fix: scope authentication cancellation and initial status delivery - #720

## Summary

Continues the original SDK 2.2 audit at specification baseline
`d5e9949c3e6a9cd072adebaa44e6f63289590c17`. No later specification
changes are included.

The missing cancellation-crossing-next-prompt test exposed a real bug:
an old `turn/interrupt` could return `no active turn to interrupt` after
a newer prompt started. Retry eligibility checked only whether *any*
prompt was active, then recomputed the turn ID from the newer prompt's
state. The old cancellation could therefore interrupt work received
after it.

- Bind interrupt retries to the original active-prompt identity and its
registered turn, rather than to the presence of any active prompt.
- Recheck ownership after retry waits and while awaiting child
interruption/pending turn starts.
- Do not remap an explicit late turn ID through a newer prompt's
registered state.
- Keep legitimate same-prompt registration retries, including the
existing shared v1 cancellation behavior.
- Add a v2 wire regression matrix for acknowledgement-before-completion,
completion-before-acknowledgement, and a delayed no-active-turn error.
Earlier queued prompts are cancelled; later prompts run normally and are
never targeted by the old interrupt.

## Validation

- `npm run typecheck`: passed
- `npm run build`: passed
- `npm test`: 2,368 passed, 39 skipped
- `npm run test:integration`: all 19 passed
- `git diff --check`: passed

The late-error regression failed before the implementation fix by
observing an extra interrupt against `turn-2`. Existing v1 cancellation
and retry tests pass unchanged. The real-Codex integration matrix covers
normal cancellation and child ownership; the exact delayed-error race is
injected through the native mock for deterministic wire coverage. Opt-in
E2E tests were not run.

This PR is independently based on main and does not include #720, #721,
or #722. No review Markdown file is included.

## Summary

Continues the original SDK 2.2 audit at specification baseline
`d5e9949c3e6a9cd072adebaa44e6f63289590c17`. No later specification
features are added.

- Extend the existing child configuration/readback owner to publish
verified absolute child `cwd` values as standard `subagent_update`
frames on the immediate parent.
- Do not reset directory fields on announcements or replay. `null`
explicitly means inheritance, not unknown placement. Keep retained
overrides until verified current data replaces them, rather than
temporarily replacing a worktree path with the parent's directory.
- Reuse native child-ID, parent-ID, loaded-state, attachment, and
pending-read checks. Current native settings outrank older readback.
Optional readback does not block child output.
- Omit `additionalDirectories`: Codex does not expose an authoritative
child ACP additional-directory list. Do not infer it from provider IDs,
parent roots, or writable sandbox paths, and do not report `[]` or
`null` as a substitute for unknown data.
- Keep AIR's legacy subagent-event contract unchanged.

## Validation

- `npm run typecheck`: passed
- `npm run build`: passed
- `npm test`: 2,379 passed, 39 skipped
- `npm run test:integration`: all 19 passed; the real-Codex child matrix
verifies directory publication before and after reattachment on both
protocol versions
- `git diff --check`: passed

Dual-version wire coverage includes worktree placement, nested parent
routing, replay without inheritance resets, unavailable current
placement, invalid paths, superseded reads, unload/close, and
foreign/mismatched child readback. Existing lifecycle goldens include
the verified directory updates; these goldens consistently end with a
newline.

Includes the same Linux-aware background-process test probe as
#720/#721: Linux zombie/dead PIDs are exited even while they remain
unreaped. A live process at the close-response boundary still fails the
assertion; no post-close wait is added.

The real-Codex integration matrix directly verifies directory behavior.
Opt-in E2E tests were not run. This PR is independently based on main
and does not include #720 or #721. No review Markdown file is included.

…otocol#720, agentclientprotocol#722, agentclientprotocol#723

Conflicts came almost entirely from the fork's bun fmt reformatting. They
were resolved by formatting the merge base and upstream side with the
repository's bun fmt settings and re-running the three-way merge, then
resolving the remaining semantic hunks by hand:

- CodexEventHandler: keep the fork's live _meta.codex.turnId tagging and
  publish the tagged update through upstream's composing publishUpdate.
- ThreadGoalSnapshot: publishGoalSessionInfo now composes both the fork's
  v2 _meta.codex.goal and the AIR goal against current session metadata,
  so v2 goal updates keep sibling codex and jetbrains.air fields. v1 still
  emits the AIR-only update via goalSessionInfoUpdate.
- CodexAcpClient/AcpAgentRouter: take upstream's cancellable, serialized
  login and initialize-response auth publication; keep the fork's boolean
  return types and its mutable v1 router used for ALwith extensions.
- SessionIndexService: archive publication uses publishAirSessionMetadata;
  withAirMeta stays imported for setArchived.
- v2-prompt-harness: close() aborts the new transport fence and keeps the
  fork's transport and CODEX_HOME cleanup.

Test adjustments for fork behaviour:
- cancel-v2 interrupt-fencing matrix forces turn/steer to fail, because the
  fork steers a second prompt into the active turn instead of queueing it.
- session-batch-get-wire mock account includes workspaceRouting.
- session-metadata-writers @ts-expect-error moved onto the private access
  line after formatting.
- live-core-v2-ownership-owned.json regenerated with vitest -u; it gains
  the verified child cwd subagent_update from agentclientprotocol#722.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RaizxxJBbHnYoG9L4g1u5b

🤖 I have created a release *beep* *boop*
---


##
[2.6.0](v2.5.0...v2.6.0)
(2026-11-06)


### Features

* expose configured permission profiles as modes
([#395](#395))
([caf2e87](caf2e87))
* predict the follow-up prompt with thread/sample on the session thread
([#740](#740))
([f9cb470](f9cb470))
* show async Codex questions as elicitations
([#707](#707))
([cc57c7e](cc57c7e))
* update ACP SDK to 2.4 and align protocol behavior
([#727](#727))
([ab513aa](ab513aa))


### Bug Fixes

* clear stale entity metadata during ACP v2 replay
([#716](#716))
([580d8b9](580d8b9))
* defer startup interactions until session setup is delivered
([#714](#714))
([ad993bb](ad993bb))
* fence turn interrupt retries to the original prompt
([#723](#723))
([9c33f86](9c33f86))
* match vendor-prefixed gateway model ids such as OpenRouter's
([#731](#731))
([29195ec](29195ec))
* preserve sibling session metadata namespace fields
([#718](#718))
([3720341](3720341))
* publish complete configuration updates for session changes
([#715](#715))
([b7ac0bf](b7ac0bf))
* release the prompt suggestion thread and keep it minimal
([#709](#709))
([82ad58f](82ad58f))
* report verified standard subagent directories
([#722](#722))
([7d7e95a](7d7e95a))
* resynchronize current session metadata on ACP v2 resume
([#717](#717))
([927c480](927c480))
* scope authentication cancellation and initial status delivery
([#720](#720))
([e059ab7](e059ab7))
* show commands in Zed approval prompts
([#735](#735))
([cca2dca](cca2dca))
* skip the app-server restart when providers/set repeats the applied
config
([#728](#728))
([3b35338](3b35338))
* start the Codex app-server with the provider of the gateway routing
([#733](#733))
([cbcd446](cbcd446))
* suppress session messages after close
([#712](#712))
([85bf932](85bf932))
* synchronize resumed titles and reset replayed message metadata
([#713](#713))
([ef45a6d](ef45a6d))
* tear down session interactions and background processes on close
([#711](#711))
([1e89efa](1e89efa))
* update ACP SDK to 2.2 and align protocol behavior
([#710](#710))
([6f96fbe](6f96fbe))
* update codex to 0.166.0
([#734](#734))
([e53f23e](e53f23e))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: acp-release-bot[bot] <246668977+acp-release-bot[bot]@users.noreply.github.com>

Upstream v2.6.0 moves the app-server initialize of initialize before the capability reads (agentclientprotocol#714),
adds request cancellation to authenticate (agentclientprotocol#720), skips the restart for a repeated provider
routing (agentclientprotocol#728) and restarts the app-server for a new routing even before a session is open
(agentclientprotocol#733). The patch's code lines are unchanged: the hook review is configured after upstream's
initialize call (no hook runs during initialize) and the authenticate invalidation sits before
upstream's new try block. A repeated routing keeps the process and configuration, so the review
stays valid as upstream returns early.

Tests: the provider-change tests now cover both cases. Disabling OpenAI keeps the process and
must fail the stale review with -32044; a new routing restarts the app-server and ends the
request with 1001. Neither dispatches thread/start or writes trust. The router test's mock agent
implements upstream's new startup publication hooks.
Adapted from 2341b05 (original 4d43405).

Upstream v2.6.0 (agentclientprotocol#720) wraps authenticate in its own try/finally, which completes the URL
elicitation and threads request cancellation. The downstream patch only adds the final hook
review invalidation to that finally block, after upstream's elicitation completion, instead of
wrapping the method again. Every other line of the patch is unchanged; the steering _meta
forwarding and the goal-control review are untouched by v2.6.0. The existing authentication
settlement tests still fail without the invalidation in finally.
Adapted from 78e7be6 (original 960f779).