compaction as a synthetic ACP tool lifecycle
instead of assistant text
- emit provider-neutral `_meta.contextCompaction` metadata with schema
version 1
- handle status, stream heartbeat, compact-boundary, terminal-only,
failure, and duplicate terminal event shapes
- keep the generated compaction summary internal to the agent
## Protocol
Compaction tool calls use `kind: "think"`, title `Compact conversation`,
standard ACP lifecycle statuses, and optional metadata fields `trigger`,
`preTokens`, `postTokens`, `durationMs`, and `error`.
## Testing
- `npm run test:run` (769 passed, 26 skipped)
- `npm run build`
- `npm run check`
Stacked on #1071. The first three commits are that PR; review the last
commit here.
## What
`--hide-claude-auth` hid the claude.ai login method from `initialize`,
but nothing stopped a session from billing a subscription that was
already stored. This moves the decision into `src/hide-claude-auth.ts`
with two layers:
1. Session creation refuses an account that holds no credential this
integration accepts, so a logged-out session never exists.
2. A sign-out during the session ends the query. The next turn recreates
it, so the next `initialize` reports the real account.
A per-turn guard repeats the check on the account the SDK cached at
`initialize`. It reads no process and costs microseconds. It covers a
session created under a provider override that `providers/disable` later
removed.
"Bills a subscription" is an allowlist of `apiKeySource` values that
outrank a stored subscription, so an unknown SDK value keeps the guard
on. The guard fails open when the account cannot be read at all, and
warns once per session.
## Client-visible additions (all additive)
- The `authRequired` JSON-RPC error carries `data.reason:
"claude_subscription_not_supported"` when the guard blocks a turn. Same
error code and same message string as before. A plain sign-out still
carries no `data`.
- `PublishedSessionFailure` gains an optional `reason`, emitted in the
failure `_meta` only when set. `hasActiveSessionError` matches on it, so
the subscription refusal and a plain sign-out cannot suppress each
other.
## Behavior changes not behind the flag
- `providers/set` and `providers/disable` no longer reject the whole
call when one session cannot be recreated. The session gets a
per-session failure row, the switch goes on to the next session. The
affected session is the one signal for that case; AIR never reaches it,
because it sends `providers/set` only while a pooled client is created,
before any session exists.
- `authenticate` validates a gateway payload that is present. A call
with no `_meta.gateway` keeps its historical meaning: no override,
success.
- A failed session creation closes the query it spawned instead of
leaking the CLI process.
## Compatibility
Checked against Zed and the JetBrains clients (`plugins/llm`, AIR main
and stable). No consumer sends a gateway `authenticate` without a
payload, none passes `--hide-claude-auth` by default, every one already
handles the `auth_required` JSON-RPC rejection, and every `_meta` /
error `data` parser ignores unknown fields.
## Test plan
- `npm run build`, `npm run check`: clean.
- `npm run test:run`: 1153 passed, 27 skipped.
- New tests in `src/tests/authorization.test.ts` cover the guard end to
end: creation refusal, per-turn refusal, sign-out respawn, provider
override on/off, gateway payload validation, degraded guard.
## Follow-up commit in this PR
- `fix(auth): start a fresh query when a signed-out session cannot be
resumed` — when the CLI never persisted the session, `resume` answers
`resourceNotFound`; the respawn now starts a fresh query under the same
ACP session id instead of failing every later prompt.
Tests after it: 1156 passed, 27 skipped.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
- Seed the Effort picker from the CLI's persisted per-model effort
(settings.modelSettings) with the legacy top-level effortLevel as
fallback, and stop pinning settings-derived seeds at the flag layer —
only explicit ACP picker choices pin effort now, so the CLI's own
per-model restore survives model switches.
- Re-seed effort from the new model's persisted entry on unpinned model
switches instead of dragging the old model's value along.
- Use the result's user_message_uuid (SDK 0.3.246+) as an exact join
key:
the empty-interruption diagnostic handler consumes exactly the token it
names (and no longer swallows a live turn's stamped failure), and
ensureActiveTurn consumes the named orphan / skips the dup-over-loss
one-skip when the stamp refutes it. Older producers keep the heuristics.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Currently, `package.json` allows zod version `3.x`. But
`agentclientprotocol/sdk` and our code use explicit `zod/v4` imports.
But `v4` became a proper ES module only in `4.x`. Before that, it was
just a directory. So if a user has zod 3.x, running this ACP server will
fail with `ERR_UNSUPPORTED_DIR_IMPORT`.
## Summary
- keep the standard latest-turn ACP fork behavior
- accept an optional AIR fork point at `_meta.jetbrains.air.fork`
- translate the ACP `messageId` to the Claude transcript UUID
- use the current Agent SDK `forkSession(..., { upToMessageId })` API
- resume the new SDK session with the same working directory and
additional directories
No Agent SDK dependency update is required. Version `0.3.238` already
provides the required API.
## Tests
- `npm run build`
- `npm run lint`
- `env -u ANTHROPIC_BASE_URL npm run test:run` — 981 passed, 27 skipped
## Summary
- negotiate native ACP subagent sessions and AIR async task support
- map Claude Agent/Task lifecycle to independent child session streams
- publish background workflow, monitor, MCP, and backgrounded shell work
as async tasks
- attach background shell tasks to their originating tool calls so
clients can update one command card and open its output log
- stream task progress and preserve running, paused, completed, failed,
and stopped states
- keep synchronous shell work, generic tools, and task notifications out
of user message chunks
- preserve typed session failures and root permission/elicitation
requests
- preserve the legacy generic Agent/Task representation and flattened
transcript opt-ins for clients without native subagent capability
## Compatibility
The published ACP SDK does not yet contain PR #1992 types, so the change
isolates the temporary structural cast in `src/acp-subagents.ts`.
Clients that do not negotiate native subagent sessions retain the
existing generic tool-call fallback, including the historical
`_meta["subagent-transcript"]` capability and `forwardSubagentText`
session option. Async tasks use the negotiated `asyncTasks` AIR
capability and remain invisible to clients that do not advertise it.
Claude does not expose a safe targeted child-cancel primitive, therefore
child `cancel` and `close` capabilities remain disabled.
## Validation
- `npm run check`
- `npm run build`
- `env -u ANTHROPIC_BASE_URL npm run test:run` (830 passed, 20 skipped)
- `npm run test:run -- src/tests/async-tasks.test.ts` (5 passed)
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
## Problem
The ACP steering extension injects follow-up user messages into a
running Claude SDK turn. Until now, every injected message used priority
`now`. That is normally desirable because it makes Claude react
immediately, but `now` is interrupting delivery: the SDK aborts the
currently running cycle before processing the new message.
This becomes unsafe while the SDK is blocked in a user-input callback,
such as a permission request or elicitation. Interrupting that cycle
makes the SDK send `$/cancel_request` for the pending ACP request. The
client then removes the permission/elicitation card before the user can
answer it. Depending on timing, the original ACP prompt can remain
pending because the callback and interrupted cycle no longer complete
through their normal lifecycle.
The failure sequence was:
1. Claude requests permission or opens an elicitation.
2. The ACP client displays a user-input card and waits for an answer.
3. The user sends a steering message while that card is still open.
4. The adapter injects the message with priority `now`.
5. The Claude SDK interrupts the cycle and emits `$/cancel_request` for
the open card.
6. The card disappears, and the original prompt may be left waiting
indefinitely.
## Fix
Track the number of permission/elicitation requests currently awaiting
user input for each session. Steering now selects its internal SDK
delivery priority as follows:
- `later` while at least one user-input request is pending, so the
steering message is queued without interrupting or cancelling the open
request;
- `now` at all other times, preserving the existing immediate steering
behavior.
The state is a counter rather than a boolean because multiple background
subagents can have concurrent permission requests. The `finally` cleanup
keeps the count correct for accepted, declined, cancelled, aborted, and
failed requests.
All ACP-backed user-input paths are covered:
- regular tool permission requests;
- the built-in `AskUserQuestion` form elicitation;
- MCP form/URL elicitations;
- refusal-fallback user dialogs.
## Regression coverage
Added parameterized tests that hold each user-input path open, inject a
steering message, and verify that the SDK message uses priority `later`.
The existing steering regression test continues to verify priority `now`
when no user input is pending. The tests also verify that the
pending-user-input state is cleared after the request settles.
Fixes IJAI-1191.
## Validation
- `npm run check`
- `npm run build`
- `env -u ANTHROPIC_BASE_URL npm run test:run` — 975 passed, 27 skipped
`ANTHROPIC_BASE_URL` was removed only for the test command because the
Codex environment injects a local proxy URL, while four provider tests
intentionally assert the native `https://api.anthropic.com` default.
## Summary
- translate Claude SDK permission suggestions and tool-specific
decisions into ACP v1 presentation and editable option metadata
- align Claude session permission modes and clear-context plan handling
- split permission effects, modes, normalization, option construction,
presentation, and response handling into focused modules
- document the permission extension and add unit plus live-audit
coverage for native edge cases
## Tests
- `npm run check`
- `npm run build`
- `env -u ANTHROPIC_BASE_URL npm run test:run` (931 passed, 27 skipped)
Bumps the minor group with 6 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.232` | `0.3.233` |
| [@tsconfig/node22](https://github.com/tsconfig/bases/tree/HEAD/bases)
| `22.0.5` | `22.0.6` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.0` |
`2.1.1` |
| [@tsconfig/node10](https://github.com/tsconfig/bases/tree/HEAD/bases)
| `1.0.12` | `1.0.13` |
| [es-module-lexer](https://github.com/guybedford/es-module-lexer) |
`2.3.1` | `2.3.2` |
| [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.9` |
Updates `@anthropic-ai/claude-agent-sdk` from 0.3.232 to 0.3.233
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.233</h2>
<h2>What's changed</h2>
<ul>
<li>Notification hooks now fire for pending permission prompts on the
SDK path, matching the interactive REPL behavior</li>
<li>Todo/task-tracking tools
(<code>TaskCreate</code>/<code>TaskGet</code>/<code>TaskUpdate</code>/<code>TaskList</code>,
<code>TodoWrite</code>) are no longer in the default tool surface on
Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; name them in
the <code>tools</code> option or reference them in
<code>allowedTools</code> (or set
<code>CLAUDE_CODE_ENABLE_TODO_TOOLS=1</code>) to keep them</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.233
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.233
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.233
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.233
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.233</h2>
<ul>
<li>Notification hooks now fire for pending permission prompts on the
SDK path, matching the interactive REPL behavior</li>
<li>Todo/task-tracking tools
(<code>TaskCreate</code>/<code>TaskGet</code>/<code>TaskUpdate</code>/<code>TaskList</code>,
<code>TodoWrite</code>) are no longer in the default tool surface on
Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; name them in
the <code>tools</code> option or reference them in
<code>allowedTools</code> (or set
<code>CLAUDE_CODE_ENABLE_TODO_TOOLS=1</code>) to keep them</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="73a28abad0"><code>73a28ab</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.232...v0.3.233">compare
view</a></li>
</ul>
</details>
<br />
Updates `@tsconfig/node22` from 22.0.5 to 22.0.6
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/tsconfig/bases/commits/HEAD/bases">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.3.232 to
0.3.233
Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.3.232 to
0.3.233
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.3.232 to
0.3.233
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.3.232
to 0.3.233
Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.3.232 to
0.3.233
Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.3.232 to
0.3.233
Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.3.232 to
0.3.233
Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.3.232 to
0.3.233
Updates `@hono/node-server` from 2.1.0 to 2.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/node-server/releases">@hono/node-server's
releases</a>.</em></p>
<blockquote>
<h2>v2.1.1</h2>
<h2>What's Changed</h2>
<ul>
<li>perf: lazily materialize request headers by <a
href="https://github.com/BlankParticle"><code>@BlankParticle</code></a>
in <a
href="https://redirect.github.com/honojs/node-server/pull/389">honojs/node-server#389</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v2.1.0...v2.1.1">https://github.com/honojs/node-server/compare/v2.1.0...v2.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="73c03adfb0"><code>73c03ad</code></a>
2.1.1</li>
<li><a
href="5515aa0a37"><code>5515aa0</code></a>
perf: lazily materialize request headers (<a
href="https://redirect.github.com/honojs/node-server/issues/389">#389</a>)</li>
<li>See full diff in <a
href="https://github.com/honojs/node-server/compare/v2.1.0...v2.1.1">compare
view</a></li>
</ul>
</details>
<br />
Updates `@tsconfig/node10` from 1.0.12 to 1.0.13
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/tsconfig/bases/commits/HEAD/bases">compare
view</a></li>
</ul>
</details>
<br />
Updates `es-module-lexer` from 2.3.1 to 2.3.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/guybedford/es-module-lexer/releases">es-module-lexer's
releases</a>.</em></p>
<blockquote>
<h2>2.3.2</h2>
<h2>What's Changed</h2>
<ul>
<li>perf(lexer): skip identifier and number runs by <a
href="https://github.com/BridgeAR"><code>@BridgeAR</code></a> in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/227">guybedford/es-module-lexer#227</a></li>
<li>fix: annotate asm.js integer return type by <a
href="https://github.com/Justineo"><code>@Justineo</code></a> in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/230">guybedford/es-module-lexer#230</a></li>
<li>Add side effects to package.json by <a
href="https://github.com/denisx"><code>@denisx</code></a> in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/183">guybedford/es-module-lexer#183</a></li>
<li>fix: forward the sourcename through the pre-init parse path by <a
href="https://github.com/hdimer"><code>@hdimer</code></a> in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/236">guybedford/es-module-lexer#236</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Justineo"><code>@Justineo</code></a>
made their first contribution in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/230">guybedford/es-module-lexer#230</a></li>
<li><a href="https://github.com/denisx"><code>@denisx</code></a> made
their first contribution in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/183">guybedford/es-module-lexer#183</a></li>
<li><a href="https://github.com/hdimer"><code>@hdimer</code></a> made
their first contribution in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/236">guybedford/es-module-lexer#236</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/guybedford/es-module-lexer/compare/2.3.1...2.3.2">https://github.com/guybedford/es-module-lexer/compare/2.3.1...2.3.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="08ee1be867"><code>08ee1be</code></a>
fix: forward the sourcename through the pre-init parse path (<a
href="https://redirect.github.com/guybedford/es-module-lexer/issues/236">#236</a>)</li>
<li><a
href="5a824a13a6"><code>5a824a1</code></a>
Update package.json (<a
href="https://redirect.github.com/guybedford/es-module-lexer/issues/183">#183</a>)</li>
<li><a
href="8274d0331a"><code>8274d03</code></a>
fix: annotate asm.js integer return type (<a
href="https://redirect.github.com/guybedford/es-module-lexer/issues/230">#230</a>)</li>
<li><a
href="2abc49eafc"><code>2abc49e</code></a>
perf(lexer): skip identifier and number runs (<a
href="https://redirect.github.com/guybedford/es-module-lexer/issues/227">#227</a>)</li>
<li>See full diff in <a
href="https://github.com/guybedford/es-module-lexer/compare/2.3.1...2.3.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `jose` from 6.2.8 to 6.2.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/panva/jose/releases">jose's
releases</a>.</em></p>
<blockquote>
<h2>v6.2.9</h2>
<h3>Fixes</h3>
<ul>
<li>reject a JWE whose generated Key Management Parameters collide (<a
href="6ed19a6a97">6ed19a6</a>)</li>
<li><strong>types:</strong> undeprecate PBES2 p2c parameter (<a
href="33bf832986">33bf832</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/panva/jose/blob/main/CHANGELOG.md">jose's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/panva/jose/compare/v6.2.8...v6.2.9">6.2.9</a>
(2026-08-15)</h2>
<h3>Fixes</h3>
<ul>
<li>reject a JWE whose generated Key Management Parameters collide (<a
href="6ed19a6a97">6ed19a6</a>)</li>
<li><strong>types:</strong> undeprecate PBES2 p2c parameter (<a
href="33bf832986">33bf832</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="f3a3c780b9"><code>f3a3c78</code></a>
chore(release): 6.2.9</li>
<li><a
href="33bf832986"><code>33bf832</code></a>
fix(types): undeprecate PBES2 p2c parameter</li>
<li><a
href="6ed19a6a97"><code>6ed19a6</code></a>
fix: reject a JWE whose generated Key Management Parameters collide</li>
<li><a
href="944840d167"><code>944840d</code></a>
ci: use shared release workflows</li>
<li><a
href="05bccf2399"><code>05bccf2</code></a>
chore: bump packages</li>
<li><a
href="f7392d1217"><code>f7392d1</code></a>
test: account for workerd nodejs_compat flag default changes</li>
<li><a
href="4e944be71e"><code>4e944be</code></a>
ci: drop the wait-for-npm machinery</li>
<li><a
href="4285b6f411"><code>4285b6f</code></a>
chore(deps-dev): bump undici</li>
<li><a
href="cb114ecde7"><code>cb114ec</code></a>
chore: cleanup after release</li>
<li>See full diff in <a
href="https://github.com/panva/jose/compare/v6.2.8...v6.2.9">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Claude Code's automatic title generation never runs under the Agent SDK,
so `SDKSessionInfo.summary` degrades to the raw first prompt — meaning
we were publishing up to 256 characters of the user's opening message as
the session title.
This PR asks the SDK for a real title instead. On the first completed
turn we send the `generate_session_title` control request with the
trailing 1000 characters of the session's own user + assistant text,
fired in the background off the `idle` handler so turn-end never waits
on the ~2 s small-model call, and publish the result through the
existing `session_info_update`.
A title is generated once per session, and any title already in the
session file — a user `/rename` or one we generated earlier, which the
SDK folds into the same field — is adopted rather than
overwritten.`persist: true` writes it to the transcript, so
`session/list` and `session/load` show the same name.
The SDK method is undeclared in `sdk.d.ts`, so it's called behind a
`typeof` check and a `try/catch` that degrades to the previous
behaviour.
### Problem
Provider routing is captured when the Claude SDK `Query` is created. As
a result, `providers/set` and `providers/disable` updated newly created
sessions but an already loaded ACP session continued using its previous
backend.
User and project Claude settings could also override the ACP-selected
URL or credentials after the subprocess environment was assembled,
making the configured proxy ineffective.
### Solution
- Serialize provider changes and wait for submitted turns to settle.
- Close and recreate every loaded SDK query with the same Claude session
ID, cwd, MCP configuration, and ACP creation parameters.
- Block new/load/resume/prompt requests only while a provider update is
in progress.
- Apply the active ACP route in both the subprocess environment and
programmatic settings tier.
- Clear competing Anthropic, Bedrock, Vertex, OAuth, API-key, and
`apiKeyHelper` routing while an ACP override is active; preserve
unrelated settings.
- Restore native/environment routing when the provider is disabled.
- Add opt-in routing diagnostics through `CLAUDE_AGENT_LOGS` without
logging request content or secret headers.
### Tests
Added coverage for:
- native behavior when Providers API is unused;
- live recreation of loaded sessions;
- waiting for active turns;
- multiple loaded sessions across native → proxy A → proxy B → native;
- user settings precedence and preservation of unrelated settings;
- Anthropic, Bedrock, Vertex, legacy gateway auth, and logout behavior.
Verification:
- `npm test`: 789 passed, 20 skipped
- `npm run build`
- `npm run check`
- `git diff --check`
---------
Co-authored-by: Junie <junie@jetbrains.com>
## Summary
- negotiate the opt-in AIR `_meta.jetbrains.air.agentFileChangeReport`
capability
- assign a unique `requestId` to each prompt and return canonical,
workspace-bounded changed paths in response metadata
- add a hidden Stop hook and an internal MCP reporting tool so Claude
can report files changed through shell commands, Git operations, and
generators
The audit is best-effort and is inactive unless the client advertises
the capability.
## Safety
- accept reports only for the active session and matching turn request
- canonicalize filesystem aliases, including `/tmp` to `/private/tmp` on
macOS
- reject paths outside the session working directory and deduplicate
valid paths
## Tests
- `npm run test:run`
- `npm run build`
- `npm run check`
## Summary
- align `_meta.jetbrains.air.sessionFailure` with AIR's
transcript-record protocol: `id`, `revision`, broad `category`, explicit
`severity`, `title`, optional `details`, and `actions`
- forward Claude's actual user-facing assistant/result text as `title`;
use adapter-authored fallback text only when Claude provides no message
(transport failure, worker EOF, or an internal invariant)
- reduce categories to `connection`, `access`, `limit`, `request`,
`service`, and `unknown`
- limit suggested actions to `retry`, `login`, and `new_session`
- update one transcript record through `id + revision`, keep resolved
entries in history, and remove clear/tombstone updates
- suppress duplicate assistant failure prose only for clients that
negotiated typed failures; preserve legacy ACP behavior otherwise
- restore synthetic usage-limit failures from session history with their
exact stored Claude text
- document negotiation, delivery carriers, identity/revision behavior,
mappings, recovery, and compatibility in the extension spec
## Validation
- `npm run check`
- `npm run build`
- `npm run test:run` — 777 passed, 26 skipped
- `git diff --check`
## Tracking
[IJAI-993](https://youtrack.jetbrains.com/issue/IJAI-993)
### Summary
- expose one `main` provider slot because Anthropic, Bedrock, and Vertex
routing are mutually exclusive
- advertise all three supported API types on that slot and replace the
active configuration on each `providers/set`
- restore native Claude routing when the slot is disabled
- keep provider headers out of list responses and preserve per-protocol
validation
### Testing
- `npm run test:run` (767 passed, 20 skipped)
- `npm run build`
- `npm run check`
Co-authored-by: Junie <junie@jetbrains.com>
## Problem
When the API refuses a turn, the SDK retries on the fallback model and
makes the swap persistent for the session. We flag that with a
transcript line:
```ts
text: `**Model fallback:** ${message.original_model} declined this request${category}; retried with ${message.fallback_model}. ${outcome}${explanation}`,
```
It goes out as an `agent_message_chunk`, so the client cannot tell a
session-level advisory from something the model actually said — the bold
label is the only severity signal available, and it is just characters
inside the assistant's own text.
The comment above that code already states the stakes: *"Without a
notice the user just sees regenerated output."* The notice matters; the
channel it uses does not fit it.
## Change
Routes it through the AIR typed session-failure extension instead, as a
new `advisory` category:
- `severity?: "error" | "warning"` on the record. **Optional, and absent
means `error`**, so a client that predates this keeps treating every
record it receives as a failure.
- The advisory carries its own wording (`safeMessage`) rather than the
canned per-category message, so the client renders the explanation
verbatim in a warning banner.
- **Clients that did not negotiate the `sessionFailure` capability keep
the exact transcript line they get today.**
### Advisories are not turn failures
Two existing behaviours would have mangled them, so both are now
guarded:
- `createSessionFailure` clears every other active record when a new one
is published. An advisory no longer does that, and is no longer cleared
by one — otherwise a model-fallback notice would erase an actionable
error, or vice versa.
- `clearFailuresFromEarlierTurns` clears everything whose `turnId` is
not the active turn. Advisories carry no `turnId`, so without the guard
every turn boundary would sweep them away.
They therefore live under their own `:notice:` id namespace,
session-scoped, one slot, newest wins.
## Scoped out
`**Fast mode turned off:**` (`syncFastMode…`) is the same pattern and
deserves the same treatment, but it sits in a class method while the
failure machinery is closure-scoped inside `prompt()`. Lifting that out
is a separate change rather than something to smuggle into this one.
## Tests
`npm run build`, `npm run check`, and `npm run test:run` (**766
passed**) are clean.
The existing `model_refusal_fallback` tests still assert the `**Model
fallback:**` transcript line and still pass — they never call
`initialize`, so they exercise the no-capability path, which is exactly
the backward-compatibility guarantee.
One test added for the typed path, asserting that the advisory is
published with `severity: "warning"`, that its `safeMessage` carries the
real model ids and refusal category, that it uses the `:notice:` id
namespace, that it contains no `**` markdown lead-in, and that the
transcript line is **not** also emitted.
Client side: IJAI-993.
## Summary
- Add `skill?: string` to `ToolUpdateMeta.claudeCode`, populated from
`toolUse.input.skill` in `claudeCodeMetaFromToolUse`. Lets ACP clients
detect skill invocations from structured metadata rather than parsing
the title string.
- Add `case "Skill":` to `toolInfoFromToolUse`: sets `title` to `"Load
skill: <name>"` and returns empty content — readable fallback for
clients that don't read `_meta`.
- Add `case "Skill":` to `toolUpdateFromToolResult`: returns `{}` to
suppress the raw `"Launching skill: <name>"` result text, matching the
pattern used for `Edit`/`Write`.
## Motivation
Without this, the Skill tool falls through to the `default` case and
renders as a generic `kind: "other"` block with title `"Skill"` and an
expand control showing the raw result text. With this change, clients
that read `_meta.claudeCode.skill` can render the block with the
appropriate icon, the skill name, and no expand control.
## Test plan
- [ ] Invoke a skill (e.g. `/commits`) and confirm
`_meta.claudeCode.skill` is present in the emitted `tool_call` update
- [ ] Confirm title is `"Load skill: commits"` in the ACP event stream
- [ ] Confirm no content is emitted for the skill tool result
## Summary
- When the SDK's `"default"` model entry carries a `resolvedModel` (e.g.
`"claude-sonnet-5"`), `buildConfigOptions` now sets the option's
`description` to the human-readable `displayName` of the matching named
model (e.g. `"Claude Sonnet 5"`)
- Falls back to the raw `resolvedModel` string if no named entry shares
that resolved ID
- No behaviour change when `resolvedModel` is absent
This lets ACP clients show the actual model behind "Default" — e.g.
"Default (Claude Sonnet 5)" — instead of just "Default (recommended)".
## Test plan
- [ ] `buildConfigOptions model option resolved description > sets
description to the named model's displayName when resolvedModel matches`
- [ ] `buildConfigOptions model option resolved description > falls back
to resolvedModel itself when no named model shares it`
- [ ] `buildConfigOptions model option resolved description > leaves
description undefined when default model has no resolvedModel`
- [ ] All 753 existing tests still pass
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
- Negotiate the JetBrains AIR `sessionFailure` extension when the client
advertises an integer version `>= 1` and the capability name.
- Return turn-terminal failures only on `PromptResponse._meta`; publish
idle and asynchronous session health failures through `session/update`.
- Preserve legacy ACP behavior for clients that do not negotiate the
extension.
- Emit bounded fixed safe messages without SDK/provider details, paths,
credentials, or stack traces.
## Recovery contract
Failures use `_meta.jetbrains.air.sessionFailure` with a stable id,
monotonic revision, phase, category, source, safe message, retryability,
and optional real turn attribution. Session-scoped ids include a
consumer epoch, so replayed tombstones from a dead consumer cannot
suppress failures after restart. Stale consumers cannot publish into a
replacement session.
AIR owns localized action presentation. Claude supplies typed category
and retryability facts. Billing maps to quota exhaustion, max-output
limits map to context exhaustion, and the irreversibly closed Claude
Query reports non-retryable `transport_lost` so AIR offers New Session.
A held-open turn keeps its already recorded successful `PromptResponse`,
while worker shutdown or transport death also emits a separate
session-scoped health failure without `turnId`; the next prompt is
proven to fail because the Query is closed. Worker-shutdown remains
armed through buffered trailing frames and is classified only when EOF
proves the live tail.
## Validation
- 750 passed, 25 skipped.
- Build passed.
- ESLint passed.
- Changed files pass Prettier; the repository-wide check is blocked only
by an unrelated untracked local proposal file.
- Tests cover negotiation, taxonomy, sanitization, terminal/asynchronous
carrier separation, stale consumers, worker replay/live-tail behavior,
held turns, process/transport failure, restart-safe ids, clear
revisions, and capability-off behavior.
## Summary
- show `Preparing file…` instead of the bare `Write` title while
streamed input has no `file_path`
- refine the same tool call to `Write <display path>` as soon as the
path is available
- cover both partial-field refinement and
complete-input/consolidated-message delivery
## Tests
- `npm run lint`
- `npx prettier --check src/tools.ts src/tests/acp-agent.test.ts`
- `npm run build`
- `npm run test:run` — 716 passed, 25 skipped
YouTrack: https://youtrack.jetbrains.com/issue/IJAI-841
## Summary
- republish unfinished Task* plan snapshots when a follow-up prompt
starts
- avoid resurfacing fully completed historical plans on unrelated
prompts
- clear stale task state when Claude starts a fresh conversation
- reconcile task state from authoritative TaskList results after resume
or history compaction
- consume structured Task* outputs during live sessions and parse Claude
Code textual output when replaying history
- reject logically failed TaskUpdate results instead of persisting the
requested mutation
- keep scanning structured tool output past unrelated JSON blocks
- use Claude activeForm for in-progress TodoWrite and Task* entries
This keeps ACP clients from losing an unfinished task list at prompt
boundaries, restores state when incremental history is unavailable, and
prevents plans from leaking across conversation resets.
## Tests
- npm run test:run (713 passed, 20 skipped)
- npm run check
- npm run build
- git diff --check
## Summary
- publish optimistic provider-neutral goal snapshots for submitted and
steered goal commands
- advertise and implement `set`, using steering for an active turn and
an ordinary prompt while idle
- suppress stale old-goal runtime updates while replacement/clear is
pending and roll back failed commands
- keep cancellation turn-scoped and orphan-account pending steers so
stale results cannot settle the next prompt
- reject unsupported pause/resume controls without host-side fallbacks
## Validation
- `npm test -- --run` (702 passed, 20 skipped)
- `npm run check`
- `npm run build`
- regression coverage for idle/active set and clear, stale runtime
updates, command failure rollback, cancellation, and stale steer
isolation
## Summary
- advertise a provider-neutral goal extension in
`InitializeResponse._meta.goal`
- map Claude SDK `active_goal` messages to
`session_info_update._meta.goal`
- expose the shared `_session/goal` control method with the truthfully
supported `clear` action
- document the extension as a candidate shape for a future first-class
ACP goal API
## Architecture
A goal is persistent **session state**, not the lifecycle of one
`session/prompt` request. `goal.status === "active"` says that the
objective may drive more work; it does not say that a prompt is
executing now.
This keeps two independent axes:
1. **Goal state** is published asynchronously as session metadata and
may survive multiple prompt turns.
2. **Prompt activity** follows the backend's actual running/quiescent
boundaries. While a turn runs, clients use advertised steering or prompt
queueing. Once the backend is quiescent, an ordinary `session/prompt` is
valid even if the goal remains active.
The metadata is deliberately provider-neutral:
```json
{
"_meta": {
"goal": {
"version": 1,
"controlMethod": "_session/goal",
"actions": ["clear"]
}
}
}
```
State is emitted as `session_info_update._meta.goal`; `null` clears it.
The common snapshot vocabulary supports `objective`, common statuses,
timestamps in Unix milliseconds, budgets/usage, iteration count, and a
continuation reason. Each implementation emits only fields it actually
knows. This shape is intentionally close to a future typed ACP
capability/update so promotion out of `_meta` would not require a
provider-specific migration.
Control actions are capability-negotiated. The shared vocabulary
reserves `set`, `pause`, `resume`, and `clear`, but an agent advertises
only the subset it can implement with correct semantics.
## Claude mapping
The Claude runtime already emits internal `active_goal` messages,
although that message is not currently included in the public
`SDKMessage` union. The adapter handles it before the exhaustive switch:
- `condition` → `objective`
- `iterations` → `iterations`
- `set_at` → `createdAt`
- `last_reason` → `lastReason`
- `value: null` → `goal: null`
Provider bookkeeping such as `tokens_at_start` is intentionally not
exposed. Goal updates do not settle, extend, or otherwise mutate ACP
prompt lifecycle. Claude's existing Stop hook remains authoritative for
whether the backend itself continues working.
Only `clear` is advertised for out-of-band control. It submits `/goal
clear` through the existing session prompt queue, preserving the
adapter's established ordering and turn ownership. Setting a goal
remains available through `/goal <condition>` but is not advertised as a
control action because it starts the long-running Stop-hook workflow.
The companion Codex implementation is agentclientprotocol/codex-acp#371.
## Verification
- `npm run test:run` — 692 passed, 20 skipped
- `npm run build`
- `npm run check`
Bumps the minor group with 1 update:
[globals](https://github.com/sindresorhus/globals).
Updates `globals` from 17.8.0 to 17.9.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sindresorhus/globals/releases">globals's
releases</a>.</em></p>
<blockquote>
<h2>v17.9.0</h2>
<ul>
<li>Update globals (2026-08-01) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/348">#348</a>)
5a958ed</li>
</ul>
<hr />
<p><a
href="https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0">https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="8e7b9358b1"><code>8e7b935</code></a>
17.9.0</li>
<li><a
href="5a958ed060"><code>5a958ed</code></a>
Update globals (2026-08-01) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/348">#348</a>)</li>
<li>See full diff in <a
href="https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Steering is delivered at priority `now`, which makes the CLI **abort**
the running cycle instead of folding the message into it. The aborted
cycle ends with an ordinary human-origin `result`, so we answered
`session/prompt` with `end_turn` while the steered work was still going
— its remaining tool calls, its answer, and its file edits then streamed
with no turn in flight.
A steered turn's results now only record their outcome, and the turn
settles at the SDK's `idle` — the only signal spanning both the
interrupted and the steered cycle. The injected message's replay tells
them apart: an idle arriving before it means the steered cycle hasn't
started, so it is swallowed. `session/cancel` and the next prompt still
settle the turn early, with the recorded stop reason.
Four steering tests cover the interrupt, an early idle, the next-prompt
hand-off, and cancel.
Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.16 to 3.3.17.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ai/nanoid/releases">nanoid's
releases</a>.</em></p>
<blockquote>
<h2>3.3.17</h2>
<ul>
<li>Fixed infinite loop on zero size.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ai/nanoid/blob/main/CHANGELOG.md">nanoid's
changelog</a>.</em></p>
<blockquote>
<h2>3.3.17</h2>
<ul>
<li>Fixed infinite loop on zero size.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="73d6716813"><code>73d6716</code></a>
Release 3.3.17 version</li>
<li><a
href="f9d13f1508"><code>f9d13f1</code></a>
Sync 0 size behaviour with PostCSS 5</li>
<li>See full diff in <a
href="https://github.com/ai/nanoid/compare/3.3.16...3.3.17">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Description
Testing this agent means wiring it into an editor's ACP integration,
which is an overkill when you just want to watch the JSON and reply with
JSON. This adds a second example next to `examples/steering.ts`: a
minimal interactive ACP client that spawns the built agent, prints every
JSON-RPC message in both directions, and turns what you type into
prompts.
```
npm run build
npm run example:simple-client
```
All four ways a client can get a message to this agent are reachable
from the prompt"
| Input | Wire |
| --- | --- |
| `<text>` | `session/prompt`; buffered client-side if a turn is running
|
| `!steer <text>` | `_session/steering`, injected into the running turn
|
| `!queue <text>` | `session/prompt` sent mid-turn, so the agent queues
it |
| `!cancel`, Ctrl-C | `session/cancel` |
## Additional options
* `--debug-port=<port>` rebuilds with source maps and starts the agent
under
* `--inspect-brk`, paused, so a debugger can attach and step through
`src/*.ts` —
replacing a hand-written editor run configuration. Teardown cancels any
live
turn, closes the agent's stdin (its clean-exit path), waits, and only
then
closes the connection, so neither side dies of EPIPE and nothing is
orphaned.
npm may accept a package before the registry update stage can run, and
repeating the workflow would attempt to republish the same immutable
version.
Add an opt-out for npm publishing on manual dispatch so the repository
GitHub App can safely retry only the registry update. The default
remains `true`, preserving the normal manual release path.
Validation: Prettier workflow check.
A skipped `release-please` job propagates to downstream jobs during a
manual release, even when npm publishing succeeds through an `always()`
condition.
Explicitly evaluate the npm job result so successful manual publications
continue to update the agent registry.
Validation: Prettier workflow check.
Release-please cannot process the already-merged, untagged release PR
#943.
This adds an explicit workflow dispatch path for publishing a supplied
tag or commit while preserving the normal push-driven release flow, and
restores the 0.64.2 release metadata for the recovery tag.
After merge, I will create `v0.64.2` at this commit and dispatch the
publish workflow for that tag.
Validation:
- ESLint
- Prettier
- TypeScript build
- Vitest: 684 passed, 20 skipped
## Summary
- revert the ExitPlanMode plan_update integration from #938
- restore the previous single switch_mode tool-call representation
- keep plan Markdown and approval state on the same transcript item
## Why
Clients currently receive both a plan_update and the separate tool call
required by requestPermission. Without a protocol-level link between
those entries, clients can render the same final plan twice. Returning
to the legacy representation avoids the duplicate while preserving the
existing approval flow.
## Testing
- pnpm exec vitest run src/tests/tools.test.ts
src/tests/acp-agent.test.ts src/tests/session-config-options.test.ts
(482 passed, 9 skipped)
- pnpm run build
- pnpm run lint
- pnpm run format:check
## Summary
- publish `ExitPlanMode` Markdown through experimental ACP `plan_update`
when the client advertises `clientCapabilities.plan`
- keep `requestPermission` as the confirmation mechanism and retain
`rawInput.plan` on the `switch_mode` tool call
- fall back to the existing tool-call content for clients without plan
support
- serialize live plan publication through the permission path so
`plan_update` and the referenced `tool_call` are delivered before
`requestPermission`
- use stable per-scope plan IDs so main-agent and subagent plans cannot
overwrite each other
- replay capable-client plans through `plan_update` without duplicating
Markdown in tool content
## Testing
- permission-first and stream-first event ordering
- approve, reject, and cancel outcomes
- capable-client Markdown payload and legacy fallback
- empty plan suppression, replay, deduplication, and subagent plan IDs
- `vitest run` (697 passed, 20 skipped)
- `tsc --noEmit`
- ESLint and Prettier on changed files
## Summary
Expose Claude Code permission-update suggestions through the same
versioned option-level metadata contract used by other ACP agents:
```json
{
"_meta": {
"permission": {
"version": 1,
"changes": []
}
}
}
```
The approval actions are presented as `Deny`, `Allow Once`, and `Always
Allow`. Exact scope and policy details live in metadata instead of being
encoded into the button label.
## Why
ACP already transports button semantics via `PermissionOption.kind`,
display text via `name`, and the selected value via `optionId`. It does
not currently expose the exact persistent policy update.
Claude Code suggestions can do considerably more than add one allow
rule: they may add, remove, or replace allow/deny/ask rule sets, add or
remove directories, change permission mode, and target different storage
destinations. Flattening those suggestions into labels or a list of
scopes loses mutation semantics and can incorrectly describe a narrow or
restrictive update as permission for the whole tool.
## Contract
Every change carries a producer-supplied human-readable `description`.
Structured fields preserve:
- ordered `add`, `remove`, and atomic `replace` operations
- `allow`, `deny`, and `ask` rule sets through `ruleBehavior`
- whole-tool targets and provider-rule matchers
- filesystem directory targets
- permission-mode changes
- session, process, user, project, and project-local destinations as
lifetime/storage
Example scoped Bash rule:
```json
{
"type": "policy_rule",
"operation": "add",
"ruleBehavior": "allow",
"description": "Allow Bash calls matching npm test:*",
"lifetime": { "scope": "session" },
"targets": [
{
"type": "tool",
"toolName": "Bash",
"matcher": {
"type": "provider_rule",
"provider": "claudeCode",
"value": "npm test:*"
}
}
]
}
```
A tool target without a matcher means the whole tool. A provider rule is
intentionally opaque; clients should show `description` rather than
reverse-engineering Claude Code rule syntax.
When Claude Code supplies no suggestions, the adapter preserves its
existing fallback behavior by describing the exact session rule it
returns: allow the whole requested tool for the session.
## Compatibility
This remains on the current ACP protocol and uses only `_meta`. Clients
that do not understand `_meta.permission` continue rendering and
dispatching the standard options. Option IDs and permission outcomes are
unchanged.
## Tests
- full suite: 682 passed, 20 skipped
- lint passed
- Prettier check passed
- TypeScript build passed
- coverage includes whole-tool fallback, scoped rules, directories,
replace/remove, deny rules, destinations, and mode changes
## Why
AskUserQuestion emits a per-question free-text field that should be
rendered as the custom-answer companion for the preceding select
question. ACP clients need a stable metadata marker for that
relationship instead of guessing from field ids, titles, or
descriptions.
## What changed
- Mark each AskUserQuestion custom-answer companion field with
`_meta._askUserQuestionCustomAnswer`.
- Use the same non-agent-specific key that Codex and other bridges can
emit, so clients can parse one shared marker instead of maintaining
per-agent metadata names.
- Keep the existing response folding behavior unchanged.
## Tests
- Updated `includes a per-question optional free-text custom-answer
field` to assert the shared `_askUserQuestionCustomAnswer` marker on
each companion field.
```sh
npm test -- src/tests/elicitation.test.ts
```
`permission_denied` forwarded an SDK frame as a `tool_call_update`
without checking that the referenced `tool_call` was ever announced,
leaving it the last emitter without that check after #916.
The id is the executing call's own, and the frame is enqueued from
inside canUseTool, so it lands between the call's `tool_use` and the
`tool_result` carrying the rejection — verified against the bundled CLI,
where the deny short-circuit only emits for pre-ask decisions (rules,
mode, classifier, asyncAgent) and fires exactly once per denial. In that
flow the call is announced and in flight, so the guard changes nothing.
It changes the denials that arrive outside that window. The
cancelled-turn guard drops the assistant message carrying the tool_use,
so no `tool_call` is emitted, and a denial for it can still land
afterwards — the same premise the `tool_result` fallback in
`toAcpNotifications` gates on `wasEmitted` for. Ids leave
`emittedToolCalls` at `tool_result`, so the check also stops a denial
trailing its own result from flipping a call the client has seen finish
back to failed.
While here: a denial raised inside a subagent identifies it by
`agent_id`, never by the Agent/Task call that spawned it, so the update
went out unattributed while the `tool_call` it resolves sits in the
subagent's transcript. Resolve the parent through `liveBackgroundTasks`,
as the canUseTool path already does, and leave the update unattributed
rather than dropped when `task_started` was never seen for that agent
id.
`permission_denied` had no test coverage. Add cases for the in-flight
resolve, the reason fallback, the never-announced and already-resolved
drops, and subagent attribution with and without a recorded parent.
Fixes#918
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Heartbeat beats reach the bridge under a derived
`<tool_use_id>-heartbeat-<n>` id that no `tool_call` was ever emitted
for, and the handler forwarded it verbatim. Clients that expect a
`tool_call_update` to reference a tool call they have been told about
saw a reference they could not resolve, and since the counter makes
every beat a fresh id, nothing deduplicated them: a ten-minute Bash call
produced roughly twenty phantom entries. Zed renders each as a failed
"Tool call not found" card; compozy/compozy#257 and
agent-of-empires/agent-of-empires#3084 report the same shape.
Strip the derived suffix so the beat is reported against the call it
describes, and drop it when that call is not in `emittedToolCalls`. Ids
enter that set at `tool_use` and leave it at `tool_result`, so the guard
covers both an id that was never announced and a straggling beat that
races past completion, which would otherwise flip a call the client has
seen finish back to `in_progress`.
The SDK sets `heartbeat: true` on these messages, but that flag alone
cannot recover the original id, and `parent_tool_use_id` is the subagent
parent rather than the call being reported on, so the suffix still has
to be stripped.
`tool_progress` had no test coverage. Add cases for the retarget across
a climbing counter, the not-in-flight drop, meta pass-through, and an
unsuffixed id being left alone.
Fixes#913
---------
Signed-off-by: Daan De Meyer <daan@amutable.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
## Problem
The `Bash` branch of `toolUpdateFromToolResult` derives its terminal id
from the result block and falls back to the empty string:
```ts
const terminalId = "tool_use_id" in toolResult ? String(toolResult.tool_use_id) : "";
```
On that fallback it still emits the whole terminal payload — `content:
[{ type: "terminal", terminalId: "" }]` plus `terminal_info`,
`terminal_output` and `terminal_exit`, every one keyed on `""`.
No client has a terminal under that id. `toolInfoFromToolUse` announces
the terminal as `toolUse.id` (`src/tools.ts:161`), so the empty id
matches nothing that was created. A client that buffers output for
terminals it has not been told about then holds the data indefinitely
behind an id that never arrives — Zed keeps it in
`pending_terminal_output` / `pending_terminal_exit` and drains only on a
matching create — so the command's output is silently stranded and the
user is left looking at an empty terminal.
It fails quietly, which is what makes it worth fixing: nothing logs, and
the update looks well-formed on the wire.
## Change
Prefer `toolUse.id` — the id that was actually announced — and keep the
result block's `tool_use_id` as a fallback. The two agree whenever both
are present, since the caller looks the tool_use up by that id, so this
only changes behaviour when one is missing.
When neither yields an id, fall through to the code-block rendering that
already exists immediately below rather than emitting a terminal
reference the client cannot resolve.
## Tests
Three cases added to `src/tests/tools.test.ts`:
- metas are keyed off the tool_use id even when the result block
disagrees
- the result block's `tool_use_id` is still used when the tool_use is
unavailable
- no id at all degrades to the `console` code block, with no `_meta`
Two of the three fail on `main` and pass with the change; the third
guards the preserved fallback. `npm run build`, `npm run check` and
`vitest run src/tests/tools.test.ts` (112 passed) are clean.
Note: `src/tests/create-session-options.test.ts > session/load seeds the
window from the resumed session's getContextUsage report` fails on a
clean `main` checkout here too — pre-existing and unrelated.
## How I got here
Found while tracing the "Tool call not found" rows in #913 — unrelated
cause, same file. The `terminal_id: ""` path came up while ruling the
terminal-streaming path out as the source of those.
---------
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
## Motivation
ACP clients currently have two gaps when rendering Claude Code activity:
1. Bash tool calls expose the shell command as the standard ACP title,
but the concise human-readable `description` produced by Claude Code is
lost.
2. ACP 1.2 has no standard subagent tool kind or nested-message
relationship, so subagent prose and child tools are either flattened
into the main conversation or filtered out entirely.
This PR adds namespaced metadata and an explicit client capability so
richer clients can render both cases without changing the standard ACP
schema or regressing legacy clients.
## What changed
### Bash descriptions
- Keeps the shell command in the standard ACP `title`, preserving
command-oriented clients.
- Exposes the optional Claude Code Bash `description` as
`_meta.claudeCode.title`.
- Applies the metadata consistently to eager permission tool calls,
normal tool calls, and streamed input refinements.
- Falls back to the command title when no description is available.
### Nested subagent transcripts
- Adds the opt-in client capability
`clientCapabilities._meta["subagent-transcript"] = true`.
- Enables the Claude Agent SDK `forwardSubagentText` option when the
client advertises support.
- Preserves the pre-existing caller-provided `forwardSubagentText: true`
option for compatibility.
- Marks Agent and legacy Task launches with `_meta.claudeCode.subagent =
true`.
- Relates nested text, thinking, and child tool calls to the launching
Agent/Task call through `_meta.claudeCode.parentToolUseId`.
- Preserves parent attribution during session-history replay, not only
during live streaming.
- Handles nested Agent-to-Agent launches without inferring subagents
from the generic ACP `think` kind.
## Compatibility
Clients that do not advertise `subagent-transcript` retain the previous
behavior: subagent text and thinking remain filtered from the top-level
feed.
The normal Agent/Task tool result is still emitted in every mode as the
protocol-compatible fallback. No existing result or standard ACP field
is removed or redefined.
## Validation
- `npm run build`
- `npm run check`
- `npm run test:run`
- 623 tests passed, 20 skipped
Coverage includes live and replayed nested text/thinking, child tool
attribution, Agent/Task launch markers, nested Agent launches, legacy
filtering, and SDK-option compatibility.
Bumps [@hono/node-server](https://github.com/honojs/node-server) from
1.19.14 to 1.19.15.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/honojs/node-server/commits">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the minor group with 2 updates:
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript)
and [hono](https://github.com/honojs/hono).
Updates `@anthropic-ai/sdk` from 0.113.0 to 0.114.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/releases">@anthropic-ai/sdk's
releases</a>.</em></p>
<blockquote>
<h2>sdk: v0.114.0</h2>
<h2>0.114.0 (2026-07-23)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.113.0...sdk-v0.114.0">sdk-v0.113.0...sdk-v0.114.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add new stop reason
'model_context_window_exceeded' (<a
href="1ec71c165d">1ec71c1</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.114.0 (2026-07-23)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.113.0...sdk-v0.114.0">sdk-v0.113.0...sdk-v0.114.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add new stop reason
'model_context_window_exceeded' (<a
href="1ec71c165d">1ec71c1</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="2d314b4127"><code>2d314b4</code></a>
chore: release main</li>
<li><a
href="3d051dfe49"><code>3d051df</code></a>
feat(api): add new stop reason 'model_context_window_exceeded'</li>
<li>See full diff in <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.113.0...sdk-v0.114.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `hono` from 4.12.31 to 4.12.32
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.32</h2>
<h2>What's Changed</h2>
<ul>
<li>ci: enable reports for type & bundle size check in <a
href="https://redirect.github.com/honojs/hono/pull/5148">honojs/hono#5148</a></li>
<li>fix(aws-lambda): add jwt and lambda authorizer types for API Gateway
v2 in <a
href="https://redirect.github.com/honojs/hono/pull/5142">honojs/hono#5142</a></li>
<li>fix(sse): emit empty id field to reset Last-Event-ID in <a
href="https://redirect.github.com/honojs/hono/pull/5138">honojs/hono#5138</a></li>
<li>test(cloudflare-workers): add coverage for onClose, onError, send,
and close in Cloudflare Workers websocket adapter in <a
href="https://redirect.github.com/honojs/hono/pull/5145">honojs/hono#5145</a></li>
<li>fix: use <code>Object.create(null)</code> when parsing query,
headers, and params in <a
href="https://redirect.github.com/honojs/hono/pull/5161">honojs/hono#5161</a></li>
<li>fix(secure-headers): keep CSP callbacks scoped to their header in <a
href="https://redirect.github.com/honojs/hono/pull/5147">honojs/hono#5147</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.31...v4.12.32">https://github.com/honojs/hono/compare/v4.12.31...v4.12.32</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="26d8e42bff"><code>26d8e42</code></a>
4.12.32</li>
<li><a
href="402eb3abe5"><code>402eb3a</code></a>
fix(secure-headers): keep CSP callbacks scoped to their header (<a
href="https://redirect.github.com/honojs/hono/issues/5147">#5147</a>)</li>
<li><a
href="c85aead088"><code>c85aead</code></a>
fix: use <code>Object.create(null)</code> when parsing query, headers,
and params (<a
href="https://redirect.github.com/honojs/hono/issues/5161">#5161</a>)</li>
<li><a
href="a88c89dac6"><code>a88c89d</code></a>
test(cloudflare-workers): add coverage for onClose, onError, send, and
close ...</li>
<li><a
href="44f884321a"><code>44f8843</code></a>
fix(sse): emit empty id field to reset Last-Event-ID (<a
href="https://redirect.github.com/honojs/hono/issues/5138">#5138</a>)</li>
<li><a
href="e36f57dac0"><code>e36f57d</code></a>
fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2
(<a
href="https://redirect.github.com/honojs/hono/issues/5142">#5142</a>)</li>
<li><a
href="bf8608cb77"><code>bf8608c</code></a>
ci: enable reports for type & bundle size check (<a
href="https://redirect.github.com/honojs/hono/issues/5148">#5148</a>)</li>
<li>See full diff in <a
href="https://github.com/honojs/hono/compare/v4.12.31...v4.12.32">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
`session/new` and switching models via `configOptions` regressed to ~15s
each in v0.59.0. This removes the blocking call responsible and seeds
the context window synchronously instead, restoring sub-second behavior
on both paths.
## Root cause
v0.59.0 added an inline `await query.getContextUsage()` on the
session-creation and model-switch paths. That SDK control request is not
serviced by the CLI until the session's first prompt turn has run —
before then it stalls ~15s. And because SDK control requests are
serialized over a single stdin/stdout channel, an awaited `setModel`
queued behind the wedged `getContextUsage` inherited the full stall. So
both paths blocked ~15s before returning.
Verified with the real CLI (setModel alone pre-prompt: ~1ms;
getContextUsage alone pre-prompt: ~16s; getContextUsage-then-setModel:
both resolve together at ~16s, confirming the serialization).
## Fix
Drop `getContextUsage` from both hot paths. The context window is seeded
synchronously by `immediateContextWindow(...)`:
1. an authoritative value from a per-(provider, model) cache, if
learned; else
2. a synchronous text heuristic (`\b1m\b` → 1,000,000); else
3. `DEFAULT_CONTEXT_WINDOW` (200,000).
The authoritative window is learned the moment it's actually available —
from each turn's `result.modelUsage` — and written into the cache, so
later sessions/switches to the same model seed the correct window
immediately with no IPC. A model that has never run a turn shows the
heuristic/default window until its first response, matching pre-0.59.0
behavior.
### Cache design
- **Keyed on `(provider, resolved model id)`.** The resolved id
(`ModelInfo.resolvedModel`, e.g. `claude-sonnet-5[1m]`) matches the
`result.modelUsage` keys, so the write key and the read keys line up.
Keying on the resolved id (not the picker value) dedups aliases that
resolve to the same model; keying on the provider keeps two providers
that reuse an id string for different windows from crossing wires
(per-session provider config, #853). The provider is captured at session
creation, since the effective provider can change process-wide over the
adapter's lifetime.
- **Non-positive/NaN windows are ignored** — they neither overwrite the
session's learned window nor enter the cache.
## Impact (measured, real CLI)
| Path | Before | After |
| --- | --- | --- |
| `session/new` | ~17.4s | ~0.9s |
| model switch (before first prompt) | ~15s | ~3ms |
| model switch (after a turn) | ~14.7s | <1ms |
## Tests
- New end-to-end cache test: a turn's authoritative window (learned
under the resolved id even when the assistant message reports the bare
id) is served on a later switch with no `getContextUsage`.
- New provider-isolation test: the same resolved id on a different
provider does not read another provider's cached window; the same
provider does.
- New non-positive-window test: a nonsensical `contextWindow` is ignored
and never poisons the cache.
- Rewrote the existing context-window tests to the new contract (assert
no `getContextUsage` on session/new and switch; window from
cache/inference/default).
Closes#886Closes#880🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
## Summary
Closes:
https://github.com/agentclientprotocol/claude-agent-acp/issues/878
Fixes the potential ReDoS warning reported by CodeQL in
`stripAgentTrailer()`.
- Replaces regex-based trailer stripping with bounded linear parsing
- Preserves valid `<usage>…</usage>` and `agentId: … (…)` trailer
handling
- Adds coverage for malformed trailers, which are left unchanged
## Testing
- `npm test -- --run src/tests/tools.test.ts`
---------
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bumps the minor group with 14 updates:
| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.206` | `0.3.207` |
|
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript)
| `0.110.0` | `0.111.0` |
| [eslint](https://github.com/eslint/eslint) | `10.6.0` | `10.7.0` |
| @anthropic-ai/claude-agent-sdk-darwin-arm64 | `0.3.206` | `0.3.207` |
| @anthropic-ai/claude-agent-sdk-darwin-x64 | `0.3.206` | `0.3.207` |
| @anthropic-ai/claude-agent-sdk-linux-arm64 | `0.3.206` | `0.3.207` |
| @anthropic-ai/claude-agent-sdk-linux-arm64-musl | `0.3.206` |
`0.3.207` |
| @anthropic-ai/claude-agent-sdk-linux-x64 | `0.3.206` | `0.3.207` |
| @anthropic-ai/claude-agent-sdk-linux-x64-musl | `0.3.206` | `0.3.207`
|
| @anthropic-ai/claude-agent-sdk-win32-arm64 | `0.3.206` | `0.3.207` |
| @anthropic-ai/claude-agent-sdk-win32-x64 | `0.3.206` | `0.3.207` |
| [es-module-lexer](https://github.com/guybedford/es-module-lexer) |
`2.3.0` | `2.3.1` |
| [hono](https://github.com/honojs/hono) | `4.12.29` | `4.12.30` |
| [postcss](https://github.com/postcss/postcss) | `8.5.16` | `8.5.19` |
Updates `@anthropic-ai/claude-agent-sdk` from 0.3.206 to 0.3.207
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.207</h2>
<h2>What's changed</h2>
<ul>
<li>Fixed <code>canUseTool</code> returning <code>{behavior:
'allow'}</code> without <code>updatedInput</code> being rejected as a
deny with a raw ZodError message; the tool now runs with the original
input per the documented contract</li>
<li>The Agent tool's structured result now has a published SDK type
(<code>AgentToolCompletedOutput</code>) that matches the emitted object
exactly</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.207
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.207
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.207
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.207
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.207</h2>
<ul>
<li>Fixed <code>canUseTool</code> returning <code>{behavior:
'allow'}</code> without <code>updatedInput</code> being rejected as a
deny with a raw ZodError message; the tool now runs with the original
input per the documented contract</li>
<li>The Agent tool's structured result now has a published SDK type
(<code>AgentToolCompletedOutput</code>) that matches the emitted object
exactly</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="79b6350e13"><code>79b6350</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.206...v0.3.207">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/sdk` from 0.110.0 to 0.111.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/releases">@anthropic-ai/sdk's
releases</a>.</em></p>
<blockquote>
<h2>sdk: v0.111.0</h2>
<h2>0.111.0 (2026-07-10)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.110.0...sdk-v0.111.0">sdk-v0.110.0...sdk-v0.111.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for dreaming (<a
href="77b28a6472">77b28a6</a>)</li>
<li><strong>tools:</strong> gate session tool calls on
evaluated_permission; bound idle by server stop_reason (<a
href="68a6d7b92a">68a6d7b</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>docs:</strong> small updates to field descriptions (<a
href="e25b885eac">e25b885</a>)</li>
<li><strong>docs:</strong> update model example (<a
href="a33f3f0b7c">a33f3f0</a>)</li>
<li><strong>docs:</strong> updates to descriptions and examples (<a
href="eac4bace32">eac4bac</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.111.0 (2026-07-10)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.110.0...sdk-v0.111.0">sdk-v0.110.0...sdk-v0.111.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for dreaming (<a
href="77b28a6472">77b28a6</a>)</li>
<li><strong>tools:</strong> gate session tool calls on
evaluated_permission; bound idle by server stop_reason (<a
href="68a6d7b92a">68a6d7b</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>docs:</strong> small updates to field descriptions (<a
href="e25b885eac">e25b885</a>)</li>
<li><strong>docs:</strong> update model example (<a
href="a33f3f0b7c">a33f3f0</a>)</li>
<li><strong>docs:</strong> updates to descriptions and examples (<a
href="eac4bace32">eac4bac</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9e46760688"><code>9e46760</code></a>
chore: release main</li>
<li><a
href="8d461ea962"><code>8d461ea</code></a>
feat(api): add support for dreaming</li>
<li><a
href="9436e29159"><code>9436e29</code></a>
codegen metadata</li>
<li><a
href="0aec1e748b"><code>0aec1e7</code></a>
feat(tools): gate session tool calls on evaluated_permission; bound idle
by s...</li>
<li><a
href="ac2fc6779d"><code>ac2fc67</code></a>
chore(docs): update model example</li>
<li><a
href="c8af65d6af"><code>c8af65d</code></a>
chore(docs): updates to descriptions and examples</li>
<li><a
href="2a3a9042ab"><code>2a3a904</code></a>
codegen metadata</li>
<li><a
href="57c56c9172"><code>57c56c9</code></a>
chore(docs): small updates to field descriptions</li>
<li>See full diff in <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.110.0...sdk-v0.111.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `eslint` from 10.6.0 to 10.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.7.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="cf2a9bf2d9"><code>cf2a9bf</code></a>
feat: add errorClassNames option to preserve-caught-error rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21032">#21032</a>)
(sethamus)</li>
<li><a
href="f8b873aae5"><code>f8b873a</code></a>
feat: max-nested-callbacks option for constructor callbacks (<a
href="https://redirect.github.com/eslint/eslint/issues/21063">#21063</a>)
(fnx)</li>
<li><a
href="557fde8bc6"><code>557fde8</code></a>
feat: support computed <code>Number.parseInt</code> member access in
<code>radix</code> rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21041">#21041</a>)
(Pixel)</li>
<li><a
href="0b4a73b658"><code>0b4a73b</code></a>
feat: add suggestions to no-compare-neg-zero (<a
href="https://redirect.github.com/eslint/eslint/issues/21034">#21034</a>)
(den$)</li>
<li><a
href="96cdd427db"><code>96cdd42</code></a>
feat: report invalid signed numeric radix values in <code>radix</code>
rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21030">#21030</a>)
(Pixel)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="3e7bf15e69"><code>3e7bf15</code></a>
fix: apply <code>ignoreClassesWithImplements</code> to class expressions
(<a
href="https://redirect.github.com/eslint/eslint/issues/21069">#21069</a>)
(Pixel)</li>
<li><a
href="0d7d70cf01"><code>0d7d70c</code></a>
fix: insert cause outside wrapping parens in preserve-caught-error (<a
href="https://redirect.github.com/eslint/eslint/issues/21062">#21062</a>)
(Mahin Anowar)</li>
<li><a
href="75ec753226"><code>75ec753</code></a>
fix: handle static template literals in <code>eqeqeq</code> rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21058">#21058</a>)
(Pixel)</li>
<li><a
href="b717a22e24"><code>b717a22</code></a>
fix: prevent <code>eqeqeq</code> null option from reporting non-equality
operators (<a
href="https://redirect.github.com/eslint/eslint/issues/21057">#21057</a>)
(Pixel)</li>
<li><a
href="e35b05f196"><code>e35b05f</code></a>
fix: avoid <code>no-invalid-regexp</code> false positive for shadowed
RegExp (<a
href="https://redirect.github.com/eslint/eslint/issues/21051">#21051</a>)
(Pixel)</li>
<li><a
href="a3172b69c7"><code>a3172b6</code></a>
fix: avoid <code>no-control-regex</code> false positive for shadowed
RegExp (<a
href="https://redirect.github.com/eslint/eslint/issues/21050">#21050</a>)
(Pixel)</li>
<li><a
href="d1f637eca2"><code>d1f637e</code></a>
fix: parenthesize sequence expression operands in no-implicit-coercion
(<a
href="https://redirect.github.com/eslint/eslint/issues/21045">#21045</a>)
(spokodev)</li>
<li><a
href="8859bafb01"><code>8859baf</code></a>
fix: avoid prefer-numeric-literals false positive for shadowed globals
(<a
href="https://redirect.github.com/eslint/eslint/issues/21047">#21047</a>)
(한국)</li>
<li><a
href="a9e5961050"><code>a9e5961</code></a>
fix: use-isnan false positive on shadowed NaN/Number (<a
href="https://redirect.github.com/eslint/eslint/issues/20958">#20958</a>)
(sethamus)</li>
<li><a
href="8a240a7610"><code>8a240a7</code></a>
fix: avoid false positives in <code>radix</code> rule for spread
arguments (<a
href="https://redirect.github.com/eslint/eslint/issues/21044">#21044</a>)
(Pixel)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="c30d80801c"><code>c30d808</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="5139800b23"><code>5139800</code></a>
docs: document ESLint migration codemods in v9 and v10 guides (<a
href="https://redirect.github.com/eslint/eslint/issues/20980">#20980</a>)
(Alex Bit)</li>
<li><a
href="04174cbfaa"><code>04174cb</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="026e130408"><code>026e130</code></a>
docs: update semver policy for bug fixes (<a
href="https://redirect.github.com/eslint/eslint/issues/21048">#21048</a>)
(Milos Djermanovic)</li>
<li><a
href="9d42fefb0e"><code>9d42fef</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="b23015955c"><code>b230159</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="0129972ba1"><code>0129972</code></a>
docs: correct <code>**/.js</code> glob to <code>**/*.js</code> in config
files guide (<a
href="https://redirect.github.com/eslint/eslint/issues/21036">#21036</a>)
(EduardF1)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="948937986f"><code>9489379</code></a>
chore: update dependency <code>@eslint/eslintrc</code> to ^3.3.6 (<a
href="https://redirect.github.com/eslint/eslint/issues/21076">#21076</a>)
(renovate[bot])</li>
<li><a
href="81a4774a92"><code>81a4774</code></a>
chore: updates for v9.39.5 release (Jenkins)</li>
<li><a
href="9835414913"><code>9835414</code></a>
chore: enable <code>$ExpectType</code> annotations in all TypeScript
files (<a
href="https://redirect.github.com/eslint/eslint/issues/21071">#21071</a>)
(Francesco Trotta)</li>
<li><a
href="72adf6bd21"><code>72adf6b</code></a>
chore: restrict <code>markdownlint-cli2</code> updates in renovate (<a
href="https://redirect.github.com/eslint/eslint/issues/21067">#21067</a>)
(lumir)</li>
<li><a
href="833ec10fd7"><code>833ec10</code></a>
chore: update dependency prettier to v3.9.4 (<a
href="https://redirect.github.com/eslint/eslint/issues/21061">#21061</a>)
(renovate[bot])</li>
<li><a
href="7ea106ddcb"><code>7ea106d</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21059">#21059</a>)
(ESLint Bot)</li>
<li><a
href="8fb550e7c2"><code>8fb550e</code></a>
chore: add prettier update commit to <code>.git-blame-ignore-revs</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21056">#21056</a>)
(lumir)</li>
<li><a
href="e4e11668ea"><code>e4e1166</code></a>
chore: update dependency prettier to v3.9.1 (<a
href="https://redirect.github.com/eslint/eslint/issues/21055">#21055</a>)
(renovate[bot])</li>
<li><a
href="0493f53f3f"><code>0493f53</code></a>
chore: update prettier to v3.9.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21054">#21054</a>)
(Pixel)</li>
<li><a
href="1056a996c6"><code>1056a99</code></a>
chore: update dependency prettier to v3.8.5 (<a
href="https://redirect.github.com/eslint/eslint/issues/21049">#21049</a>)
(renovate[bot])</li>
<li><a
href="4d4155df4a"><code>4d4155d</code></a>
ci: run ecosystem tests on pull requests (<a
href="https://redirect.github.com/eslint/eslint/issues/21027">#21027</a>)
(sethamus)</li>
<li><a
href="993539fd45"><code>993539f</code></a>
chore: update dependency <code>@eslint/json</code> to ^2.0.1 (<a
href="https://redirect.github.com/eslint/eslint/issues/21042">#21042</a>)
(renovate[bot])</li>
<li><a
href="53f8b69c15"><code>53f8b69</code></a>
test: add error locations to <code>no-constant-binary-expression</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21039">#21039</a>)
(lumir)</li>
<li><a
href="5ab71d52f9"><code>5ab71d5</code></a>
refactor: clean up radix rule internals (<a
href="https://redirect.github.com/eslint/eslint/issues/21015">#21015</a>)
(Pixel)</li>
<li><a
href="a80a9a4614"><code>a80a9a4</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21035">#21035</a>)
(ESLint Bot)</li>
<li><a
href="7c9a02933c"><code>7c9a029</code></a>
ci: add Node.js 26 to CI (<a
href="https://redirect.github.com/eslint/eslint/issues/20847">#20847</a>)
(lumir)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fabd99bb74"><code>fabd99b</code></a>
10.7.0</li>
<li><a
href="37c5e75949"><code>37c5e75</code></a>
Build: changelog update for 10.7.0</li>
<li><a
href="948937986f"><code>9489379</code></a>
chore: update dependency <code>@eslint/eslintrc</code> to ^3.3.6 (<a
href="https://redirect.github.com/eslint/eslint/issues/21076">#21076</a>)</li>
<li><a
href="81a4774a92"><code>81a4774</code></a>
chore: updates for v9.39.5 release</li>
<li><a
href="3e7bf15e69"><code>3e7bf15</code></a>
fix: apply <code>ignoreClassesWithImplements</code> to class expressions
(<a
href="https://redirect.github.com/eslint/eslint/issues/21069">#21069</a>)</li>
<li><a
href="9835414913"><code>9835414</code></a>
chore: enable <code>$ExpectType</code> annotations in all TypeScript
files (<a
href="https://redirect.github.com/eslint/eslint/issues/21071">#21071</a>)</li>
<li><a
href="cf2a9bf2d9"><code>cf2a9bf</code></a>
feat: add errorClassNames option to preserve-caught-error rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21032">#21032</a>)</li>
<li><a
href="c30d80801c"><code>c30d808</code></a>
docs: Update README</li>
<li><a
href="f8b873aae5"><code>f8b873a</code></a>
feat: max-nested-callbacks option for constructor callbacks (<a
href="https://redirect.github.com/eslint/eslint/issues/21063">#21063</a>)</li>
<li><a
href="72adf6bd21"><code>72adf6b</code></a>
chore: restrict <code>markdownlint-cli2</code> updates in renovate (<a
href="https://redirect.github.com/eslint/eslint/issues/21067">#21067</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.6.0...v10.7.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.3.206 to
0.3.207
Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.3.206 to
0.3.207
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.3.206 to
0.3.207
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.3.206
to 0.3.207
Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.3.206 to
0.3.207
Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.3.206 to
0.3.207
Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.3.206 to
0.3.207
Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.3.206 to
0.3.207
Updates `es-module-lexer` from 2.3.0 to 2.3.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/guybedford/es-module-lexer/releases">es-module-lexer's
releases</a>.</em></p>
<blockquote>
<h2>2.3.1</h2>
<h2>What's Changed</h2>
<ul>
<li>perf: fast native UTF-16 source copy into Wasm memory on Node by <a
href="https://github.com/guybedford"><code>@guybedford</code></a> in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/224">guybedford/es-module-lexer#224</a></li>
<li>perf(lexer): gate keywordStart on the next byte for i/c tokens by <a
href="https://github.com/BridgeAR"><code>@BridgeAR</code></a> in <a
href="https://redirect.github.com/guybedford/es-module-lexer/pull/223">guybedford/es-module-lexer#223</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/guybedford/es-module-lexer/compare/2.3.0...2.3.1">https://github.com/guybedford/es-module-lexer/compare/2.3.0...2.3.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="2b2e6209ba"><code>2b2e620</code></a>
2.3.1</li>
<li><a
href="8c21b74b1f"><code>8c21b74</code></a>
perf(lexer): gate keywordStart on the next byte for i/c tokens (<a
href="https://redirect.github.com/guybedford/es-module-lexer/issues/223">#223</a>)</li>
<li><a
href="b8f9d89f9d"><code>b8f9d89</code></a>
perf: fast native UTF-16 source copy into Wasm memory on Node (<a
href="https://redirect.github.com/guybedford/es-module-lexer/issues/224">#224</a>)</li>
<li>See full diff in <a
href="https://github.com/guybedford/es-module-lexer/compare/2.3.0...2.3.1">compare
view</a></li>
</ul>
</details>
<br />
Updates `hono` from 4.12.29 to 4.12.30
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.30</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(benchmark/routers): bump deps in <a
href="https://redirect.github.com/honojs/hono/pull/5107">honojs/hono#5107</a></li>
<li>chore(benchmark): remove not used benchmarks in <a
href="https://redirect.github.com/honojs/hono/pull/5108">honojs/hono#5108</a></li>
<li>chore: update to ts6 in prep for ts7 in <a
href="https://redirect.github.com/honojs/hono/pull/5104">honojs/hono#5104</a></li>
<li>fix(cache): deduplicate Cache-Control directives case-insensitively
in <a
href="https://redirect.github.com/honojs/hono/pull/5025">honojs/hono#5025</a></li>
<li>fix(compress): do not compress 206 Partial Content responses in <a
href="https://redirect.github.com/honojs/hono/pull/5020">honojs/hono#5020</a></li>
<li>fix(client): replaceUrlParam should not match a param that prefixes
another in <a
href="https://redirect.github.com/honojs/hono/pull/5096">honojs/hono#5096</a></li>
<li>fix(method-override): set duplex when forwarding a stream body in
query mode in <a
href="https://redirect.github.com/honojs/hono/pull/5110">honojs/hono#5110</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.29...v4.12.30">https://github.com/honojs/hono/compare/v4.12.29...v4.12.30</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b2ae3a2204"><code>b2ae3a2</code></a>
4.12.30</li>
<li><a
href="e0cdeb0a89"><code>e0cdeb0</code></a>
fix(method-override): set duplex when forwarding a stream body in query
mode ...</li>
<li><a
href="653025e5c3"><code>653025e</code></a>
fix(client): replaceUrlParam should not match a param that prefixes
another (...</li>
<li><a
href="67efb27f7b"><code>67efb27</code></a>
fix(compress): do not compress 206 Partial Content responses (<a
href="https://redirect.github.com/honojs/hono/issues/5020">#5020</a>)</li>
<li><a
href="a48c8bf248"><code>a48c8bf</code></a>
fix(cache): deduplicate Cache-Control directives case-insensitively (<a
href="https://redirect.github.com/honojs/hono/issues/5025">#5025</a>)</li>
<li><a
href="3bb9a0e3a7"><code>3bb9a0e</code></a>
chore: update to ts6 in prep for ts7 (<a
href="https://redirect.github.com/honojs/hono/issues/5104">#5104</a>)</li>
<li><a
href="d3f97caa29"><code>d3f97ca</code></a>
chore(benchmark): remove not used benchmarks (<a
href="https://redirect.github.com/honojs/hono/issues/5108">#5108</a>)</li>
<li><a
href="29a3f73fd5"><code>29a3f73</code></a>
chore(benchmark/routers): bump deps (<a
href="https://redirect.github.com/honojs/hono/issues/5107">#5107</a>)</li>
<li>See full diff in <a
href="https://github.com/honojs/hono/compare/v4.12.29...v4.12.30">compare
view</a></li>
</ul>
</details>
<br />
Updates `postcss` from 8.5.16 to 8.5.19
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.19</h2>
<ul>
<li>Fixed cleaning <code>before</code> for new nodes inserted to
<code>Root</code> (by <a
href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li>
</ul>
<h2>8.5.18</h2>
<ul>
<li>Restricted loading previous source maps file to the
<code>opts.from</code> folder for security reasons (use <code>unsafeMap:
true</code> to disable the check).</li>
</ul>
<h2>8.5.17</h2>
<ul>
<li>Fixed <code>Maximum call stack size exceeded</code> error.</li>
<li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li>
<li>Fixed <code>Input#origin()</code> for unmapped end position (by <a
href="https://github.com/chatman-media"><code>@chatman-media</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.19</h2>
<ul>
<li>Fixed cleaning <code>before</code> for new nodes inserted to
<code>Root</code> (by <a
href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li>
</ul>
<h2>8.5.18</h2>
<ul>
<li>Restricted loading previous source maps file to the
<code>opts.from</code> folder for security reasons (use <code>unsafeMap:
true</code> to disable the check).</li>
</ul>
<h2>8.5.17</h2>
<ul>
<li>Fixed <code>Maximum call stack size exceeded</code> error.</li>
<li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li>
<li>Fixed <code>Input#origin()</code> for unmapped end position (by <a
href="https://github.com/chatman-media"><code>@chatman-media</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9543b22769"><code>9543b22</code></a>
Release 8.5.19 version</li>
<li><a
href="3d13bf9360"><code>3d13bf9</code></a>
Fix CI on Windows too</li>
<li><a
href="00d0dd2322"><code>00d0dd2</code></a>
Keep explicitly set raws.before when inserting nodes into root (<a
href="https://redirect.github.com/postcss/postcss/issues/2111">#2111</a>)</li>
<li><a
href="7a05b33e7a"><code>7a05b33</code></a>
Temporary fix CI</li>
<li><a
href="4c0d194c13"><code>4c0d194</code></a>
Release 8.5.18 version</li>
<li><a
href="92b4e7891e"><code>92b4e78</code></a>
Update dependencies</li>
<li><a
href="95663d3eb7"><code>95663d3</code></a>
Limit where source map can be loaded for security reasons</li>
<li><a
href="74e25ae9f4"><code>74e25ae</code></a>
Release 8.5.17 version</li>
<li><a
href="d1518afd5a"><code>d1518af</code></a>
Fix Maximum call stack size exceeded error</li>
<li><a
href="2421312ffe"><code>2421312</code></a>
Fix linter</li>
<li>Additional commits viewable in <a
href="https://github.com/postcss/postcss/compare/8.5.16...8.5.19">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
## Problem
`session/prompt` settled at the turn's terminal `result`, but a turn
that launched an **async subagent** is not done at that point.
Everything after settlement — the subagent's streamed tool calls, the
model's promised task-notification followup summary, and any
`session/request_permission` the subagent raises — landed **outside any
turn**. Some clients stops consuming updates at the prompt response, so
the output was silently lost and the permission request deadlocked on an
RPC nobody answers.
Reported as #864 (no signal for the post-turn activity), #865
(background tasks not trackable), and #866 (end-to-end field report
incl. the permission deadlock).
## What I verified before designing this
Driving the adapter over real ACP stdio against the bundled CLI
(2.1.206) with `emitRawSDKMessages` on showed that the SDK's trailing
`session_state_changed: idle` **does not wait for background agents** —
it follows the user result immediately, while the subagent is still
running, and the session then cycles:
```
user result → idle → (subagent works) → task_notification → followup turn → result(origin: task-notification) → idle
```
So the old #463-era "settle at idle" design would **not** fix this on
current CLIs (and plain re-adopting it would still trade away #773). The
hold has to be keyed on the live-subagent set and span those idle
cycles.
## Fix
A user turn whose terminal result arrives while subagents **it spawned**
are still live stores its outcome on `Turn.deferredSettle` instead of
settling. The prompt stays pending, so all of the subagent's output and
permission requests arrive inside a live turn. It settles with the
stored stop reason/usage:
- at the **task-notification followup's terminal result** — the promised
summary has fully streamed by then (the common case), or
- at an **idle with none of its subagents left**, when no followup
comes, or
- earlier, via `session/cancel` or the next prompt's echo hand-off — a
long-running subagent never holds the prompt hostage, and the hand-off
reports the recorded stop reason instead of rewriting it to `end_turn`.
Tracking: `Turn.spawnedTaskIds` ∩ `session.liveSubagentTasks`, fed by
`task_started` (only entries with `subagent_type`; background shells are
deliberately excluded — a dev server outlives every turn), pruned at
`task_notification`/terminal `task_updated`, and reconciled against
`background_tasks_changed`'s replace-semantics payload so a lost bookend
can't wedge the hold. A spawn during the held-open window (an agent
chain) extends the hold naturally.
Turns that spawned nothing (or whose subagents finished in-turn) still
settle at their result — the #773 responsiveness is untouched.
## Live verification (adapter on real stdio, CLI 2.1.206, temp cwd)
Prompt: *"launch a background agent to read the two files and create
summary.txt, then end your turn saying you'll report back"*:
```
[ 15.72] raw: result success ← user result; subagent live → HELD
[ 15.72] raw: session_state_changed idle ← immediate idle survives the hold
[ 17.50] update: tool_call Read hello.txt ← subagent work, in-turn
[ 21.39] update: tool_call Write summary.txt ← in-turn
[ 24.17] raw: task_notification completed
[ 34.35] update: agent_message_chunk "The background agent finished. It created summary.txt…" ← promised summary, in-turn
[ 35.70] raw: result success (origin task-notification)
[ 35.70] PROMPT RESOLVED end_turn, usage = user turn's own tokens
```
No-regression check: a plain `"say hello"` prompt resolves the instant
its result lands (2.09s, zero added latency).
## Hardening from the adversarial review pass
A high-effort review (8 finder angles) of the change surfaced three
confirmed defects, each fixed with a regression test that fails pre-fix:
- **cancel() of a held turn stalled ~30s**: the session is already idle
during the hold, so the interrupt may never emit the trailing idle the
cancelled-settle path waited on. cancel() now settles a deferred turn
immediately (its result is already in hand); this also prevents the
force-cancel backstop from seeding a phantom orphan for a result that
already passed.
- **A followup's `is_error` / "Please run /login" could reject a held
user turn** whose own result was a success (reachable with parallel
subagents). Followup results now never touch the user-turn lifecycle.
- **The followup's own trailing idle was un-owed**: settling at the
followup result unblocks the client at exactly the moment that idle can
lag past the next prompt's echo — which would have been read as the
fresh turn ending without a result (#825 false-fail). All results now
record their trailer debt.
A second review round on the post-merge state (after resolving conflicts
with #858) found and fixed five more: an echo-less command (`/context`)
during a hold overwrote the held turn's outcome and hung
(ensureActiveTurn now hands the held turn off and promotes the head);
the refusal lane bypassed the deferral gate (result-time settles now
route through a shared `settleOrDefer`); cancel()'s inline settle
couldn't record the interrupt trailer's owed-idle debt (the counter
moved onto the Session) and skipped the backstop disarm; `failAllTurns`
rejected a held turn whose answer had already streamed (now resolves the
stored outcome, like stream-done); and a followup result inside a cancel
window skipped the trailer count. Settling at a followup result also now
closes the #453 delivery stretch so a following replayed turn's fallback
isn't suppressed.
Known residuals, deliberately accepted: a subagent whose settle bookends
are all lost parks the held turn until `session/cancel` or the next
prompt (same rescue contract as the adapter's other wedge classes); a
wake whose origin can't be attributed (the SDK's `origin` carries no
task id) can settle the turn one followup early, degrading to today's
behavior, never worse.
## Verification
Unit: 530 tests green; the deferral/cancel/false-fail tests were each
run against the pre-fix adapter and fail there. Live (real ACP stdio,
CLI 2.1.206): held turn with in-turn subagent output + followup summary,
resolution at the followup's result; plain prompts resolve instantly at
their result.
## Out of scope (follow-ups)
- A background **shell**'s exit waking the model between turns remains
an out-of-turn episode — there is no turn to hold for it without
blocking every prompt behind a dev server. Same for clients that want a
session-level active/idle or background-task level signal (#864/#865's
additive asks): both raw signals are already available today via
`_meta.claudeCode.emitRawSDKMessages` → `_claude/sdkMessage` ext
notifications.
- Flipping the spawning `Task` tool call's status at terminal
`task_updated` (#865's optional ask).
A third review round on the consolidated state fixed: the reconciliation
deleting live sync-subagent attribution entries (the level's universe is
background-only — absent subagent entries are now kept but marked
`endedPerLevel` so holds stop waiting on them);
peer/coordinator/observer-origin results being treated as the user's
turn (now gated via `AUTONOMOUS_RESULT_ORIGINS`, preserving
channel-origin behavior); `emittedAssistantText` moving onto the Session
so every held-turn settle lane closes the #453 delivery stretch (with
the snapshot taken after the held-turn hand-off); the interrupt-trailer
pre-count gated on a running cycle so idle-cancels can't mask future
#825 detections; and `turnAwaitingSubagents` now reading `isSubagent` as
defense in depth for the shells-never-defer contract. Plus
`isHeldOpen()`/`disarmForceCancel()` deduplicating the hold predicate
and backstop disarm.
(An earlier follow-up — folding the attribution map and the
live-subagent set into one task registry — is now done in this PR:
`liveBackgroundTasks` keyed by task id, so the
`background_tasks_changed` reconciliation heals both concerns and future
terminal paths can't prune one but not the other.)
Fixes#866. Addresses the settlement half of #864 / #865.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.15 to 3.3.16.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ai/nanoid/releases">nanoid's
releases</a>.</em></p>
<blockquote>
<h2>3.3.16</h2>
<ul>
<li>Fixed infinite loop on negative size (by <a
href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ai/nanoid/blob/main/CHANGELOG.md">nanoid's
changelog</a>.</em></p>
<blockquote>
<h2>3.3.16</h2>
<ul>
<li>Fixed infinite loop on negative size (by <a
href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9760e11275"><code>9760e11</code></a>
Release 3.3.16 version</li>
<li><a
href="e835c9b71e"><code>e835c9b</code></a>
fix(non-secure): clamp negative size to prevent infinite loop (<a
href="https://redirect.github.com/ai/nanoid/issues/601">#601</a>)</li>
<li><a
href="96dd086eb2"><code>96dd086</code></a>
Update CI action</li>
<li><a
href="ba0bc3b6b9"><code>ba0bc3b</code></a>
Do not create latest release for v3</li>
<li>See full diff in <a
href="https://github.com/ai/nanoid/compare/3.3.15...3.3.16">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Fixes#453.
On a cache-replayed turn the CLI can answer on the `result` alone:
output_tokens is 0, no `stream_event` deltas, and no consolidated
`assistant` message. The result handler never forwarded that text, so
the client rendered an empty turn.
The check suggested in the issue (output_tokens === 0 and a non-empty
result) isn't enough by itself. I tried it: it emits the answer twice
when the consolidated `assistant` message already delivered it,
including the case where the echo lands mid-message and the consolidated
message dedupes to nothing, and it forwards a background
task-notification followup's output into the user's turn.
So this tracks whether any top-level assistant text already reached the
client since the last user-turn result, and forwards `message.result`
only when none did and the turn isn't a task-notification followup. The
direct emitters in the `status` handler (compaction notices, local
command output) set the flag too, since they bypass the forwarding
loops. `compact_boundary` doesn't, because it only sends a usage update.
Tests: six added to the "assembled assistant text fallback" block.
Reverting the source change fails "forwards the result text when nothing
else carried it"; the other five pin the guards, and they catch the
naive version, which double-emits and leaks task-notification output.
Full suite: 501 passed, 2 failed, and both failures reproduce on a clean
main (Windows path separator assertions in the tool-conversion tests).
eslint, tsc --noEmit, and prettier --check are clean.
---------
Co-authored-by: Josh Kappler <boffytv@gmail.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
## Why
Tool-use `content_block_start` events arrive before their JSON input.
This leaves pending calls with generic labels such as `Read File` or
`Terminal`; long-running and concurrent calls can remain
indistinguishable in clients while they execute.
Anthropic specifies `input_json_delta.partial_json` as arbitrary string
fragments, so delta boundaries cannot be assumed to align with fields or
JSON values.
## What changed
- Buffer `input_json_delta` fragments per parent message and
content-block index.
- Recover completed top-level fields while the overall JSON is still
incomplete.
- Refine the existing ACP tool call immediately when distinguishing
fields such as `file_path`, `command`, `query`, `pattern`, `url`, or
`description` become available.
- Continue refining as later fields arrive, while keeping the early
pending lifecycle and cleaning incomplete buffers at block/message
boundaries.
- Avoid publishing ambiguous numeric suffixes (`10` may still become
`100` or `10.5`) until a delimiter arrives.
## Test coverage
Parameterized coverage now includes Agent/Task, Bash, Read/Write/Edit,
Glob/Grep, WebFetch/WebSearch, ReportFindings, ExitPlanMode,
AskUserQuestion, Other, custom MCP calls, TodoWrite plan updates, and
intentionally suppressed TaskCreate/Update/List/Get calls. Edge cases
cover arbitrary field splits, unfinished strings, escaped quotes and
commas, numbers, booleans, null, arrays, nested objects, and all three
tool block types (`tool_use`, `server_tool_use`, `mcp_tool_use`).
## Validation
- `npm run build`
- `npm run test:run` (535 passed, 20 skipped)
- `npm run check`
---------
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Bumps the minor group with 11 updates:
| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.205` | `0.3.206` |
| [prettier](https://github.com/prettier/prettier) | `3.9.4` | `3.9.5` |
| @anthropic-ai/claude-agent-sdk-darwin-arm64 | `0.3.205` | `0.3.206` |
| @anthropic-ai/claude-agent-sdk-darwin-x64 | `0.3.205` | `0.3.206` |
| @anthropic-ai/claude-agent-sdk-linux-arm64 | `0.3.205` | `0.3.206` |
| @anthropic-ai/claude-agent-sdk-linux-arm64-musl | `0.3.205` |
`0.3.206` |
| @anthropic-ai/claude-agent-sdk-linux-x64 | `0.3.205` | `0.3.206` |
| @anthropic-ai/claude-agent-sdk-linux-x64-musl | `0.3.205` | `0.3.206`
|
| @anthropic-ai/claude-agent-sdk-win32-arm64 | `0.3.205` | `0.3.206` |
| @anthropic-ai/claude-agent-sdk-win32-x64 | `0.3.205` | `0.3.206` |
| [hono](https://github.com/honojs/hono) | `4.12.28` | `4.12.29` |
Updates `@anthropic-ai/claude-agent-sdk` from 0.3.205 to 0.3.206
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.206</h2>
<h2>What's changed</h2>
<ul>
<li>Added <code>command_lifecycle</code> frames to stream-json and SDK
sessions, reporting each uuid-stamped message's terminal state
(<code>queued</code>/<code>started</code>/<code>completed</code>/<code>cancelled</code>/<code>discarded</code>);
zero-API results no longer report stale
<code>duration_api_ms</code></li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.206
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.206
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.206
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.206
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.206</h2>
<ul>
<li>Added <code>command_lifecycle</code> frames to stream-json and SDK
sessions, reporting each uuid-stamped message's terminal state
(<code>queued</code>/<code>started</code>/<code>completed</code>/<code>cancelled</code>/<code>discarded</code>);
zero-API results no longer report stale
<code>duration_api_ms</code></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9fc7ea5ff6"><code>9fc7ea5</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.205...v0.3.206">compare
view</a></li>
</ul>
</details>
<br />
Updates `prettier` from 3.9.4 to 3.9.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/releases">prettier's
releases</a>.</em></p>
<blockquote>
<h2>3.9.5</h2>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.9.5/CHANGELOG.md#395">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md">prettier's
changelog</a>.</em></p>
<blockquote>
<h1>3.9.5</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.9.4...3.9.5">diff</a></p>
<h4>Markdown: Cap ordered list mark at 999,999,999 (<a
href="https://redirect.github.com/prettier/prettier/pull/19351">#19351</a>
by <a href="https://github.com/tats-u"><code>@tats-u</code></a>)</h4>
<p>CommonMark parsers only support ordered list item numbers up to
999,999,999.</p>
<p>With this change, Prettier now caps the ordered list item number at
999,999,999 to ensure that the output is correctly parsed as an ordered
list by CommonMark parsers. Numbers larger than 999,999,999 are not
parsed as list item numbers and are left unchanged in the output:</p>
<!-- raw HTML omitted -->
<pre lang="markdown"><code><!-- Input -->
999999998. text
999999998. text
999999998. text
999999998. text
<p>1234567890123456789012) text</p>
<p><!-- Prettier 3.9.4 -->
999999998. text
999999999. text
1000000000. text
1000000001. text</p>
<p>1234567890123456789012) text</p>
<p><!-- Prettier 3.9.5 -->
999999998. text
999999999. text
999999999. text
999999999. text</p>
<p>1234567890123456789012) text
</code></pre></p>
<h4>Markdown: Avoid corrupting empty link with title (<a
href="https://redirect.github.com/prettier/prettier/pull/19487">#19487</a>
by <a href="https://github.com/andersk"><code>@andersk</code></a>)</h4>
<p>Do not remove <code><></code> from an inline link or image with
an empty URL and a title, as this removal would change its
interpretation.</p>
<!-- raw HTML omitted -->
<pre lang="md"><code><!-- Input -->
[link](https://github.com/prettier/prettier/blob/main/<>
"title")
<p><!-- Prettier 3.9.4 -->
[link](<a
href="https://github.com/prettier/prettier/blob/main/">https://github.com/prettier/prettier/blob/main/</a>
"title")</p>
<p><!-- Prettier 3.9.5 -->
</tr></table>
</code></pre></p>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b6c7d18068"><code>b6c7d18</code></a>
Release 3.9.5</li>
<li><a
href="cd54ccc728"><code>cd54ccc</code></a>
Avoid corrupting empty Markdown link with title (<a
href="https://redirect.github.com/prettier/prettier/issues/19487">#19487</a>)</li>
<li><a
href="2bb67ce8cd"><code>2bb67ce</code></a>
Preserving comments' <code>placement</code> property (<a
href="https://redirect.github.com/prettier/prettier/issues/19567">#19567</a>)</li>
<li><a
href="91bcac88ec"><code>91bcac8</code></a>
Add more tests for comment-only object type (<a
href="https://redirect.github.com/prettier/prettier/issues/19587">#19587</a>)</li>
<li><a
href="cbee7377a1"><code>cbee737</code></a>
Remove space in empty object type (<a
href="https://redirect.github.com/prettier/prettier/issues/19583">#19583</a>)</li>
<li><a
href="6394c73209"><code>6394c73</code></a>
Align empty module declaration with TS (<a
href="https://redirect.github.com/prettier/prettier/issues/19568">#19568</a>)</li>
<li><a
href="a4e6f7a026"><code>a4e6f7a</code></a>
Prevent the addition of space in <code>type()</code> with <code>+</code>
(<a
href="https://redirect.github.com/prettier/prettier/issues/19516">#19516</a>)</li>
<li><a
href="3d063b57b1"><code>3d063b5</code></a>
Ignore dangling comments when checking type parameter comments (<a
href="https://redirect.github.com/prettier/prettier/issues/19572">#19572</a>)</li>
<li><a
href="908503e9ee"><code>908503e</code></a>
Handle dangling comments in <code>SwitchStatement</code> (<a
href="https://redirect.github.com/prettier/prettier/issues/19581">#19581</a>)</li>
<li><a
href="943a475c35"><code>943a475</code></a>
Angular: Support expression for exhaustive typechecking (<a
href="https://redirect.github.com/prettier/prettier/issues/19571">#19571</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/prettier/prettier/compare/3.9.4...3.9.5">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.3.205 to
0.3.206
Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.3.205 to
0.3.206
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.3.205 to
0.3.206
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.3.205
to 0.3.206
Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.3.205 to
0.3.206
Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.3.205 to
0.3.206
Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.3.205 to
0.3.206
Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.3.205 to
0.3.206
Updates `hono` from 4.12.28 to 4.12.29
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.29</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(client): merge function headers with per-request headers by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5092">honojs/hono#5092</a></li>
<li>chore: fix no-op tsc in test script by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5093">honojs/hono#5093</a></li>
<li>fix(lambda-edge): resolve the handler with the value passed to the
callback by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5094">honojs/hono#5094</a></li>
<li>docs(language): add JSDoc <a
href="https://github.com/example"><code>@example</code></a> to
languageDetector by <a
href="https://github.com/codebybilal18"><code>@codebybilal18</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/5081">honojs/hono#5081</a></li>
<li>test(workerd): add <code>compatibilityDate</code> by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5100">honojs/hono#5100</a></li>
<li>fix(lambda-edge): base64 encode content-encoded response bodies by
<a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5099">honojs/hono#5099</a></li>
<li>fix(aws-lambda): treat any non-identity content-encoding as binary
by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in
<a
href="https://redirect.github.com/honojs/hono/pull/5101">honojs/hono#5101</a></li>
<li>fix(types): strip extra properties from array types in JSONParsed by
<a
href="https://github.com/Arman-Luthra"><code>@Arman-Luthra</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/5103">honojs/hono#5103</a></li>
<li>fix(trie-router): match empty wildcard remainder after regexp param
by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in
<a
href="https://redirect.github.com/honojs/hono/pull/5102">honojs/hono#5102</a></li>
<li>fix(etag): treat If-None-Match: <code>*</code> as a match by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5084">honojs/hono#5084</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/codebybilal18"><code>@codebybilal18</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/5081">honojs/hono#5081</a></li>
<li><a
href="https://github.com/Arman-Luthra"><code>@Arman-Luthra</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/5103">honojs/hono#5103</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.28...v4.12.29">https://github.com/honojs/hono/compare/v4.12.28...v4.12.29</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="cda1af2002"><code>cda1af2</code></a>
4.12.29</li>
<li><a
href="2126289c15"><code>2126289</code></a>
fix(etag): treat If-None-Match: <code>*</code> as a match (<a
href="https://redirect.github.com/honojs/hono/issues/5084">#5084</a>)</li>
<li><a
href="0fc7ffc949"><code>0fc7ffc</code></a>
fix(trie-router): match empty wildcard remainder after regexp param (<a
href="https://redirect.github.com/honojs/hono/issues/5102">#5102</a>)</li>
<li><a
href="ab590e4ec8"><code>ab590e4</code></a>
fix(types): strip extra properties from array types in JSONParsed (<a
href="https://redirect.github.com/honojs/hono/issues/5103">#5103</a>)</li>
<li><a
href="b93a2547a3"><code>b93a254</code></a>
fix(aws-lambda): treat any non-identity content-encoding as binary (<a
href="https://redirect.github.com/honojs/hono/issues/5101">#5101</a>)</li>
<li><a
href="6217f4b74c"><code>6217f4b</code></a>
fix(lambda-edge): base64 encode content-encoded response bodies (<a
href="https://redirect.github.com/honojs/hono/issues/5099">#5099</a>)</li>
<li><a
href="ba89e973c7"><code>ba89e97</code></a>
test(workerd): add <code>compatibilityDate</code> (<a
href="https://redirect.github.com/honojs/hono/issues/5100">#5100</a>)</li>
<li><a
href="46557ef820"><code>46557ef</code></a>
docs(language): add JSDoc <a
href="https://github.com/example"><code>@example</code></a> to
languageDetector (<a
href="https://redirect.github.com/honojs/hono/issues/5081">#5081</a>)</li>
<li><a
href="24547a6ed5"><code>24547a6</code></a>
fix(lambda-edge): resolve the handler with the value passed to the
callback (...</li>
<li><a
href="9c6ccd76f1"><code>9c6ccd7</code></a>
chore: fix no-op tsc in test script (<a
href="https://redirect.github.com/honojs/hono/issues/5093">#5093</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.28...v4.12.29">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
## Summary
This makes streamed text/thinking chunk handling defensive when gateways
emit empty or malformed delta payloads.
- Guard `text_delta.text` and `thinking_delta.thinking` before reading
`.length`
- Skip missing/non-string text or thinking content the same way empty
chunks are already skipped
- Add regression coverage for a missing `thinking` delta before a real
text delta
- Add direct `toAcpNotifications` coverage for missing/non-string text
and thinking chunks
## Why
The adapter already skips empty thinking chunks, but some
Anthropic-compatible gateways can emit signature-only or omitted
thinking deltas where `thinking` is absent rather than an empty string.
In that case the adapter currently throws:
```text
Cannot read properties of undefined (reading 'length')
```
That aborts the ACP session even though the following text chunks are
valid.
This change keeps the existing behavior for valid chunks, while treating
missing/non-string chunk text as empty content.
## Test Plan
- `npm run check`
- `npm test -- --run`
- `npm run build`
Also verified manually through a VibeAround Web Chat flow using Claude
Code ACP with an Anthropic-compatible custom endpoint; the session
completed and returned a normal assistant response.
---------
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
## Why this is needed
`toAcpNotifications` can emit an `agent_message_chunk` whose content is
an empty string. This happens in two situations:
1. **Streamed text deltas** — the `text` / `text_delta` case builds the
update unconditionally from `chunk.text`, and the Claude Agent SDK can
stream zero-length text deltas (for example, an empty trailing assistant
block at the end of a turn).
2. **Full-string content** — the string-content path emits a chunk even
when the string is empty.
An empty message chunk carries no information, so at best it is noise.
At worst it breaks clients: the ACP spec does not forbid empty content,
so clients handle it inconsistently and some throw. In JetBrains Air the
frontend event consumer throws on an empty-content `agent_message_chunk`
(`Failed to handle agent event`); once that happens the transcript is
**frozen for the rest of the turn** — no further updates render and
queued prompts are never dispatched. In practice this reproduced
repeatedly around image reads and end-of-turn, and the only recovery was
restarting the IDE.
Because the adapter is client-agnostic, this affects any ACP client that
is strict about chunk content, not a single editor — so the correct
place to fix it is here, in the adapter, rather than working around it
in each client.
## Fix
Do not emit empty content. Both call sites are guarded, mirroring the
empty-`thinking` guard that already exists a few lines below in the same
function, so behavior is consistent across content types:
- `text` / `text_delta`: only build the update when `chunk.text.length >
0`;
- string content: return `[]` when the string is empty.
The change is intentionally minimal and conservative — no information is
lost, and non-empty chunks are entirely unaffected.
## Tests
Three unit tests added on `toAcpNotifications`:
- empty string content → no notifications emitted;
- non-empty string content → still emitted unchanged;
- a stream containing an empty text block followed by a non-empty one →
only the non-empty block is emitted.
Full suite green (476 passing); eslint and prettier clean.
Bumps the minor group with 11 updates:
| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.198` | `0.3.199` |
|
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript)
| `0.109.1` | `0.110.0` |
| @anthropic-ai/claude-agent-sdk-darwin-arm64 | `0.3.198` | `0.3.199` |
| @anthropic-ai/claude-agent-sdk-darwin-x64 | `0.3.198` | `0.3.199` |
| @anthropic-ai/claude-agent-sdk-linux-arm64 | `0.3.198` | `0.3.199` |
| @anthropic-ai/claude-agent-sdk-linux-arm64-musl | `0.3.198` |
`0.3.199` |
| @anthropic-ai/claude-agent-sdk-linux-x64 | `0.3.198` | `0.3.199` |
| @anthropic-ai/claude-agent-sdk-linux-x64-musl | `0.3.198` | `0.3.199`
|
| @anthropic-ai/claude-agent-sdk-win32-arm64 | `0.3.198` | `0.3.199` |
| @anthropic-ai/claude-agent-sdk-win32-x64 | `0.3.198` | `0.3.199` |
| [picomatch](https://github.com/micromatch/picomatch) | `4.0.4` |
`4.0.5` |
Updates `@anthropic-ai/claude-agent-sdk` from 0.3.198 to 0.3.199
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.199</h2>
<h2>What's changed</h2>
<ul>
<li>Added <code>requestId</code> to <code>canUseTool</code> callback
options for correlating out-of-band permission responses, and support
for returning <code>null</code> to suppress the SDK's automatic control
response</li>
<li>Added <code>blocked</code> field to <code>workflow_agent</code>
progress events indicating when an agent was blocked by the auto-mode
safety classifier</li>
<li>Added <code>mode:"mask"</code> and per-credential
<code>injectHosts</code> to <code>sandbox.credentials</code> settings
types for injecting masked credentials into sandboxed commands</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.199
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.199
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.199
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.199
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.199</h2>
<ul>
<li>Added <code>requestId</code> to <code>canUseTool</code> callback
options for correlating out-of-band permission responses, and support
for returning <code>null</code> to suppress the SDK's automatic control
response</li>
<li>Added <code>blocked</code> field to <code>workflow_agent</code>
progress events indicating when an agent was blocked by the auto-mode
safety classifier</li>
<li>Added <code>mode:"mask"</code> and per-credential
<code>injectHosts</code> to <code>sandbox.credentials</code> settings
types for injecting masked credentials into sandboxed commands</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a0c02d6d99"><code>a0c02d6</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.198...v0.3.199">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/sdk` from 0.109.1 to 0.110.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/releases">@anthropic-ai/sdk's
releases</a>.</em></p>
<blockquote>
<h2>sdk: v0.110.0</h2>
<h2>0.110.0 (2026-07-02)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.109.1...sdk-v0.110.0">sdk-v0.109.1...sdk-v0.110.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add agent-memory-2026-07-22 beta header (<a
href="a470e10aaa">a470e10</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.110.0 (2026-07-02)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.109.1...sdk-v0.110.0">sdk-v0.109.1...sdk-v0.110.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add agent-memory-2026-07-22 beta header (<a
href="a470e10aaa">a470e10</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4f2eb80719"><code>4f2eb80</code></a>
chore: release main (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1107">#1107</a>)</li>
<li>See full diff in <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.109.1...sdk-v0.110.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.3.198 to
0.3.199
Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.3.198 to
0.3.199
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.3.198 to
0.3.199
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.3.198
to 0.3.199
Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.3.198 to
0.3.199
Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.3.198 to
0.3.199
Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.3.198 to
0.3.199
Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.3.198 to
0.3.199
Updates `picomatch` from 4.0.4 to 4.0.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/micromatch/picomatch/releases">picomatch's
releases</a>.</em></p>
<blockquote>
<h2>4.0.5</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: preserve all branches when rewriting risky repeated extglobs by
<a href="https://github.com/MerlijnW70"><code>@MerlijnW70</code></a> in
<a
href="https://redirect.github.com/micromatch/picomatch/pull/182">micromatch/picomatch#182</a></li>
<li>fix: honor the windows option when matching basenames by <a
href="https://github.com/MerlijnW70"><code>@MerlijnW70</code></a> in <a
href="https://redirect.github.com/micromatch/picomatch/pull/183">micromatch/picomatch#183</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/MerlijnW70"><code>@MerlijnW70</code></a> made
their first contribution in <a
href="https://redirect.github.com/micromatch/picomatch/pull/182">micromatch/picomatch#182</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/micromatch/picomatch/compare/4.0.4...4.0.5">https://github.com/micromatch/picomatch/compare/4.0.4...4.0.5</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4f41a8edad"><code>4f41a8e</code></a>
4.0.5</li>
<li><a
href="02cfc1bf91"><code>02cfc1b</code></a>
Update .verb.md and run verb to generate README documentation</li>
<li><a
href="cc52ff6e86"><code>cc52ff6</code></a>
Only run the upload code coverage step for 1 matrix permutation</li>
<li><a
href="6d426d7fe9"><code>6d426d7</code></a>
Allow workflow to continue if the code coverage step to fails</li>
<li><a
href="a00b954c04"><code>a00b954</code></a>
Merge branch 'codeql-coverage'</li>
<li><a
href="96803818ca"><code>9680381</code></a>
Merge pull request <a
href="https://redirect.github.com/micromatch/picomatch/issues/183">#183</a>
from MerlijnW70/fix/matchbase-windows-basename</li>
<li><a
href="648b4f2f13"><code>648b4f2</code></a>
Merge pull request <a
href="https://redirect.github.com/micromatch/picomatch/issues/182">#182</a>
from MerlijnW70/fix/repeated-extglob-drops-branches</li>
<li><a
href="70e6485a54"><code>70e6485</code></a>
Configure code coverage upload for CodeQL</li>
<li><a
href="ab8bc4df81"><code>ab8bc4d</code></a>
fix: honor the windows option when matching basenames</li>
<li><a
href="628930764f"><code>6289307</code></a>
fix: preserve all branches when rewriting risky repeated extglobs</li>
<li>Additional commits viewable in <a
href="https://github.com/micromatch/picomatch/compare/4.0.4...4.0.5">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
## Problem
When `claude-agent-acp` runs against a Bedrock or Vertex deployment
where the
enterprise enforces **short model aliases** in `availableModels` (e.g.
`claude-opus-4-6`), session creation fails immediately with:
```
API Error (claude-opus-4-6): 400 The provided model identifier is invalid.
Try switching to us.anthropic.claude-opus-4-5-20251101-v1:0.
```
### Root cause
`applyAvailableModelsAllowlist` rewrites each allowlisted model's
`value` to the
user's literal entry (the short alias), and that value is what gets
passed to
`query.setModel()`. The provider API rejects short aliases — it requires
provider-specific IDs such as `global.anthropic.claude-opus-4-6-v1[1m]`.
The `modelOverrides` map — which exists precisely to translate aliases
to
provider IDs — was never consulted during allowlist resolution. So even
with a
correct `modelOverrides` configured (via `settings.json` or
`CLAUDE_MODEL_CONFIG`),
the alias still reached the API unchanged.
This is reproducible on the Amazon-internal Toolbox Claude distribution,
which
regenerates `~/.claude/settings.json` on every launch with
`availableModels`
pinned to short aliases — so editing `settings.json` cannot work around
it.
### Trace (with temporary debug logging)
```
settings.model = "global.anthropic.claude-opus-4-6-v1[1m]" (desired)
getAvailableModels currentModel.value = "claude-opus-4-6" (WRONG)
calling query.setModel("claude-opus-4-6") (rejected)
```
## Fix
`applyAvailableModelsAllowlist` now accepts `settings.modelOverrides`.
When an
allowlist alias has an override mapping, the **overridden provider ID**
becomes
the surfaced model value, so `setModel` passes an ID the provider
accepts.
After the fix:
```
getAvailableModels currentModel.value = "global.anthropic.claude-opus-4-6-v1[1m]"
calling query.setModel("global.anthropic.claude-opus-4-6-v1[1m]")
```
and `acpx claude exec "what model are you using?"` responds normally:
> I'm running on Claude Opus 4.6 with a 1M token context window.
## Testing
- Added a regression test (`maps allowlist aliases through
modelOverrides to
provider IDs`) under the existing `availableModels allowlist from
settings`
suite.
- Full suite: `411 passed | 17 skipped`.
- `npm run check` (eslint + prettier) clean.
- `tsc` build clean.
- Manually verified end-to-end via `acpx` against a Bedrock-routed
Toolbox
Claude binary.
---------
Co-authored-by: Hao Zhou <zhuha@amazon.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Bumps the minor group with 1 update:
[prettier](https://github.com/prettier/prettier).
Updates `prettier` from 3.9.1 to 3.9.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/releases">prettier's
releases</a>.</em></p>
<blockquote>
<h2>3.9.3</h2>
<ul>
<li>Markdown: Fix unexpected removal of characters in liquid syntax (<a
href="https://redirect.github.com/prettier/prettier/pull/19489">prettier/prettier#19489</a>
by <a href="https://github.com/seiyab"><code>@seiyab</code></a>)</li>
<li>TypeScript: Allow decorators to be used with declare on class fields
(<a
href="https://redirect.github.com/prettier/prettier/pull/19492">prettier/prettier#19492</a>
by <a
href="https://github.com/evoactivity"><code>@evoactivity</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.9.3/CHANGELOG.md#393">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md">prettier's
changelog</a>.</em></p>
<blockquote>
<h1>3.9.3</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.9.1...3.9.3">diff</a></p>
<h4>Markdown: Fix unexpected removal of characters in liquid syntax (<a
href="https://redirect.github.com/prettier/prettier/pull/19489">#19489</a>
by <a href="https://github.com/seiyab"><code>@seiyab</code></a>)</h4>
<!-- raw HTML omitted -->
<pre lang="md"><code>// Input
<!-- Input -->
{{ page.title
}} text
<p><!-- Prettier 3.9.1 --><br />
{{ page.title<br />
text</p>
<p><!-- Prettier 3.9.3 --><br />
{{ page.title<br />
}} text<br />
</code></pre></p>
<h4>TypeScript: Allow decorators to be used with declare on class fields
(<a
href="https://redirect.github.com/prettier/prettier/pull/19492">#19492</a>
by <a
href="https://github.com/evoactivity"><code>@evoactivity</code></a>)</h4>
<p>Extensively used within the Ember ecosystem, decorators with
<code>declare</code> on class fields will ignore the babel parser error
and allow Prettier to format the code without breaking it.</p>
<!-- raw HTML omitted -->
<pre lang="ts"><code>// Input
export default class ProjectStatusComponent extends
Component<ProjectStatusSig> {
@service declare server: ServerService;
}
<p>// Prettier 3.9.1<br />
// SyntaxError: Decorators can't be used with a declare field. (2:3)<br
/>
// 1 | export default class ProjectStatusComponent extends
Component<ProjectStatusSig> {<br />
//> 2 | <a
href="https://github.com/service"><code>@service</code></a> declare
server: ServerService;<br />
// | ^<br />
// 3 | }</p>
<p>// Prettier 3.9.3<br />
export default class ProjectStatusComponent extends
Component<ProjectStatusSig> {<br />
<a href="https://github.com/service"><code>@service</code></a> declare
server: ServerService;<br />
}<br />
</code></pre></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="3732e1dee6"><code>3732e1d</code></a>
Release 3.9.3</li>
<li><a
href="a74a7b05de"><code>a74a7b0</code></a>
Allow decorators to be used with <code>declare</code> on class fields
(<a
href="https://redirect.github.com/prettier/prettier/issues/19492">#19492</a>)</li>
<li><a
href="bd9e11ab41"><code>bd9e11a</code></a>
Correct text identification in liquid syntax (<a
href="https://redirect.github.com/prettier/prettier/issues/19489">#19489</a>)</li>
<li><a
href="269eee3faa"><code>269eee3</code></a>
Bump Prettier dependency to 3.9.1</li>
<li><a
href="ec7ccd1ea4"><code>ec7ccd1</code></a>
Clean changelog_unreleased</li>
<li>See full diff in <a
href="https://github.com/prettier/prettier/compare/3.9.1...3.9.3">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
The Claude Agent SDK changed the timing of `canUseTool` — it now runs
*before* the assistant message's `tool_use` block streams to us. As a
result we sent a permission request (and `AskUserQuestion` elicitation)
referencing a `toolCallId` the client had not yet seen via a `tool_call`
update, so clients couldn't associate the prompt with a tool call.
This supersedes #815, which fixed the ordering by blocking `canUseTool`
until the stream emitted the `tool_call`. That approach could deadlock
on cancellation (the `await` had no signal/timeout) and woke the waiter
from only one branch, so suppressed tools never resolved it.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bumps the minor group with 11 updates:
| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.191` | `0.3.193` |
| [prettier](https://github.com/prettier/prettier) | `3.8.4` | `3.8.5` |
| @anthropic-ai/claude-agent-sdk-darwin-arm64 | `0.3.191` | `0.3.193` |
| @anthropic-ai/claude-agent-sdk-darwin-x64 | `0.3.191` | `0.3.193` |
| @anthropic-ai/claude-agent-sdk-linux-arm64 | `0.3.191` | `0.3.193` |
| @anthropic-ai/claude-agent-sdk-linux-arm64-musl | `0.3.191` |
`0.3.193` |
| @anthropic-ai/claude-agent-sdk-linux-x64 | `0.3.191` | `0.3.193` |
| @anthropic-ai/claude-agent-sdk-linux-x64-musl | `0.3.191` | `0.3.193`
|
| @anthropic-ai/claude-agent-sdk-win32-arm64 | `0.3.191` | `0.3.193` |
| @anthropic-ai/claude-agent-sdk-win32-x64 | `0.3.191` | `0.3.193` |
| [range-parser](https://github.com/jshttp/range-parser) | `1.2.1` |
`1.3.0` |
Updates `@anthropic-ai/claude-agent-sdk` from 0.3.191 to 0.3.193
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.193</h2>
<h2>What's changed</h2>
<ul>
<li>Added <code>promptSuggestions</code> option to Browser SDK
<code>query()</code> to opt the remote CLI into emitting follow-up
suggestions</li>
<li>Fixed brief console window flashes on Windows when spawning CLI
subprocesses</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.193
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.193
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.193
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.193
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.193</h2>
<ul>
<li>Added <code>promptSuggestions</code> option to Browser SDK
<code>query()</code> to opt the remote CLI into emitting follow-up
suggestions</li>
<li>Fixed brief console window flashes on Windows when spawning CLI
subprocesses</li>
</ul>
<h2>0.3.192</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.192</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="761e2bec6f"><code>761e2be</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.191...v0.3.193">compare
view</a></li>
</ul>
</details>
<br />
Updates `prettier` from 3.8.4 to 3.8.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/releases">prettier's
releases</a>.</em></p>
<blockquote>
<h2>3.8.5</h2>
<ul>
<li>Fix Flow variance annotation print (<a
href="https://redirect.github.com/prettier/prettier/pull/19022">#19022</a>
by <a
href="https://github.com/marcoww6"><code>@marcoww6</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.8.5/CHANGELOG.md#385">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md">prettier's
changelog</a>.</em></p>
<blockquote>
<h1>3.8.5</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.8.4...3.8.5">diff</a></p>
<h4>Flow: Support <code>readonly</code> as a variance annotation (<a
href="https://redirect.github.com/prettier/prettier/pull/19022">#19022</a>
by <a
href="https://github.com/marcoww6"><code>@marcoww6</code></a>)</h4>
<p>Flow now accepts <code>readonly</code> as a property variance
annotation, equivalent to <code>+</code> (covariant/read-only).</p>
<!-- raw HTML omitted -->
<pre lang="jsx"><code>// Input
type T = {
readonly foo: string,
};
<p>// Prettier 3.8.4<br />
SyntaxError</p>
<p>// Prettier 3.8.5<br />
type T = {<br />
readonly foo: string,<br />
};<br />
</code></pre></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1ce8c47015"><code>1ce8c47</code></a>
Release 3.8.5</li>
<li><a
href="74923fa831"><code>74923fa</code></a>
Fix variance annotation</li>
<li><a
href="8b4eb339d4"><code>8b4eb33</code></a>
Bump Prettier dependency to 3.8.4</li>
<li><a
href="e9cbdfa1b7"><code>e9cbdfa</code></a>
Clean changelog_unreleased</li>
<li>See full diff in <a
href="https://github.com/prettier/prettier/compare/3.8.4...3.8.5">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.3.191 to
0.3.193
Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.3.191 to
0.3.193
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.3.191 to
0.3.193
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.3.191
to 0.3.193
Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.3.191 to
0.3.193
Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.3.191 to
0.3.193
Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.3.191 to
0.3.193
Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.3.191 to
0.3.193
Updates `range-parser` from 1.2.1 to 1.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jshttp/range-parser/releases">range-parser's
releases</a>.</em></p>
<blockquote>
<h2>v1.3.0</h2>
<p><strong>Fixed</strong></p>
<ul>
<li>Improve number parsing (<a
href="https://redirect.github.com/jshttp/range-parser/issues/58">#58</a>)
eba9c7a</li>
<li>Handle invalid start and end byte positions in range parsing (<a
href="https://redirect.github.com/jshttp/range-parser/issues/57">#57</a>)
269cb4e</li>
</ul>
<hr />
<p><a
href="https://github.com/jshttp/range-parser/compare/v1.2.1...v1.3.0">https://github.com/jshttp/range-parser/compare/v1.2.1...v1.3.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="f4bf1736f2"><code>f4bf173</code></a>
Clamp a suffix whose length exceeds the representation (<a
href="https://redirect.github.com/jshttp/range-parser/issues/66">#66</a>)</li>
<li><a
href="b49e00f6d3"><code>b49e00f</code></a>
fix: still show ranges if there are multiple ranges, even if some are
invalid...</li>
<li><a
href="4f3b09123c"><code>4f3b091</code></a>
Remove dependabot config (<a
href="https://redirect.github.com/jshttp/range-parser/issues/60">#60</a>)</li>
<li><a
href="eba9c7a9cb"><code>eba9c7a</code></a>
Improve number parsing (<a
href="https://redirect.github.com/jshttp/range-parser/issues/58">#58</a>)</li>
<li><a
href="269cb4eafa"><code>269cb4e</code></a>
fix: handle invalid start and end byte positions in range parsing (<a
href="https://redirect.github.com/jshttp/range-parser/issues/57">#57</a>)</li>
<li><a
href="098e332bfc"><code>098e332</code></a>
build(deps): bump github/codeql-action from 3.31.2 to 4.31.6 (<a
href="https://redirect.github.com/jshttp/range-parser/issues/50">#50</a>)</li>
<li><a
href="3599369124"><code>3599369</code></a>
build(deps): bump actions/checkout from 3.6.0 to 6.0.0 (<a
href="https://redirect.github.com/jshttp/range-parser/issues/51">#51</a>)</li>
<li><a
href="054ea57071"><code>054ea57</code></a>
build(deps): bump github/codeql-action from 2.23.2 to 4.31.2 (<a
href="https://redirect.github.com/jshttp/range-parser/issues/48">#48</a>)</li>
<li><a
href="d230b16695"><code>d230b16</code></a>
build(deps): bump actions/upload-artifact from 3.1.3 to 5.0.0 (<a
href="https://redirect.github.com/jshttp/range-parser/issues/49">#49</a>)</li>
<li><a
href="54f84f423b"><code>54f84f4</code></a>
chore: add funding to package.json (<a
href="https://redirect.github.com/jshttp/range-parser/issues/42">#42</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/jshttp/range-parser/compare/v1.2.1...v1.3.0">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~blakeembrey">blakeembrey</a>, a new
releaser for range-parser since your current version.</p>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
## Summary
`src/tests/settings.test.ts` didn't isolate the **user settings tier**,
so the `availableModels` merge tests failed on any machine whose real
`~/.claude/settings.json` defines `availableModels`.
`SettingsManager.loadAllSettings()` resolves through the SDK's
`resolveSettings({ cwd })`, which reads the user `settings.json` from
`process.env.CLAUDE_CONFIG_DIR` at call time and falls back to the real
`~/.claude` when it's unset. The tests set up only the project/local
tiers under a temp `cwd` and left the user tier pointing at the
developer's real home, so the developer's own settings merged into the
result.
This only surfaced for `availableModels` because that key is **unioned**
across tiers — leaked entries get prepended. `model` and
`permissions.defaultMode` use override semantics (project tier wins), so
they masked the leak. Example failure with `availableModels:
["sonnet","opus","haiku"]` in the user's real settings:
```
- Expected
+ Received
+ "sonnet",
+ "opus",
+ "haiku",
"claude-haiku-4-5",
"claude-opus-4-7[1m]",
"claude-sonnet-4-6[1m]",
```
## Fix
Point `CLAUDE_CONFIG_DIR` at an empty per-test directory in `beforeEach`
(and restore it in `afterEach`) so the user tier contributes nothing.
This mirrors the isolation already used in `acp-agent-settings.test.ts`.
Test-only change; no production code touched.
## Test Plan
- `settings.test.ts` run plainly with a real `~/.claude` containing
`availableModels` → 10 passed (previously 2 failing).
- `settings.test.ts` run with `CLAUDE_CONFIG_DIR` pointed at a directory
holding decoy `availableModels`/`model` → 10 passed, confirming
`beforeEach` overrides any external user tier.
- Full suite with no env wrapper → 355 passed, 0 failed.
- lint + prettier clean.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## What's broken
The Bash branch of `toolUpdateFromToolResult` (`src/tools.ts`) guards
the array-content path on `"text" in result[0]`. When the local Bash
tool produces image content — `[{ type: "image", source: { type:
"base64", ... } }]`, e.g. when a command pipes a base64 data URI — the
guard rejects the array and `output` stays empty. The image is silently
dropped from the ACP `tool_call_update` and the client renders nothing.
## Fix
Distinguish text-only arrays (existing terminal-stream behavior) from
arrays containing non-text blocks. For the latter, bypass the terminal
`_meta` channel (binary payloads can't be streamed through it) and
delegate to `toAcpContentUpdate` so images surface as ACP content
blocks.
The change is contained to the Bash case in `toolUpdateFromToolResult`;
no other tool dispatch is affected.
## Tests
Three regression tests added in `src/tests/tools.test.ts` under a new
`describe("with image array tool_result …")`:
- pure image, `supportsTerminalOutput: false` — image surfaces as ACP
content
- pure image, `supportsTerminalOutput: true` — `_meta` is correctly
bypassed and image still surfaces
- mixed text + image — both blocks surface in order
All existing tests pass. Total: 240 → 243.
## Validation
- `npm run check` ✅
- `npm run build` ✅
- `npm run test:run` ✅ (243 passed, 13 integration skipped)
Co-authored-by: dave <dave@mint.lan>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
I generated this PR using AI. if not helpful, please delete it.
Or, maybe its value is just to show a potential bug.
I found this bug when using Tidewave. I noticed text was being
duplicated when using claude and claude-agent-acp 0.47.0.
I asked the agent to investigate, and this PR seems to fix it.
---
## Summary
- Stop `resetTurnScratch()` from nulling `currentStreamMessageId` on
turn activation, which was causing the assistant's message text to
render **twice** (concatenated) in the feed.
## Problem
When a turn activates mid-message, the agent's message text renders
twice, back-to-back. Only prose duplicates — never tool calls — and
specifically the text/thinking block that streams *after* the
activation. Reproduces on `0.47.0` with a prompt like *"say a sentence,
run a shell command that sleeps 10s, then say a sentence."*
Bumps the minor group with 11 updates:
| Package | From | To |
| --- | --- | --- |
|
[@agentclientprotocol/sdk](https://github.com/agentclientprotocol/typescript-sdk)
| `0.26.0` | `0.27.0` |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.179` | `0.3.181` |
| @anthropic-ai/claude-agent-sdk-darwin-arm64 | `0.3.179` | `0.3.181` |
| @anthropic-ai/claude-agent-sdk-darwin-x64 | `0.3.179` | `0.3.181` |
| @anthropic-ai/claude-agent-sdk-linux-arm64 | `0.3.179` | `0.3.181` |
| @anthropic-ai/claude-agent-sdk-linux-arm64-musl | `0.3.179` |
`0.3.181` |
| @anthropic-ai/claude-agent-sdk-linux-x64 | `0.3.179` | `0.3.181` |
| @anthropic-ai/claude-agent-sdk-linux-x64-musl | `0.3.179` | `0.3.181`
|
| @anthropic-ai/claude-agent-sdk-win32-arm64 | `0.3.179` | `0.3.181` |
| @anthropic-ai/claude-agent-sdk-win32-x64 | `0.3.179` | `0.3.181` |
| [hono](https://github.com/honojs/hono) | `4.12.25` | `4.12.26` |
Updates `@agentclientprotocol/sdk` from 0.26.0 to 0.27.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/agentclientprotocol/typescript-sdk/releases">@agentclientprotocol/sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.27.0</h2>
<h2><a
href="https://github.com/agentclientprotocol/typescript-sdk/compare/v0.26.0...v0.27.0">0.27.0</a>
(2026-06-18)</h2>
<p>This is a big release! We have rewritten the SDK to have a more
ergonomic design for creating new agents and clients. You can read more
in the <a
href="https://github.com/agentclientprotocol/typescript-sdk/blob/main/MIGRATION_0.26_0.27.md">Migration
Guide</a> for how to migrate.</p>
<p>For now, you will still have the old interfaces available to ease the
migration, but they are deprecated and will be removed in a future
release.</p>
<h3>Features</h3>
<ul>
<li>Experimental Streamable HTTP & WebSocket Transport (<a
href="https://redirect.github.com/agentclientprotocol/typescript-sdk/issues/155">#155</a>)
(<a
href="d6a3d88107">d6a3d88</a>)</li>
<li>New SDK design (see MIGRATION_0.26_0.27.md) (<a
href="https://redirect.github.com/agentclientprotocol/typescript-sdk/issues/181">#181</a>)
(<a
href="87e2df33b5">87e2df3</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/agentclientprotocol/typescript-sdk/blob/main/CHANGELOG.md">@agentclientprotocol/sdk's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/agentclientprotocol/typescript-sdk/compare/v0.26.0...v0.27.0">0.27.0</a>
(2026-06-18)</h2>
<p>This is a big release! We have rewritten the SDK to have a more
ergonomic design for creating new agents and clients. You can read more
in the <a
href="https://github.com/agentclientprotocol/typescript-sdk/blob/main/MIGRATION_0.26_0.27.md">Migration
Guide</a> for how to migrate.</p>
<p>For now, you will still have the old interfaces available to ease the
migration, but they are deprecated and will be removed in a future
release.</p>
<h3>Features</h3>
<ul>
<li>Experimental Streamable HTTP & WebSocket Transport (<a
href="https://redirect.github.com/agentclientprotocol/typescript-sdk/issues/155">#155</a>)
(<a
href="d6a3d88107">d6a3d88</a>)</li>
<li>New SDK design (see MIGRATION_0.26_0.27.md) (<a
href="https://redirect.github.com/agentclientprotocol/typescript-sdk/issues/181">#181</a>)
(<a
href="87e2df33b5">87e2df3</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a3437f5f3f"><code>a3437f5</code></a>
chore(main): release 0.27.0 (<a
href="https://redirect.github.com/agentclientprotocol/typescript-sdk/issues/182">#182</a>)</li>
<li><a
href="a3acfa25d7"><code>a3acfa2</code></a>
chore: Cleanup documentation of ctx args and slim down public api (<a
href="https://redirect.github.com/agentclientprotocol/typescript-sdk/issues/184">#184</a>)</li>
<li><a
href="bd1f514d02"><code>bd1f514</code></a>
Update dev deps (<a
href="https://redirect.github.com/agentclientprotocol/typescript-sdk/issues/183">#183</a>)</li>
<li><a
href="87e2df33b5"><code>87e2df3</code></a>
feat: New SDK design (see MIGRATION_0.26_0.27.md) (<a
href="https://redirect.github.com/agentclientprotocol/typescript-sdk/issues/181">#181</a>)</li>
<li><a
href="d6a3d88107"><code>d6a3d88</code></a>
feat: Experimental Streamable HTTP & WebSocket Transport (<a
href="https://redirect.github.com/agentclientprotocol/typescript-sdk/issues/155">#155</a>)</li>
<li>See full diff in <a
href="https://github.com/agentclientprotocol/typescript-sdk/compare/v0.26.0...v0.27.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk` from 0.3.179 to 0.3.181
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.181</h2>
<h2>What's changed</h2>
<ul>
<li>Added <code>errorCode</code>, <code>canUserPurchaseCredits</code>,
and <code>hasChargeableSavedPaymentMethod</code> fields to
<code>SDKRateLimitInfo</code> for detecting credits-required rate
limits</li>
<li>Added <code>tool_use_meta.icon_url</code> to assistant messages,
populated from MCP server directory metadata</li>
<li>Fixed SDK-hosted Remote Control sessions dropping
<code>file_attachments</code> from inbound user messages</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.181
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.181
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.181
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.181
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.181</h2>
<ul>
<li>Added <code>errorCode</code>, <code>canUserPurchaseCredits</code>,
and <code>hasChargeableSavedPaymentMethod</code> fields to
<code>SDKRateLimitInfo</code> for detecting credits-required rate
limits</li>
<li>Added <code>tool_use_meta.icon_url</code> to assistant messages,
populated from MCP server directory metadata</li>
<li>Fixed SDK-hosted Remote Control sessions dropping
<code>file_attachments</code> from inbound user messages</li>
</ul>
<h2>0.3.180</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.180</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4d3840c936"><code>4d3840c</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.179...v0.3.181">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.3.179 to
0.3.181
Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.3.179 to
0.3.181
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.3.179 to
0.3.181
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.3.179
to 0.3.181
Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.3.179 to
0.3.181
Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.3.179 to
0.3.181
Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.3.179 to
0.3.181
Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.3.179 to
0.3.181
Updates `hono` from 4.12.25 to 4.12.26
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.26</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(lambda-edge): satisfy Deno lib types for Content-Length body
encoding by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5013">honojs/hono#5013</a></li>
<li>ci: publish to npm from CI with OIDC trusted publishing by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5028">honojs/hono#5028</a></li>
<li>chore: remove unused devcontainer and gitpod configs by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5029">honojs/hono#5029</a></li>
<li>chore: replace arg and glob with Bun native APIs in build script by
<a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5030">honojs/hono#5030</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.25...v4.12.26">https://github.com/honojs/hono/compare/v4.12.25...v4.12.26</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="27b7992f82"><code>27b7992</code></a>
4.12.26</li>
<li><a
href="d29982cc40"><code>d29982c</code></a>
chore: replace arg and glob with Bun native APIs in build script</li>
<li><a
href="16215d5f50"><code>16215d5</code></a>
chore: remove unused devcontainer and gitpod configs (<a
href="https://redirect.github.com/honojs/hono/issues/5029">#5029</a>)</li>
<li><a
href="c574cf1640"><code>c574cf1</code></a>
ci: publish to npm from CI with OIDC trusted publishing (<a
href="https://redirect.github.com/honojs/hono/issues/5028">#5028</a>)</li>
<li><a
href="e50df01453"><code>e50df01</code></a>
fix(lambda-edge): satisfy Deno lib types for Content-Length body
encoding (<a
href="https://redirect.github.com/honojs/hono/issues/5">#5</a>...</li>
<li>See full diff in <a
href="https://github.com/honojs/hono/compare/v4.12.25...v4.12.26">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for hono since your current version.</p>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Claude has a lot of background tasks. If we wait for "idle", some people
experience turns that never end.
If we stop iterating the query after result, people end up with events
that never show up.
Given we already often have session_updates outside of the prompt (and
clients need to handle it for v2 if they aren't already) this moves the
setup to better handle how the SDK gives us this information.
I've been test-driving this build all day and it seems to be working
great.
Closes#773Closes#679Closes#435Closes#497Closes#688Closes#630
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
When `availableModels` is set to a slim list (e.g.
`["sonnet","opus","haiku"]`), the model from
`ANTHROPIC_CUSTOM_MODEL_OPTION` was dropped from `session/new`'s model
picker. Claude Code's CLI keeps it; ACP hid it.
Per the [model-config
docs](https://code.claude.com/docs/en/model-config#add-a-custom-model-option),
`ANTHROPIC_CUSTOM_MODEL_OPTION` adds a custom entry "without replacing
the built-in aliases" and "appears at the bottom of the `/model` picker"
— i.e. it's additive, not subject to the alias allowlist.
Observed under:
* `availableModels: ["sonnet","opus","haiku"]`
* `ANTHROPIC_DEFAULT_OPUS_MODEL=claude-opus-4-6[1m]`
* `ANTHROPIC_CUSTOM_MODEL_OPTION=claude-opus-4-8[1m]`
| | Default | Sonnet | Opus | Haiku | Opus 4.8 |
|---|---|---|---|---|---|
| CLI picker | ✅ | ✅ | ✅ | ✅ | ✅ (bottom) |
| ACP (before) | ✅ | ✅ | ✅ | ✅ | ❌ |
| ACP (after) | ✅ | ✅ | ✅ | ✅ | ✅ (bottom) |
### Root cause
The SDK returns the custom option as an ordinary entry in
`initializationResult.models` with no flag distinguishing it
(`ModelInfo` has no `custom`/`isCustom` field).
`applyAvailableModelsAllowlist` treats `availableModels` as a strict
allowlist: keep `default`, then keep only SDK models matching an
allowlist entry. The custom value (`claude-opus-4-8[1m]`) matches no
alias, so it's filtered out — diverging from the CLI's additive
treatment.
### Fix
After the allowlist loop, append the model named by
`ANTHROPIC_CUSTOM_MODEL_OPTION` if the SDK surfaced it and it isn't
already present. It's placed last, matching the documented "bottom of
the picker" position, and exempted from the allowlist the same way we
already exempt `default` (the docs note the Default option is likewise
"not affected by `availableModels`").
The entry is preserved in the `ModelInfo[]` (`allowedModels` / session
`modelInfos`), not just the trimmed picker list, so its capability flags
(`supportedEffortLevels`, `supportsAutoMode`) flow to mode gating and
the effort dropdown when the custom model is selected.
Only the allowlist path needs this — when `availableModels` is absent,
ACP uses the full SDK list, which already contains the custom option.
## Test Plan
`src/tests/acp-agent-settings.test.ts` (TDD):
- Custom option preserved at the end of the list when absent from a slim
allowlist, with its name/description intact.
- No duplication when the custom option's exact ID is *also* in
`availableModels`.
No behavior change when `ANTHROPIC_CUSTOM_MODEL_OPTION` is unset or when
`availableModels` is absent.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Bumps the minor group with 3 updates:
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript),
[@napi-rs/wasm-runtime](https://github.com/napi-rs/napi-rs/tree/HEAD/wasm-runtime)
and [semver](https://github.com/npm/node-semver).
Updates `@anthropic-ai/sdk` from 0.103.0 to 0.104.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/releases">@anthropic-ai/sdk's
releases</a>.</em></p>
<blockquote>
<h2>sdk: v0.104.1</h2>
<h2>0.104.1 (2026-06-09)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.104.0...sdk-v0.104.1">sdk-v0.104.0...sdk-v0.104.1</a></p>
<h3>Bug Fixes</h3>
<ul>
<li><strong>api:</strong> add <code>frontier_llm</code> refusal category
(<a
href="465e6866d6">465e686</a>)</li>
</ul>
<h2>sdk: v0.104.0</h2>
<h2>0.104.0 (2026-06-09)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.103.0...sdk-v0.104.0">sdk-v0.103.0...sdk-v0.104.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for Managed Agents deployments and
environment variable credentials (<a
href="d01e38b5b6">d01e38b</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.104.1 (2026-06-09)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.104.0...sdk-v0.104.1">sdk-v0.104.0...sdk-v0.104.1</a></p>
<h3>Bug Fixes</h3>
<ul>
<li><strong>api:</strong> add <code>frontier_llm</code> refusal category
(<a
href="465e6866d6">465e686</a>)</li>
</ul>
<h2>0.104.0 (2026-06-09)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.103.0...sdk-v0.104.0">sdk-v0.103.0...sdk-v0.104.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for Managed Agents deployments and
environment variable credentials (<a
href="d01e38b5b6">d01e38b</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9a0442d88e"><code>9a0442d</code></a>
chore: release main</li>
<li><a
href="1ccd4012e7"><code>1ccd401</code></a>
fix(api): add <code>frontier_llm</code> refusal category</li>
<li><a
href="8be0232e92"><code>8be0232</code></a>
chore: release main</li>
<li><a
href="813af32183"><code>813af32</code></a>
feat(api): add support for Managed Agents deployments and environment
variabl...</li>
<li>See full diff in <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.103.0...sdk-v0.104.1">compare
view</a></li>
</ul>
</details>
<br />
Updates `@napi-rs/wasm-runtime` from 1.1.4 to 1.1.5
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/napi-rs/napi-rs/blob/main/wasm-runtime/CHANGELOG.md">@napi-rs/wasm-runtime's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/napi-rs/napi-rs/compare/@napi-rs/wasm-runtime@1.1.4...@napi-rs/wasm-runtime@1.1.5">1.1.5</a>
(2026-06-10)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>wasm-runtime:</strong> preserve Buffer return values in
fs-proxy (<a
href="https://redirect.github.com/napi-rs/napi-rs/issues/3250">#3250</a>)
(<a
href="c70f205a07">c70f205</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="670e5d3195"><code>670e5d3</code></a>
chore(release): publish</li>
<li><a
href="ad7b1c8fbf"><code>ad7b1c8</code></a>
chore(deps): lock file maintenance (<a
href="https://github.com/napi-rs/napi-rs/tree/HEAD/wasm-runtime/issues/3318">#3318</a>)</li>
<li><a
href="c70f205a07"><code>c70f205</code></a>
fix(wasm-runtime): preserve Buffer return values in fs-proxy (<a
href="https://github.com/napi-rs/napi-rs/tree/HEAD/wasm-runtime/issues/3250">#3250</a>)</li>
<li>See full diff in <a
href="https://github.com/napi-rs/napi-rs/commits/@napi-rs/wasm-runtime@1.1.5/wasm-runtime">compare
view</a></li>
</ul>
</details>
<br />
Updates `semver` from 7.8.3 to 7.8.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/npm/node-semver/releases">semver's
releases</a>.</em></p>
<blockquote>
<h2>v7.8.4</h2>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.8.3...v7.8.4">7.8.4</a>
(2026-06-09)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="e583226b16"><code>e583226</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/874">#874</a>
reject numeric segments after x-ranges (<a
href="https://github.com/pupuking723"><code>@pupuking723</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/npm/node-semver/blob/main/CHANGELOG.md">semver's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.8.3...v7.8.4">7.8.4</a>
(2026-06-09)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="e583226b16"><code>e583226</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/874">#874</a>
reject numeric segments after x-ranges (<a
href="https://github.com/pupuking723"><code>@pupuking723</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="8640bd68f1"><code>8640bd6</code></a>
chore: release 7.8.4 (<a
href="https://redirect.github.com/npm/node-semver/issues/875">#875</a>)</li>
<li><a
href="e583226b16"><code>e583226</code></a>
fix: reject numeric segments after x-ranges</li>
<li>See full diff in <a
href="https://github.com/npm/node-semver/compare/v7.8.3...v7.8.4">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
- Bump `@anthropic-ai/claude-agent-sdk` from 0.3.169 to **0.3.170**
- Bump `@anthropic-ai/sdk` from 0.102.0 to **0.103.0**
- Handle two new SDK types: `model_refusal_fallback` (system message)
and `fallback` (content block)
## Test plan
- [x] Build passes
- [x] All 355 tests pass (15 skipped)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bumps the minor group with 12 updates:
| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.165` | `0.3.168` |
|
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript)
| `0.100.1` | `0.102.0` |
|
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
| `25.9.1` | `25.9.2` |
| @anthropic-ai/claude-agent-sdk-darwin-arm64 | `0.3.165` | `0.3.168` |
| @anthropic-ai/claude-agent-sdk-darwin-x64 | `0.3.165` | `0.3.168` |
| @anthropic-ai/claude-agent-sdk-linux-arm64 | `0.3.165` | `0.3.168` |
| @anthropic-ai/claude-agent-sdk-linux-arm64-musl | `0.3.165` |
`0.3.168` |
| @anthropic-ai/claude-agent-sdk-linux-x64 | `0.3.165` | `0.3.168` |
| @anthropic-ai/claude-agent-sdk-linux-x64-musl | `0.3.165` | `0.3.168`
|
| @anthropic-ai/claude-agent-sdk-win32-arm64 | `0.3.165` | `0.3.168` |
| @anthropic-ai/claude-agent-sdk-win32-x64 | `0.3.165` | `0.3.168` |
| [hono](https://github.com/honojs/hono) | `4.12.23` | `4.12.24` |
Updates `@anthropic-ai/claude-agent-sdk` from 0.3.165 to 0.3.168
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.168</h2>
<h2>What's changed</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.168</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.168
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.168
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.168
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.168
</code></pre>
<h2>v0.3.167</h2>
<h2>What's changed</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.167</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.167
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.167
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.167
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.167
</code></pre>
<h2>v0.3.166</h2>
<h2>What's changed</h2>
<ul>
<li>Fixed MCP resource tools not being injected for servers added at
runtime via the <code>mcp_set_servers</code> control request</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.166
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.166
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.166
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.166
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.168</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.168</li>
</ul>
<h2>0.3.167</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.167</li>
</ul>
<h2>0.3.166</h2>
<ul>
<li>Fixed MCP resource tools not being injected for servers added at
runtime via the <code>mcp_set_servers</code> control request</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="2c2eeb8ce4"><code>2c2eeb8</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="3e35050adc"><code>3e35050</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="bc853fcd68"><code>bc853fc</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.165...v0.3.168">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/sdk` from 0.100.1 to 0.102.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/releases">@anthropic-ai/sdk's
releases</a>.</em></p>
<blockquote>
<h2>sdk: v0.102.0</h2>
<h2>0.102.0 (2026-06-06)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.101.0...sdk-v0.102.0">sdk-v0.101.0...sdk-v0.102.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> small updates to Managed Agents types (<a
href="8ba4f92df3">8ba4f92</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>client:</strong> run middleware before request signing (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/45">#45</a>)
(<a
href="95f1a4a406">95f1a4a</a>)</li>
</ul>
<h2>sdk: v0.101.0</h2>
<h2>0.101.0 (2026-06-05)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.100.1...sdk-v0.101.0">sdk-v0.100.1...sdk-v0.101.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>client:</strong> add support for middleware (<a
href="9b01120796">9b01120</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>apply request timeout to inner fetch only, not middleware chain (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/40">#40</a>)
(<a
href="25c13f6183">25c13f6</a>)</li>
<li><strong>streaming:</strong> carry stop_details through beta
message_delta accumulation (<a
href="ed3fec7ace">ed3fec7</a>)</li>
<li><strong>streaming:</strong> correctly parse json numbers with
scientific notation (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/9">#9</a>)
(<a
href="7d5e6422dc">7d5e642</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>internal:</strong> fix artifact url (<a
href="925ec276fa">925ec27</a>)</li>
<li><strong>internal:</strong> fix branch names (<a
href="fa3cf2c491">fa3cf2c</a>)</li>
<li><strong>internal:</strong> update private repo name (<a
href="a8ac213b8c">a8ac213</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>point security reports to Anthropic's HackerOne program (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/16">#16</a>)
(<a
href="5c7912c36e">5c7912c</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.102.0 (2026-06-06)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.101.0...sdk-v0.102.0">sdk-v0.101.0...sdk-v0.102.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> small updates to Managed Agents types (<a
href="8ba4f92df3">8ba4f92</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>client:</strong> run middleware before request signing (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/45">#45</a>)
(<a
href="95f1a4a406">95f1a4a</a>)</li>
</ul>
<h2>0.101.0 (2026-06-05)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.100.1...sdk-v0.101.0">sdk-v0.100.1...sdk-v0.101.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>client:</strong> add support for middleware (<a
href="9b01120796">9b01120</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>apply request timeout to inner fetch only, not middleware chain (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/40">#40</a>)
(<a
href="25c13f6183">25c13f6</a>)</li>
<li><strong>streaming:</strong> carry stop_details through beta
message_delta accumulation (<a
href="ed3fec7ace">ed3fec7</a>)</li>
<li><strong>streaming:</strong> correctly parse json numbers with
scientific notation (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/9">#9</a>)
(<a
href="7d5e6422dc">7d5e642</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>internal:</strong> fix artifact url (<a
href="925ec276fa">925ec27</a>)</li>
<li><strong>internal:</strong> fix branch names (<a
href="fa3cf2c491">fa3cf2c</a>)</li>
<li><strong>internal:</strong> update private repo name (<a
href="a8ac213b8c">a8ac213</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>point security reports to Anthropic's HackerOne program (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/16">#16</a>)
(<a
href="5c7912c36e">5c7912c</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="f7dfb972f6"><code>f7dfb97</code></a>
chore: release main</li>
<li><a
href="a3f3c97258"><code>a3f3c97</code></a>
feat(api): small updates to Managed Agents types</li>
<li><a
href="a5c98d117a"><code>a5c98d1</code></a>
fix(client): run middleware before request signing (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/45">#45</a>)</li>
<li><a
href="185ec061cf"><code>185ec06</code></a>
chore: release main</li>
<li><a
href="fab891069a"><code>fab8910</code></a>
codegen metadata</li>
<li><a
href="7ff4036756"><code>7ff4036</code></a>
fix: apply request timeout to inner fetch only, not middleware chain (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/40">#40</a>)</li>
<li><a
href="257bc1f56b"><code>257bc1f</code></a>
feat(client): add support for middleware</li>
<li><a
href="5b3ace5ec5"><code>5b3ace5</code></a>
chore(internal): fix artifact url</li>
<li><a
href="70966be8fc"><code>70966be</code></a>
fix(streaming): correctly parse json numbers with scientific notation
(<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/9">#9</a>)</li>
<li><a
href="7e22f20552"><code>7e22f20</code></a>
docs: point security reports to Anthropic's HackerOne program (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/16">#16</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.100.1...sdk-v0.102.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `@types/node` from 25.9.1 to 25.9.2
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.3.165 to
0.3.168
Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.3.165 to
0.3.168
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.3.165 to
0.3.168
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.3.165
to 0.3.168
Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.3.165 to
0.3.168
Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.3.165 to
0.3.168
Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.3.165 to
0.3.168
Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.3.165 to
0.3.168
Updates `hono` from 4.12.23 to 4.12.24
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.24</h2>
<h2>What's Changed</h2>
<ul>
<li>docs(contribution): simplifyAI Usage Policy by <a
href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4972">honojs/hono#4972</a></li>
<li>chore: remove <code>@types/glob</code> by <a
href="https://github.com/rtritto"><code>@rtritto</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4978">honojs/hono#4978</a></li>
<li>fix(bearer-auth): mention verifyToken in missing-options error
message by <a
href="https://github.com/tan7vir"><code>@tan7vir</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4987">honojs/hono#4987</a></li>
<li>refactor(language): Test/improve tests on languages middleware by <a
href="https://github.com/iNeoO"><code>@iNeoO</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4980">honojs/hono#4980</a></li>
<li>fix(utils/ipaddr): expand "::" to eight zero groups by <a
href="https://github.com/youcefzemmar"><code>@youcefzemmar</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4973">honojs/hono#4973</a></li>
<li>fix: clean up config files trailing comma, stale excludes,
typesVersions gaps, jsr paths by <a
href="https://github.com/Mohammad-Faiz-Cloud-Engineer"><code>@Mohammad-Faiz-Cloud-Engineer</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4982">honojs/hono#4982</a></li>
<li>refactor(timing): Test/add test for middleware timing by <a
href="https://github.com/iNeoO"><code>@iNeoO</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4991">honojs/hono#4991</a></li>
<li>fix(utils/ipaddr): render the unspecified address binary as
"::" by <a
href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4998">honojs/hono#4998</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.24">https://github.com/honojs/hono/compare/v4.12.23...v4.12.24</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="5fdde5ab5a"><code>5fdde5a</code></a>
4.12.24</li>
<li><a
href="c78932d745"><code>c78932d</code></a>
fix(utils/ipaddr): render the unspecified address binary as
"::" (<a
href="https://redirect.github.com/honojs/hono/issues/4998">#4998</a>)</li>
<li><a
href="5ef800ee45"><code>5ef800e</code></a>
refactor(timing): Test/add test for middleware timing (<a
href="https://redirect.github.com/honojs/hono/issues/4991">#4991</a>)</li>
<li><a
href="d743bb7dc0"><code>d743bb7</code></a>
fix: clean up config files trailing comma, stale excludes, typesVersions
gaps...</li>
<li><a
href="d22ff9c6fe"><code>d22ff9c</code></a>
fix(utils/ipaddr): expand "::" to eight zero groups (<a
href="https://redirect.github.com/honojs/hono/issues/4973">#4973</a>)</li>
<li><a
href="8e2cccc2fb"><code>8e2cccc</code></a>
refactor(language): Test/improve tests on languages middleware (<a
href="https://redirect.github.com/honojs/hono/issues/4980">#4980</a>)</li>
<li><a
href="413d3cbd0e"><code>413d3cb</code></a>
fix(bearer-auth): mention verifyToken in missing-options error message
(<a
href="https://redirect.github.com/honojs/hono/issues/4987">#4987</a>)</li>
<li><a
href="2cbeadda34"><code>2cbeadd</code></a>
chore: remove <code>@types/glob</code> (<a
href="https://redirect.github.com/honojs/hono/issues/4978">#4978</a>)</li>
<li><a
href="9051d3e80a"><code>9051d3e</code></a>
docs(contribution): simplifyAI Usage Policy (<a
href="https://redirect.github.com/honojs/hono/issues/4972">#4972</a>)</li>
<li>See full diff in <a
href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.24">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Bumps the minor group with 1 update:
[obug](https://github.com/sxzz/obug).
Updates `obug` from 2.1.1 to 2.1.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sxzz/obug/releases">obug's
releases</a>.</em></p>
<blockquote>
<h2>v2.1.2</h2>
<p><em>No significant changes</em></p>
<h5> <a
href="https://github.com/sxzz/obug/compare/v2.1.1...v2.1.2">View changes
on GitHub</a></h5>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1f9500da5b"><code>1f9500d</code></a>
chore: release v2.1.2</li>
<li><a
href="6dcc07cd49"><code>6dcc07c</code></a>
chore: upgrade deps</li>
<li><a
href="9bcc620b15"><code>9bcc620</code></a>
ci: staging publish</li>
<li><a
href="c9688880be"><code>c968888</code></a>
chore: migrate tsdown config</li>
<li><a
href="2d652378be"><code>2d65237</code></a>
chore: add "engines" field to <code>package.json</code> (<a
href="https://redirect.github.com/sxzz/obug/issues/3">#3</a>)</li>
<li><a
href="a1191fd954"><code>a1191fd</code></a>
test: add file extensions to imports</li>
<li><a
href="b8239e5b9e"><code>b8239e5</code></a>
docs: add 'How to use' section to README [ci skip] (<a
href="https://redirect.github.com/sxzz/obug/issues/2">#2</a>)</li>
<li><a
href="55fe075260"><code>55fe075</code></a>
test: ignore dynamic import warning</li>
<li><a
href="a71beb8092"><code>a71beb8</code></a>
chore: update workflow references to main branch</li>
<li><a
href="e39bee9fcf"><code>e39bee9</code></a>
chore: upgrade deps</li>
<li>Additional commits viewable in <a
href="https://github.com/sxzz/obug/compare/v2.1.1...v2.1.2">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
Partially addresses #639. Builds on #702 which added version-aware
matching.
When the SDK's `opus` alias resolves to a newer version than what's in
`availableModels` (e.g. the SDK was bumped to Opus 4.8 but
`availableModels` still contains `claude-opus-4-6[1m]`), the version
check from #702 correctly rejects the `opus` entry (4.8 ≠ 4.6). However,
the tokenized matcher then falls through to `sonnet[1m]` because the
`1m` context hint token alone scores 3 points — enough to win. This
causes `claude-opus-4-6[1m]` to display as "Sonnet (1M context)".
Fix: `scoreModelMatch` now returns 0 when the only matching token is the
context hint. This prevents cross-family matches without hardcoding
model family names.
Note: Claude initially recommended hardcoding model families to be 100%
sure we avoid cross-family matching. While it would be a stronger
signal, I didn't find references to model families in the codebase
(except for opusplan --> opus) so I'm assuming the family list is
transparent to claude-agent-acp.
## Test plan
- [x] Added test: `does not inherit display info across mismatched model
families` — verifies `claude-opus-4-6[1m]` does not resolve to `Sonnet
(1M context)`
- [x] Existing tests pass (20/20 in `acp-agent-settings.test.ts`)
- [x] New test confirmed to fail on unmodified `main` and pass with the
fix
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bumps the minor group with 9 updates:
| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.160` | `0.3.162` |
| @anthropic-ai/claude-agent-sdk-darwin-arm64 | `0.3.160` | `0.3.162` |
| @anthropic-ai/claude-agent-sdk-darwin-x64 | `0.3.160` | `0.3.162` |
| @anthropic-ai/claude-agent-sdk-linux-arm64 | `0.3.160` | `0.3.162` |
| @anthropic-ai/claude-agent-sdk-linux-arm64-musl | `0.3.160` |
`0.3.162` |
| @anthropic-ai/claude-agent-sdk-linux-x64 | `0.3.160` | `0.3.162` |
| @anthropic-ai/claude-agent-sdk-linux-x64-musl | `0.3.160` | `0.3.162`
|
| @anthropic-ai/claude-agent-sdk-win32-arm64 | `0.3.160` | `0.3.162` |
| @anthropic-ai/claude-agent-sdk-win32-x64 | `0.3.160` | `0.3.162` |
Updates `@anthropic-ai/claude-agent-sdk` from 0.3.160 to 0.3.162
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.162</h2>
<h2>What's changed</h2>
<ul>
<li>Refusal error messages now carry <code>stop_reason:
"refusal"</code> and <code>stop_details</code> on the
assistant message and in session transcripts, so SDK consumers can
detect refusals without text-matching the error content</li>
<li>Agent SDK sessions on native builds now default to fast embedded
<code>find</code>/<code>grep</code> search in Bash, matching the
interactive CLI, instead of always registering the dedicated Grep/Glob
tools. To keep the dedicated tools (e.g. to intercept searches via
<code>canUseTool</code> or hooks), name them in the <code>tools</code>
option or reference them in <code>allowedTools</code></li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.162
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.162
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.162
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.162
</code></pre>
<h2>v0.3.161</h2>
<h2>What's changed</h2>
<ul>
<li>The <code>initialize</code> control request is now idempotent: a
second <code>initialize</code> returns the same success payload instead
of an <code>Already initialized</code> error.
<code>ControlResponse</code> gains an optional
<code>pending_permission_requests</code> field, mirroring
<code>ControlErrorResponse</code></li>
<li><code>applyFlagSettings</code> now live-applies <code>agent</code>
changes: switching the active agent (or passing <code>null</code> to
reset) takes effect on the next turn in a running session</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.161
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.161
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.161
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.161
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.162</h2>
<ul>
<li>Refusal error messages now carry <code>stop_reason:
"refusal"</code> and <code>stop_details</code> on the
assistant message and in session transcripts, so SDK consumers can
detect refusals without text-matching the error content</li>
<li>Agent SDK sessions on native builds now default to fast embedded
<code>find</code>/<code>grep</code> search in Bash, matching the
interactive CLI, instead of always registering the dedicated Grep/Glob
tools. To keep the dedicated tools (e.g. to intercept searches via
<code>canUseTool</code> or hooks), name them in the <code>tools</code>
option or reference them in <code>allowedTools</code></li>
</ul>
<h2>0.3.161</h2>
<ul>
<li>The <code>initialize</code> control request is now idempotent: a
second <code>initialize</code> returns the same success payload instead
of an <code>Already initialized</code> error.
<code>ControlResponse</code> gains an optional
<code>pending_permission_requests</code> field, mirroring
<code>ControlErrorResponse</code></li>
<li><code>applyFlagSettings</code> now live-applies <code>agent</code>
changes: switching the active agent (or passing <code>null</code> to
reset) takes effect on the next turn in a running session</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e9f26a0e02"><code>e9f26a0</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="2f67c51150"><code>2f67c51</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.160...v0.3.162">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.3.160 to
0.3.162
Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.3.160 to
0.3.162
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.3.160 to
0.3.162
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.3.160
to 0.3.162
Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.3.160 to
0.3.162
Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.3.160 to
0.3.162
Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.3.160 to
0.3.162
Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.3.160 to
0.3.162
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Bumps the minor group with 2 updates:
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript)
and [tinyexec](https://github.com/tinylibs/tinyexec).
Updates `@anthropic-ai/sdk` from 0.100.0 to 0.100.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/releases">@anthropic-ai/sdk's
releases</a>.</em></p>
<blockquote>
<h2>sdk: v0.100.1</h2>
<h2>0.100.1 (2026-05-29)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.100.0...sdk-v0.100.1">sdk-v0.100.0...sdk-v0.100.1</a></p>
<h3>Bug Fixes</h3>
<ul>
<li><strong>streaming:</strong> carry encrypted_content on beta
compaction blocks (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1025">#1025</a>)
(<a
href="eccddf3ed2">eccddf3</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>client:</strong> update lockfiles to have proper
dependencies on standardwebhooks (<a
href="5e9b5237e5">5e9b523</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.100.1 (2026-05-29)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.100.0...sdk-v0.100.1">sdk-v0.100.0...sdk-v0.100.1</a></p>
<h3>Bug Fixes</h3>
<ul>
<li><strong>streaming:</strong> carry encrypted_content on beta
compaction blocks (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1025">#1025</a>)
(<a
href="eccddf3ed2">eccddf3</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>client:</strong> update lockfiles to have proper
dependencies on standardwebhooks (<a
href="5e9b5237e5">5e9b523</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="512605fa9b"><code>512605f</code></a>
chore: release main</li>
<li><a
href="d0148df188"><code>d0148df</code></a>
codegen metadata</li>
<li><a
href="4d836b47ef"><code>4d836b4</code></a>
codegen metadata</li>
<li><a
href="323e350620"><code>323e350</code></a>
codegen metadata</li>
<li><a
href="ea36df73ef"><code>ea36df7</code></a>
chore(client): update lockfiles to have proper dependencies on
standardwebhooks</li>
<li><a
href="0ea1922fad"><code>0ea1922</code></a>
codegen metadata</li>
<li><a
href="991d88f14b"><code>991d88f</code></a>
fix(streaming): carry encrypted_content on beta compaction blocks (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1025">#1025</a>)</li>
<li>See full diff in <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.100.0...sdk-v0.100.1">compare
view</a></li>
</ul>
</details>
<br />
Updates `tinyexec` from 1.2.2 to 1.2.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tinylibs/tinyexec/releases">tinyexec's
releases</a>.</em></p>
<blockquote>
<h2>1.2.3</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps-dev): bump the development-dependencies group with 4
updates by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/135">tinylibs/tinyexec#135</a></li>
<li>fix: destroy piped streams on child exit to prevent grandchild
deadlock by <a
href="https://github.com/Mearman"><code>@Mearman</code></a> in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/137">tinylibs/tinyexec#137</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Mearman"><code>@Mearman</code></a> made
their first contribution in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/137">tinylibs/tinyexec#137</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tinylibs/tinyexec/compare/1.2.2...1.2.3">https://github.com/tinylibs/tinyexec/compare/1.2.2...1.2.3</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="20e4117b26"><code>20e4117</code></a>
fix: destroy piped streams on child exit to prevent grandchild deadlock
(<a
href="https://redirect.github.com/tinylibs/tinyexec/issues/137">#137</a>)</li>
<li><a
href="51e4f279b6"><code>51e4f27</code></a>
chore(deps-dev): bump the development-dependencies group with 4 updates
(<a
href="https://redirect.github.com/tinylibs/tinyexec/issues/135">#135</a>)</li>
<li>See full diff in <a
href="https://github.com/tinylibs/tinyexec/compare/1.2.2...1.2.3">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
- Updates `@anthropic-ai/claude-agent-sdk` from `0.3.154` to `0.3.156`.
- Refreshes the npm lockfile entries for the SDK and its optional
platform packages.
## Why this is important
This upgrade pulls in the Claude Code `v2.1.156` fix for Opus 4.8 where
thinking blocks could be modified, leading to API errors. That makes the
dependency update important for keeping Opus 4.8 sessions stable and
avoiding request failures caused by malformed thinking block handling.
Release note:
https://github.com/anthropics/claude-code/releases/tag/v2.1.156
## Verification
- `npm run check`
- `npm run build`
- `npm run test:run`
AI disclaimer: I noticed `ping` events spamming the agent-shell Notices
buffer and used Claude to confirm the mechanism, locate the missing
case, and draft the fix and test. I reviewed the diff, ran the full lint
/ type-check / test gauntlet locally, and vouch for the change.
## Summary
`streamEventToAcpNotifications` exhaustively switches on `event.type`
against the SDK's `BetaRawMessageStreamEvent` union and falls through to
`unreachable` for anything else. The Anthropic Messages streaming API
also emits `ping` keep-alive events
([docs](https://docs.anthropic.com/en/api/messages-streaming#ping-events))
which aren't listed in that union but do reach this function at runtime.
Since #173 made `unreachable` log rather than throw, every ping now
writes `Unexpected case: {"type":"ping"}` to stderr.
## Symptom
In ACP clients that surface agent stderr, each `ping` lands as a
"Notice" entry next to the agent's normal output. With long-running
turns this produces multiple stderr lines per minute of generation.
Example from an agent-shell debug capture:
```
▶ Notices
Unexpected case: {"type":"ping"}
Unexpected case: {"type":"ping"}
```
## Fix
Add `case "ping" as never:` to the existing no-content branch in
`streamEventToAcpNotifications`. The `as never` cast is required because
`BetaRawMessageStreamEvent` is closed at the type level even though the
wire format emits `ping`. Comment placed above the no-content group so
ESLint's `no-fallthrough` rule doesn't see it as breaking case
adjacency.
## Test plan
- [x] `npx tsc --noEmit` — clean
- [x] `npm run lint` — clean
- [x] `npm run format:check` — clean
- [x] `npm run test:run` — 290 passed / 13 skipped (integration-gated)
- [x] New unit test in `src/tests/acp-agent.test.ts` covers
`streamEventToAcpNotifications` directly: feeds a synthetic `ping`
stream_event and asserts both `[]` return and that the logger's `error`
channel is never touched.
Co-authored-by: Tim Visher <194828183+timvisher-dd@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add a "Default" selection to the effort level config option, allowing
users to let the SDK decide the effort level instead of forcing a
specific level. When "default" is selected, applyFlagSettings is called
with effortLevel: undefined, clearing any previous override.
Replaces the previous fallback logic (xhigh -> high ->
supportedLevels[0]) with a simpler "default" fallback that lets the SDK
use its own default.
Please,agree it. The third-party model may not support the 'Effort', or
not support 'high' and 'xhigh'. We need it.
---------
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
When a prompt errors mid-turn (e.g. a 400/529 from the API), the SDK
leaves a trailing session_state_changed: idle in the query iterator.
The next prompt's first query.next() consumed that stale idle and
short-circuited to end_turn with zero usage, shifting every subsequent
response one slot late until the session was restarted.
In the catch block, call query.interrupt() and drain the iterator
until the trailing idle is consumed (bounded so a misbehaving SDK
can't hang the next prompt). In the finally block, on the error path,
resolve all queued pending prompts as cancelled — the previous code
only resolved one (with handoff semantics), leaking the rest forever.
Closes#654
Supersedes #659, #660, #691
### Summary
Fix session_state_changed: idle handler to check session.cancelled,
ensuring the prompt response returns stopReason:
"cancelled" instead of "end_turn" when the session was interrupted.
### Problem
When a client sends session/cancel, the cancel() method sets
session.cancelled = true and calls query.interrupt(). The
SDK then transitions to idle state and emits a session_state_changed
event with state: "idle". However, the handler
for this event returns the prompt response immediately without checking
session.cancelled:
```
case "session_state_changed": {
if (message.state === "idle") {
return { stopReason, usage: sessionUsage(session) }; // stopReason defaults to "end_turn"
}
break;
}
```
Since stopReason is initialized as "end_turn" and may not have been
updated to "cancelled" by a preceding result
message (the result handler at line 601 does check session.cancelled),
the prompt response can incorrectly report
stopReason: "end_turn" when the turn was actually cancelled.
This causes clients (e.g. JetBrains AI Assistant) to treat the turn as
completed normally rather than cancelled,
leaving the frontend UI stuck in a "running" state.
### Fix
Check session.cancelled in the session_state_changed: idle handler,
mirroring the checks already present in the done
handler (line 464) and the result handler (line 601):
```
case "session_state_changed": {
if (message.state === "idle") {
if (session.cancelled) {
stopReason = "cancelled";
}
return { stopReason, usage: sessionUsage(session) };
}
break;
}
```
Per the ACP spec, upon receiving session/cancel the agent must respond
to the original session/prompt request with
StopReason::Cancelled. This fix ensures that obligation is met
regardless of which message type triggers the prompt
response.
### Test plan
- Start a session, send a prompt, then immediately cancel — verify the
prompt response returns stopReason: "cancelled"
and the client UI transitions out of "running" state
- Start a session, send a prompt, let it complete normally — verify
stopReason remains "end_turn" (no false
cancellation)
- Existing test suite passes (npm run test:run)
Closes#657
This probably isn't the desired fix, but as /clear creates a new
session, it breaks a lot of guarantees on ACP's usage of session ids we
want to uphold. Given you can do session/new to get the same effect, it
seems safer.
## Summary
Follow-up cleanup to #649. Two small changes:
- **Tighten the comment block** above the marker-strip branch in
`acp-agent.ts:1119`. The original 15-line block restated history that
already lives in the PR description; replaced with a 5-line "what this
does, and why the no-op case is preserved" comment that points at the
replay path for parallel context.
- **Forward `clientCapabilities`, `parentToolUseId`, `cwd`, and
`taskState`** to `toAcpNotifications` so the new strip-and-render call
matches the sibling call below it at `acp-agent.ts:1192`. Without these
the rendered output loses threading under a wrapping tool use and skips
terminal-output detection.
- **Only log the raw payload when nothing renders** — previously every
marker-containing message was logged AND rendered. Now we render the
stripped prose if anything remains, and fall back to logging only the
pure-marker case (e.g. `/compact`).
## Test plan
- [x] `npm run check` (lint + format) — passes
- [x] `npm run build` (tsc) — passes
- [x] `stripLocalCommandMetadata` unit tests — 8 passed
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
AI disclaimer: I identified this bug after noticing that custom skills
produced no output within the Zed Thread/Claude Agent UI. I used Claude
to investigate the issue and develop the fix. I have manually verified
the equivalent fix against an installed
`@zed-industries/claude-code-acp@0.16.1` (the deprecated package Zed
currently ships): custom slash commands that previously produced empty
threads now render the model's response correctly after Zed restart.
## Summary
The live `case "user" / "assistant"` handler in `src/acp-agent.ts` drops
every SDK message whose string content contains
`<local-command-stdout>`. The branch was added to tolerate `/compact`'s
malformed output, but its side-effect is silencing every successful
slash command invocation — custom user-defined skills (whose expanded
bodies arrive wrapped in `<command-*>` + `<local-command-stdout>`
markers) and built-in commands that emit textual output through these
tags.
## Symptom in ACP clients
User types `/some-command` (custom skill, or one of the affected
built-ins). Thread renders the user's `/some-command` bubble at the top,
then nothing — no expanded skill body, no model response. Under the hood
the model has actually received the expansion and produced a turn, but
the user message carrying the expansion never reaches the UI, and the
cascade of subsequent assistant content gets visually decoupled.
In CLI Claude Code the same expansion is printed to the terminal, so the
asymmetry is purely client-side.
## Fix
This repo already ships `stripLocalCommandMetadata` (and its underlying
`stripMarkerTags` helper) — they return `null` for marker-only payloads
and the stripped prose otherwise. They are already wired into session
replay/load (`acp-agent.ts:1385`) but not into the live handler.
The change wires the same helper into the live handler: strip the
markers and route what remains through the existing `toAcpNotifications`
path, preserving the message's role. Pure-marker payloads (e.g.
`/compact`'s) still no-op via the `null` branch, so the existing
`/compact works` integration test in `src/tests/acp-agent.test.ts`
continues to pass.
## Why the previous behaviour was conservative-but-wrong
The inline comment notes the filter exists for `/compact`'s SDK-side
malformed output. That tradeoff swallows a much larger class of
legitimate output (anything that uses `<local-command-stdout>` to wrap
real prose) to avoid one specific command's noise. With
`stripLocalCommandMetadata` available, the conservative behaviour can
target exactly the empty-after-strip case (still `null` → no-op) without
affecting messages that have real prose alongside markers — which is
exactly the regression case the helper's tests were written to cover
(see `src/tests/acp-agent.test.ts:1145-1163`, *"in the original bug
report the entire /model preamble and the user's real 'hi' prompt were
concatenated into a single message. We want to strip the marker tags and
preserve the real prose, not drop the whole message."*).
The fix applies that same principle to the live handler, where the
helper is most needed.
## Refs
- `zed-industries/claude-code-acp#624` — "'Skill' Session Updates
missing when invoked via slash command". The reporter correctly
diagnoses the mechanism: *"Claude just attaches the skill directly to
context when the /command is used, which means the skill loader isn't
used."* The skill body arrives wrapped in markers and gets dropped by
this filter.
- `zed-industries/claude-code-acp#642` — built-in slash commands
(`/usage`, `/status`, `/model`, `/memory`, `/permissions`, `/agents`,
`/mcp`) emit no output when invoked. Same root cause: their output
arrives in messages tagged with `<local-command-stdout>` and is filtered
out.
Both upstream issues remain open against the old repo
`zed-industries/claude-code-acp` and have no comments / linked PRs yet.
Cross-linking here so this PR can be the closing reference for both.
## Test plan
- [x] `npm run check` (lint + format) — passes
- [x] `npm run build` (tsc) — passes
- [x] `npx vitest run src/tests/acp-agent.test.ts -t
"stripLocalCommandMetadata"` — 8 passed
- [ ] Existing `/compact works` integration test — needs a CLI
environment to run; relies on the `null` branch preserving the no-op
behaviour for marker-only payloads, which the helper tests already cover
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Bumps the minor group with 6 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.2.126` | `0.2.132` |
|
[@types/estree](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/estree)
| `1.0.8` | `1.0.9` |
|
[express-rate-limit](https://github.com/express-rate-limit/express-rate-limit)
| `8.4.1` | `8.5.1` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.1` | `3.1.2` |
| [hono](https://github.com/honojs/hono) | `4.12.16` | `4.12.18` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) |
`8.0.10` | `8.0.11` |
Updates `@anthropic-ai/claude-agent-sdk` from 0.2.126 to 0.2.132
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.2.132</h2>
<h2>What's changed</h2>
<ul>
<li>Documented <code>applyFlagSettings()</code> in the TypeScript Agent
SDK reference and added support for <code>null</code> on top-level keys
to clear flag-settings overrides</li>
<li>Updated to parity with Claude Code v2.1.132</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.2.132
# or
yarn add @anthropic-ai/claude-agent-sdk@0.2.132
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.2.132
# or
bun add @anthropic-ai/claude-agent-sdk@0.2.132
</code></pre>
<h2>v0.2.131</h2>
<h2>What's changed</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.131</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.2.131
# or
yarn add @anthropic-ai/claude-agent-sdk@0.2.131
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.2.131
# or
bun add @anthropic-ai/claude-agent-sdk@0.2.131
</code></pre>
<h2>v0.2.129</h2>
<h2>What's changed</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.129</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.2.129
# or
yarn add @anthropic-ai/claude-agent-sdk@0.2.129
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.2.129
# or
bun add @anthropic-ai/claude-agent-sdk@0.2.129
</tr></table>
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.2.132</h2>
<ul>
<li>Documented <code>applyFlagSettings()</code> in the TypeScript Agent
SDK reference and added support for <code>null</code> on top-level keys
to clear flag-settings overrides</li>
<li>Updated to parity with Claude Code v2.1.132</li>
</ul>
<h2>0.2.131</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.131</li>
</ul>
<h2>0.2.130</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.130</li>
</ul>
<h2>0.2.129</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.129</li>
</ul>
<h2>0.2.128</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.128</li>
</ul>
<h2>0.2.127</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.127</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="82da44ce66"><code>82da44c</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="0fe2005ff2"><code>0fe2005</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="7bc3bd7660"><code>7bc3bd7</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="e76e32558b"><code>e76e325</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.2.126...v0.2.132">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.2.126 to
0.2.132
Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.2.126 to
0.2.132
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.2.126 to
0.2.132
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.2.126
to 0.2.132
Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.2.126 to
0.2.132
Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.2.126 to
0.2.132
Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.2.126 to
0.2.132
Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.2.126 to
0.2.132
Updates `@types/estree` from 1.0.8 to 1.0.9
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/estree">compare
view</a></li>
</ul>
</details>
<br />
Updates `express-rate-limit` from 8.4.1 to 8.5.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/express-rate-limit/express-rate-limit/releases">express-rate-limit's
releases</a>.</em></p>
<blockquote>
<h2>v8.5.1</h2>
<p>You can view the changelog <a
href="https://express-rate-limit.mintlify.app/reference/changelog">here</a>.</p>
<h2>v8.5.0</h2>
<p>You can view the changelog <a
href="https://express-rate-limit.mintlify.app/reference/changelog">here</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="50cc3f6345"><code>50cc3f6</code></a>
8.5.1</li>
<li><a
href="92c8e3efd8"><code>92c8e3e</code></a>
chore: bump ip-address library to latest (<a
href="https://redirect.github.com/express-rate-limit/express-rate-limit/issues/626">#626</a>)</li>
<li><a
href="807e383875"><code>807e383</code></a>
8.5.0</li>
<li><a
href="b844137931"><code>b844137</code></a>
v8.5.0 changelog</li>
<li><a
href="ceaffabad1"><code>ceaffab</code></a>
feat: async store init (<a
href="https://redirect.github.com/express-rate-limit/express-rate-limit/issues/621">#621</a>)</li>
<li>See full diff in <a
href="https://github.com/express-rate-limit/express-rate-limit/compare/v8.4.1...v8.5.1">compare
view</a></li>
</ul>
</details>
<br />
Updates `fast-uri` from 3.1.1 to 3.1.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fastify/fast-uri/releases">fast-uri's
releases</a>.</em></p>
<blockquote>
<h2>v3.1.2</h2>
<h2>⚠️ Security Release</h2>
<ul>
<li>Fix for <a
href="https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc">https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc</a></li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Handle malformed fragment decoding as a parse error by <a
href="https://github.com/mcollina"><code>@mcollina</code></a> in <a
href="https://redirect.github.com/fastify/fast-uri/pull/171">fastify/fast-uri#171</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fastify/fast-uri/compare/v3.1.1...v3.1.2">https://github.com/fastify/fast-uri/compare/v3.1.1...v3.1.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="919dd8ea76"><code>919dd8e</code></a>
Bumped v3.1.2</li>
<li><a
href="c65ba57371"><code>c65ba57</code></a>
fixup: linting</li>
<li><a
href="6c86c17c3d"><code>6c86c17</code></a>
Merge commit from fork</li>
<li><a
href="a95158ad30"><code>a95158a</code></a>
Handle malformed fragment decoding without throwing (<a
href="https://redirect.github.com/fastify/fast-uri/issues/171">#171</a>)</li>
<li>See full diff in <a
href="https://github.com/fastify/fast-uri/compare/v3.1.1...v3.1.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `hono` from 4.12.16 to 4.12.18
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.18</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Cache Middleware ignores Vary: Authorization / Vary: Cookie leading
to cross-user cache leakage</h3>
<p>Affects: Cache Middleware. Fixes missing cache-skip handling for
<code>Vary: Authorization</code> and <code>Vary: Cookie</code>, where a
response cached for one authenticated user could be served to other
users. GHSA-p77w-8qqv-26rm</p>
<h3>CSS Declaration Injection via Style Object Values in JSX SSR</h3>
<p>Affects: hono/jsx. Fixes a missing CSS-context escape for
<code>style</code> object values and property names, where untrusted
input could inject additional CSS declarations. The impact is limited to
CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p</p>
<h3>Improper validation of NumericDate claims (exp, nbf, iat) in JWT
verify()</h3>
<p>Affects: <code>hono/utils/jwt</code>. Fixes improper validation of
<code>exp</code>, <code>nbf</code>, and <code>iat</code> claims, where
falsy, non-finite, or non-numeric values could silently bypass
time-based checks instead of being rejected per RFC 7519.
GHSA-hm8q-7f3q-5f36</p>
<hr />
<p>Users who use the JWT helper, hono/jsx, or the Cache middleware are
strongly encouraged to upgrade to this version.</p>
<h2>v4.12.17</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(jsx): normalize SVG attributes on the <!-- raw HTML omitted -->
root element by <a
href="https://github.com/kfly8"><code>@kfly8</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4893">honojs/hono#4893</a></li>
<li>fix(ssg): add <code>atom+xml</code> and <code>rss+xml</code> to
<code>defaultExtensionMap</code> by <a
href="https://github.com/yuintei"><code>@yuintei</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4899">honojs/hono#4899</a></li>
<li>fix(cors): make origin optional in CORSOptions by <a
href="https://github.com/truffle-dev"><code>@truffle-dev</code></a> in
<a
href="https://redirect.github.com/honojs/hono/pull/4905">honojs/hono#4905</a></li>
<li>fix(types): propagate middleware response types to app.on overloads
by <a href="https://github.com/T4ko0522"><code>@T4ko0522</code></a> in
<a
href="https://redirect.github.com/honojs/hono/pull/4906">honojs/hono#4906</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/kfly8"><code>@kfly8</code></a> made
their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4893">honojs/hono#4893</a></li>
<li><a
href="https://github.com/truffle-dev"><code>@truffle-dev</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4905">honojs/hono#4905</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.16...v4.12.17">https://github.com/honojs/hono/compare/v4.12.16...v4.12.17</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="f10dee89ce"><code>f10dee8</code></a>
4.12.18</li>
<li><a
href="a5bd9ebead"><code>a5bd9eb</code></a>
Merge commit from fork</li>
<li><a
href="58d3d3ad56"><code>58d3d3a</code></a>
Merge commit from fork</li>
<li><a
href="568c2ecc1d"><code>568c2ec</code></a>
Merge commit from fork</li>
<li><a
href="ff2b3d31df"><code>ff2b3d3</code></a>
4.12.17</li>
<li><a
href="52aaaf9714"><code>52aaaf9</code></a>
fix(types): propagate middleware response types to app.on overloads (<a
href="https://redirect.github.com/honojs/hono/issues/4906">#4906</a>)</li>
<li><a
href="76d5589e9b"><code>76d5589</code></a>
fix(cors): make origin optional in CORSOptions (<a
href="https://redirect.github.com/honojs/hono/issues/4905">#4905</a>)</li>
<li><a
href="8f027e5574"><code>8f027e5</code></a>
fix(ssg): add <code>atom+xml</code> and <code>rss+xml</code> to
<code>defaultExtensionMap</code> (<a
href="https://redirect.github.com/honojs/hono/issues/4899">#4899</a>)</li>
<li><a
href="bfba97ca7e"><code>bfba97c</code></a>
fix(jsx): normalize SVG attributes on the <svg> root element (<a
href="https://redirect.github.com/honojs/hono/issues/4893">#4893</a>)</li>
<li>See full diff in <a
href="https://github.com/honojs/hono/compare/v4.12.16...v4.12.18">compare
view</a></li>
</ul>
</details>
<br />
Updates `ip-address` from 10.1.0 to 10.2.0
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/beaugunderson/ip-address/commits">compare
view</a></li>
</ul>
</details>
<br />
Updates `vite` from 8.0.10 to 8.0.11
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>v8.0.11</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.11/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.10...v8.0.11">8.0.11</a>
(2026-05-07)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>update rolldown to 1.0.0-rc.18 (<a
href="https://redirect.github.com/vitejs/vite/issues/22360">#22360</a>)
(<a
href="3f80524aa1">3f80524</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22334">#22334</a>)
(<a
href="672c96288f">672c962</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22382">#22382</a>)
(<a
href="5c0cfcb83d">5c0cfcb</a>)</li>
<li><strong>glob:</strong> align hmr matcher options with glob
enumeration (<a
href="https://redirect.github.com/vitejs/vite/issues/22306">#22306</a>)
(<a
href="30028f9451">30028f9</a>)</li>
<li>make separate object instance for each environment (<a
href="https://redirect.github.com/vitejs/vite/issues/22276">#22276</a>)
(<a
href="7c2aa3b40b">7c2aa3b</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li><strong>create-vite:</strong> list react-compiler templates in
README (<a
href="https://redirect.github.com/vitejs/vite/issues/22347">#22347</a>)
(<a
href="7c3a61f42d">7c3a61f</a>)</li>
<li>explain mergeConfig skips null/undefined (<a
href="https://redirect.github.com/vitejs/vite/issues/22325">#22325</a>)
(<a
href="2151f701dc">2151f70</a>)</li>
<li>mention native config loader in CLI options (<a
href="https://redirect.github.com/vitejs/vite/issues/22348">#22348</a>)
(<a
href="0420c5d37b">0420c5d</a>)</li>
<li>update evan's x handle (<a
href="640202a216">640202a</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> update dependency tsdown to ^0.21.10 (<a
href="https://redirect.github.com/vitejs/vite/issues/22333">#22333</a>)
(<a
href="3b51e05021">3b51e05</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22383">#22383</a>)
(<a
href="555ff36de7">555ff36</a>)</li>
<li><strong>deps:</strong> update transitive packages to fix npm audit
alerts (<a
href="https://redirect.github.com/vitejs/vite/issues/22316">#22316</a>)
(<a
href="86aee6268a">86aee62</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li>devtools integration (<a
href="https://redirect.github.com/vitejs/vite/issues/22312">#22312</a>)
(<a
href="3c8bf064ec">3c8bf06</a>)</li>
<li>remove unnecessary async (<a
href="https://redirect.github.com/vitejs/vite/issues/22296">#22296</a>)
(<a
href="b31fd355d9">b31fd35</a>)</li>
<li>show direct path type in bad character warning (<a
href="https://redirect.github.com/vitejs/vite/issues/22339">#22339</a>)
(<a
href="0c162e96a6">0c162e9</a>)</li>
</ul>
<h3>Tests</h3>
<ul>
<li><strong>create-vite:</strong> use short help alias (<a
href="https://redirect.github.com/vitejs/vite/issues/22389">#22389</a>)
(<a
href="994ab66bc4">994ab66</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="66f3194aa8"><code>66f3194</code></a>
release: v8.0.11</li>
<li><a
href="5c0cfcb83d"><code>5c0cfcb</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22382">#22382</a>)</li>
<li><a
href="555ff36de7"><code>555ff36</code></a>
chore(deps): update rolldown-related dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22383">#22383</a>)</li>
<li><a
href="b31fd355d9"><code>b31fd35</code></a>
refactor: remove unnecessary async (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22296">#22296</a>)</li>
<li><a
href="3c8bf064ec"><code>3c8bf06</code></a>
refactor: devtools integration (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22312">#22312</a>)</li>
<li><a
href="7c2aa3b40b"><code>7c2aa3b</code></a>
fix: make separate object instance for each environment (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22276">#22276</a>)</li>
<li><a
href="3f80524aa1"><code>3f80524</code></a>
feat: update rolldown to 1.0.0-rc.18 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22360">#22360</a>)</li>
<li><a
href="0c162e96a6"><code>0c162e9</code></a>
refactor: show direct path type in bad character warning (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22339">#22339</a>)</li>
<li><a
href="672c96288f"><code>672c962</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22334">#22334</a>)</li>
<li><a
href="30028f9451"><code>30028f9</code></a>
fix(glob): align hmr matcher options with glob enumeration (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22306">#22306</a>)</li>
<li>See full diff in <a
href="https://github.com/vitejs/vite/commits/v8.0.11/packages/vite">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Add origin-aware raw SDK message filtering and forward result
origin metadata in usage updates.
Ignore task-notification followup results when computing the
user-turn stop reason or forwarding local slash-command output.
Bumps the minor group with 12 updates:
| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.2.123` | `0.2.126` |
| [eslint](https://github.com/eslint/eslint) | `10.2.1` | `10.3.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.5.0` |
`17.6.0` |
| @anthropic-ai/claude-agent-sdk-darwin-arm64 | `0.2.123` | `0.2.126` |
| @anthropic-ai/claude-agent-sdk-darwin-x64 | `0.2.123` | `0.2.126` |
| @anthropic-ai/claude-agent-sdk-linux-arm64 | `0.2.123` | `0.2.126` |
| @anthropic-ai/claude-agent-sdk-linux-arm64-musl | `0.2.123` |
`0.2.126` |
| @anthropic-ai/claude-agent-sdk-linux-x64 | `0.2.123` | `0.2.126` |
| @anthropic-ai/claude-agent-sdk-linux-x64-musl | `0.2.123` | `0.2.126`
|
| @anthropic-ai/claude-agent-sdk-win32-arm64 | `0.2.123` | `0.2.126` |
| @anthropic-ai/claude-agent-sdk-win32-x64 | `0.2.123` | `0.2.126` |
| [postcss](https://github.com/postcss/postcss) | `8.5.12` | `8.5.13` |
Updates `@anthropic-ai/claude-agent-sdk` from 0.2.123 to 0.2.126
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases"><code>@anthropic-ai/claude-agent-sdk</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v0.2.126</h2>
<h2>What's changed</h2>
<ul>
<li>Added <code>origin</code> to result messages
(<code>SDKResultSuccess</code> / <code>SDKResultError</code>) — forwards
the triggering message's <code>SDKMessageOrigin</code> so consumers can
distinguish user-prompted results from <code>task-notification</code>
followups</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.2.126
# or
yarn add @anthropic-ai/claude-agent-sdk@0.2.126
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.2.126
# or
bun add @anthropic-ai/claude-agent-sdk@0.2.126
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md"><code>@anthropic-ai/claude-agent-sdk</code>'s
changelog</a>.</em></p>
<blockquote>
<h2>0.2.126</h2>
<ul>
<li>Added <code>origin</code> to result messages
(<code>SDKResultSuccess</code> / <code>SDKResultError</code>) — forwards
the triggering message's <code>SDKMessageOrigin</code> so consumers can
distinguish user-prompted results from <code>task-notification</code>
followups</li>
</ul>
<h2>0.2.125</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.125</li>
</ul>
<h2>0.2.124</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.124</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="36c350af3e"><code>36c350a</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.2.123...v0.2.126">compare
view</a></li>
</ul>
</details>
<br />
Updates `eslint` from 10.2.1 to 10.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.3.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="379571a975"><code>379571a</code></a>
feat: add suggestions for no-unused-private-class-members (<a
href="https://redirect.github.com/eslint/eslint/issues/20773">#20773</a>)
(sethamus)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="b6ae5cf07b"><code>b6ae5cf</code></a>
fix: handle unavailable require cache (<a
href="https://redirect.github.com/eslint/eslint/issues/20812">#20812</a>)
(Simon Podlipsky)</li>
<li><a
href="6fb3685bcb"><code>6fb3685</code></a>
fix: rule suggestions cause continuation in class body (<a
href="https://redirect.github.com/eslint/eslint/issues/20787">#20787</a>)
(Milos Djermanovic)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="32cc7ab4ec"><code>32cc7ab</code></a>
docs: fix typos in docs and comments (<a
href="https://redirect.github.com/eslint/eslint/issues/20809">#20809</a>)
(Tanuj Kanti)</li>
<li><a
href="7f479376a2"><code>7f47937</code></a>
docs: Update README (GitHub Actions Bot)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="d32235ec19"><code>d32235e</code></a>
ci: use pnpm in <code>eslint-flat-config-utils</code> type integration
test (<a
href="https://redirect.github.com/eslint/eslint/issues/20826">#20826</a>)
(Francesco Trotta)</li>
<li><a
href="3ffb14ea51"><code>3ffb14e</code></a>
chore: clean up typos in comments and JSDoc (<a
href="https://redirect.github.com/eslint/eslint/issues/20821">#20821</a>)
(Pixel998)</li>
<li><a
href="22eb58a21c"><code>22eb58a</code></a>
chore: add missing continue-on-error to ecosystem-tests.yml (<a
href="https://redirect.github.com/eslint/eslint/issues/20818">#20818</a>)
(Josh Goldberg ✨)</li>
<li><a
href="88bf0024cb"><code>88bf002</code></a>
ci: bump pnpm/action-setup from 6.0.1 to 6.0.3 (<a
href="https://redirect.github.com/eslint/eslint/issues/20815">#20815</a>)
(dependabot[bot])</li>
<li><a
href="97c8c330be"><code>97c8c33</code></a>
chore: update ilshidur/action-discord action to v0.4.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/20811">#20811</a>)
(renovate[bot])</li>
<li><a
href="2f58136dd4"><code>2f58136</code></a>
chore: pin peter-evans/create-pull-request action to 5f6978f (<a
href="https://redirect.github.com/eslint/eslint/issues/20810">#20810</a>)
(renovate[bot])</li>
<li><a
href="77add7f1bc"><code>77add7f</code></a>
chore: add initial ecosystem plugin tests workflow (<a
href="https://redirect.github.com/eslint/eslint/issues/19643">#19643</a>)
(Josh Goldberg ✨)</li>
<li><a
href="4023b55490"><code>4023b55</code></a>
test: Add unit tests for SuppressionsService.prune() (<a
href="https://redirect.github.com/eslint/eslint/issues/20797">#20797</a>)
(kuldeep kumar)</li>
<li><a
href="54080dad4f"><code>54080da</code></a>
test: add unit tests for ForkContext (<a
href="https://redirect.github.com/eslint/eslint/issues/20778">#20778</a>)
(kuldeep kumar)</li>
<li><a
href="f0e2bcc4bf"><code>f0e2bcc</code></a>
test: add unit tests for SuppressionsService.suppress() method (<a
href="https://redirect.github.com/eslint/eslint/issues/20765">#20765</a>)
(kuldeep kumar)</li>
<li><a
href="a7f0b94743"><code>a7f0b94</code></a>
chore: update dependency prettier to v3.8.3 (<a
href="https://redirect.github.com/eslint/eslint/issues/20782">#20782</a>)
(renovate[bot])</li>
<li><a
href="7bf93d9e79"><code>7bf93d9</code></a>
chore: update TypeScript to v6 (<a
href="https://redirect.github.com/eslint/eslint/issues/20677">#20677</a>)
(sethamus)</li>
<li><a
href="b42dd72e76"><code>b42dd72</code></a>
ci: bump pnpm/action-setup from 6.0.0 to 6.0.1 (<a
href="https://redirect.github.com/eslint/eslint/issues/20781">#20781</a>)
(dependabot[bot])</li>
<li><a
href="2b252be80f"><code>2b252be</code></a>
test: add unit tests for IdGenerator (<a
href="https://redirect.github.com/eslint/eslint/issues/20775">#20775</a>)
(kuldeep kumar)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="78892043a3"><code>7889204</code></a>
10.3.0</li>
<li><a
href="5b69b4fce4"><code>5b69b4f</code></a>
Build: changelog update for 10.3.0</li>
<li><a
href="d32235ec19"><code>d32235e</code></a>
ci: use pnpm in <code>eslint-flat-config-utils</code> type integration
test (<a
href="https://redirect.github.com/eslint/eslint/issues/20826">#20826</a>)</li>
<li><a
href="b6ae5cf07b"><code>b6ae5cf</code></a>
fix: handle unavailable require cache (<a
href="https://redirect.github.com/eslint/eslint/issues/20812">#20812</a>)</li>
<li><a
href="3ffb14ea51"><code>3ffb14e</code></a>
chore: clean up typos in comments and JSDoc (<a
href="https://redirect.github.com/eslint/eslint/issues/20821">#20821</a>)</li>
<li><a
href="6fb3685bcb"><code>6fb3685</code></a>
fix: rule suggestions cause continuation in class body (<a
href="https://redirect.github.com/eslint/eslint/issues/20787">#20787</a>)</li>
<li><a
href="22eb58a21c"><code>22eb58a</code></a>
chore: add missing continue-on-error to ecosystem-tests.yml (<a
href="https://redirect.github.com/eslint/eslint/issues/20818">#20818</a>)</li>
<li><a
href="88bf0024cb"><code>88bf002</code></a>
ci: bump pnpm/action-setup from 6.0.1 to 6.0.3 (<a
href="https://redirect.github.com/eslint/eslint/issues/20815">#20815</a>)</li>
<li><a
href="379571a975"><code>379571a</code></a>
feat: add suggestions for no-unused-private-class-members (<a
href="https://redirect.github.com/eslint/eslint/issues/20773">#20773</a>)</li>
<li><a
href="97c8c330be"><code>97c8c33</code></a>
chore: update ilshidur/action-discord action to v0.4.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/20811">#20811</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.2.1...v10.3.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `globals` from 17.5.0 to 17.6.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sindresorhus/globals/releases">globals's
releases</a>.</em></p>
<blockquote>
<h2>v17.6.0</h2>
<ul>
<li>Update globals (2026-05-01) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/343">#343</a>)
00a4dd9</li>
</ul>
<hr />
<p><a
href="https://github.com/sindresorhus/globals/compare/v17.5.0...v17.6.0">https://github.com/sindresorhus/globals/compare/v17.5.0...v17.6.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6b15870f1c"><code>6b15870</code></a>
17.6.0</li>
<li><a
href="00a4dd9821"><code>00a4dd9</code></a>
Update globals (2026-05-01) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/343">#343</a>)</li>
<li>See full diff in <a
href="https://github.com/sindresorhus/globals/compare/v17.5.0...v17.6.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.2.123 to
0.2.126
Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.2.123 to
0.2.126
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.2.123 to
0.2.126
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.2.123
to 0.2.126
Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.2.123 to
0.2.126
Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.2.123 to
0.2.126
Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.2.123 to
0.2.126
Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.2.123 to
0.2.126
Updates `postcss` from 8.5.12 to 8.5.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.13</h2>
<ul>
<li>Fixed <code>postcss-scss</code> commend regression.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.13</h2>
<ul>
<li>Fixed <code>postcss-scss</code> commend regression.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="af58cf1b7a"><code>af58cf1</code></a>
Release 8.5.13 version</li>
<li><a
href="f227dbd0e9"><code>f227dbd</code></a>
Temporary ignore pnpm 11 config</li>
<li><a
href="d3abd40d72"><code>d3abd40</code></a>
Update dependencies</li>
<li><a
href="dd06c3e113"><code>dd06c3e</code></a>
Revert stringifier changes because of the conflict with
postcss-scss</li>
<li><a
href="ae889c815f"><code>ae889c8</code></a>
Try to fix CI</li>
<li><a
href="e0093e49bc"><code>e0093e4</code></a>
Move to pnpm 11</li>
<li>See full diff in <a
href="https://github.com/postcss/postcss/compare/8.5.12...8.5.13">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## What's broken
The PostToolUse hook fan-out (`src/acp-agent.ts`) only invokes
`toolUpdateFromEditToolResponse` for tools named `Edit`. Any `Write`
that overwrites an existing file (`FileWriteOutput.type === "update"`)
keeps the optimistic content built at tool-use time by
`toolInfoFromToolUse` — `oldText: null, newText: input.content` —
permanently. The user sees a "creation" diff regardless of whether the
file already existed, so overwrites visually look indistinguishable from
brand-new files.
This affects every Write that touches an existing file, which Claude
does routinely (rewriting configs, replacing small files, etc.).
## Fix
The SDK's `FileWriteOutput`
(`@anthropic-ai/claude-agent-sdk/sdk-tools.d.ts`) ships the same
hunk-shaped `structuredPatch` for `Write` that we already render for
`Edit`. Extending the dispatch to cover both tools replays the hook's
payload through `toolUpdateFromEditToolResponse` so update mode shows
the actual diff.
Create mode is unchanged in practice because the structuredPatch hunk's
lines are all additions, which collapse to the same `oldText: null,
newText: <content>` shape the optimistic path produced.
## Tests
Two regression tests added in `src/tests/tools.test.ts` under a new
`describe("post-tool-use hook sends diff content for Write tool")`:
- `Write` with `type: "update"` asserts the corrected diff (real
`oldText` / `newText` derived from `structuredPatch`)
- `Write` with `type: "create"` asserts the existing optimistic-style
diff is preserved
All existing tests pass. Total: 240 → 242.
## Validation
- `npm run check` ✅
- `npm run build` ✅
- `npm run test:run` ✅ (242 passed, 13 integration skipped)
---------
Co-authored-by: dave <dave@mint.lan>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.11 to 3.3.12.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ai/nanoid/releases">nanoid's
releases</a>.</em></p>
<blockquote>
<h2>3.3.12</h2>
<ul>
<li>Fixed breaking Nano ID by requesting big ID.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ai/nanoid/blob/main/CHANGELOG.md">nanoid's
changelog</a>.</em></p>
<blockquote>
<h2>3.3.12</h2>
<ul>
<li>Fixed breaking Nano ID by requesting big ID.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="aa9c399f69"><code>aa9c399</code></a>
Release 3.3.12 version</li>
<li><a
href="b0036ed60d"><code>b0036ed</code></a>
Backport fix to CommonJS version too</li>
<li><a
href="08a19a4c82"><code>08a19a4</code></a>
Update test</li>
<li><a
href="821dfed7b5"><code>821dfed</code></a>
Backport pool breaking fix</li>
<li><a
href="609646c644"><code>609646c</code></a>
Fix CI</li>
<li>See full diff in <a
href="https://github.com/ai/nanoid/compare/3.3.11...3.3.12">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the minor group with 2 updates:
[zod](https://github.com/colinhacks/zod) and
[hono](https://github.com/honojs/hono).
Updates `zod` from 4.3.6 to 4.4.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/colinhacks/zod/releases">zod's
releases</a>.</em></p>
<blockquote>
<h2>v4.4.1</h2>
<h2>Commits:</h2>
<ul>
<li>481f7be4238c83ed58183f921b2646f340a91c6a ci: gate release publishing
on full test workflow</li>
<li>95ccab423aec720b2523c3a64cdc7e3204537cc7 test(v3): restore optional
undefined expectations</li>
<li>cede2c63739a5823d6aa5093d291e9a111da943d fix(v4): reject tuple holes
before required defaults (<a
href="https://redirect.github.com/colinhacks/zod/issues/5900">#5900</a>)</li>
<li>edd0bf0f5ada4a8dc581c259407d7bbad0a71ea7 release: 4.4.1</li>
<li>180d83d1dbe6a59260710cc8637a3dea2281ee56 docs: remove Jazz featured
sponsor</li>
</ul>
<h2>v4.4.0</h2>
<h2>4.4.0</h2>
<p>This is a minor release with a wide set of correctness and soundness
fixes. Some fixes intentionally make Zod stricter, so code that depended
on previously accepted invalid or ambiguous inputs may need small
updates.</p>
<h2>Potentially breaking bug fixes</h2>
<h3>Tuple defaults now materialize output values correctly</h3>
<p>Fixed in <a
href="https://redirect.github.com/colinhacks/zod/pull/5661">#5661</a>.
Tuple parsing now more accurately reflects defaults, optional tails,
explicit <code>undefined</code>, and under-filled inputs. The headline
behavior is that defaults in tuple positions now properly appear in
parsed output.</p>
<pre lang="ts"><code>const schema = z.tuple([
z.string(),
z.string().default("fallback"),
]);
<p>schema.parse(["a"]);
// ["a", "fallback"]
</code></pre></p>
<p>Trailing optional elements that are absent still stay absent; they
are not filled with <code>undefined</code>.</p>
<pre lang="ts"><code>const schema = z.tuple([
z.string(),
z.string().optional(),
]);
<p>schema.parse(["a"]);
// ["a"]
</code></pre></p>
<p>But explicit <code>undefined</code> values supplied by the caller are
preserved.</p>
<pre lang="ts"><code>schema.parse(["a", undefined]);
// ["a", undefined]
</code></pre>
<p>When optional elements appear before later defaults, the parsed tuple
is now dense so array operations behave predictably.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="180d83d1db"><code>180d83d</code></a>
docs: remove Jazz featured sponsor</li>
<li><a
href="edd0bf0f5a"><code>edd0bf0</code></a>
release: 4.4.1</li>
<li><a
href="cede2c6373"><code>cede2c6</code></a>
fix(v4): reject tuple holes before required defaults (<a
href="https://redirect.github.com/colinhacks/zod/issues/5900">#5900</a>)</li>
<li><a
href="95ccab423a"><code>95ccab4</code></a>
test(v3): restore optional undefined expectations</li>
<li><a
href="481f7be423"><code>481f7be</code></a>
ci: gate release publishing on full test workflow</li>
<li><a
href="d05f026e9e"><code>d05f026</code></a>
release: 4.4.0</li>
<li><a
href="f778e02a81"><code>f778e02</code></a>
build: bump zshy for JSR wildcard exports</li>
<li><a
href="6db607be3c"><code>6db607b</code></a>
fix(release): keep JSR manifest publishable</li>
<li><a
href="ad0b82713e"><code>ad0b827</code></a>
ci: update release workflow for trusted publishing</li>
<li><a
href="b6066b3e47"><code>b6066b3</code></a>
fix(v4): align object and tuple optionality handling (<a
href="https://redirect.github.com/colinhacks/zod/issues/5661">#5661</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/colinhacks/zod/compare/v4.3.6...v4.4.1">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for zod since your current version.</p>
</details>
<br />
Updates `hono` from 4.12.15 to 4.12.16
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.16</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection</h3>
<p>Affects: hono/jsx. Fixes missing validation of JSX tag names when
using <code>jsx()</code> or <code>createElement()</code>, which could
allow HTML injection if untrusted input is used as the tag name.
GHSA-69xw-7hcm-h432</p>
<h3>bodyLimit() can be bypassed for chunked / unknown-length
requests</h3>
<p>Affects: Body Limit Middleware. Fixes late enforcement for request
bodies without a reliable Content-Length (e.g. chunked requests), where
oversized requests could reach handlers and return successful responses
before being rejected. GHSA-9vqf-7f2p-gf9v</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="90d4182aab"><code>90d4182</code></a>
4.12.16</li>
<li><a
href="db05b96d7a"><code>db05b96</code></a>
Merge commit from fork</li>
<li><a
href="614b834551"><code>614b834</code></a>
Merge commit from fork</li>
<li><a
href="027e3dfca9"><code>027e3df</code></a>
fix(method-override): handle Content-Type with charset parameter (<a
href="https://redirect.github.com/honojs/hono/issues/4894">#4894</a>)</li>
<li>See full diff in <a
href="https://github.com/honojs/hono/compare/v4.12.15...v4.12.16">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the minor group with 11 updates:
| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.2.121` | `0.2.123` |
|
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript)
| `0.89.0` | `0.91.1` |
| @anthropic-ai/claude-agent-sdk-darwin-arm64 | `0.2.121` | `0.2.123` |
| @anthropic-ai/claude-agent-sdk-darwin-x64 | `0.2.121` | `0.2.123` |
| @anthropic-ai/claude-agent-sdk-linux-arm64 | `0.2.121` | `0.2.123` |
| @anthropic-ai/claude-agent-sdk-linux-arm64-musl | `0.2.121` |
`0.2.123` |
| @anthropic-ai/claude-agent-sdk-linux-x64 | `0.2.121` | `0.2.123` |
| @anthropic-ai/claude-agent-sdk-linux-x64-musl | `0.2.121` | `0.2.123`
|
| @anthropic-ai/claude-agent-sdk-win32-arm64 | `0.2.121` | `0.2.123` |
| @anthropic-ai/claude-agent-sdk-win32-x64 | `0.2.121` | `0.2.123` |
| [tinyexec](https://github.com/tinylibs/tinyexec) | `1.1.1` | `1.1.2` |
Updates `@anthropic-ai/claude-agent-sdk` from 0.2.121 to 0.2.123
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases"><code>@anthropic-ai/claude-agent-sdk</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v0.2.123</h2>
<h2>What's changed</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.123</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.2.123
# or
yarn add @anthropic-ai/claude-agent-sdk@0.2.123
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.2.123
# or
bun add @anthropic-ai/claude-agent-sdk@0.2.123
</code></pre>
<h2>v0.2.122</h2>
<h2>What's changed</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.122</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.2.122
# or
yarn add @anthropic-ai/claude-agent-sdk@0.2.122
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.2.122
# or
bun add @anthropic-ai/claude-agent-sdk@0.2.122
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md"><code>@anthropic-ai/claude-agent-sdk</code>'s
changelog</a>.</em></p>
<blockquote>
<h2>0.2.123</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.123</li>
</ul>
<h2>0.2.122</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.122</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="38cd292318"><code>38cd292</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="5f07f15d5d"><code>5f07f15</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.2.121...v0.2.123">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/sdk` from 0.89.0 to 0.91.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/releases"><code>@anthropic-ai/sdk</code>'s
releases</a>.</em></p>
<blockquote>
<h2>sdk: v0.91.1</h2>
<h2>0.91.1 (2026-04-24)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.91.0...sdk-v0.91.1">sdk-v0.91.0...sdk-v0.91.1</a></p>
<h3>Bug Fixes</h3>
<ul>
<li><strong>memory:</strong> use restrictive file mode for memory files
(<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/901">#901</a>)
(<a
href="6db3b7e221">6db3b7e</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>formatter:</strong> run prettier and eslint separately (<a
href="974d22fcf6">974d22f</a>)</li>
</ul>
<h2>sdk: v0.91.0</h2>
<h2>0.91.0 (2026-04-23)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.90.0...sdk-v0.91.0">sdk-v0.90.0...sdk-v0.91.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> CMA Memory public beta (<a
href="ddf732f5f3">ddf732f</a>)</li>
<li><strong>bedrock:</strong> use auth header for mantle client (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/866">#866</a>)
(<a
href="aec801afc7">aec801a</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>api:</strong> fix errors in api spec (<a
href="ae10768485">ae10768</a>)</li>
<li><strong>api:</strong> restore missing features (<a
href="1a5b47b689">1a5b47b</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>internal:</strong> more robust bootstrap script (<a
href="7716e19f7f">7716e19</a>)</li>
<li><strong>tests:</strong> bump steady to v0.22.1 (<a
href="219a971743">219a971</a>)</li>
</ul>
<h2>sdk: v0.90.0</h2>
<h2>0.90.0 (2026-04-16)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.89.0...sdk-v0.90.0">sdk-v0.89.0...sdk-v0.90.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add claude-opus-4-7, token budgets and
user_profiles (<a
href="b26134bb17">b26134b</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li>actually delete release-doctor.yml (<a
href="0fe984d1f6">0fe984d</a>)</li>
<li><strong>ci:</strong> remove release-doctor workflow (<a
href="08e58bd0bb">08e58bd</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md"><code>@anthropic-ai/sdk</code>'s
changelog</a>.</em></p>
<blockquote>
<h2>0.91.1 (2026-04-24)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.91.0...sdk-v0.91.1">sdk-v0.91.0...sdk-v0.91.1</a></p>
<h3>Bug Fixes</h3>
<ul>
<li><strong>memory:</strong> use restrictive file mode for memory files
(<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/901">#901</a>)
(<a
href="6db3b7e221">6db3b7e</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>formatter:</strong> run prettier and eslint separately (<a
href="974d22fcf6">974d22f</a>)</li>
</ul>
<h2>0.91.0 (2026-04-23)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.90.0...sdk-v0.91.0">sdk-v0.90.0...sdk-v0.91.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> CMA Memory public beta (<a
href="ddf732f5f3">ddf732f</a>)</li>
<li><strong>bedrock:</strong> use auth header for mantle client (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/866">#866</a>)
(<a
href="aec801afc7">aec801a</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>api:</strong> fix errors in api spec (<a
href="ae10768485">ae10768</a>)</li>
<li><strong>api:</strong> restore missing features (<a
href="1a5b47b689">1a5b47b</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>internal:</strong> more robust bootstrap script (<a
href="7716e19f7f">7716e19</a>)</li>
<li><strong>tests:</strong> bump steady to v0.22.1 (<a
href="219a971743">219a971</a>)</li>
</ul>
<h2>0.90.0 (2026-04-16)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.89.0...sdk-v0.90.0">sdk-v0.89.0...sdk-v0.90.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add claude-opus-4-7, token budgets and
user_profiles (<a
href="b26134bb17">b26134b</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li>actually delete release-doctor.yml (<a
href="0fe984d1f6">0fe984d</a>)</li>
<li><strong>ci:</strong> remove release-doctor workflow (<a
href="08e58bd0bb">08e58bd</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="74ac150346"><code>74ac150</code></a>
chore: release main (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1014">#1014</a>)</li>
<li><a
href="22cb810364"><code>22cb810</code></a>
chore: release main (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1008">#1008</a>)</li>
<li><a
href="93ac7c7e05"><code>93ac7c7</code></a>
chore: release main (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1003">#1003</a>)</li>
<li>See full diff in <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.89.0...sdk-v0.91.1">compare
view</a></li>
</ul>
</details>
<br />
Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.2.121 to
0.2.123
Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.2.121 to
0.2.123
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.2.121 to
0.2.123
Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.2.121
to 0.2.123
Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.2.121 to
0.2.123
Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.2.121 to
0.2.123
Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.2.121 to
0.2.123
Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.2.121 to
0.2.123
Updates `tinyexec` from 1.1.1 to 1.1.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tinylibs/tinyexec/releases">tinyexec's
releases</a>.</em></p>
<blockquote>
<h2>1.1.2</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: accept readonly string[] for args parameters by <a
href="https://github.com/tatzyr"><code>@tatzyr</code></a> in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/112">tinylibs/tinyexec#112</a></li>
<li>chore(deps-dev): bump the development-dependencies group with 7
updates by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/113">tinylibs/tinyexec#113</a></li>
<li>fix: Fix typo in <code>README</code> by <a
href="https://github.com/porada"><code>@porada</code></a> in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/114">tinylibs/tinyexec#114</a></li>
<li>chore(deps-dev): bump the development-dependencies group with 5
updates by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/116">tinylibs/tinyexec#116</a></li>
<li>chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 in the
github-actions group by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/115">tinylibs/tinyexec#115</a></li>
<li>chore(deps-dev): bump the development-dependencies group with 4
updates by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/117">tinylibs/tinyexec#117</a></li>
<li>fix: remove normalisation of commands by <a
href="https://github.com/43081j"><code>@43081j</code></a> in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/118">tinylibs/tinyexec#118</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/tatzyr"><code>@tatzyr</code></a> made
their first contribution in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/112">tinylibs/tinyexec#112</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tinylibs/tinyexec/compare/1.1.1...1.1.2">https://github.com/tinylibs/tinyexec/compare/1.1.1...1.1.2</a></p>
<h2>1.1.2-next.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: accept readonly string[] for args parameters by <a
href="https://github.com/tatzyr"><code>@tatzyr</code></a> in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/112">tinylibs/tinyexec#112</a></li>
<li>chore(deps-dev): bump the development-dependencies group with 7
updates by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/113">tinylibs/tinyexec#113</a></li>
<li>fix: Fix typo in <code>README</code> by <a
href="https://github.com/porada"><code>@porada</code></a> in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/114">tinylibs/tinyexec#114</a></li>
<li>chore(deps-dev): bump the development-dependencies group with 5
updates by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/116">tinylibs/tinyexec#116</a></li>
<li>chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 in the
github-actions group by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/115">tinylibs/tinyexec#115</a></li>
<li>chore(deps-dev): bump the development-dependencies group with 4
updates by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/117">tinylibs/tinyexec#117</a></li>
<li>fix: remove normalisation of commands by <a
href="https://github.com/43081j"><code>@43081j</code></a> in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/118">tinylibs/tinyexec#118</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/tatzyr"><code>@tatzyr</code></a> made
their first contribution in <a
href="https://redirect.github.com/tinylibs/tinyexec/pull/112">tinylibs/tinyexec#112</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tinylibs/tinyexec/compare/1.1.1...1.1.2-next.0">https://github.com/tinylibs/tinyexec/compare/1.1.1...1.1.2-next.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="66f20383d8"><code>66f2038</code></a>
fix: remove normalisation of commands (<a
href="https://redirect.github.com/tinylibs/tinyexec/issues/118">#118</a>)</li>
<li><a
href="7a412e2c4b"><code>7a412e2</code></a>
chore(deps-dev): bump the development-dependencies group with 4 updates
(<a
href="https://redirect.github.com/tinylibs/tinyexec/issues/117">#117</a>)</li>
<li><a
href="bb8e95baeb"><code>bb8e95b</code></a>
chore(deps): bump actions/setup-node in the github-actions group (<a
href="https://redirect.github.com/tinylibs/tinyexec/issues/115">#115</a>)</li>
<li><a
href="2eb8aa1089"><code>2eb8aa1</code></a>
chore(deps-dev): bump the development-dependencies group with 5 updates
(<a
href="https://redirect.github.com/tinylibs/tinyexec/issues/116">#116</a>)</li>
<li><a
href="64d77c1c95"><code>64d77c1</code></a>
chore: fix typo in readme (<a
href="https://redirect.github.com/tinylibs/tinyexec/issues/114">#114</a>)</li>
<li><a
href="d5443a19f3"><code>d5443a1</code></a>
chore(deps-dev): bump the development-dependencies group with 7 updates
(<a
href="https://redirect.github.com/tinylibs/tinyexec/issues/113">#113</a>)</li>
<li><a
href="76f9e38477"><code>76f9e38</code></a>
feat: accept readonly string[] for args parameters (<a
href="https://redirect.github.com/tinylibs/tinyexec/issues/112">#112</a>)</li>
<li>See full diff in <a
href="https://github.com/tinylibs/tinyexec/compare/1.1.1...1.1.2">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Closes#594
Only advertise and accept `auto` permission mode when the active SDK
model reports `supportsAutoMode: true`.
This fixes the Haiku path where clients could select `auto`, only for
the SDK to later reject it with `auto mode unavailable for this model`.
Changes included:
- build available permission modes from the active model's `ModelInfo`
- omit `auto` from `availableModes` when `supportsAutoMode` is absent or
false
- clamp `permissions.defaultMode: "auto"` to `default` when the resolved
model cannot use auto mode
- recompute and clamp the current mode on model switch
- reject direct `setSessionMode("auto")` when `auto` is not available
- filter `ExitPlanMode` choices so unavailable modes are not offered or
accepted
- add regression coverage for session creation, model switching, direct
mode setting, and `ExitPlanMode`
## Verification
- `npm run lint`
- `npx prettier --check src/acp-agent.ts
src/tests/acp-agent-settings.test.ts src/tests/acp-agent.test.ts
src/tests/session-config-options.test.ts`
- `npm run build`
- `npm run test:run`
- Manual ACP subprocess smoke test with `ANTHROPIC_MODEL=haiku`
- `auto` was not advertised
- `setSessionMode("auto")` was rejected before reaching the SDK
---------
Co-authored-by: dave <dave@mint.lan>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
A broken value in settings.json (e.g. an unknown permissions.defaultMode
or a non-string model) used to throw and prevent session creation. Match
the Claude Code SDK behavior by logging the bad value and falling back
to defaults instead, so a single typo no longer renders the agent
unusable.
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
## Summary
Re-records #598 with a Conventional Commit prefix so
[release-please](https://github.com/googleapis/release-please) generates
a release PR. The actual fix was merged in 1a9d3ce but lacked the `fix:`
prefix, so release-please skipped it.
This PR is intentionally empty — once squash-merged, the resulting
commit message on `main` will start with `fix:` and trigger a patch
release.
See https://github.com/tidewave-ai/tidewave_app/issues/141.
Closes#581
Pass through object-based systemPrompt options from _meta while
forcing the claude_code preset, and add tests for defaulting,
string replacement, option forwarding, and override protection.
## Motivation
When a Zed user on the Claude Pro tier hits their usage limit, Zed
receives an error like this from claude-agent-acp:
```json
{
"code": -32603,
"message": "Internal error: You've hit your limit \u00b7 resets 8pm (America/Los_Angeles)",
"data": undefined
}
```
The only way for a client to recognize this as a rate-limit condition
(vs. any of the other things that can hit the `is_error: true` path —
billing issues, server errors, max tokens, etc.) is to pattern-match on
the human-readable message text. That's fragile and breaks every time
the message gets reworded upstream.
## What Claude Code already provides
The Claude Agent SDK actually emits a categorical kind on the
`SDKAssistantMessage` that precedes the failing `result`:
```ts
export declare type SDKAssistantMessageError =
| 'authentication_failed'
| 'billing_error'
| 'rate_limit'
| 'invalid_request'
| 'server_error'
| 'unknown'
| 'max_output_tokens';
```
\(Confirmed by inspection of the shipped `cli.js`: the CLI calls a
helper that wraps errors into assistant messages with `error:
"rate_limit"` \(or `billing_error`, etc.\) based on the nature of the
failure.\)
The adapter today reads `message.message.usage`,
`message.message.model`, and `message.message.content` off the
`SDKAssistantMessage`, but ignores the top-level `error` field. By the
time we throw `RequestError.internalError\(undefined, message.result\)`
on the failing result, the categorical info has been discarded.
## This PR
Capture the last seen `SDKAssistantMessage.error` and forward it to
`RequestError.internalError`'s `data` as `{ errorKind }`:
```json
{
"code": -32603,
"message": "Internal error: You've hit your limit \u00b7 resets 8pm (America/Los_Angeles)",
"data": { "errorKind": "rate_limit" }
}
```
ACP clients can then dispatch on the structured kind instead of
pattern-matching on the message text. Clients that don't understand the
field fall back to the existing message-based rendering unchanged
\(`data` is now populated in some cases where it used to be `undefined`,
but that's purely additive — no existing client reads this field today
so there's no compatibility risk\).
When the SDK doesn't provide a categorical error, we continue to pass
`undefined` so `data` stays absent.
## Changes
- `src/acp-agent.ts`: Track a `lastAssistantError:
SDKAssistantMessageError | undefined` through the `prompt()` iteration,
populated from the assistant branch. Thread it through to all three
`throw RequestError.internalError` sites in the result branch via a
small `errorKindData` helper.
- `src/tests/acp-agent.test.ts`: Two new tests — one verifying that an
upstream `error: "rate_limit"` on an `SDKAssistantMessage` shows up as
`{ errorKind: "rate_limit" }` on the thrown error's `data`, one
verifying that absence stays `undefined`.
## Open questions
1. **Field name.** I went with `errorKind` since it's short,
agent-agnostic, and not conflated with JSON-RPC's own `code`. Open to
bikeshedding.
2. **Whether to push this toward being an ACP-wide convention.** Other
adapters \(codex, gemini\) face the same problem — everything non-auth
squashed into `InternalError`. If this lands and works well here, it
might be worth writing up a little guidance in the ACP docs for "how
adapters should encode categorical error reasons" so we get the same
shape from every agent.
3. **Companion Zed PR.** The Zed-side change to read `data.errorKind`
and map to the existing `ThreadError::RateLimitExceeded` /
`AuthenticationRequired` / `PaymentRequired` / `MaxOutputTokens`
variants is straightforward \(~20 lines\) but I've held off on it until
this ships and a release is cut.
## Testing
- `npm run test:run`: 199 passing \(was 197; 2 new\).
- `npm run build`: clean.
- `npm run check`: lint + format clean.
This is part of a broader quality-week effort in Zed to improve the
external-agent debugging experience
\(<https://github.com/zed-industries/zed/issues/54531>\).
Allow providing Claude model settings via env var on startup. Providing
model settings is required when using Claude with alternative llm
provider, e.g. Bedrock as models have different IDs there
Bumps `@anthropic-ai/claude-agent-sdk` from `0.2.114` to `0.2.119`
(latest).
## Why
Primarily to pick up the April 20 system prompt verbosity revert called
out in the [April 23
postmortem](https://www.anthropic.com/engineering/april-23-postmortem),
which shipped in `claude-agent-sdk` `0.2.116` (parity with Claude Code
v2.1.116). Per the postmortem, an instruction added on April 16 —
_"Length limits: keep text between tool calls to ≤25 words. Keep final
responses to ≤100 words unless the task requires more detail."_ — caused
a measurable drop in coding quality for Sonnet 4.6, Opus 4.6, and Opus
4.7, and was reverted in the v2.1.116 release.
The other two regressions described in the postmortem (the
cache-clearing thinking-blocks bug fixed on April 10, and the default
reasoning effort revert on April 7) were already addressed before the
`0.2.114` this repo currently pins, so this upgrade is specifically
about the verbosity-prompt fix and the SDK improvements that have landed
since.
## What's also included between 0.2.114 and 0.2.119
From the [SDK release
notes](https://github.com/anthropics/claude-agent-sdk-typescript/releases):
- **0.2.116** — parity with Claude Code v2.1.116 (postmortem fix)
- **0.2.117** — parity with Claude Code v2.1.117
- **0.2.118** — adds `Options.managedSettings` for embedders to pass
policy-tier settings to the spawned CLI in-memory, honored below
IT-controlled managed sources
- **0.2.119**
- `excludeDynamicSections` now keeps static auto-memory instructions in
the cacheable system-prompt block; only the per-user memory directory
path and per-machine environment values are relocated to the first user
message
- Long-running SDK sessions now reconnect claude.ai-proxied MCP servers
after a transport-stream abort
- `SessionStore.append()` failures are now retried up to 3 times with
short backoff before the batch is dropped and `mirror_error` is emitted
No source changes were required in this repo — the public API surface
this project uses is unchanged.
## Verification
- `npm run build` ✅
- `npm run check` (lint + prettier) ✅
- `npm run test:run` ✅ (197 passed, 11 skipped)
---------
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
## Summary
- emit ACP `usage_update` notifications from top-level Claude
`stream_event` message usage
- keep tracking a usage snapshot across `message_start` and
`message_delta` so partial deltas still produce a complete total
- preserve the existing `result`-path update as the final
exact/cost-bearing usage event
## Why
Claude SDK stream events already carry incremental usage on
`message_delta`, but `claude-agent-acp` currently ignores that path and
only emits `usage_update` from the final `result`. This makes usage
appear stale until the turn ends in ACP clients that expect live context
usage updates.
## Verification
- built the repo with `npm run build`
- ran a direct ACP stdio client against the patched local build
- observed `usage_update` notifications emitted before the final
result-path usage update
Patched local smoke-test output included this sequence:
- `usage_update used=20973 size=200000`
- `agent_message_chunk text=TEST_OK`
- `usage_update used=20989 size=200000`
- `usage_update used=20989 size=1000000 cost=0.1314875`
---------
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Make cancellation a no-op for unknown sessions, close each
session query during disposal, and run the same cleanup path on
SIGINT and SIGTERM in CLI mode.
Follow up to #530
## Summary
- Return `AgentSideConnection` from `runAcp()` instead of discarding it
- Listen for `connection.closed` and call `process.exit(0)` on
resolution
- Fixes orphan process accumulation in oneshot mode (e.g. via ACPX)
## Problem
When used in oneshot mode, `claude-agent-acp` does not exit after the
client closes the stdin pipe. `process.stdin.resume()` keeps the Node.js
event loop alive indefinitely. Over time, orphan processes accumulate on
the host (~97MB RSS each), eventually exhausting system resources.
## Root cause
`runAcp()` creates an `AgentSideConnection` but discards the reference.
The `Connection.#receive()` loop detects stdin EOF and fires
`abortController.abort()`, resolving `connection.closed` — but no code
listens for it to trigger `process.exit()`.
## Fix
1. **`acp-agent.ts`**: `runAcp()` now returns the `AgentSideConnection`
instance
2. **`index.ts`**: Awaits `connection.closed` and calls
`process.exit(0)`
## Impact
- **Oneshot sessions**: Process now exits cleanly when the client closes
stdin (EOF)
- **Persistent sessions**: Unaffected — the client keeps stdin open, so
`connection.closed` does not fire until explicit disconnect
## Test plan
- [x] Verified oneshot: process exits within 1s after stdin EOF
- [x] Verified persistent: process remains alive while stdin is open
- [x] Measured idle RSS: ~97MB → freed on exit
- [x] Tested with ACPX runtime (OpenClaw gateway) in production
🤖 Generated with [Claude Code](https://claude.ai/code)
---------
Co-authored-by: WayChan <dove.h14@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
The auth methods don't have interactive modes, which means they don't
work on remote machines when you need to paste a code in.
Our previous change might not have been enough, so added some heuristics
similar to what the SDK does for checking for remote.
It's not perfect because I think they are attempting to open the URL and
then falling back when it fails, but heopfully this is at least closer.
## Summary
- Guard `toolInfoFromToolUse()` against `undefined` input for Read,
Glob, Grep, WebSearch, and TodoWrite cases
- Make `planEntries()` resilient to `undefined` input (returns `[]`
instead of crashing)
- Guard TodoWrite plan updates in `streamEventToAcpNotifications()` with
optional chaining on `chunk.input?.todos`
## Why this change
Claude `tool_use` blocks can temporarily carry `input: undefined` during
streaming (before `input_json_delta` arrives), and historical `tool_use`
messages with incomplete input may be replayed when a JetBrains IDEA
session is resumed. Without these guards, ACP crashes with:
```
TypeError: Cannot read properties of undefined (reading 'limit')
TypeError: Cannot read properties of undefined (reading '-i')
TypeError: Cannot read properties of undefined (reading 'todos')
```
All three crashes share the same root cause: the ACP bridge assumes
`tool_use.input` is always defined, but it can be `undefined` during
streaming early chunks or session history replay.
## Test plan
- [x] Added regression tests for `toolInfoFromToolUse()` with `input:
undefined` (Read, Grep, Glob, WebSearch, TodoWrite)
- [x] Added regression test for `planEntries(undefined)` — returns `[]`
- [x] Added regression test for `planEntries({})` — graceful handling
- [x] Added regression test for `toAcpNotifications()` with TodoWrite +
undefined input — no crash, no spurious plan update
- [x] Added regression test verifying TodoWrite + valid input still
emits plan update
- [x] `npm run build` passes with no TypeScript errors
- [x] All 167 tests pass (10 new)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
The auth subcommand goes through a flow that requires pasting in a code
on remote environments, but does not allow for pasting that code in.
Until they fix this in the CLI subcommand, we'll have to go to the old
flow of launching the full CLI.
Bumps [@hono/node-server](https://github.com/honojs/node-server) from
1.19.12 to 1.19.13.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/node-server/releases"><code>@hono/node-server</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v1.19.13</h2>
<h2>Security Fix</h2>
<p>Fixed an issue in Serve Static Middleware where inconsistent handling
of repeated slashes (<code>//</code>) between the router and static file
resolution could allow middleware to be bypassed. Users of Serve Static
Middleware are encouraged to upgrade to this version.</p>
<p>See GHSA-92pp-h63x-v22m for details.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fd64e659a3"><code>fd64e65</code></a>
1.19.13</li>
<li><a
href="025c30f55d"><code>025c30f</code></a>
Merge commit from fork</li>
<li>See full diff in <a
href="https://github.com/honojs/node-server/compare/v1.19.12...v1.19.13">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/agentclientprotocol/claude-agent-acp/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [hono](https://github.com/honojs/hono) from 4.12.11 to 4.12.12.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.12</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Middleware bypass via repeated slashes in serveStatic</h3>
<p>Affects: Serve Static middleware. Fixes a path normalization
inconsistency where repeated slashes (<code>//</code>) could bypass
route-based middleware protections and allow access to protected static
files. GHSA-wmmm-f939-6g9c</p>
<h3>Path traversal in toSSG() allows writing files outside the output
directory</h3>
<p>Affects: <code>toSSG()</code> for Static Site Generation. Fixes a
path traversal issue where crafted <code>ssgParams</code> values could
write files outside the configured output directory.
GHSA-xf4j-xp2r-rqqx</p>
<h3>Incorrect IP matching in ipRestriction() for IPv4-mapped IPv6
addresses</h3>
<p>Affects: IP Restriction Middleware. Fixes improper handling of
IPv4-mapped IPv6 addresses (e.g. <code>::ffff:127.0.0.1</code>) that
could cause allow/deny rules to be bypassed. GHSA-xpcf-pg52-r92g</p>
<h3>Missing validation of cookie name on write path in setCookie()</h3>
<p>Affects: <code>setCookie()</code>, <code>serialize()</code>, and
<code>serializeSigned()</code> from <code>hono/cookie</code>. Fixes
missing validation of cookie names on the write path, preventing
inconsistent handling between parsing and serialization.
GHSA-26pp-8wgv-hjvm</p>
<h3>Non-breaking space prefix bypass in cookie name handling in
getCookie()</h3>
<p>Affects: <code>getCookie()</code> from <code>hono/cookie</code>.
Fixes a discrepancy in cookie name handling that could allow
attacker-controlled cookies to override legitimate ones and bypass
prefix protections. GHSA-r5rp-j6wh-rvv4</p>
<hr />
<p>Users who use Serve Static, Static Site Generation, Cookie utilities,
or IP restriction middleware are strongly encouraged to upgrade to this
version.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c37ba26da9"><code>c37ba26</code></a>
4.12.12</li>
<li><a
href="cc067c8559"><code>cc067c8</code></a>
Merge commit from fork</li>
<li><a
href="a586cd72e3"><code>a586cd7</code></a>
Merge commit from fork</li>
<li><a
href="48fa2233bc"><code>48fa223</code></a>
Merge commit from fork</li>
<li><a
href="b470278920"><code>b470278</code></a>
Merge commit from fork</li>
<li><a
href="9aff14bd72"><code>9aff14b</code></a>
Merge commit from fork</li>
<li>See full diff in <a
href="https://github.com/honojs/hono/compare/v4.12.11...v4.12.12">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/agentclientprotocol/claude-agent-acp/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Closes#512
Fingerprint session-defining params to detect cwd or MCP server
changes, reuse sessions when unchanged, and ignore MCP server
ordering differences. Extract session teardown into a helper and add
tests covering reuse and recreation paths.
Title:
fix: ANTHROPIC_MODEL env var not respected in ACP agent model selection
Body:
## Summary
The `ANTHROPIC_MODEL` environment variable is not being respected when
using Claude Code via the ACP (Agent Client Protocol). This causes users
who set their preferred model via
environment variable to have their setting ignored, with the default
model (`claude-sonnet-4-6`) being used instead.
## Problem
When using Claude Code through ACP integrations (e.g., agent platforms),
users expect the `ANTHROPIC_MODEL` environment variable to control which
model is used for LLM requests.
However, the current implementation only checks `settings.model` (from
configuration files) and completely ignores `ANTHROPIC_MODEL`.
## Root Cause
In `src/acp-agent.ts`, the `getAvailableModels` function only checks
`settings.model`:
```typescript
let currentModel = models[0];
if (settings.model) {
const match = resolveModelPreference(models, settings.model);
if (match) {
currentModel = match;
}
}
The ANTHROPIC_MODEL environment variable is never read, so
environment-based model configuration is silently ignored.
Reproduction
1. Set ANTHROPIC_MODEL=glm-4.7 (or any custom model)
2. Start Claude Code via ACP protocol
3. Send a prompt request
4. Capture network traffic - the actual model used is claude-sonnet-4-6
instead of glm-4.7
Fix
Added priority-based model selection that respects the ANTHROPIC_MODEL
environment variable, aligning with the main Claude Code CLI behavior:
// Model priority (highest to lowest):
// 1. ANTHROPIC_MODEL environment variable
// 2. settings.model (user configuration)
// 3. models[0] (default first model)
if (process.env.ANTHROPIC_MODEL) {
const match = resolveModelPreference(models,
process.env.ANTHROPIC_MODEL);
if (match) {
currentModel = match;
}
} else if (settings.model) {
const match = resolveModelPreference(models, settings.model);
if (match) {
currentModel = match;
}
}
This matches the model selection priority used by the main Claude Code
CLI.
Testing
- Verified ANTHROPIC_MODEL is now respected when set
- Verified settings.model still works when ANTHROPIC_MODEL is not set
- Verified default model (models[0]) is used when neither is set
Breaking Change
None - this fix makes behavior more consistent with user expectations
and the main CLI.
ACP version is `v0.25.0`. Should be the newest.
I get this error when pressing Shift+Tab to cycle through the modes:
```
Caused by:
RPC request LspQuery failed: unknown buffer id 12884902333
2026-04-05T21:46:02+00:00 WARN [agent_servers::acp] agent stderr: Error handling request {
2026-04-05T21:46:02+00:00 WARN [agent_servers::acp] agent stderr: jsonrpc: '2.0',
2026-04-05T21:46:02+00:00 WARN [agent_servers::acp] agent stderr: id: 48,
2026-04-05T21:46:02+00:00 WARN [agent_servers::acp] agent stderr: method: 'session/set_config_option',
2026-04-05T21:46:02+00:00 WARN [agent_servers::acp] agent stderr: params: {
2026-04-05T21:46:02+00:00 WARN [agent_servers::acp] agent stderr: sessionId: '$UUID_GOES_HERE',
2026-04-05T21:46:02+00:00 WARN [agent_servers::acp] agent stderr: configId: 'mode',
2026-04-05T21:46:02+00:00 WARN [agent_servers::acp] agent stderr: value: 'auto'
2026-04-05T21:46:02+00:00 WARN [agent_servers::acp] agent stderr: }
2026-04-05T21:46:02+00:00 WARN [agent_servers::acp] agent stderr: } {
2026-04-05T21:46:02+00:00 WARN [agent_servers::acp] agent stderr: code: -32603,
2026-04-05T21:46:02+00:00 WARN [agent_servers::acp] agent stderr: message: 'Internal error',
2026-04-05T21:46:02+00:00 WARN [agent_servers::acp] agent stderr: data: { details: 'Invalid Mode' }
2026-04-05T21:46:02+00:00 WARN [agent_servers::acp] agent stderr: }
2026-04-05T21:46:02+00:00 ERROR [agent_ui::config_options] Failed to set config option: Internal error: {
"details": "Invalid Mode"
}
```
I looked through the code on both sides and I think what might be
happening is, here are the modes:
f422c7c954/src/acp-agent.ts (L236-L244)
When a user gets to `bypassPermissions` and cycle again, the next
selected mode is `auto` but that option seems to be missing from here:
f422c7c954/src/acp-agent.ts (L1007-L1013)
Could the maintainers please help verify and test?
Signed-off-by: k4yt3x <i@k4yt3x.com>
Bumps
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript)
from 0.80.0 to 0.81.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/releases"><code>@anthropic-ai/sdk</code>'s
releases</a>.</em></p>
<blockquote>
<h2>sdk: v0.81.0</h2>
<h2>0.81.0 (2026-03-31)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.80.0...sdk-v0.81.0">sdk-v0.80.0...sdk-v0.81.0</a></p>
<h3>Features</h3>
<ul>
<li>add .type field to APIError for error kind identification (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/790">#790</a>)
(<a
href="4bf637d962">4bf637d</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>memory:</strong> append path separator in validatePath
prefix check (<a
href="0ac69b3438">0ac69b3</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>ci:</strong> run builds on CI even if only spec metadata
changed (<a
href="70b657aac1">70b657a</a>)</li>
<li><strong>ci:</strong> skip lint on metadata-only changes (<a
href="69bdc94a16">69bdc94</a>)</li>
<li><strong>internal:</strong> codegen related update (<a
href="7ff7390029">7ff7390</a>)</li>
<li><strong>internal:</strong> update gitignore (<a
href="46d66675d5">46d6667</a>)</li>
<li><strong>internal:</strong> update multipart form array serialization
(<a
href="d55b07d4f7">d55b07d</a>)</li>
<li><strong>tests:</strong> bump steady to v0.19.4 (<a
href="4957a5e65b">4957a5e</a>)</li>
<li><strong>tests:</strong> bump steady to v0.19.5 (<a
href="c511ae0421">c511ae0</a>)</li>
<li><strong>tests:</strong> bump steady to v0.19.6 (<a
href="6d2b4b910a">6d2b4b9</a>)</li>
<li><strong>tests:</strong> bump steady to v0.19.7 (<a
href="d6cff9d2c8">d6cff9d</a>)</li>
<li><strong>tests:</strong> bump steady to v0.20.1 (<a
href="284561fe36">284561f</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md"><code>@anthropic-ai/sdk</code>'s
changelog</a>.</em></p>
<blockquote>
<h2>0.81.0 (2026-03-31)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.80.0...sdk-v0.81.0">sdk-v0.80.0...sdk-v0.81.0</a></p>
<h3>Features</h3>
<ul>
<li>add .type field to APIError for error kind identification (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/790">#790</a>)
(<a
href="4bf637d962">4bf637d</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>memory:</strong> append path separator in validatePath
prefix check (<a
href="0ac69b3438">0ac69b3</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>ci:</strong> run builds on CI even if only spec metadata
changed (<a
href="70b657aac1">70b657a</a>)</li>
<li><strong>ci:</strong> skip lint on metadata-only changes (<a
href="69bdc94a16">69bdc94</a>)</li>
<li><strong>internal:</strong> codegen related update (<a
href="7ff7390029">7ff7390</a>)</li>
<li><strong>internal:</strong> update gitignore (<a
href="46d66675d5">46d6667</a>)</li>
<li><strong>internal:</strong> update multipart form array serialization
(<a
href="d55b07d4f7">d55b07d</a>)</li>
<li><strong>tests:</strong> bump steady to v0.19.4 (<a
href="4957a5e65b">4957a5e</a>)</li>
<li><strong>tests:</strong> bump steady to v0.19.5 (<a
href="c511ae0421">c511ae0</a>)</li>
<li><strong>tests:</strong> bump steady to v0.19.6 (<a
href="6d2b4b910a">6d2b4b9</a>)</li>
<li><strong>tests:</strong> bump steady to v0.19.7 (<a
href="d6cff9d2c8">d6cff9d</a>)</li>
<li><strong>tests:</strong> bump steady to v0.20.1 (<a
href="284561fe36">284561f</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="bc1a2ff79c"><code>bc1a2ff</code></a>
chore: release main (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/955">#955</a>)</li>
<li>See full diff in <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.80.0...sdk-v0.81.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/agentclientprotocol/claude-agent-acp/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
The `usage_update` notification reports `size: 200000` even when the
active model has a 1M context window (e.g. `opus[1m]`), causing clients
to display incorrect context utilization (e.g. `689k/200k (344.3%)`
instead of `689k/1000k (68.9%)`).
Four bugs fixed:
- **Min across all models**: The original code used `Math.min` across
all `modelUsage` entries, so subagent models (Sonnet/Haiku with 200k
windows) dragged down the reported size for the main Opus 1M model. Now
tracks the top-level assistant model and looks up its context window
specifically.
- **Model name mismatch**: The SDK's streaming path keys `modelUsage` by
the requested model alias (e.g. `claude-opus-4-6`) while
`BetaMessage.model` on assistant messages has the resolved API response
model (e.g. `claude-opus-4-6-20250514`). The exact-match lookup always
missed, falling back to the hardcoded 200k default. Now falls back to
prefix matching, preferring the longest/most-specific match.
- **Synthetic messages corrupt model tracking**: `/compact` and similar
commands emit assistant messages with `model: "<synthetic>"`. These were
updating `lastAssistantModel`, causing the next `usage_update` to miss
the `modelUsage` lookup and fall back to the 200k default. Now filters
out `<synthetic>` models.
- **Stale usage after compaction**: No `usage_update` was sent on
`compact_boundary`, so clients kept showing the pre-compaction context
size (e.g. `944k/1m`) right after "Compacting completed" until the next
full turn. Now sends `used: 0` immediately on compaction. This is a
deliberate approximation — the exact post-compaction size isn't known
until the SDK's next API call, which replaces it within seconds. The
alternative (no update) is worse UX: showing a full context bar right
after compaction.
Eight new tests cover: token sum correctness, current-model context
window lookup, model switching, subagent isolation, prefix matching in
both directions, and synthetic message filtering.
Note: `bin/test` (local CI validation script) is cherry-picked from
#353.
Would fix `agent-shell`'s usage indicator which currently has to defend
against this broken math:
https://github.com/xenodium/agent-shell/pull/364
## Testing
- [x] Manual riding with it for a bit.
---------
Co-authored-by: Tim Visher <194828183+timvisher-dd@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Steffen Deusch <steffen@deusch.me>
## Summary
- **Concurrent `setCwd()` calls** could produce duplicate file watchers
because both calls cleared `initialized` before either completed
`initialize()`. Added an `initPromise` guard so concurrent calls await
the same initialization.
- **Debounce timer callback** could fire after `dispose()`, reloading
stale settings and calling `onChange` on a disposed manager. Added a
`disposed` flag checked in the async callback before proceeding.
Follows up on #454 which fixed the missing `dispose()` calls — this PR
hardens the `SettingsManager` lifecycle against race conditions.
## Test plan
- [x] `npm run lint` passes
- [x] All settings tests pass
- [x] Verified `disposed` flag prevents stale callback execution
- [x] Verified `initPromise` deduplicates concurrent `initialize()`
calls
## Summary
- `loadSettingsFile()` silently returned `{}` for **all** errors
including malformed JSON, permission errors, and unexpected file content
- Only `ENOENT` (file not found) should be silent since missing settings
files are expected
- Other errors now log a warning via the logger to help diagnose
misconfigured settings (e.g. a typo in `settings.json` was previously
completely invisible)
## Test plan
- [x] `npm run lint` passes
- [x] All settings tests pass
- [x] Missing files still return `{}` silently (ENOENT path unchanged)
- [x] Malformed JSON now produces a logged warning
Bumps the minor group with 2 updates:
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Updates `@anthropic-ai/claude-agent-sdk` from 0.2.83 to 0.2.84
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases"><code>@anthropic-ai/claude-agent-sdk</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v0.2.84</h2>
<h2>What's changed</h2>
<ul>
<li>Added <code>taskBudget</code> option for API-side token budget
awareness, allowing the model to pace tool use within a token limit</li>
<li>Added <code>enableChannel()</code> method and
<code>capabilities</code> field on <code>McpServerStatus</code> for
SDK-driven MCP channel activation</li>
<li>Exported <code>EffortLevel</code> type (<code>'low' | 'medium' |
'high' | 'max'</code>) for consumers to reference effort values
directly</li>
<li>Fixed showing "[Request interrupted by user]" for errors
that were not caused by user interruption</li>
<li>Updated to parity with Claude Code v2.1.84</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.2.84
# or
yarn add @anthropic-ai/claude-agent-sdk@0.2.84
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.2.84
# or
bun add @anthropic-ai/claude-agent-sdk@0.2.84
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md"><code>@anthropic-ai/claude-agent-sdk</code>'s
changelog</a>.</em></p>
<blockquote>
<h2>0.2.84</h2>
<ul>
<li>Added <code>taskBudget</code> option for API-side token budget
awareness, allowing the model to pace tool use within a token limit</li>
<li>Added <code>enableChannel()</code> method and
<code>capabilities</code> field on <code>McpServerStatus</code> for
SDK-driven MCP channel activation</li>
<li>Exported <code>EffortLevel</code> type (<code>'low' | 'medium' |
'high' | 'max'</code>) for consumers to reference effort values
directly</li>
<li>Fixed showing "[Request interrupted by user]" for errors
that were not caused by user interruption</li>
<li>Updated to parity with Claude Code v2.1.84</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ba2688c1d4"><code>ba2688c</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.2.83...v0.2.84">compare
view</a></li>
</ul>
</details>
<br />
Updates `vite` from 8.0.2 to 8.0.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>create-vite@8.0.3</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/create-vite@8.0.3/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.3</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.2...v8.0.3">8.0.3</a>
(2026-03-26)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>update rolldown to 1.0.0-rc.12 (<a
href="https://redirect.github.com/vitejs/vite/issues/22024">#22024</a>)
(<a
href="84164ef47b">84164ef</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>html:</strong> cache unfiltered CSS list to prevent missing
styles across entries (<a
href="https://redirect.github.com/vitejs/vite/issues/22017">#22017</a>)
(<a
href="5464190a3e">5464190</a>)</li>
<li><strong>module-runner:</strong> handle non-ascii characters in
base64 sourcemaps (<a
href="https://redirect.github.com/vitejs/vite/issues/21985">#21985</a>)
(<a
href="77c95bff83">77c95bf</a>)</li>
<li><strong>module-runner:</strong> skip re-import if the runner is
closed (<a
href="https://redirect.github.com/vitejs/vite/issues/22020">#22020</a>)
(<a
href="ee2c2cd2c2">ee2c2cd</a>)</li>
<li><strong>optimizer:</strong> scan is not resolving sub path import if
used in a glob import (<a
href="https://redirect.github.com/vitejs/vite/issues/22018">#22018</a>)
(<a
href="ddfe20d19e">ddfe20d</a>)</li>
<li><strong>ssr:</strong> ssrTransform incorrectly rewrites
<code>meta</code> identifier inside <code>import.meta</code> when a
binding named <code>meta</code> exists (<a
href="https://redirect.github.com/vitejs/vite/issues/22019">#22019</a>)
(<a
href="cff5f0cca5">cff5f0c</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> bump picomatch from 4.0.3 to 4.0.4 (<a
href="https://redirect.github.com/vitejs/vite/issues/22027">#22027</a>)
(<a
href="7e56003fec">7e56003</a>)</li>
</ul>
<h3>Tests</h3>
<ul>
<li><strong>html:</strong> add tests for
<code>getCssFilesForChunk</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/22016">#22016</a>)
(<a
href="43fbbf9a09">43fbbf9</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6a34ac3422"><code>6a34ac3</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21096">#21096</a>)</li>
<li><a
href="02ceaec45e"><code>02ceaec</code></a>
chore(deps): update dependency <code>@rollup/plugin-commonjs</code> to
v29 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21099">#21099</a>)</li>
<li><a
href="572aaca459"><code>572aaca</code></a>
release: v7.2.2</li>
<li><a
href="728c8eeebc"><code>728c8ee</code></a>
fix: revert "refactor: use fs.cpSync (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21019">#21019</a>)"
(<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21081">#21081</a>)</li>
<li><a
href="a532e68c6b"><code>a532e68</code></a>
release: v7.2.1</li>
<li><a
href="82d2d6ccf5"><code>82d2d6c</code></a>
fix(worker): some worker asset was missing (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21074">#21074</a>)</li>
<li><a
href="f83264f5d9"><code>f83264f</code></a>
refactor(build): rename <code>indexOfMatchInSlice</code> to
<code>findPreloadMarker</code> (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21054">#21054</a>)</li>
<li><a
href="8293de0e17"><code>8293de0</code></a>
release: v7.2.0</li>
<li><a
href="2833c5576a"><code>2833c55</code></a>
fix(types): add undefined to optional properties for
exactOptionalProperties ...</li>
<li><a
href="e3a6a83406"><code>e3a6a83</code></a>
chore(deps): update rolldown-related dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21047">#21047</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite/commits/create-vite@8.0.3/packages/vite">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#463 introduced a problem with cancelling prompts. Because cancel exited
the loop early, the idle session state message was not consumed. Then,
in the next prompt, we'd immediately get the idle state and assume it's
done.
Instead, we always wait for the idle state (and still finish early when
detecting a queued prompt).
Note that this is based on my tests that showed Claude only sending the
idle state when all background agents are done.
---------
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
-`/mcp` in the chat: the MCP server status as a list. The adapter runs `/mcp reconnect`, `/mcp enable`, and `/mcp disable` through the SDK control API, because Claude Code refuses them in SDK mode. A reconnect of an ACP server that needs authentication starts MCP OAuth through URL elicitation
- Session-scoped long-running goals for AIR through the [goal extension](docs/air-extensions.md#goal) under `_meta.jetbrains.air.goal`
- Structured errors, recovery, and warnings through the opt-in [session failure extension](docs/air-extensions.md#session-failure)
- Concrete model and effort defaults through the opt-in [recommended config value extension](docs/air-extensions.md#recommended-config-values)
- Tool permission presentation, editable choices, and durable effects through the [permission extension](docs/air-extensions.md#permission-presentation)
- One fact per field in every tool call report, as the [ACP tool call contract](docs/air-extensions.md#tool-call-contract) defines
- All AIR extensions, capabilities, and `_meta` keys: [AIR extensions](docs/air-extensions.md)
Learn more about the [Agent Client Protocol](https://agentclientprotocol.com/).
To try changes that have landed on `main` but are not released yet, install from the
`preview` channel — every push to `main` publishes one. See
A client that declares `clientCapabilities.subagents`, other than JetBrains AIR, gets each Agent or
Task subagent as its own child session, following the [subagents RFD](https://github.com/agentclientprotocol/agent-client-protocol/blob/main/docs/rfds/subagents.mdx):
-`subagent_update` on the parent announces the child before any of its traffic, with the
parent's `title` and `description` for it, and reports its work state: `running`,
`requires_action` while one of its requests is open (and `running` again when the last one ends,
unless a cancel withdrew it: the child is stopping then), and `idle` when its work ends, with
`end_turn` or `cancelled` when the SDK gives the reason. A failure is `idle` with the `error`
stop reason and the SDK's error text as its `error`. The child keeps its session for every
delegation to it.
- The prompt of the Agent or Task call that launches the child, and the message of each
SendMessage call that resumes it, is a `session_message` in the child's transcript. The tool
call stays a tool call of the session that made it.
-`session/cancel` on the parent interrupts Claude Code, which stops the foreground children that
the turn waits on. Background children keep running, as the RFD prefers; a client stops one with
its own `cancel`. Each stopped child reports `idle` with `cancelled` from Claude Code's own
events, and its open requests are withdrawn. The adapter ends no child at a cancel itself, so a
child that keeps running keeps its open requests and its open tool calls. To spare background
children, the adapter declares the SDK option `perTaskStopAffordance`, which a client can turn
off in `_meta.claudeCode.options`. That option spares background workflows too, which a client
cannot stop, so the adapter stops them after the interrupt, as Claude Code did without it.
Background commands keep running after a cancel either way. A tool call of a stopped child that Claude Code reports no
result for, such as the command it was running, ends in the child's session before the cancelled
prompt resolves. When Claude Code stops a background child after that, or while no prompt runs,
the tool call ends right after the child reports `idle`. A child that still runs when Claude Code
exits is `idle` with no stop reason.
- A child whose parent is not yet known when it ends is not exposed, since the RFD forbids
guessing its parent.
- A replay restores each child under its live session id, from its own transcript: its prompt and
each SendMessage message are `session_message`s, and its end is an `idle` before the response.
A launch without Claude Code's metadata file for the child stays an ordinary tool call of the
parent, and a notice, for a client that takes notices, says that subagent history is missing.
- After a load or resume, with or without replay, a SendMessage that resumes an agent from before
it runs that agent in its session from before. Before the agent's traffic, each of its ancestors
that the client was not told about in this connection is announced, parent before child and
with no work state, as the RFD requires. An agent whose launch the session's history does not
record stays unexposed.
- Each running child is announced with the `cancel` capability. `session/cancel` with the child's
session id stops that child's current work, through the SDK's `Query.stopTask`, and not its
parent's: Claude Code also stops the foreground children it waits on, and the parent's turn goes
on. Each stopped child reports `idle` with `cancelled` from Claude Code's own events, and its
requests that the stop withdraws report no `running` first. A replayed child, which no longer
runs, gets no capabilities. A client cannot prompt or otherwise change a child.
An [ACP v2](#experimental-acp-v2) client gets the same without declaring anything, since subagents
are part of v2's baseline. Each child also reports its work state as its own `state_update`, right
after the parent's copy.
JetBrains AIR keeps the earlier draft of the RFD (`subagent_spawned`, `subagent_state_update`),
which it enables with `nativeSubagentSessions` in `_meta.jetbrains.air.capabilities`. See
When using claude-agent-acp with alternative providers (e.g. AWS Bedrock), model IDs differ from the direct Anthropic API. The `CLAUDE_MODEL_CONFIG` environment variable lets you configure model overrides and availability at the deployment level.
An ACP caller can provide `settings` via `_meta.claudeCode.options.settings` in `session/new` or `session/load`, as an object or a path to a settings file. The adapter merges `CLAUDE_MODEL_CONFIG` into those settings, so a caller that only adds hooks keeps the model settings. When both set the same key, the caller wins; the merge is shallow, so a caller's `modelOverrides` replaces the env var's map.
| `_meta.claudeCode.options.settings` (caller) | Highest — wins for each key it sets |
| `CLAUDE_MODEL_CONFIG` (env var) | Used for the keys that the caller does not set |
## Format details
- The value must be valid JSON. Invalid JSON will cause session creation to fail with a parse error.
- Only `modelOverrides` and `availableModels` keys are read; other keys in the JSON are ignored.
- Both fields map directly to the Claude Agent SDK's `Settings` type.
## Models of a `providers/set` gateway
When an ACP client routes the agent through a gateway with `providers/set`, the adapter lists the gateway's models before `providers/set` returns, with the provider headers:
-`anthropic`: `GET {baseUrl}/v1/models`, paginated by `has_more`/`last_id`.
-`bedrock`: `GET {baseUrl}/foundation-models` (Bedrock `ListFoundationModels`, `modelSummaries[].modelId`). Only `anthropic.` ids count. The cross-region prefix `global` when listed, else that of the first listed id with one (`eu` for `eu.anthropic.claude-sonnet-5`), becomes the session's `ANTHROPIC_BEDROCK_REGION_PREFIX`, and ids with other prefixes, or without one, are dropped.
The model picker then offers only the SDK models whose resolved model the gateway lists, matched without dates, version suffixes (`-v1:0`), `-fast`, `@` suffixes, context hints (`[1m]`) and provider prefixes, after the `availableModels` allowlist above. On Bedrock, a model the CLI resolved to another region prefix is dropped as well. When the gateway does not list the model a session runs, that is the default model or a resumed session's last model, the session switches to the first remaining picker row.
A 4xx answer means the gateway has no listing: `providers/set` succeeds and nothing is narrowed. A failed listing (network error, a status other than 2xx or 4xx, unexpected body, the 10 s timeout, an invalid header, or a base URL with credentials) fails `providers/set` with a JSON-RPC internal error, and the previous provider stays in effect. A listing that matches no SDK model leaves the session with no model to offer: there is no model config option. Gateways set through `authenticate`, `vertex` providers, and native routing are not listed. Setting the same gateway again (the same protocol, base URL and headers) reuses its listing, unless it answered 4xx; `providers/set` and `providers/disable` apply in the order they arrive, and logout clears the routing after `claude auth logout`, including a `providers/set` still listing; `providers/disable` and logout drop it.
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"availableCommands":[{"description":"Show the MCP servers and their status, or reconnect, enable, or disable a server","input":{"hint":"[reconnect|enable|disable [<server>|all]]"},"name":"mcp"}],"sessionUpdate":"available_commands_update"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"_meta":{"claudeCode":{"toolName":"AskUserQuestion"}},"content":[],"kind":"other","name":"AskUserQuestion","sessionUpdate":"tool_call","status":"pending","title":"Asking for your input","toolCallId":"toolu_ask"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"rawInput":{"questions":[{"header":"Database","multiSelect":false,"options":[{"description":"Relational","label":"Postgres","preview":"CREATE TABLE t ();"},{"description":"Key-value","label":"Redis"}],"question":"Which database?"}]},"sessionUpdate":"tool_call_update","toolCallId":"toolu_ask"}}}
{"kind":"createElicitation","payload":{"message":"Which database?","mode":"form","requestedSchema":{"properties":{"question_0":{"oneOf":[{"_meta":{"_claude/askUserQuestionOption":{"preview":"CREATE TABLE t ();"}},"const":"Postgres","description":"Relational","title":"Postgres"},{"const":"Redis","description":"Key-value","title":"Redis"}],"title":"Database","type":"string"},"question_0_custom":{"_meta":{"_askUserQuestionCustomAnswer":{"isCustomAnswer":true,"questionId":"question_0"},"jetbrains":{"air":{"customAnswer":{"isCustomAnswer":true,"questionId":"question_0"},"version":1}}},"description":"Type your own answer, or add a note to the option you chose above (optional).","title":"Other","type":"string"}},"type":"object"},"sessionId":"<session>","toolCallId":"toolu_ask"}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"content":[{"content":{"text":"User has answered your questions: \"Which database?\"=\"Postgres\".","type":"text"},"type":"content"}],"sessionUpdate":"tool_call_update","status":"completed","toolCallId":"toolu_ask"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"availableCommands":[{"description":"Show the MCP servers and their status, or reconnect, enable, or disable a server","input":{"hint":"[reconnect|enable|disable [<server>|all]]"},"name":"mcp"}],"sessionUpdate":"available_commands_update"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"availableCommands":[{"description":"Show the MCP servers and their status, or reconnect, enable, or disable a server","input":{"hint":"[reconnect|enable|disable [<server>|all]]"},"name":"mcp"}],"sessionUpdate":"available_commands_update"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"asyncTaskId":"workflow_3","canStop":true,"description":"Watch the logs","name":"Watch the logs","sessionUpdate":"async_task_spawned","showInTranscript":true,"taskType":"workflow","toolCallId":"toolu_workflow"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"availableCommands":[{"description":"Show the MCP servers and their status, or reconnect, enable, or disable a server","input":{"hint":"[reconnect|enable|disable [<server>|all]]"},"name":"mcp"}],"sessionUpdate":"available_commands_update"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"availableCommands":[{"description":"Show the MCP servers and their status, or reconnect, enable, or disable a server","input":{"hint":"[reconnect|enable|disable [<server>|all]]"},"name":"mcp"}],"sessionUpdate":"available_commands_update"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"_meta":{"jetbrains":{"air":{"asyncTasks":{"backgrounded":true}}},"terminal_output_delta":{"data":"Command running in background with ID: bash_1. Output is being written to: /tmp/tasks/bash_1.output. You will be notified when it completes.","terminal_id":"toolu_bg"}},"sessionUpdate":"tool_call_update","toolCallId":"toolu_bg"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"availableCommands":[{"description":"Show the MCP servers and their status, or reconnect, enable, or disable a server","input":{"hint":"[reconnect|enable|disable [<server>|all]]"},"name":"mcp"}],"sessionUpdate":"available_commands_update"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"availableCommands":[{"description":"Show the MCP servers and their status, or reconnect, enable, or disable a server","input":{"hint":"[reconnect|enable|disable [<server>|all]]"},"name":"mcp"}],"sessionUpdate":"available_commands_update"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"availableCommands":[{"description":"Show the MCP servers and their status, or reconnect, enable, or disable a server","input":{"hint":"[reconnect|enable|disable [<server>|all]]"},"name":"mcp"}],"sessionUpdate":"available_commands_update"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"_meta":{"jetbrains":{"air":{"contextCompaction":{"error":"Context too small","version":1}}}},"content":[{"content":{"text":"Compaction failed: Context too small","type":"text"},"type":"content"}],"sessionUpdate":"tool_call_update","status":"failed","toolCallId":"00000000-0000-4000-8000-000000000001"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"availableCommands":[{"description":"Show the MCP servers and their status, or reconnect, enable, or disable a server","input":{"hint":"[reconnect|enable|disable [<server>|all]]"},"name":"mcp"}],"sessionUpdate":"available_commands_update"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"availableCommands":[{"description":"Show the MCP servers and their status, or reconnect, enable, or disable a server","input":{"hint":"[reconnect|enable|disable [<server>|all]]"},"name":"mcp"}],"sessionUpdate":"available_commands_update"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"availableCommands":[{"description":"Show the MCP servers and their status, or reconnect, enable, or disable a server","input":{"hint":"[reconnect|enable|disable [<server>|all]]"},"name":"mcp"}],"sessionUpdate":"available_commands_update"}}}
{"kind":"requestPermission","payload":{"_meta":{"jetbrains":{"air":{"permission":{"title":"Edit src/app.ts","version":1},"version":1}}},"options":[{"kind":"allow_once","name":"Yes","optionId":"allow-once"},{"kind":"reject_once","name":"No","optionId":"reject"}],"sessionId":"<session>","toolCall":{"content":[{"_meta":{"jetbrains":{"air":{"diffPatch":{"format":"git_patch","text":"diff --git a<cwd>/src/app.ts b<cwd>/src/app.ts\n--- a<cwd>/src/app.ts\n+++ b<cwd>/src/app.ts\n@@ -1 +1 @@\n-const value = 1;\n+const value = 2;\n","version":1},"version":1}}},"newText":"","oldText":null,"path":"<cwd>/src/app.ts","type":"diff"}],"rawInput":{"file_path":"<cwd>/src/app.ts"},"title":"Edit src/app.ts","toolCallId":"toolu_edit"}}}
{"kind":"sessionUpdate","payload":{"sessionId":"<session>","update":{"content":[{"content":{"text":"```\nThe user doesn't want to proceed with this tool use. The tool use was rejected.\n```","type":"text"},"type":"content"}],"sessionUpdate":"tool_call_update","status":"failed","toolCallId":"toolu_edit"}}}
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
