fix(acp): make session/close and auth errors spec-compliant

[elkaix]

What

Two ACP 0.10 fixes surfaced by a deep-code-scan of the dependabot dep-bump, re-validated against the live code, the installed agent-client-protocol==0.10.1, and the current ACP spec.

session/close resource leak + spec violation

close_session previously only did self.sessions.pop(...). The ACP session/close spec mandates the agent must "cancel any ongoing work related to the session (treat it as if session/cancel was called) and then free up any resources associated with the session." The fix cancels the in-flight turn and calls PythinkerCLI.cleanup_runtime_resources() (the same teardown used by the shell-reload / shutdown paths), which tears down the per-session MCP toolset and background-refresh task, before dropping the registry entry.

authenticate error path raised TypeError on encode

The authenticate("login") failure path put raw Pydantic authMethods models in the JSON-RPC error data. The connection layer encodes error data with a plain json.dumps (no Pydantic-aware encoder), so that path raised TypeError: Object of type TerminalAuthMethod is not JSON serializable while building the response. Now serialized to plain dicts via model_dump(by_alias=True, exclude_none=True), matching the existing _check_auth path.

Tests

• test_authenticate_auth_required_data_is_json_serializable — asserts the error data is json.dumps-able and authMethods are dicts (fails on main with the exact TypeError).
• test_close_session_cancels_and_releases_resources — asserts cancel() and cleanup_runtime_resources() are awaited (replaces the prior synthetic-tuple test).
• test_close_session_unknown_is_noop — closing an unknown session stays a no-op.

Verification

• New tests fail before / pass after.
• tests/acp + tests/ui_and_conv → 1472 passed.
• ruff check, ruff format --check, pyright → clean on changed files.
• CHANGELOG updated (root SSOT) + docs sync script run.

Notes

session/close is routed (the agent runs with use_unstable_protocol=True) but initialize() does not advertise sessionCapabilities.close, so spec-compliant clients won't call it today — this hardens the path against non-compliant callers and makes it correct for when the capability is advertised. Whether to advertise close is left as a separate decision.

Summary by CodeRabbit

Bug Fixes

• Session closure now properly cancels in-flight work and frees session runtime resources (e.g., toolsets and background processes) before dropping the session.
• Authentication error responses now serialize correctly to prevent JSON encoding failures when returning error details.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 33ff1c57-58fd-404a-bae0-59010de1d555

📥 Commits

Reviewing files that changed from the base of the PR and between 7ac3b9c and f957047.

📒 Files selected for processing (5)

• CHANGELOG.md
• docs/en/release-notes/changelog.md
• src/pythinker_code/acp/server.py
• tests/acp/test_server_initialize.py
• tests/ui_and_conv/test_acp_server_auth.py

---

📝 Walkthrough

Walkthrough

This PR fixes two ACP spec-compliance bugs: session/close now properly tears down session resources by canceling in-flight work and invoking cleanup before removal, and authenticate error responses serialize authMethods as plain dicts to prevent JSON encoding failures in JSON-RPC error construction.

Changes

ACP Session and Auth Fixes

Layer / File(s)	Summary
Session teardown implementation and tests src/pythinker_code/acp/server.py, tests/acp/test_server_initialize.py	close_session now cancels in-flight session work via acp_session.cancel() and invokes cli.cleanup_runtime_resources() before removing the session from the registry. Tests verify teardown order and confirm closing an unknown session is a safe no-op.
Authentication error serialization src/pythinker_code/acp/server.py, tests/ui_and_conv/test_acp_server_auth.py	authenticate error payload now serializes authMethods using model_dump(by_alias=True, exclude_none=True) instead of passing raw Pydantic models. Integration test confirms the error data is JSON-serializable and safe for JSON-RPC encoding.
Release notes CHANGELOG.md, docs/en/release-notes/changelog.md	Both changelog entries document the two fixes: session teardown behavior and auth error serialization changes.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• Pythoughts-labs/pythinker-code#55: Both PRs modify authMethods serialization in authenticate error payloads and work with close_session behavior in the ACP server.

Suggested labels

bug

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title follows conventional commits (fix(acp): description) and accurately summarizes the two spec-compliance fixes in the changeset.
Description check	✅ Passed	The PR description comprehensively covers the motivation, implementation details, tests, and verification for both fixes, though the formal checklist template sections are not explicitly filled.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 70.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/acp-auth-serialization-and-close-session

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}