@agentconnect.md/daemon 1.41.0-rc.31 → 1.41.0-rc.32

package/dist/shim/index.js

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
-import { readFileSync } from "node:fs";
+import { accessSync, constants, readFileSync, statSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { delimiter, isAbsolute, join, resolve } from "node:path";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -5563,6 +5565,115 @@ function handleIntersectionResults(result, left, right) {
 	result.value = merged.data;
 	return result;
 }
+const $ZodRecord = /*@__PURE__*/ $constructor("$ZodRecord", (inst, def) => {
+	$ZodType.init(inst, def);
+	inst._zod.parse = (payload, ctx) => {
+		const input = payload.value;
+		if (!isPlainObject(input)) {
+			payload.issues.push({
+				expected: "record",
+				code: "invalid_type",
+				input,
+				inst
+			});
+			return payload;
+		}
+		const proms = [];
+		const values = def.keyType._zod.values;
+		if (values) {
+			payload.value = {};
+			const recordKeys = /* @__PURE__ */ new Set();
+			for (const key of values) if (typeof key === "string" || typeof key === "number" || typeof key === "symbol") {
+				recordKeys.add(typeof key === "number" ? key.toString() : key);
+				const keyResult = def.keyType._zod.run({
+					value: key,
+					issues: []
+				}, ctx);
+				if (keyResult instanceof Promise) throw new Error("Async schemas not supported in object keys currently");
+				if (keyResult.issues.length) {
+					payload.issues.push({
+						code: "invalid_key",
+						origin: "record",
+						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
+						input: key,
+						path: [key],
+						inst
+					});
+					continue;
+				}
+				const outKey = keyResult.value;
+				const result = def.valueType._zod.run({
+					value: input[key],
+					issues: []
+				}, ctx);
+				if (result instanceof Promise) proms.push(result.then((result) => {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[outKey] = result.value;
+				}));
+				else {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[outKey] = result.value;
+				}
+			}
+			let unrecognized;
+			for (const key in input) if (!recordKeys.has(key)) {
+				unrecognized = unrecognized ?? [];
+				unrecognized.push(key);
+			}
+			if (unrecognized && unrecognized.length > 0) payload.issues.push({
+				code: "unrecognized_keys",
+				input,
+				inst,
+				keys: unrecognized
+			});
+		} else {
+			payload.value = {};
+			for (const key of Reflect.ownKeys(input)) {
+				if (key === "__proto__") continue;
+				if (!Object.prototype.propertyIsEnumerable.call(input, key)) continue;
+				let keyResult = def.keyType._zod.run({
+					value: key,
+					issues: []
+				}, ctx);
+				if (keyResult instanceof Promise) throw new Error("Async schemas not supported in object keys currently");
+				if (typeof key === "string" && number$1.test(key) && keyResult.issues.length) {
+					const retryResult = def.keyType._zod.run({
+						value: Number(key),
+						issues: []
+					}, ctx);
+					if (retryResult instanceof Promise) throw new Error("Async schemas not supported in object keys currently");
+					if (retryResult.issues.length === 0) keyResult = retryResult;
+				}
+				if (keyResult.issues.length) {
+					if (def.mode === "loose") payload.value[key] = input[key];
+					else payload.issues.push({
+						code: "invalid_key",
+						origin: "record",
+						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
+						input: key,
+						path: [key],
+						inst
+					});
+					continue;
+				}
+				const result = def.valueType._zod.run({
+					value: input[key],
+					issues: []
+				}, ctx);
+				if (result instanceof Promise) proms.push(result.then((result) => {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[keyResult.value] = result.value;
+				}));
+				else {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[keyResult.value] = result.value;
+				}
+			}
+		}
+		if (proms.length) return Promise.all(proms).then(() => payload);
+		return payload;
+	};
+});
 const $ZodEnum = /*@__PURE__*/ $constructor("$ZodEnum", (inst, def) => {
 	$ZodType.init(inst, def);
 	const values = getEnumValues(def.entries);
@@ -6838,6 +6949,39 @@ const intersectionProcessor = (schema, ctx, json, params) => {
 	const isSimpleIntersection = (val) => "allOf" in val && Object.keys(val).length === 1;
 	json.allOf = [...isSimpleIntersection(a) ? a.allOf : [a], ...isSimpleIntersection(b) ? b.allOf : [b]];
 };
+const recordProcessor = (schema, ctx, _json, params) => {
+	const json = _json;
+	const def = schema._zod.def;
+	json.type = "object";
+	const keyType = def.keyType;
+	const patterns = keyType._zod.bag?.patterns;
+	if (def.mode === "loose" && patterns && patterns.size > 0) {
+		const valueSchema = process$1(def.valueType, ctx, {
+			...params,
+			path: [
+				...params.path,
+				"patternProperties",
+				"*"
+			]
+		});
+		json.patternProperties = {};
+		for (const pattern of patterns) json.patternProperties[pattern.source] = valueSchema;
+	} else {
+		if (ctx.target === "draft-07" || ctx.target === "draft-2020-12") json.propertyNames = process$1(def.keyType, ctx, {
+			...params,
+			path: [...params.path, "propertyNames"]
+		});
+		json.additionalProperties = process$1(def.valueType, ctx, {
+			...params,
+			path: [...params.path, "additionalProperties"]
+		});
+	}
+	const keyValues = keyType._zod.values;
+	if (keyValues) {
+		const validKeyValues = [...keyValues].filter((v) => typeof v === "string" || typeof v === "number");
+		if (validKeyValues.length > 0) json.required = validKeyValues;
+	}
+};
 const nullableProcessor = (schema, ctx, json, params) => {
 	const def = schema._zod.def;
 	const inner = process$1(def.innerType, ctx, params);
@@ -7533,6 +7677,27 @@ function intersection(left, right) {
 		right
 	});
 }
+const ZodRecord = /*@__PURE__*/ $constructor("ZodRecord", (inst, def) => {
+	$ZodRecord.init(inst, def);
+	ZodType.init(inst, def);
+	inst._zod.processJSONSchema = (ctx, json, params) => recordProcessor(inst, ctx, json, params);
+	inst.keyType = def.keyType;
+	inst.valueType = def.valueType;
+});
+function record(keyType, valueType, params) {
+	if (!valueType || !valueType._zod) return new ZodRecord({
+		type: "record",
+		keyType: string(),
+		valueType: keyType,
+		...normalizeParams(valueType)
+	});
+	return new ZodRecord({
+		type: "record",
+		keyType,
+		valueType,
+		...normalizeParams(params)
+	});
+}
 const ZodEnum = /*@__PURE__*/ $constructor("ZodEnum", (inst, def) => {
 	$ZodEnum.init(inst, def);
 	ZodType.init(inst, def);
@@ -7863,6 +8028,146 @@ var ClientTransport = class ClientTransport {
 		this.ws.close(code, reason);
 	}
 };
+const AcpStreamPayloadSchema = discriminatedUnion("op", [
+	object({
+		op: literal("open"),
+		/** The runtime command to start inside the sandbox, resolved in ITS filesystem. */
+		command: string().min(1),
+		args: array(string()),
+		/** Complete child environment, decided by the daemon. */
+		env: record(string(), string()),
+		cwd: string().min(1).optional(),
+		/** Env pointers the shim fills from its own PATH when unset (e.g. CLAUDE_CODE_EXECUTABLE). */
+		hints: array(object({
+			envVar: string().min(1),
+			command: string().min(1)
+		})).optional()
+	}),
+	object({
+		op: literal("chunk"),
+		/** base64: the frame is JSON text, the payload is opaque ND-JSON bytes. */
+		data: string()
+	}),
+	object({
+		op: literal("close"),
+		/** Graceful stop deadline before the shim escalates to a kill. */
+		deadlineMs: number().int().nonnegative().optional(),
+		error: string().max(500).optional()
+	})
+]);
+discriminatedUnion("event", [object({
+	event: literal("chunk"),
+	data: string()
+}), object({
+	event: literal("exit"),
+	code: number().int().nullable(),
+	signal: string().nullable()
+})]);
+//#endregion
+//#region src/shim/acp-runner.ts
+/**
+* Runs the ACP runtime inside the sandbox and relays its stdio.
+*
+* The relay is deliberately dumb: bytes out as chunk events, bytes in written to stdin,
+* exit reported once. ACP is a complete protocol already, so parsing it here would only add
+* a second place for it to go wrong — and the daemon's `AcpHost` is the half that speaks it.
+*/
+var AcpRunner = class {
+	deps;
+	child;
+	exited = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** Handle one payload on the ACP stream. Returns once the payload is applied. */
+	async apply(rawPayload) {
+		const payload = AcpStreamPayloadSchema.parse(rawPayload);
+		if (payload.op === "open") return this.open(payload);
+		if (payload.op === "chunk") {
+			const child = this.child;
+			if (!child?.stdin) throw new Error("acp stream is not open");
+			await new Promise((resolve, reject) => {
+				child.stdin.write(Buffer.from(payload.data, "base64"), (err) => err ? reject(err) : resolve());
+			});
+			return;
+		}
+		await this.close(payload.deadlineMs ?? 5e3);
+	}
+	async open(payload) {
+		if (this.child) throw new Error("acp stream is already open");
+		const env = { ...payload.env };
+		for (const hint of payload.hints ?? []) {
+			if (env[hint.envVar]) continue;
+			const resolved = this.deps.resolveCommand?.(hint.command, env);
+			if (resolved) env[hint.envVar] = resolved;
+		}
+		const child = spawn(this.deps.resolveCommand?.(payload.command, env) ?? payload.command, payload.args, {
+			stdio: [
+				"pipe",
+				"pipe",
+				"inherit"
+			],
+			env,
+			...payload.cwd ? { cwd: payload.cwd } : {},
+			detached: process.platform !== "win32"
+		});
+		this.child = child;
+		child.stdout?.on("data", (chunk) => this.deps.emit({
+			kind: "chunk",
+			data: Buffer.from(chunk).toString("base64")
+		}));
+		child.once("error", (err) => this.finish(null, null, err.message));
+		child.once("exit", (code, signal) => this.finish(code, signal));
+		if (!child.stdin || !child.stdout) throw new Error("acp runtime stdio is not piped");
+	}
+	finish(code, signal, error) {
+		if (this.exited) return;
+		this.exited = true;
+		const child = this.child;
+		if (child?.pid && process.platform !== "win32") try {
+			process.kill(-child.pid, "SIGTERM");
+		} catch {}
+		this.deps.emit({
+			kind: "exit",
+			code: typeof code === "number" ? code : null,
+			signal: typeof signal === "string" ? signal : null,
+			...error ? { error } : {}
+		});
+	}
+	/** Graceful stop, escalating past the deadline — the same shape as the local driver. */
+	async close(deadlineMs) {
+		const child = this.child;
+		this.child = void 0;
+		if (!child) return;
+		if (child.exitCode !== null || child.signalCode !== null) return;
+		const kill = (signal) => {
+			if (child.pid && process.platform !== "win32") try {
+				process.kill(-child.pid, signal);
+				return;
+			} catch {}
+			child.kill(signal);
+		};
+		try {
+			child.stdin?.end();
+		} catch {}
+		kill("SIGTERM");
+		await new Promise((resolve) => {
+			let settled = false;
+			const done = () => {
+				if (settled) return;
+				settled = true;
+				clearTimeout(timer);
+				resolve();
+			};
+			const timer = setTimeout(() => {
+				this.deps.log?.warn(`acp runtime ignored SIGTERM after ${deadlineMs}ms — sending SIGKILL`);
+				kill("SIGKILL");
+				setTimeout(done, 2e3);
+			}, deadlineMs);
+			child.once("exit", done);
+		});
+	}
+};
 //#endregion
 //#region src/shim/protocol.ts
 /** WS subprotocol and path the shim dials the daemon on. */
@@ -7878,7 +8183,8 @@ const ShimCapabilitySchema = _enum([
 	"materialize",
 	"exec",
 	"read",
-	"tunnel"
+	"tunnel",
+	"acp"
 ]);
 const ShimFrameSchema = discriminatedUnion("type", [
 	object({
@@ -7925,6 +8231,20 @@ const ShimFrameSchema = discriminatedUnion("type", [
 		ok: boolean(),
 		payload: unknown().optional(),
 		error: string().max(500).optional()
+	}),
+	object({
+		type: literal("shim/event"),
+		/** The request id that opened the stream. */
+		streamId: string().uuid(),
+		event: discriminatedUnion("kind", [object({
+			kind: literal("chunk"),
+			data: string()
+		}), object({
+			kind: literal("exit"),
+			code: number().int().nullable(),
+			signal: string().nullable(),
+			error: string().max(500).optional()
+		})])
 	})
 ]);
 /** Parse an inbound frame, returning undefined rather than throwing: a malformed frame
@@ -7939,6 +8259,8 @@ function parseShimFrame(text) {
 }
 //#endregion
 //#region src/shim/client.ts
+/** Bounded so a long outage cannot grow the buffer without limit. */
+const MAX_BUFFERED_EVENTS = 2e3;
 /**
 * The in-sandbox arm. It holds no policy: it proves which pod it is, then executes the
 * operations the daemon authorizes. Everything it carries is short-lived and re-obtained
@@ -7950,6 +8272,12 @@ function parseShimFrame(text) {
 */
 var ShimClient = class {
 	deps;
+	/** ACP streams by the request id that opened them; each emits many events. */
+	acpStreams = /* @__PURE__ */ new Map();
+	/** Events produced while no transport is attached. A renewal closes the old socket before
+	*  the replacement binds, and ACP bytes cannot simply be dropped — losing a fragment
+	*  corrupts the protocol — so they wait here and flush on the next bind. */
+	pendingEvents = [];
 	transport;
 	bound;
 	stopped = false;
@@ -8084,6 +8412,7 @@ var ShimClient = class {
 				if (frame.type === "shim/bound") {
 					this.bound = frame;
 					this.backoff.reset();
+					this.flushPendingEvents(transport);
 					if (!settled) {
 						settled = true;
 						this.deps.log?.info(`shim: bound as ${frame.agentId} generation ${frame.generation}`);
@@ -8107,6 +8436,89 @@ var ShimClient = class {
 			}));
 		});
 	}
+	/**
+	* The ACP stream: one request opens it, then many events flow until the runtime exits.
+	*
+	* The opening request is still acknowledged with a single response so the caller knows the
+	* runtime started (or why it did not); the recurring traffic goes out as `shim/event`
+	* frames keyed by that request id, because one-shot correlation cannot express continuous
+	* stdout and a terminal exit.
+	*/
+	async serveAcp(transport, request) {
+		const payload = request.payload;
+		const streamId = payload?.op === "open" ? request.id : payload?.streamId ?? "";
+		if (payload?.op === "open") {
+			const runner = new AcpRunner({
+				emit: (event) => this.emitEvent(streamId, event),
+				...this.deps.resolveCommand ? { resolveCommand: this.deps.resolveCommand } : {},
+				...this.deps.log ? { log: this.deps.log } : {}
+			});
+			this.acpStreams.set(streamId, runner);
+			await runner.apply(request.payload);
+			transport.send(JSON.stringify({
+				type: "shim/response",
+				id: request.id,
+				ok: true,
+				payload: { streamId }
+			}));
+			return;
+		}
+		const runner = this.acpStreams.get(streamId);
+		if (!runner) {
+			transport.send(JSON.stringify({
+				type: "shim/response",
+				id: request.id,
+				ok: false,
+				error: "unknown acp stream"
+			}));
+			return;
+		}
+		await runner.apply(request.payload);
+		if (payload.op === "close") this.acpStreams.delete(streamId);
+		transport.send(JSON.stringify({
+			type: "shim/response",
+			id: request.id,
+			ok: true
+		}));
+	}
+	/** Send an event on whichever transport is currently bound, or hold it until one is. */
+	emitEvent(streamId, event) {
+		const text = JSON.stringify({
+			type: "shim/event",
+			streamId,
+			event
+		});
+		if (event.kind === "exit") this.acpStreams.delete(streamId);
+		const transport = this.transport;
+		if (transport && this.bound) {
+			transport.send(text);
+			return;
+		}
+		if (this.pendingEvents.length >= MAX_BUFFERED_EVENTS) {
+			this.deps.log?.warn(`shim: buffered ${MAX_BUFFERED_EVENTS} events with no channel — failing stream ${streamId}`);
+			this.pendingEvents.length = 0;
+			this.acpStreams.get(streamId)?.close(0);
+			this.acpStreams.delete(streamId);
+			this.pendingEvents.push(JSON.stringify({
+				type: "shim/event",
+				streamId,
+				event: {
+					kind: "exit",
+					code: null,
+					signal: null,
+					error: "channel unavailable too long"
+				}
+			}));
+			return;
+		}
+		this.pendingEvents.push(text);
+	}
+	/** Flush events produced while the channel was down, oldest first. */
+	flushPendingEvents(transport) {
+		if (this.pendingEvents.length === 0) return;
+		this.deps.log?.info(`shim: flushing ${this.pendingEvents.length} event(s) buffered across a rebind`);
+		for (const text of this.pendingEvents.splice(0)) transport.send(text);
+	}
 	async serve(transport, request) {
 		const bound = this.bound;
 		if (!bound || request.sessionCredential !== bound.sessionCredential || request.generation !== bound.generation) {
@@ -8128,6 +8540,10 @@ var ShimClient = class {
 			return;
 		}
 		try {
+			if (request.capability === "acp") {
+				await this.serveAcp(transport, request);
+				return;
+			}
 			const payload = await (this.deps.handle ?? (async () => void 0))(request.capability, request.payload);
 			transport.send(JSON.stringify({
 				type: "shim/response",
@@ -8146,6 +8562,33 @@ var ShimClient = class {
 	}
 };
 //#endregion
+//#region src/shim/path-resolve.ts
+/**
+* Resolve a command in THIS filesystem, which inside a sandbox is the only one that counts.
+*
+* Deliberately a local implementation rather than an import of the daemon's resolver: that
+* one pulls the runtime registry and curated catalog behind it, and the shim ships as a
+* single self-contained file with nothing but node builtins.
+*/
+function resolveCommandInPath(command, env) {
+	const executable = (candidate) => {
+		try {
+			if (!statSync(candidate).isFile()) return void 0;
+			accessSync(candidate, constants.X_OK);
+			return candidate;
+		} catch {
+			return;
+		}
+	};
+	if (isAbsolute(command)) return executable(command);
+	if (command.startsWith("./") || command.startsWith("../")) return executable(resolve(command));
+	for (const dir of (env.PATH ?? "").split(delimiter)) {
+		if (!dir) continue;
+		const found = executable(join(dir, command));
+		if (found) return found;
+	}
+}
+//#endregion
 //#region src/shim/index.ts
 /** The in-sandbox shim executable. Lives at a fixed path in the runtime image
 *  (`/opt/agentconnect/shim`), root-owned and read-only, with tini as PID 1. */
@@ -8165,6 +8608,7 @@ async function main() {
 			subprotocol: opts.subprotocol,
 			path: opts.path
 		}),
+		resolveCommand: resolveCommandInPath,
 		log
 	});
 	for (const signal of ["SIGTERM", "SIGINT"]) process.on(signal, () => {