fix(acp): surface failed turns to clients

[shizhigu]

Related Issue

Resolves #1813
Resolves #1865

Related #2037

Problem

Non-auth turn.ended(reason: "failed") events resolved session/prompt with end_turn. ACP clients treated quota and upstream failures as successful empty turns.

What changed

SDK outcome	ACP result
completed	end_turn
cancelled	cancelled
Hook block or provider.filtered	refusal
Auth failure	authRequired (-32000)
Other failure	internalError (-32603)

Event failures and prompt rejections now share one mapper. Public Kimi errors expose only code, canonical retryable, and an optional valid HTTP statusCode; provider messages, details, request IDs, and stacks stay off the wire.

Prompt settlement also binds to the first new main-agent turn. An older terminal event or a rejected busy prompt cannot settle or overwrite another request.

Validation

• ACP adapter: 341 tests passed. CLI ACP command: 6 tests passed.
• Typecheck, build, type-aware lint with 0 errors, docs build, changeset status, and git diff --check passed.
• Real kimi acp smoke used a local provider returning 403. Two consecutive prompts returned -32603 with the allowlisted data; provider text and request ID did not cross the wire.

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue, or explained the problem above.
• I have added tests that prove my feature works.
• Ran gen-changesets skill, or this PR needs no changeset.
• Ran gen-docs skill, or this PR needs no doc update.

[changeset-bot]

🦋 Changeset detected

Latest commit: 4bc00f5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@moonshot-ai/kimi-code	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR