@buildautomaton/cli 0.1.45 → 0.1.46

package/dist/cli.js

@@ -5233,7 +5233,7 @@ var require_websocket = __commonJS({
     "use strict";
     var EventEmitter2 = __require("events");
     var https2 = __require("https");
-    var http = __require("http");
+    var http2 = __require("http");
     var net = __require("net");
     var tls = __require("tls");
     var { randomBytes: randomBytes3, createHash: createHash3 } = __require("crypto");
@@ -5767,7 +5767,7 @@ var require_websocket = __commonJS({
       }
       const defaultPort = isSecure ? 443 : 80;
       const key = randomBytes3(16).toString("base64");
-      const request = isSecure ? https2.request : http.request;
+      const request = isSecure ? https2.request : http2.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
       opts.createConnection = opts.createConnection || (isSecure ? tlsConnect : netConnect);
@@ -6261,7 +6261,7 @@ var require_websocket_server = __commonJS({
   "../../node_modules/.pnpm/ws@8.19.0/node_modules/ws/lib/websocket-server.js"(exports, module) {
     "use strict";
     var EventEmitter2 = __require("events");
-    var http = __require("http");
+    var http2 = __require("http");
     var { Duplex } = __require("stream");
     var { createHash: createHash3 } = __require("crypto");
     var extension = require_extension();
@@ -6336,8 +6336,8 @@ var require_websocket_server = __commonJS({
           );
         }
         if (options.port != null) {
-          this._server = http.createServer((req, res) => {
-            const body = http.STATUS_CODES[426];
+          this._server = http2.createServer((req, res) => {
+            const body = http2.STATUS_CODES[426];
             res.writeHead(426, {
               "Content-Length": body.length,
               "Content-Type": "text/plain"
@@ -6624,7 +6624,7 @@ var require_websocket_server = __commonJS({
       this.destroy();
     }
     function abortHandshake(socket, code, message, headers) {
-      message = message || http.STATUS_CODES[code];
+      message = message || http2.STATUS_CODES[code];
       headers = {
         Connection: "close",
         "Content-Type": "text/html",
@@ -6633,7 +6633,7 @@ var require_websocket_server = __commonJS({
       };
       socket.once("finish", socket.destroy);
       socket.end(
-        `HTTP/1.1 ${code} ${http.STATUS_CODES[code]}\r
+        `HTTP/1.1 ${code} ${http2.STATUS_CODES[code]}\r
 ` + Object.keys(headers).map((h) => `${h}: ${headers[h]}`).join("\r\n") + "\r\n\r\n" + message
       );
     }
@@ -25174,7 +25174,7 @@ var {
 } = import_index.default;
 
 // src/cli-version.ts
-var CLI_VERSION = "0.1.45".length > 0 ? "0.1.45" : "0.0.0-dev";
+var CLI_VERSION = "0.1.46".length > 0 ? "0.1.46" : "0.0.0-dev";
 
 // src/cli/defaults.ts
 var DEFAULT_API_URL = process.env.BUILDAUTOMATON_API_URL ?? "https://api.buildautomaton.com";
@@ -27479,6 +27479,7 @@ var AcpPromptRoutingRegistry = class {
 function createAcpManagerContext(options) {
   return {
     log: options.log,
+    getBridgeAccessPort: options.getBridgeAccessPort,
     reportAgentCapabilities: options.reportAgentCapabilities,
     backendFallbackAgentType: null,
     acpAgents: /* @__PURE__ */ new Map(),
@@ -28751,7 +28752,7 @@ function createSdkStdioSessionContext(options) {
   return {
     cwd: options.cwd,
     onFileChange: options.onFileChange,
-    mcpServers: [],
+    mcpServers: options.mcpServers ?? [],
     persistedAcpSessionId: options.persistedAcpSessionId,
     agentLabel: "ACP",
     suppressLoadReplay: suppressLoadReplayRef,
@@ -29194,6 +29195,7 @@ async function createSdkStdioAcpClient(options) {
   });
   const sessionCtx = createSdkStdioSessionContext({
     cwd,
+    mcpServers: options.mcpServers,
     persistedAcpSessionId,
     backendAgentType,
     agentConfig,
@@ -29325,7 +29327,7 @@ function createCursorAcpSessionContext(options) {
   return {
     cwd: options.cwd,
     onFileChange: options.onFileChange,
-    mcpServers: [],
+    mcpServers: options.mcpServers ?? [],
     persistedAcpSessionId: options.persistedAcpSessionId,
     agentLabel: "Cursor",
     suppressLoadReplay: suppressLoadReplayRef,
@@ -29751,6 +29753,7 @@ async function createCursorAcpClient(options) {
   });
   const sessionCtx = createCursorAcpSessionContext({
     cwd,
+    mcpServers: options.mcpServers,
     persistedAcpSessionId,
     backendAgentType,
     agentConfig: options.agentConfig,
@@ -30709,6 +30712,30 @@ function computeAcpAgentKey(preferredAgentType, mode, agentConfig) {
   return `${resolved.label}::${fullCmd.join("\0")}${cacheConfig}`;
 }
 
+// src/mcp/bridge-mcp-constants.ts
+var BRIDGE_MCP_SERVER_NAME = "buildautomaton-bridge";
+
+// src/mcp/resolve-bridge-mcp-server-path.ts
+import { dirname as dirname4, join as join3 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+function resolveBridgeMcpServerScriptPath() {
+  const cliDir = dirname4(fileURLToPath4(import.meta.url));
+  return join3(cliDir, "bridge-mcp-server.js");
+}
+
+// src/mcp/build-acp-mcp-servers.ts
+function buildAcpMcpServers(bridgeAccessPort) {
+  if (!Number.isFinite(bridgeAccessPort) || bridgeAccessPort <= 0) return [];
+  return [
+    {
+      name: BRIDGE_MCP_SERVER_NAME,
+      command: process.execPath,
+      args: [resolveBridgeMcpServerScriptPath(), String(bridgeAccessPort)],
+      env: []
+    }
+  ];
+}
+
 // src/agents/acp/ensure-acp-client.ts
 function invalidateAcpClientState(state) {
   state.clientEpoch += 1;
@@ -30740,11 +30767,13 @@ async function ensureAcpClient(options) {
     sessionParentPath,
     resolveRouting,
     cloudSessionId,
+    bridgeAccessPort,
     reportAgentCapabilities,
     sendSessionUpdate,
     sendRequest,
     log: log2
   } = options;
+  const mcpServers = buildAcpMcpServers(bridgeAccessPort ?? 0);
   state.latestAgentConfigForBridgeHooks = agentConfig != null && typeof agentConfig === "object" && !Array.isArray(agentConfig) ? agentConfig : null;
   const targetSessionParentPath = resolveSessionParentPathForAgentProcess(sessionParentPath);
   if (state.acpStartPromise && !state.acpHandle) {
@@ -30860,7 +30889,8 @@ async function ensureAcpClient(options) {
         state.lastAcpStartError = "Agent subprocess exited";
       },
       ...hooks,
-      cwd: targetSessionParentPath
+      cwd: targetSessionParentPath,
+      mcpServers
     }).then(async (h) => {
       if (spawnEpoch !== state.clientEpoch || isCliImmediateShutdownRequested()) {
         try {
@@ -35841,7 +35871,7 @@ async function putEncryptedChangeSummaryRows(params) {
     return { path: path46, summary: JSON.stringify(enc) };
   });
   const res = await fetch(
-    `${base}/api/sessions/${encodeURIComponent(params.sessionId)}/follow-ups/summarize-changes`,
+    `${base}/internal/sessions/${encodeURIComponent(params.sessionId)}/follow-ups/summarize-changes`,
     {
       method: "PUT",
       headers: {
@@ -35980,8 +36010,8 @@ async function fetchSessionAttachmentPayloadsForAgent(params) {
   for (const a of attachments) {
     const id = typeof a.attachmentId === "string" ? a.attachmentId.trim() : "";
     if (!id) continue;
-    const metaUrl = `${base}/api/sessions/${encodeURIComponent(sessionId)}/attachments/${encodeURIComponent(id)}/meta`;
-    const blobUrl = `${base}/api/sessions/${encodeURIComponent(sessionId)}/attachments/${encodeURIComponent(id)}/blob`;
+    const metaUrl = `${base}/internal/sessions/${encodeURIComponent(sessionId)}/attachments/${encodeURIComponent(id)}/meta`;
+    const blobUrl = `${base}/internal/sessions/${encodeURIComponent(sessionId)}/attachments/${encodeURIComponent(id)}/blob`;
     const metaRes = await fetch(metaUrl, { headers: { Authorization: `Bearer ${token}` } });
     if (!metaRes.ok) {
       const t = await metaRes.text().catch(() => "");
@@ -36029,6 +36059,106 @@ async function fetchSessionAttachmentPayloadsForAgent(params) {
   return { ok: true, images: out };
 }
 
+// src/agents/acp/build-forked-session-agent-prompt.ts
+function buildForkedSessionAgentPrompt(userPrompt, childSessionId, parentSessionId) {
+  const childRef = childSessionId.trim();
+  const parentRef = parentSessionId.trim();
+  return [
+    "You are working in a new session that was forked from a prior session.",
+    `This forked session id: ${childRef}`,
+    `Parent session id: ${parentRef}`,
+    "",
+    "The parent session history is available through MCP tools on the buildautomaton-bridge server:",
+    "- list_parent_session_prompts \u2014 list each user prompt / turn in the parent session",
+    "- get_parent_session_turn_transcript \u2014 full transcript for one turn (including tool calls); requires turnId",
+    "",
+    "When calling these tools, always pass this forked session id as sessionId (not the parent session id).",
+    "",
+    "Use these tools when you need prior context instead of guessing.",
+    "",
+    "User request:",
+    userPrompt.trim()
+  ].join("\n");
+}
+
+// src/mcp/tools/session-history/fetch-parent-session-cloud.ts
+function internalApiBase(cloudApiBaseUrl) {
+  return cloudApiBaseUrl.replace(/\/+$/, "");
+}
+async function fetchCloudSessionMeta(params) {
+  const token = params.getCloudAccessToken();
+  if (!token) return { ok: false, error: "Missing cloud access token." };
+  const url2 = `${internalApiBase(params.cloudApiBaseUrl)}/internal/sessions/${encodeURIComponent(params.sessionId)}/meta`;
+  const res = await fetch(url2, { headers: { Authorization: `Bearer ${token}` } });
+  if (!res.ok) {
+    const t = await res.text().catch(() => "");
+    return { ok: false, error: `Session meta fetch failed (${res.status}): ${t.slice(0, 200)}` };
+  }
+  const data = await res.json().catch(() => null);
+  if (!data) return { ok: false, error: "Invalid session meta response." };
+  return { ok: true, data };
+}
+async function fetchCloudParentSessionPrompts(params) {
+  const token = params.getCloudAccessToken();
+  if (!token) return { ok: false, error: "Missing cloud access token." };
+  const url2 = `${internalApiBase(params.cloudApiBaseUrl)}/internal/sessions/${encodeURIComponent(params.childSessionId)}/parent/prompts`;
+  const res = await fetch(url2, { headers: { Authorization: `Bearer ${token}` } });
+  if (!res.ok) {
+    const t = await res.text().catch(() => "");
+    return { ok: false, error: `Parent prompts fetch failed (${res.status}): ${t.slice(0, 200)}` };
+  }
+  const data = await res.json().catch(() => null);
+  if (!data) return { ok: false, error: "Invalid parent prompts response." };
+  return { ok: true, data };
+}
+async function fetchCloudParentTurnTranscript(params) {
+  const token = params.getCloudAccessToken();
+  if (!token) return { ok: false, error: "Missing cloud access token." };
+  const url2 = `${internalApiBase(params.cloudApiBaseUrl)}/internal/sessions/${encodeURIComponent(params.childSessionId)}/parent/turns/${encodeURIComponent(params.turnId)}/transcript`;
+  const res = await fetch(url2, { headers: { Authorization: `Bearer ${token}` } });
+  if (!res.ok) {
+    const t = await res.text().catch(() => "");
+    return { ok: false, error: `Transcript fetch failed (${res.status}): ${t.slice(0, 200)}` };
+  }
+  const data = await res.json().catch(() => null);
+  const rows = Array.isArray(data?.transcript) ? data.transcript : [];
+  const lines = rows.map((row) => {
+    const kind = typeof row.kind === "string" ? row.kind : "event";
+    const payload = typeof row.payload === "string" ? row.payload : JSON.stringify(row.payload ?? "");
+    return `[${kind}] ${payload}`;
+  });
+  return { ok: true, text: lines.join("\n") };
+}
+async function resolveParentSessionIdForChild(params) {
+  const meta = await fetchCloudSessionMeta({
+    sessionId: params.childSessionId,
+    cloudApiBaseUrl: params.cloudApiBaseUrl,
+    getCloudAccessToken: params.getCloudAccessToken
+  });
+  if (!meta.ok) return meta;
+  const parent = meta.data.parentSessionId?.trim() ?? "";
+  if (!parent) {
+    return {
+      ok: false,
+      error: `Session ${params.childSessionId} has no parent session history. It was not forked from another session (no parent_session_id). Pass the forked child session id as sessionId, not the parent session id.`
+    };
+  }
+  return { ok: true, parentSessionId: parent };
+}
+
+// src/agents/acp/enrich-forked-session-prompt-for-agent.ts
+async function enrichForkedSessionPromptForAgent(params) {
+  const meta = await fetchCloudSessionMeta({
+    sessionId: params.sessionId,
+    cloudApiBaseUrl: params.cloudApiBaseUrl,
+    getCloudAccessToken: params.getCloudAccessToken
+  });
+  if (!meta.ok) return params.promptText;
+  const parentSessionId = meta.data.parentSessionId?.trim() ?? "";
+  if (!parentSessionId) return params.promptText;
+  return buildForkedSessionAgentPrompt(params.promptText, params.sessionId, parentSessionId);
+}
+
 // src/agents/acp/send-prompt-to-agent.ts
 async function sendPromptToAgent(options) {
   const {
@@ -36050,6 +36180,15 @@ async function sendPromptToAgent(options) {
     attachments
   } = options;
   try {
+    let agentPromptText = promptText;
+    if (sessionId && cloudApiBaseUrl && getCloudAccessToken) {
+      agentPromptText = await enrichForkedSessionPromptForAgent({
+        sessionId,
+        promptText,
+        cloudApiBaseUrl,
+        getCloudAccessToken
+      });
+    }
     let sendOpts = {};
     if (attachments && attachments.length > 0) {
       if (!sessionId || !cloudApiBaseUrl || !getCloudAccessToken) {
@@ -36088,7 +36227,7 @@ async function sendPromptToAgent(options) {
       }
       sendOpts = { images: resolved.images };
     }
-    const result = await handle.sendPrompt(promptText, sendOpts);
+    const result = await handle.sendPrompt(agentPromptText, sendOpts);
     if (sessionId && runId && sendSessionUpdate && agentCwd && result.success) {
       await collectTurnGitDiffFromPreTurnSnapshot({
         sessionId,
@@ -36212,6 +36351,7 @@ function handlePrompt(ctx, opts) {
       sessionParentPath,
       resolveRouting: () => ctx.promptRouting.resolveRouting(activeAcpSessionAgentKey),
       cloudSessionId: sessionId,
+      bridgeAccessPort: ctx.getBridgeAccessPort(),
       sendSessionUpdate,
       sendRequest: sendSessionUpdate,
       log: ctx.log,
@@ -36298,6 +36438,7 @@ function logPromptReceivedFromBridge(ctx, opts) {
 async function createAcpManager(options) {
   const ctx = createAcpManagerContext({
     log: options.log,
+    getBridgeAccessPort: options.getBridgeAccessPort,
     reportAgentCapabilities: options.reportAgentCapabilities
   });
   return {
@@ -41950,6 +42091,232 @@ async function warmupAgentCapabilitiesOnConnect(params) {
   })();
 }
 
+// src/mcp/tools/session-history/fork-session-mcp-tools.ts
+var LIST_PARENT_SESSION_PROMPTS_TOOL = "list_parent_session_prompts";
+var GET_PARENT_SESSION_TURN_TRANSCRIPT_TOOL = "get_parent_session_turn_transcript";
+var SESSION_ID_SCHEMA = {
+  type: "string",
+  description: "Id of this forked (child) session \u2014 not the parent session id. Required on every tool call."
+};
+var FORK_SESSION_MCP_TOOL_DEFINITIONS = [
+  {
+    name: LIST_PARENT_SESSION_PROMPTS_TOOL,
+    description: "List user prompts (main turns) from the parent session a fork was created from. Requires sessionId. Returns an error if the session has no parent history (not a fork).",
+    inputSchema: {
+      type: "object",
+      properties: { sessionId: SESSION_ID_SCHEMA },
+      required: ["sessionId"],
+      additionalProperties: false
+    }
+  },
+  {
+    name: GET_PARENT_SESSION_TURN_TRANSCRIPT_TOOL,
+    description: "Full transcript for one parent-session turn, including tool calls and agent messages. Requires sessionId and turnId. Returns an error if the session has no parent history (not a fork).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        sessionId: SESSION_ID_SCHEMA,
+        turnId: { type: "string", description: "Turn id from list_parent_session_prompts" }
+      },
+      required: ["sessionId", "turnId"],
+      additionalProperties: false
+    }
+  }
+];
+function textResult(text, isError = false) {
+  return { content: [{ type: "text", text }], ...isError ? { isError: true } : {} };
+}
+function isForkSessionMcpToolName(name) {
+  return name === LIST_PARENT_SESSION_PROMPTS_TOOL || name === GET_PARENT_SESSION_TURN_TRANSCRIPT_TOOL;
+}
+async function callForkSessionMcpTool(ctx, cloud, name, args) {
+  const childSessionId = ctx.sessionId.trim();
+  if (!childSessionId) {
+    return textResult("sessionId is required.", true);
+  }
+  const parentResolved = await resolveParentSessionIdForChild({
+    childSessionId,
+    cloudApiBaseUrl: cloud.cloudApiBaseUrl,
+    getCloudAccessToken: cloud.getCloudAccessToken
+  });
+  if (!parentResolved.ok) {
+    return textResult(parentResolved.error, true);
+  }
+  const parentSessionId = parentResolved.parentSessionId;
+  if (name === LIST_PARENT_SESSION_PROMPTS_TOOL) {
+    const detail = await fetchCloudParentSessionPrompts({
+      childSessionId,
+      cloudApiBaseUrl: cloud.cloudApiBaseUrl,
+      getCloudAccessToken: cloud.getCloudAccessToken
+    });
+    if (!detail.ok) return textResult(detail.error, true);
+    const turns = Array.isArray(detail.data.turns) ? detail.data.turns : [];
+    const payload = turns.map((t) => ({
+      turnId: typeof t.turnId === "string" ? t.turnId : "",
+      title: typeof t.title === "string" ? t.title : null,
+      status: typeof t.status === "string" ? t.status : null,
+      promptText: typeof t.promptText === "string" ? t.promptText : null
+    }));
+    return textResult(JSON.stringify({ parentSessionId, turns: payload }, null, 2));
+  }
+  if (name === GET_PARENT_SESSION_TURN_TRANSCRIPT_TOOL) {
+    const turnId = typeof args.turnId === "string" ? args.turnId.trim() : "";
+    if (!turnId) return textResult("turnId is required.", true);
+    const transcript = await fetchCloudParentTurnTranscript({
+      childSessionId,
+      turnId,
+      cloudApiBaseUrl: cloud.cloudApiBaseUrl,
+      getCloudAccessToken: cloud.getCloudAccessToken,
+      e2ee: ctx.e2ee
+    });
+    if (!transcript.ok) return textResult(transcript.error, true);
+    return textResult(transcript.text);
+  }
+  return textResult(`Unknown fork session tool: ${name}`, true);
+}
+
+// src/mcp/bridge-mcp-tools.ts
+function requireCloud(shared) {
+  const cloudApiBaseUrl = shared.cloudApiBaseUrl?.trim() ?? "";
+  const getCloudAccessToken = shared.getCloudAccessToken;
+  if (!cloudApiBaseUrl || !getCloudAccessToken) return null;
+  return { cloudApiBaseUrl, getCloudAccessToken };
+}
+function createBridgeMcpToolRegistry(shared) {
+  const cloud = requireCloud(shared);
+  return {
+    listTools: async () => [...FORK_SESSION_MCP_TOOL_DEFINITIONS],
+    callTool: async (name, args) => {
+      if (isForkSessionMcpToolName(name)) {
+        if (!cloud) {
+          return {
+            content: [{ type: "text", text: "Bridge MCP tools require cloud API credentials." }],
+            isError: true
+          };
+        }
+        const sessionId = typeof args.sessionId === "string" ? args.sessionId.trim() : "";
+        if (!sessionId) {
+          return {
+            content: [{ type: "text", text: "sessionId is required." }],
+            isError: true
+          };
+        }
+        return callForkSessionMcpTool({ ...shared, sessionId }, cloud, name, args);
+      }
+      throw new Error(`Unknown bridge MCP tool: ${name}`);
+    }
+  };
+}
+
+// src/mcp/bridge-access/start-server.ts
+import * as http from "node:http";
+
+// src/mcp/bridge-access/read-json-body.ts
+function readJsonBody(req) {
+  return new Promise((resolve22, reject) => {
+    const chunks = [];
+    req.on("data", (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
+    req.on("end", () => {
+      try {
+        const raw = Buffer.concat(chunks).toString("utf8").trim();
+        if (!raw) {
+          resolve22({});
+          return;
+        }
+        const parsed = JSON.parse(raw);
+        resolve22(parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {});
+      } catch (e) {
+        reject(e);
+      }
+    });
+    req.on("error", reject);
+  });
+}
+
+// src/mcp/bridge-access/send-json-response.ts
+function sendJsonResponse(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+
+// src/mcp/bridge-access/handle-request.ts
+function createBridgeAccessRequestHandler(registry2) {
+  return (req, res) => {
+    void (async () => {
+      if (req.method !== "POST") {
+        sendJsonResponse(res, 405, { ok: false, error: "Method not allowed" });
+        return;
+      }
+      try {
+        const body = await readJsonBody(req);
+        if (req.url === "/tools/list") {
+          const tools = await Promise.resolve(registry2.listTools());
+          sendJsonResponse(res, 200, { ok: true, data: tools });
+          return;
+        }
+        if (req.url === "/tools/call") {
+          const sessionId = typeof body.sessionId === "string" ? body.sessionId.trim() : "";
+          if (!sessionId) {
+            sendJsonResponse(res, 400, { ok: false, error: "sessionId is required" });
+            return;
+          }
+          const name = typeof body.name === "string" ? body.name.trim() : "";
+          const args = body.args && typeof body.args === "object" && !Array.isArray(body.args) ? body.args : {};
+          if (!name) {
+            sendJsonResponse(res, 400, { ok: false, error: "name is required" });
+            return;
+          }
+          const data = await registry2.callTool(name, { ...args, sessionId });
+          sendJsonResponse(res, 200, { ok: true, data });
+          return;
+        }
+        sendJsonResponse(res, 404, { ok: false, error: "Not found" });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        sendJsonResponse(res, 500, { ok: false, error: message });
+      }
+    })();
+  };
+}
+
+// src/mcp/bridge-access/start-server.ts
+function startBridgeAccessServer(registry2) {
+  const server = http.createServer(createBridgeAccessRequestHandler(registry2));
+  return new Promise((resolve22, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      if (!addr || typeof addr === "string") {
+        reject(new Error("Bridge access server did not bind"));
+        return;
+      }
+      resolve22({
+        port: addr.port,
+        close: () => new Promise((closeResolve, closeReject) => {
+          server.close((err) => err ? closeReject(err) : closeResolve());
+        })
+      });
+    });
+  });
+}
+
+// src/mcp/bridge-access/create-state.ts
+async function createBridgeAccessState(options = {}) {
+  const registry2 = createBridgeMcpToolRegistry({
+    cloudApiBaseUrl: options.cloudApiBaseUrl,
+    getCloudAccessToken: options.getCloudAccessToken,
+    e2ee: options.e2ee
+  });
+  const server = await startBridgeAccessServer(registry2);
+  return {
+    getPort: () => server.port,
+    getRegistry: () => registry2,
+    close: async () => {
+      await server.close();
+    }
+  };
+}
+
 // src/connection/create-bridge-connection.ts
 async function createBridgeConnection(options) {
   const { apiUrl, workspaceId, justAuthenticated, onAuthInvalid, persistTokens } = options;
@@ -42012,12 +42379,18 @@ async function createBridgeConnection(options) {
     worktreesRootPath,
     log: logFn
   });
+  const e2ee = options.e2eCertificate ? createCliE2eeRuntime(options.e2eCertificate) : void 0;
+  const bridgeAccess = await createBridgeAccessState({
+    cloudApiBaseUrl: apiUrl,
+    getCloudAccessToken: () => tokens.accessToken,
+    e2ee
+  });
   const acpManager = await createAcpManager({
     log: logFn,
+    getBridgeAccessPort: () => bridgeAccess.getPort(),
     reportAgentCapabilities: sendAgentCapabilitiesToBridge
   });
   logFn("CLI running. Press Ctrl+C to exit.");
-  const e2ee = options.e2eCertificate ? createCliE2eeRuntime(options.e2eCertificate) : void 0;
   const devServerManager = new DevServerManager({ getWs, log: logFn, getBridgeRoot, e2ee });
   const bridgeHeartbeat = createBridgeHeartbeatController({ getWs, log: logFn });
   const baseOnBridgeIdentified = createOnBridgeIdentified({
@@ -42083,6 +42456,7 @@ async function createBridgeConnection(options) {
       stopFileIndexWatcher();
       bridgeHeartbeat.stop();
       await closeBridgeConnection(state, acpManager, devServerManager, logFn);
+      await bridgeAccess.close();
     }
   };
 }