SDK JSON-RPC wire: request session/cancel — killing the runtime process is currently the only way to abandon a turn

[jiaoqsh]

Context

We embed the dsh SDK runtime (dsh-jsonrpc-agent, stdio JSON-RPC) as one of several
agent runtimes inside a host application (an open-source agent workstation). The host
needs to interrupt a running turn routinely: the user presses stop, an orchestrator
sends a subtask back for rework, or the host reconfigures model connectivity and must
quiesce affected sessions first.

The dsh-sdk-protocol README
already lists this as a known limitation:

No cancel or session-close methods — a client abandons a turn by closing the runtime process

This is a concrete consumer report that the limitation bites in practice, plus a
sketch of how small the fix appears to be given what already exists in-tree.

What "closing the runtime process" costs

Killing the subprocess abandons more than the turn:

• The live agent (in-memory session log) dies with the process, so the next prompt
  pays a full cold start and loses native conversation state. We compensate by
  replaying our own transcript sidecar into the first prompt of the new process,
  which is text-level fidelity only (tool traffic is not replayed).
• Every other session hosted by the same runtime process (the server creates one
  agent per sessionId) dies collaterally, so embedders are pushed toward
  one-process-per-session even when they would otherwise share.

The primitive already exists on both other transports

• The ACP server (packages/acp) has
  session/cancel: "Cancels only the addressed agent and settles its pending prompt
  as cancelled; unknown ids are no-ops."
• The web gateway's session.cancel is a thin wrapper over the in-core handle:
  agent.cancel({ kind: 'user' }, { keepInbox: true }).

Ask

Expose the same primitive on HarnessSdkJsonRpcServer:

client -> server   session/cancel { sessionId }  ->  { accepted: true }

Suggested semantics, mirroring the web gateway:

• agent.cancel({ kind: 'user' }, { keepInbox: true }) on the addressed agent only;
• the in-flight turn settles with a durable turn/end whose reason reflects the
  interrupt, followed by session.status: idle — clients already own their activity
  interval, so no new result plumbing is needed;
• unknown / idle sessionId is an accepted no-op.

keepInbox: true matters for the follow-up UX: a queued "please continue" after a
user stop resumes cleanly, which is exactly how the web client behaves today.

Environment

• @deepseek-ai/dsh-sdk-jsonrpc-demo / dsh-sdk-jsonrpc-server 0.1.0-rc.6 (npm),
  driven over stdio from a Python asyncio host; macOS 15 / Node 22.19.