@actant/acp 0.1.2

package/dist/index.js

@@ -0,0 +1,1089 @@
+// src/connection.ts
+import { spawn as spawn2 } from "child_process";
+import { Writable, Readable } from "stream";
+import {
+  ClientSideConnection,
+  ndJsonStream
+} from "@agentclientprotocol/sdk";
+import { createLogger as createLogger2 } from "@actant/shared";
+import { PermissionPolicyEnforcer, PermissionAuditLogger } from "@actant/core";
+
+// src/terminal-manager.ts
+import { spawn } from "child_process";
+import { createLogger } from "@actant/shared";
+var logger = createLogger("acp-terminal");
+var LocalTerminalManager = class {
+  terminals = /* @__PURE__ */ new Map();
+  counter = 0;
+  async createTerminal(params) {
+    const id = `term_${++this.counter}_${Date.now()}`;
+    const envEntries = { ...process.env };
+    if (params.env) {
+      for (const entry of params.env) {
+        envEntries[entry.name] = entry.value;
+      }
+    }
+    const proc = spawn(params.command, params.args ?? [], {
+      cwd: params.cwd ?? void 0,
+      env: envEntries,
+      stdio: ["ignore", "pipe", "pipe"],
+      shell: true
+    });
+    const limit = params.outputByteLimit ?? 1024 * 1024;
+    const output = [];
+    let totalBytes = 0;
+    const exitPromise = new Promise((resolve) => {
+      proc.on("exit", (code, signal) => {
+        resolve({ exitCode: code ?? null, signal: signal ?? null });
+      });
+      proc.on("error", (err) => {
+        logger.error({ terminalId: id, error: err }, "Terminal process error");
+        resolve({ exitCode: 1, signal: null });
+      });
+    });
+    const appendOutput = (chunk) => {
+      output.push(chunk);
+      totalBytes += chunk.length;
+      while (totalBytes > limit && output.length > 1) {
+        const removed = output.shift();
+        if (removed) totalBytes -= removed.length;
+      }
+    };
+    proc.stdout?.on("data", appendOutput);
+    proc.stderr?.on("data", appendOutput);
+    const terminal = {
+      id,
+      process: proc,
+      output,
+      totalBytes,
+      outputByteLimit: limit,
+      exitStatus: null,
+      exitPromise,
+      disposed: false
+    };
+    exitPromise.then((status) => {
+      terminal.exitStatus = status;
+    });
+    this.terminals.set(id, terminal);
+    logger.info({ terminalId: id, command: params.command, cwd: params.cwd }, "Terminal created");
+    return { terminalId: id };
+  }
+  async terminalOutput(params) {
+    const term = this.getTerminal(params.terminalId);
+    const outputStr = Buffer.concat(term.output).toString("utf-8");
+    const truncated = term.totalBytes > term.outputByteLimit;
+    return {
+      output: outputStr,
+      truncated,
+      ...term.exitStatus != null ? { exitStatus: term.exitStatus } : {}
+    };
+  }
+  async waitForExit(params) {
+    const term = this.getTerminal(params.terminalId);
+    const status = await term.exitPromise;
+    return { exitCode: status.exitCode, signal: status.signal };
+  }
+  async killTerminal(params) {
+    const term = this.getTerminal(params.terminalId);
+    if (!term.process.killed && term.exitStatus == null) {
+      term.process.kill("SIGTERM");
+      setTimeout(() => {
+        if (term.exitStatus == null && !term.process.killed) {
+          term.process.kill("SIGKILL");
+        }
+      }, 3e3);
+    }
+    return {};
+  }
+  async releaseTerminal(params) {
+    const term = this.terminals.get(params.terminalId);
+    if (!term) return {};
+    if (!term.process.killed && term.exitStatus == null) {
+      term.process.kill("SIGKILL");
+    }
+    term.disposed = true;
+    this.terminals.delete(params.terminalId);
+    logger.debug({ terminalId: params.terminalId }, "Terminal released");
+    return {};
+  }
+  disposeAll() {
+    for (const [id, term] of this.terminals) {
+      if (!term.process.killed && term.exitStatus == null) {
+        term.process.kill("SIGKILL");
+      }
+      term.disposed = true;
+      this.terminals.delete(id);
+    }
+  }
+  getTerminal(terminalId) {
+    const term = this.terminals.get(terminalId);
+    if (!term) {
+      throw new Error(`Terminal "${terminalId}" not found or already released`);
+    }
+    return term;
+  }
+};
+
+// src/connection.ts
+var logger2 = createLogger2("acp-connection");
+var AcpConnection = class {
+  child = null;
+  conn = null;
+  initResponse = null;
+  sessions = /* @__PURE__ */ new Map();
+  updateListeners = /* @__PURE__ */ new Map();
+  options;
+  terminalManager;
+  enforcer = null;
+  auditLogger;
+  constructor(options) {
+    this.options = options ?? {};
+    this.terminalManager = new LocalTerminalManager();
+    this.auditLogger = new PermissionAuditLogger(options?.instanceName);
+    if (options?.permissionPolicy) {
+      this.enforcer = new PermissionPolicyEnforcer(options.permissionPolicy);
+    }
+  }
+  /** Update the permission policy at runtime (hot-reload). */
+  updatePermissionPolicy(config) {
+    if (this.enforcer) {
+      this.enforcer.updateConfig(config);
+    } else {
+      this.enforcer = new PermissionPolicyEnforcer(config);
+    }
+    this.auditLogger.logUpdated("runtime");
+  }
+  get isConnected() {
+    return this.conn != null && !this.conn.signal.aborted;
+  }
+  get agentCapabilities() {
+    return this.initResponse;
+  }
+  get rawConnection() {
+    return this.conn;
+  }
+  /* ---------------------------------------------------------------- */
+  /*  Lifecycle                                                        */
+  /* ---------------------------------------------------------------- */
+  async spawn(command, args, cwd) {
+    if (this.child) throw new Error("AcpConnection already spawned");
+    const env = { ...process.env, ...this.options.env };
+    logger2.info({ command, args, cwd }, "Spawning ACP agent subprocess");
+    this.child = spawn2(command, args, {
+      cwd,
+      stdio: ["pipe", "pipe", "pipe"],
+      env
+    });
+    if (!this.child.stdout || !this.child.stdin) {
+      throw new Error("Failed to create stdio pipes for ACP agent");
+    }
+    this.child.stderr?.on("data", (chunk) => {
+      logger2.debug({ stderr: chunk.toString().trim() }, "ACP agent stderr");
+    });
+    this.child.on("error", (err) => {
+      logger2.error({ error: err }, "ACP agent process error");
+    });
+    const webWritable = Writable.toWeb(this.child.stdin);
+    const webReadable = Readable.toWeb(this.child.stdout);
+    const stream = ndJsonStream(webWritable, webReadable);
+    this.conn = new ClientSideConnection(
+      (_agent) => this.buildClient(),
+      stream
+    );
+    this.conn.signal.addEventListener("abort", () => {
+      logger2.info("ACP connection closed");
+    });
+  }
+  async initialize() {
+    if (!this.conn) throw new Error("AcpConnection not spawned");
+    this.initResponse = await this.conn.initialize({
+      protocolVersion: 1,
+      clientCapabilities: {
+        fs: { readTextFile: true, writeTextFile: true },
+        terminal: true
+      },
+      clientInfo: {
+        name: "actant",
+        title: "Actant Daemon",
+        version: "0.1.0"
+      }
+    });
+    logger2.info({
+      agentName: this.initResponse.agentInfo?.name,
+      protocolVersion: this.initResponse.protocolVersion,
+      loadSession: this.initResponse.agentCapabilities?.loadSession
+    }, "ACP initialized");
+    return this.initResponse;
+  }
+  /* ---------------------------------------------------------------- */
+  /*  Session management                                               */
+  /* ---------------------------------------------------------------- */
+  async newSession(cwd, mcpServers = []) {
+    if (!this.conn) throw new Error("AcpConnection not initialized");
+    const response = await this.conn.newSession({
+      cwd,
+      mcpServers
+    });
+    const info = {
+      sessionId: response.sessionId,
+      modes: response.modes,
+      configOptions: response.configOptions
+    };
+    this.sessions.set(response.sessionId, info);
+    logger2.info({ sessionId: response.sessionId, cwd }, "ACP session created");
+    return info;
+  }
+  async loadSession(sessionId, cwd) {
+    if (!this.conn) throw new Error("AcpConnection not initialized");
+    if (!this.initResponse?.agentCapabilities?.loadSession) {
+      throw new Error("Agent does not support loadSession capability");
+    }
+    await this.conn.loadSession({ sessionId, cwd, mcpServers: [] });
+    logger2.info({ sessionId }, "ACP session loaded");
+  }
+  async setSessionMode(sessionId, modeId) {
+    if (!this.conn) throw new Error("AcpConnection not initialized");
+    await this.conn.setSessionMode({ sessionId, modeId });
+    logger2.info({ sessionId, modeId }, "Session mode set");
+  }
+  async setSessionConfigOption(sessionId, configId, value) {
+    if (!this.conn) throw new Error("AcpConnection not initialized");
+    const result = await this.conn.setSessionConfigOption({ sessionId, configId, value });
+    logger2.info({ sessionId, configId, value }, "Session config option set");
+    return result;
+  }
+  async authenticate(methodId) {
+    if (!this.conn) throw new Error("AcpConnection not initialized");
+    await this.conn.authenticate({ methodId });
+    logger2.info({ methodId }, "Authenticated");
+  }
+  /* ---------------------------------------------------------------- */
+  /*  Prompt                                                           */
+  /* ---------------------------------------------------------------- */
+  /**
+   * Send a prompt with arbitrary content blocks.
+   * For text-only convenience, use the string overload.
+   */
+  async prompt(sessionId, content) {
+    if (!this.conn) throw new Error("AcpConnection not initialized");
+    const promptBlocks = typeof content === "string" ? [{ type: "text", text: content }] : content;
+    let collectedText = "";
+    const listener = (notification) => {
+      const update = notification.update;
+      if (update.sessionUpdate === "agent_message_chunk" && update.content.type === "text") {
+        collectedText += update.content.text;
+      }
+    };
+    this.addUpdateListener(sessionId, listener);
+    try {
+      const response = await this.conn.prompt({
+        sessionId,
+        prompt: promptBlocks
+      });
+      return { stopReason: response.stopReason, text: collectedText };
+    } finally {
+      this.removeUpdateListener(sessionId, listener);
+    }
+  }
+  /**
+   * Stream prompt — yields every SessionNotification as it arrives.
+   */
+  async *streamPrompt(sessionId, content) {
+    if (!this.conn) throw new Error("AcpConnection not initialized");
+    const promptBlocks = typeof content === "string" ? [{ type: "text", text: content }] : content;
+    const queue = [];
+    let resolve = null;
+    let done = false;
+    const listener = (notification) => {
+      queue.push(notification);
+      resolve?.();
+    };
+    this.addUpdateListener(sessionId, listener);
+    const promptPromise = this.conn.prompt({
+      sessionId,
+      prompt: promptBlocks
+    }).then(() => {
+      done = true;
+      resolve?.();
+    }).catch((err) => {
+      done = true;
+      resolve?.();
+      throw err;
+    });
+    try {
+      while (!done || queue.length > 0) {
+        if (queue.length === 0 && !done) {
+          await new Promise((r) => {
+            resolve = r;
+          });
+          resolve = null;
+        }
+        while (queue.length > 0) {
+          const item = queue.shift();
+          if (item) yield item;
+        }
+      }
+      await promptPromise;
+    } finally {
+      this.removeUpdateListener(sessionId, listener);
+    }
+  }
+  async cancel(sessionId) {
+    if (!this.conn) return;
+    await this.conn.cancel({ sessionId });
+  }
+  /* ---------------------------------------------------------------- */
+  /*  Session accessors                                                */
+  /* ---------------------------------------------------------------- */
+  getSession(sessionId) {
+    return this.sessions.get(sessionId);
+  }
+  listSessions() {
+    return Array.from(this.sessions.keys());
+  }
+  /* ---------------------------------------------------------------- */
+  /*  Close                                                            */
+  /* ---------------------------------------------------------------- */
+  async close() {
+    this.terminalManager.disposeAll();
+    if (this.child) {
+      const child = this.child;
+      this.child = null;
+      if (child.stdin && !child.stdin.destroyed) {
+        child.stdin.end();
+      }
+      await new Promise((resolve) => {
+        const timer = setTimeout(() => {
+          child.kill("SIGKILL");
+          resolve();
+        }, 5e3);
+        child.once("exit", () => {
+          clearTimeout(timer);
+          resolve();
+        });
+        child.kill("SIGTERM");
+      });
+      logger2.info("ACP agent subprocess terminated");
+    }
+    this.conn = null;
+    this.initResponse = null;
+    this.sessions.clear();
+    this.updateListeners.clear();
+  }
+  /* ---------------------------------------------------------------- */
+  /*  Build the Client callback implementation                         */
+  /* ---------------------------------------------------------------- */
+  buildClient() {
+    const handler = this.options.callbackHandler;
+    if (handler) {
+      return {
+        requestPermission: (p) => handler.requestPermission(p),
+        sessionUpdate: (p) => handler.sessionUpdate(p),
+        readTextFile: (p) => handler.readTextFile(p),
+        writeTextFile: (p) => handler.writeTextFile(p),
+        createTerminal: handler.createTerminal?.bind(handler),
+        terminalOutput: handler.terminalOutput?.bind(handler),
+        waitForTerminalExit: handler.waitForTerminalExit?.bind(handler),
+        killTerminal: handler.killTerminal?.bind(handler),
+        releaseTerminal: handler.releaseTerminal?.bind(handler)
+      };
+    }
+    return {
+      requestPermission: (p) => this.localRequestPermission(p),
+      sessionUpdate: (p) => this.localSessionUpdate(p),
+      readTextFile: (p) => this.localReadTextFile(p),
+      writeTextFile: (p) => this.localWriteTextFile(p),
+      createTerminal: (p) => this.terminalManager.createTerminal(p),
+      terminalOutput: (p) => this.terminalManager.terminalOutput(p),
+      waitForTerminalExit: (p) => this.terminalManager.waitForExit(p),
+      killTerminal: (p) => this.terminalManager.killTerminal(p),
+      releaseTerminal: (p) => this.terminalManager.releaseTerminal(p)
+    };
+  }
+  /* ---------------------------------------------------------------- */
+  /*  Local callback implementations                                   */
+  /* ---------------------------------------------------------------- */
+  async localRequestPermission(params) {
+    if (this.enforcer && params.options.length > 0) {
+      const toolInfo = {
+        kind: params.toolCall?.kind ?? void 0,
+        title: params.toolCall?.title ?? void 0,
+        toolCallId: params.toolCall?.toolCallId ?? "unknown"
+      };
+      const decision = this.enforcer.evaluate(toolInfo);
+      this.auditLogger.logEvaluation(toolInfo, decision);
+      if (decision.action === "allow" || decision.action === "deny") {
+        const outcome = this.enforcer.buildOutcome(decision, params.options);
+        return { outcome };
+      }
+    }
+    if (this.options.autoApprove && params.options.length > 0) {
+      const allowOption = params.options.find(
+        (o) => o.kind === "allow_once" || o.kind === "allow_always"
+      ) ?? params.options[0];
+      if (!allowOption) return { outcome: { outcome: "cancelled" } };
+      return { outcome: { outcome: "selected", optionId: allowOption.optionId } };
+    }
+    logger2.warn({ sessionId: params.sessionId }, "Permission request denied (no handler)");
+    return { outcome: { outcome: "cancelled" } };
+  }
+  async localSessionUpdate(params) {
+    this.options.onSessionUpdate?.(params);
+    const listeners = this.updateListeners.get(params.sessionId);
+    if (listeners) {
+      for (const listener of listeners) {
+        listener(params);
+      }
+    }
+  }
+  async localReadTextFile(params) {
+    const { readFile } = await import("fs/promises");
+    try {
+      const raw = await readFile(params.path, "utf-8");
+      if (params.line != null || params.limit != null) {
+        const lines = raw.split("\n");
+        const start = Math.max(0, (params.line ?? 1) - 1);
+        const end = params.limit != null ? start + params.limit : lines.length;
+        return { content: lines.slice(start, end).join("\n") };
+      }
+      return { content: raw };
+    } catch {
+      throw new Error(`Cannot read file: ${params.path}`);
+    }
+  }
+  async localWriteTextFile(params) {
+    const { writeFile, mkdir } = await import("fs/promises");
+    const { dirname } = await import("path");
+    try {
+      await mkdir(dirname(params.path), { recursive: true });
+      await writeFile(params.path, params.content, "utf-8");
+      return {};
+    } catch {
+      throw new Error(`Cannot write file: ${params.path}`);
+    }
+  }
+  /* ---------------------------------------------------------------- */
+  /*  Update listener management                                       */
+  /* ---------------------------------------------------------------- */
+  addUpdateListener(sessionId, listener) {
+    const existing = this.updateListeners.get(sessionId) ?? [];
+    existing.push(listener);
+    this.updateListeners.set(sessionId, existing);
+  }
+  removeUpdateListener(sessionId, listener) {
+    const existing = this.updateListeners.get(sessionId);
+    if (existing) {
+      const idx = existing.indexOf(listener);
+      if (idx >= 0) existing.splice(idx, 1);
+      if (existing.length === 0) this.updateListeners.delete(sessionId);
+    }
+  }
+};
+
+// src/connection-manager.ts
+import { createLogger as createLogger5 } from "@actant/shared";
+import { PermissionPolicyEnforcer as PermissionPolicyEnforcer2, PermissionAuditLogger as PermissionAuditLogger2 } from "@actant/core";
+
+// src/callback-router.ts
+import { createLogger as createLogger3 } from "@actant/shared";
+var logger3 = createLogger3("acp-callback-router");
+var ClientCallbackRouter = class {
+  constructor(local) {
+    this.local = local;
+  }
+  upstream = null;
+  ideCapabilities = null;
+  enforcer = null;
+  /** Attach a PermissionPolicyEnforcer for pre-filtering in lease mode. */
+  setEnforcer(enforcer) {
+    this.enforcer = enforcer;
+  }
+  /**
+   * Activate lease-forwarding mode.
+   * Callbacks will be routed to the IDE for supported capabilities.
+   */
+  attachUpstream(handler, capabilities) {
+    this.upstream = handler;
+    this.ideCapabilities = capabilities;
+    logger3.info({
+      terminal: !!capabilities.terminal,
+      fsRead: !!capabilities.fs?.readTextFile,
+      fsWrite: !!capabilities.fs?.writeTextFile
+    }, "Upstream IDE attached \u2014 lease forwarding active");
+  }
+  /**
+   * Deactivate lease-forwarding. All callbacks revert to local handlers.
+   */
+  detachUpstream() {
+    this.upstream = null;
+    this.ideCapabilities = null;
+    logger3.info("Upstream IDE detached \u2014 local mode");
+  }
+  get isLeaseActive() {
+    return this.upstream != null;
+  }
+  /* ---------------------------------------------------------------- */
+  /*  ClientCallbackHandler implementation                             */
+  /* ---------------------------------------------------------------- */
+  async requestPermission(params) {
+    if (this.enforcer && params.options.length > 0) {
+      const toolInfo = {
+        kind: params.toolCall?.kind ?? void 0,
+        title: params.toolCall?.title ?? void 0,
+        toolCallId: params.toolCall?.toolCallId ?? "unknown"
+      };
+      const decision = this.enforcer.evaluate(toolInfo);
+      if (decision.action === "deny") {
+        const outcome = this.enforcer.buildOutcome(decision, params.options);
+        return { outcome };
+      }
+      if (decision.action === "allow") {
+        const outcome = this.enforcer.buildOutcome(decision, params.options);
+        return { outcome };
+      }
+    }
+    if (this.upstream) {
+      try {
+        return await this.upstream.requestPermission(params);
+      } catch (err) {
+        logger3.warn({ error: err }, "Failed to forward requestPermission to IDE, falling back");
+      }
+    }
+    return this.local.requestPermission(params);
+  }
+  async sessionUpdate(params) {
+    await this.local.sessionUpdate(params);
+    if (this.upstream) {
+      try {
+        await this.upstream.sessionUpdate(params);
+      } catch {
+      }
+    }
+  }
+  async readTextFile(params) {
+    if (this.upstream && this.ideCapabilities?.fs?.readTextFile) {
+      try {
+        return await this.upstream.readTextFile(params);
+      } catch (err) {
+        logger3.warn({ path: params.path, error: err }, "IDE readTextFile failed, falling back");
+      }
+    }
+    return this.local.readTextFile(params);
+  }
+  async writeTextFile(params) {
+    if (this.upstream && this.ideCapabilities?.fs?.writeTextFile) {
+      try {
+        return await this.upstream.writeTextFile(params);
+      } catch (err) {
+        logger3.warn({ path: params.path, error: err }, "IDE writeTextFile failed, falling back");
+      }
+    }
+    return this.local.writeTextFile(params);
+  }
+  async createTerminal(params) {
+    if (this.upstream && this.ideCapabilities?.terminal) {
+      try {
+        return await this.upstream.createTerminal(params);
+      } catch (err) {
+        logger3.warn({ error: err }, "IDE createTerminal failed, falling back");
+      }
+    }
+    if (this.local.createTerminal) return this.local.createTerminal(params);
+    throw new Error("Terminal not supported");
+  }
+  async terminalOutput(params) {
+    if (this.upstream && this.ideCapabilities?.terminal) {
+      try {
+        return await this.upstream.terminalOutput(params);
+      } catch (err) {
+        logger3.warn({ error: err }, "IDE terminalOutput failed, falling back");
+      }
+    }
+    if (this.local.terminalOutput) return this.local.terminalOutput(params);
+    throw new Error("Terminal not supported");
+  }
+  async waitForTerminalExit(params) {
+    if (this.upstream && this.ideCapabilities?.terminal) {
+      try {
+        return await this.upstream.waitForTerminalExit(params);
+      } catch (err) {
+        logger3.warn({ error: err }, "IDE waitForTerminalExit failed, falling back");
+      }
+    }
+    if (this.local.waitForTerminalExit) return this.local.waitForTerminalExit(params);
+    throw new Error("Terminal not supported");
+  }
+  async killTerminal(params) {
+    if (this.upstream && this.ideCapabilities?.terminal) {
+      try {
+        return await this.upstream.killTerminal(params);
+      } catch (err) {
+        logger3.warn({ error: err }, "IDE killTerminal failed, falling back");
+      }
+    }
+    if (this.local.killTerminal) return this.local.killTerminal(params);
+    throw new Error("Terminal not supported");
+  }
+  async releaseTerminal(params) {
+    if (this.upstream && this.ideCapabilities?.terminal) {
+      try {
+        return await this.upstream.releaseTerminal(params);
+      } catch (err) {
+        logger3.warn({ error: err }, "IDE releaseTerminal failed, falling back");
+      }
+    }
+    if (this.local.releaseTerminal) return this.local.releaseTerminal(params);
+    throw new Error("Terminal not supported");
+  }
+};
+
+// src/gateway.ts
+import { Duplex } from "stream";
+import {
+  AgentSideConnection,
+  ndJsonStream as ndJsonStream2
+} from "@agentclientprotocol/sdk";
+import { createLogger as createLogger4 } from "@actant/shared";
+var logger4 = createLogger4("acp-gateway");
+var AcpGateway = class {
+  upstream = null;
+  downstream;
+  callbackRouter;
+  ideCapabilities = null;
+  /**
+   * WORKAROUND for SDK API limitation (see #95):
+   * AgentSideConnection exposes flat methods for fs (readTextFile, writeTextFile)
+   * but wraps terminal ops behind TerminalHandle. Ideally the Gateway should be
+   * stateless — the IDE (Client) manages its own terminal state keyed by terminalId.
+   * We maintain this map only because the SDK doesn't expose flat terminalOutput(),
+   * waitForTerminalExit(), killTerminal(), releaseTerminal() on AgentSideConnection.
+   * Remove this once the SDK adds flat terminal methods.
+   */
+  terminalHandles = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.downstream = options.downstream;
+    this.callbackRouter = options.callbackRouter;
+  }
+  get isUpstreamConnected() {
+    return this.upstream != null && !this.upstream.signal.aborted;
+  }
+  /**
+   * Accept an IDE connection on a Unix/named-pipe socket.
+   * Creates an AgentSideConnection that bridges to the downstream Agent.
+   */
+  acceptSocket(socket) {
+    if (this.upstream && !this.upstream.signal.aborted) {
+      throw new Error("Gateway already has an active upstream connection");
+    }
+    const { readable, writable } = Duplex.toWeb(socket);
+    const stream = ndJsonStream2(
+      writable,
+      readable
+    );
+    this.upstream = new AgentSideConnection(
+      (conn) => this.buildAgentHandler(conn),
+      stream
+    );
+    this.upstream.signal.addEventListener("abort", () => {
+      logger4.info("Upstream IDE disconnected from Gateway");
+      for (const handle of this.terminalHandles.values()) {
+        handle.release().catch(() => {
+        });
+      }
+      this.terminalHandles.clear();
+      this.callbackRouter.detachUpstream();
+      this.ideCapabilities = null;
+    });
+    logger4.info("Upstream IDE connected to Gateway");
+  }
+  /**
+   * Disconnect the upstream IDE.
+   */
+  disconnectUpstream() {
+    for (const handle of this.terminalHandles.values()) {
+      handle.release().catch(() => {
+      });
+    }
+    this.terminalHandles.clear();
+    this.callbackRouter.detachUpstream();
+    this.upstream = null;
+    this.ideCapabilities = null;
+  }
+  /* ---------------------------------------------------------------- */
+  /*  Agent handler (facing IDE)                                       */
+  /* ---------------------------------------------------------------- */
+  buildAgentHandler(conn) {
+    const cachedInit = this.downstream.agentCapabilities;
+    const upstreamHandler = {
+      requestPermission: (p) => conn.requestPermission(p),
+      sessionUpdate: (p) => conn.sessionUpdate(p),
+      readTextFile: (p) => conn.readTextFile(p),
+      writeTextFile: (p) => conn.writeTextFile(p),
+      // Terminal forwarding via TerminalHandle map.
+      // SDK limitation: AgentSideConnection doesn't expose flat terminalOutput() etc.
+      // so we store handles from createTerminal and delegate through them.
+      // The IDE (Client) owns the real terminal state; this map is purely an SDK
+      // adapter and should be removed once the SDK exposes flat terminal methods.
+      createTerminal: async (p) => {
+        const handle = await conn.createTerminal(p);
+        this.terminalHandles.set(handle.id, handle);
+        return { terminalId: handle.id };
+      },
+      terminalOutput: async (p) => {
+        const handle = this.terminalHandles.get(p.terminalId);
+        if (!handle) throw new Error(`Terminal "${p.terminalId}" not found in Gateway handle map`);
+        return handle.currentOutput();
+      },
+      waitForTerminalExit: async (p) => {
+        const handle = this.terminalHandles.get(p.terminalId);
+        if (!handle) throw new Error(`Terminal "${p.terminalId}" not found in Gateway handle map`);
+        return handle.waitForExit();
+      },
+      killTerminal: async (p) => {
+        const handle = this.terminalHandles.get(p.terminalId);
+        if (!handle) throw new Error(`Terminal "${p.terminalId}" not found in Gateway handle map`);
+        return handle.kill();
+      },
+      releaseTerminal: async (p) => {
+        const handle = this.terminalHandles.get(p.terminalId);
+        if (!handle) return {};
+        const result = await handle.release();
+        this.terminalHandles.delete(p.terminalId);
+        return result ?? {};
+      }
+    };
+    return {
+      initialize: async (params) => {
+        this.ideCapabilities = params.clientCapabilities ?? {};
+        this.callbackRouter.attachUpstream(upstreamHandler, this.ideCapabilities);
+        if (cachedInit) {
+          return {
+            protocolVersion: cachedInit.protocolVersion,
+            agentCapabilities: cachedInit.agentCapabilities,
+            agentInfo: cachedInit.agentInfo,
+            authMethods: cachedInit.authMethods
+          };
+        }
+        return {
+          protocolVersion: 1,
+          agentCapabilities: {},
+          agentInfo: { name: "actant-gateway", version: "0.1.0" }
+        };
+      },
+      authenticate: async (params) => {
+        await this.downstream.authenticate(params.methodId);
+        return {};
+      },
+      newSession: async (params) => {
+        const info = await this.downstream.newSession(
+          params.cwd,
+          params.mcpServers
+        );
+        return {
+          sessionId: info.sessionId,
+          modes: info.modes,
+          configOptions: info.configOptions
+        };
+      },
+      loadSession: async (params) => {
+        await this.downstream.loadSession(params.sessionId, params.cwd);
+        return {};
+      },
+      prompt: async (params) => {
+        const conn2 = this.downstream.rawConnection;
+        if (!conn2) throw new Error("Downstream not connected");
+        return conn2.prompt(params);
+      },
+      cancel: async (params) => {
+        await this.downstream.cancel(params.sessionId);
+      },
+      setSessionMode: async (params) => {
+        await this.downstream.setSessionMode(params.sessionId, params.modeId);
+      },
+      setSessionConfigOption: async (params) => {
+        return await this.downstream.setSessionConfigOption(
+          params.sessionId,
+          params.configId,
+          params.value
+        );
+      }
+    };
+  }
+};
+
+// src/connection-manager.ts
+var logger5 = createLogger5("acp-connection-manager");
+var AcpConnectionManager = class {
+  connections = /* @__PURE__ */ new Map();
+  primarySessions = /* @__PURE__ */ new Map();
+  routers = /* @__PURE__ */ new Map();
+  gateways = /* @__PURE__ */ new Map();
+  enforcers = /* @__PURE__ */ new Map();
+  /**
+   * Spawn an ACP agent process, initialize, and create a default session.
+   * Uses ClientCallbackRouter so Gateway can later attach an IDE upstream.
+   * When connectionOptions.permissionPolicy is set, creates a PermissionPolicyEnforcer
+   * for Layer 2 ACP Client allowlist enforcement.
+   */
+  async connect(name, options) {
+    if (this.connections.has(name)) {
+      throw new Error(`ACP connection for "${name}" already exists`);
+    }
+    let enforcer;
+    let auditLogger;
+    if (options.connectionOptions?.permissionPolicy) {
+      enforcer = new PermissionPolicyEnforcer2(options.connectionOptions.permissionPolicy);
+      auditLogger = new PermissionAuditLogger2(name);
+      this.enforcers.set(name, enforcer);
+    }
+    const localConn = new AcpConnection(options.connectionOptions);
+    const localHandler = buildLocalHandler(localConn, options.connectionOptions, enforcer, auditLogger);
+    const router = new ClientCallbackRouter(localHandler);
+    const connWithRouter = new AcpConnection({
+      ...options.connectionOptions,
+      callbackHandler: router
+    });
+    this.connections.set(name, connWithRouter);
+    this.routers.set(name, router);
+    try {
+      await connWithRouter.spawn(options.command, options.args, options.cwd);
+      await connWithRouter.initialize();
+      const session = await connWithRouter.newSession(options.cwd);
+      this.primarySessions.set(name, session.sessionId);
+      const gateway = new AcpGateway({
+        downstream: connWithRouter,
+        callbackRouter: router
+      });
+      this.gateways.set(name, gateway);
+      logger5.info({ name, sessionId: session.sessionId }, "ACP agent connected (gateway-ready)");
+      return session;
+    } catch (err) {
+      await connWithRouter.close().catch(() => {
+      });
+      this.connections.delete(name);
+      this.primarySessions.delete(name);
+      this.routers.delete(name);
+      throw err;
+    }
+  }
+  /**
+   * Accept an IDE connection on the Gateway for a named agent.
+   * The IDE socket carries ACP protocol messages.
+   */
+  acceptLeaseSocket(name, socket) {
+    const gateway = this.gateways.get(name);
+    if (!gateway) {
+      throw new Error(`No gateway for agent "${name}". Is the agent connected via ACP?`);
+    }
+    gateway.acceptSocket(socket);
+  }
+  /**
+   * Disconnect IDE from the Gateway.
+   */
+  disconnectLease(name) {
+    this.gateways.get(name)?.disconnectUpstream();
+  }
+  getConnection(name) {
+    return this.connections.get(name);
+  }
+  getGateway(name) {
+    return this.gateways.get(name);
+  }
+  getRouter(name) {
+    return this.routers.get(name);
+  }
+  getPrimarySessionId(name) {
+    return this.primarySessions.get(name);
+  }
+  has(name) {
+    const conn = this.connections.get(name);
+    return conn != null && conn.isConnected;
+  }
+  async disconnect(name) {
+    this.gateways.get(name)?.disconnectUpstream();
+    this.gateways.delete(name);
+    this.routers.delete(name);
+    this.enforcers.delete(name);
+    const conn = this.connections.get(name);
+    if (!conn) return;
+    await conn.close();
+    this.connections.delete(name);
+    this.primarySessions.delete(name);
+    logger5.info({ name }, "ACP agent disconnected");
+  }
+  async disposeAll() {
+    const names = Array.from(this.connections.keys());
+    await Promise.allSettled(names.map((n) => this.disconnect(n)));
+    logger5.info({ count: names.length }, "All ACP connections disposed");
+  }
+  /**
+   * Update the permission policy for a named connection at runtime.
+   * Propagates to both the AcpConnection and the local handler enforcer.
+   */
+  updatePermissionPolicy(name, config) {
+    const conn = this.connections.get(name);
+    if (conn) {
+      conn.updatePermissionPolicy(config);
+    }
+    const enforcer = this.enforcers.get(name);
+    if (enforcer) {
+      enforcer.updateConfig(config);
+    }
+  }
+};
+function buildLocalHandler(_conn, options, enforcer, auditLogger) {
+  const terminalManager = new LocalTerminalManager();
+  return {
+    requestPermission: async (params) => {
+      if (enforcer && params.options.length > 0) {
+        const toolInfo = {
+          kind: params.toolCall?.kind ?? void 0,
+          title: params.toolCall?.title ?? void 0,
+          toolCallId: params.toolCall?.toolCallId ?? "unknown"
+        };
+        const decision = enforcer.evaluate(toolInfo);
+        auditLogger?.logEvaluation(toolInfo, decision);
+        if (decision.action === "allow" || decision.action === "deny") {
+          const outcome = enforcer.buildOutcome(decision, params.options);
+          return { outcome };
+        }
+      }
+      if (options?.autoApprove && params.options.length > 0) {
+        const opt = params.options.find(
+          (o) => o.kind === "allow_once" || o.kind === "allow_always"
+        ) ?? params.options[0];
+        if (!opt) return { outcome: { outcome: "cancelled" } };
+        return { outcome: { outcome: "selected", optionId: opt.optionId } };
+      }
+      return { outcome: { outcome: "cancelled" } };
+    },
+    sessionUpdate: async (params) => {
+      options?.onSessionUpdate?.(params);
+    },
+    readTextFile: async (params) => {
+      const { readFile } = await import("fs/promises");
+      const raw = await readFile(params.path, "utf-8");
+      if (params.line != null || params.limit != null) {
+        const lines = raw.split("\n");
+        const start = Math.max(0, (params.line ?? 1) - 1);
+        const end = params.limit != null ? start + params.limit : lines.length;
+        return { content: lines.slice(start, end).join("\n") };
+      }
+      return { content: raw };
+    },
+    writeTextFile: async (params) => {
+      const { writeFile, mkdir } = await import("fs/promises");
+      const { dirname } = await import("path");
+      await mkdir(dirname(params.path), { recursive: true });
+      await writeFile(params.path, params.content, "utf-8");
+      return {};
+    },
+    createTerminal: (p) => terminalManager.createTerminal(p),
+    terminalOutput: (p) => terminalManager.terminalOutput(p),
+    waitForTerminalExit: (p) => terminalManager.waitForExit(p),
+    killTerminal: (p) => terminalManager.killTerminal(p),
+    releaseTerminal: (p) => terminalManager.releaseTerminal(p)
+  };
+}
+
+// src/communicator.ts
+import { createLogger as createLogger6 } from "@actant/shared";
+var logger6 = createLogger6("acp-communicator");
+var AcpCommunicator = class {
+  constructor(connection, sessionId) {
+    this.connection = connection;
+    this.sessionId = sessionId;
+  }
+  async runPrompt(_workspaceDir, prompt, _options) {
+    logger6.debug({ sessionId: this.sessionId, promptLength: prompt.length }, "Sending ACP prompt");
+    const result = await this.connection.prompt(this.sessionId, prompt);
+    return { text: result.text, sessionId: this.sessionId };
+  }
+  async *streamPrompt(_workspaceDir, prompt, _options) {
+    logger6.debug({ sessionId: this.sessionId, promptLength: prompt.length }, "Streaming ACP prompt");
+    for await (const notification of this.connection.streamPrompt(this.sessionId, prompt)) {
+      const chunks = mapNotificationToChunks(notification);
+      for (const chunk of chunks) {
+        yield chunk;
+      }
+    }
+  }
+};
+function mapNotificationToChunks(notification) {
+  const update = notification.update;
+  switch (update.sessionUpdate) {
+    case "agent_message_chunk":
+      return [mapContentToChunk(update.content)].filter(Boolean);
+    case "agent_thought_chunk":
+      if (update.content.type === "text") {
+        return [{ type: "text", content: `[Thought] ${update.content.text}` }];
+      }
+      return [];
+    case "user_message_chunk":
+      return [];
+    case "tool_call":
+      return [{
+        type: "tool_use",
+        content: `[Tool: ${update.title ?? "unknown"}] ${update.toolCallId} (${update.kind ?? "other"}) [${update.status ?? "pending"}]`
+      }];
+    case "tool_call_update": {
+      const chunks = [];
+      if (update.content) {
+        for (const item of update.content) {
+          if (item.type === "content" && item.content.type === "text") {
+            chunks.push({ type: "text", content: item.content.text });
+          } else if (item.type === "diff") {
+            chunks.push({
+              type: "text",
+              content: `[Diff: ${item.path ?? ""}]`
+            });
+          }
+        }
+      }
+      return chunks;
+    }
+    case "plan": {
+      const entries = update.entries;
+      return [{
+        type: "text",
+        content: entries?.map((e) => `[Plan ${e.status}] ${e.content}`).join("\n") ?? "[Plan updated]"
+      }];
+    }
+    case "available_commands_update":
+      return [];
+    case "current_mode_update":
+      return [{
+        type: "text",
+        content: `[Mode changed: ${update.modeId ?? "unknown"}]`
+      }];
+    case "config_option_update":
+      return [];
+    default:
+      return [];
+  }
+}
+function mapContentToChunk(content) {
+  switch (content.type) {
+    case "text":
+      return { type: "text", content: content.text };
+    case "image":
+      return { type: "text", content: "[Image content]" };
+    case "audio":
+      return { type: "text", content: "[Audio content]" };
+    case "resource":
+      return { type: "text", content: `[Resource: ${content.resource?.uri ?? "unknown"}]` };
+    case "resource_link":
+      return { type: "text", content: `[ResourceLink: ${content.uri ?? "unknown"}]` };
+    default:
+      return null;
+  }
+}
+export {
+  AcpCommunicator,
+  AcpConnection,
+  AcpConnectionManager,
+  AcpGateway,
+  ClientCallbackRouter,
+  LocalTerminalManager
+};
+//# sourceMappingURL=index.js.map