@cirvix_ai/agent-control 0.1.0

package/src/core/secrets.mjs

@@ -0,0 +1,312 @@
+/**
+ * The secrets edge — substitution at the boundary, and the return path.
+ *
+ * The control plane holds the material and decides who may spend a handle.
+ * This module is the half that runs next to the agent, and it exists so the
+ * credential passes through exactly one place: the moment a permitted call is
+ * written to an upstream.
+ *
+ *   agent  ─▶  Authorization: Bearer sec_handle_a89f…      (opaque, in context)
+ *   edge   ─▶  resolve(handle, destination) ─▶ control plane
+ *   edge   ─▶  Authorization: Bearer rk_live_…             (real, on the wire)
+ *   result ◀─  scanned for resolved material, redacted back to the handle
+ *
+ * FOUR DECISIONS WORTH THE COMMENT:
+ *
+ * 1. AN UNRESOLVABLE HANDLE FAILS THE CALL. It is never forwarded as a literal
+ *    string. Forwarding it would hand the handle to an upstream that has no
+ *    business seeing it, and would produce a 401 the agent cannot diagnose —
+ *    a silent failure where a legible refusal belongs.
+ *
+ * 2. SUBSTITUTION DOES NOT TAINT THE SESSION. The `touchedSecret` flag exists
+ *    because an agent that *read* raw credential material can exfiltrate it.
+ *    An agent holding a handle never held the material, which is the entire
+ *    point, so brokering must not trip the egress rule that the raw-read path
+ *    trips. Tainting here would make the documented flow — resolve, call the
+ *    API, call it again — fail on the second call.
+ *
+ * 3. LEAK DETECTION COVERS MATERIAL THIS SESSION RESOLVED, AND SAYS SO.
+ *    The edge cannot recognise a credential it was never told about. That is
+ *    stated in the product's own limits, and this implementation matches it
+ *    rather than implying broader coverage.
+ *
+ * 4. REDACTION PUTS THE HANDLE BACK, NOT A PLACEHOLDER. Replacing a leaked
+ *    value with `[REDACTED]` tells the model something was removed and nothing
+ *    about what to do next. Replacing it with the handle it already holds
+ *    leaves the run coherent.
+ */
+
+/**
+ * The canonical handle shape. The control plane imports these; nothing
+ * redefines them.
+ *
+ * Two bodies, one format. A brokered handle is 32 hex characters, minted by the
+ * control plane and unguessable. A locally-vaulted handle is a short ordinal —
+ * `sec_handle_01` — because it never leaves the machine, and because an
+ * operator watching a demo has to be able to read it off the screen and see
+ * that it is not a credential.
+ *
+ * The short form is not a weaker secret: it is not a secret at all. A handle's
+ * security comes from the broker refusing to resolve it off-path, not from
+ * being hard to type. Making the local form guessable is therefore free, and
+ * making it legible is worth something.
+ */
+export const HANDLE_PREFIX = "sec_handle_";
+const HANDLE_BODY = "(?:[0-9a-f]{32}|[0-9]{2,8}(?![0-9a-f]))";
+
+/**
+ * Values shorter than this are never used for return-path matching.
+ *
+ * A short secret appears inside unrelated text by coincidence, and redacting
+ * on a coincidence corrupts a tool result the agent depends on. Substitution
+ * is unaffected — this guards only the scan direction.
+ */
+const MIN_SCANNABLE_LENGTH = 8;
+
+/** Depth cap on the structure walk. MCP payloads are JSON; this is insurance. */
+const MAX_DEPTH = 12;
+
+export const isHandle = (value) =>
+  typeof value === "string" && new RegExp(`^${HANDLE_PREFIX}${HANDLE_BODY}$`).test(value);
+
+/**
+ * Every handle appearing anywhere in a value, including inside longer strings
+ * (`"Bearer sec_handle_…"`), which is where they usually appear.
+ *
+ * Builds a fresh regex per call: a shared `/g` regex carries `lastIndex`
+ * between calls and silently skips matches on every other invocation.
+ */
+export function findHandles(value, depth = 0) {
+  const found = new Set();
+  if (depth > MAX_DEPTH) return found;
+
+  if (typeof value === "string") {
+    for (const m of value.matchAll(new RegExp(`${HANDLE_PREFIX}${HANDLE_BODY}`, "g"))) {
+      found.add(m[0]);
+    }
+    return found;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) for (const h of findHandles(item, depth + 1)) found.add(h);
+    return found;
+  }
+  if (value && typeof value === "object") {
+    for (const item of Object.values(value)) for (const h of findHandles(item, depth + 1)) found.add(h);
+  }
+  return found;
+}
+
+/** Rewrites every string in a structure, returning a copy. */
+function mapStrings(value, fn, depth = 0) {
+  if (depth > MAX_DEPTH) return value;
+  if (typeof value === "string") return fn(value);
+  if (Array.isArray(value)) return value.map((v) => mapStrings(v, fn, depth + 1));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([k, v]) => [k, mapStrings(v, fn, depth + 1)]),
+    );
+  }
+  return value;
+}
+
+/* -------------------------------------------------------------------------- */
+
+/**
+ * @typedef {object} Substitution
+ * @property {boolean} ok
+ * @property {any} value            the arguments with handles replaced
+ * @property {string[]} substituted names of the secrets that were spent
+ * @property {string} [reason]      why it failed, safe to show the agent
+ * @property {string} [outcome]     the control plane's refusal outcome
+ */
+
+export class SecretsClient {
+  /** handle → { value, secretId, name }, for the life of this session only. */
+  #resolved = new Map();
+
+  /**
+   * @param {object} opts
+   * @param {string} opts.apiUrl      control-plane base URL
+   * @param {string} opts.apiKey      `cvx_…`
+   * @param {string} [opts.agent]     recorded against every resolution
+   * @param {typeof fetch} [opts.fetchImpl] injected for tests
+   * @param {(m:string,extra?:object)=>void} [opts.log]
+   */
+  constructor({ apiUrl, apiKey, agent = "local", fetchImpl = globalThis.fetch, log = () => {} }) {
+    this.apiUrl = String(apiUrl ?? "").replace(/\/$/, "");
+    this.apiKey = apiKey;
+    this.agent = agent;
+    this.fetch = fetchImpl;
+    this.log = log;
+    this.stats = { requested: 0, substituted: 0, refused: 0, leaksCaught: 0 };
+  }
+
+  async #api(path, body) {
+    const res = await this.fetch(this.apiUrl + path, {
+      method: "POST",
+      headers: { authorization: `Bearer ${this.apiKey}`, "content-type": "application/json" },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(10_000),
+    });
+    const payload = await res.json().catch(() => ({}));
+    return { status: res.status, payload };
+  }
+
+  /**
+   * Asks the control plane for a handle to a named secret.
+   *
+   * Returns the opaque string the agent is allowed to hold. This is what
+   * `secrets.get("STRIPE_RESTRICTED_KEY")` returns to a caller.
+   */
+  async get(name, { ttlSeconds, maxUses } = {}) {
+    this.stats.requested++;
+    const { status, payload } = await this.#api("/v1/secrets/handles", {
+      name,
+      agent: this.agent,
+      ttlSeconds,
+      maxUses,
+    });
+    if (status !== 201) {
+      throw new Error(payload.error ?? `Could not issue a handle for "${name}".`);
+    }
+    return payload.handle;
+  }
+
+  /**
+   * Replaces every handle in `args` with the material it stands for.
+   *
+   * Fails closed: if any handle in the payload cannot be resolved for this
+   * destination, nothing is substituted and the caller must refuse the call.
+   * Partial substitution would send a real credential alongside a literal
+   * handle, which is the worst of both.
+   *
+   * @returns {Promise<Substitution>}
+   */
+  async substitute(args, { destination } = {}) {
+    const handles = [...findHandles(args)];
+    if (handles.length === 0) return { ok: true, value: args, substituted: [] };
+
+    if (!destination) {
+      this.stats.refused++;
+      return {
+        ok: false,
+        value: args,
+        substituted: [],
+        outcome: "no_destination",
+        reason:
+          "This call carries a secret handle but names no destination the broker can authorize. A handle resolves only against a destination.",
+      };
+    }
+
+    const replacements = new Map();
+    const names = [];
+    for (const handle of handles) {
+      const resolved = await this.#resolve(handle, destination);
+      if (!resolved.ok) {
+        this.stats.refused++;
+        return {
+          ok: false,
+          value: args,
+          substituted: [],
+          outcome: resolved.outcome,
+          reason: resolved.reason,
+        };
+      }
+      replacements.set(handle, resolved.value);
+      names.push(resolved.name);
+    }
+
+    const value = mapStrings(args, (s) => {
+      let out = s;
+      for (const [handle, real] of replacements) out = out.split(handle).join(real);
+      return out;
+    });
+
+    this.stats.substituted += replacements.size;
+    return { ok: true, value, substituted: names };
+  }
+
+  async #resolve(handle, destination) {
+    const { status, payload } = await this.#api("/v1/secrets/resolve", {
+      handle,
+      destination,
+      agent: this.agent,
+    });
+
+    if (status !== 200 || typeof payload.value !== "string") {
+      return {
+        ok: false,
+        outcome: payload.outcome ?? "unresolved",
+        reason: payload.error ?? "This handle does not resolve for that destination.",
+      };
+    }
+
+    // Remembered so the return path can recognise it coming back. Held for the
+    // life of the session and nowhere else — never written to disk, never in a
+    // decision record, never in the audit chain.
+    this.#resolved.set(handle, {
+      value: payload.value,
+      secretId: payload.secretId,
+      name: payload.name,
+    });
+    return { ok: true, value: payload.value, name: payload.name };
+  }
+
+  /**
+   * Finds material this session resolved appearing in a return payload.
+   *
+   * A well-behaved upstream never echoes a credential back. A misbehaving or
+   * compromised one does, and if that reaches the model the handle indirection
+   * has bought nothing.
+   */
+  scan(payload) {
+    const findings = [];
+    if (this.#resolved.size === 0) return findings;
+
+    const text = typeof payload === "string" ? payload : JSON.stringify(payload ?? "");
+    for (const [handle, entry] of this.#resolved) {
+      if (entry.value.length < MIN_SCANNABLE_LENGTH) continue;
+      if (text.includes(entry.value)) {
+        findings.push({ handle, secretId: entry.secretId, name: entry.name });
+      }
+    }
+    return findings;
+  }
+
+  /**
+   * Returns `payload` with any resolved material swapped back to its handle.
+   *
+   * @returns {{payload:any, findings:Array<{handle:string,secretId:string,name:string}>}}
+   */
+  redact(payload) {
+    const findings = this.scan(payload);
+    if (findings.length === 0) return { payload, findings };
+
+    this.stats.leaksCaught += findings.length;
+    const redacted = mapStrings(payload, (s) => {
+      let out = s;
+      for (const finding of findings) {
+        const entry = this.#resolved.get(finding.handle);
+        if (entry) out = out.split(entry.value).join(finding.handle);
+      }
+      return out;
+    });
+    return { payload: redacted, findings };
+  }
+
+  /**
+   * Drops every resolved value.
+   *
+   * Called when a session ends. The material is process memory for the life of
+   * a run and no longer — a laptop with a root-level compromise is outside any
+   * userspace product's threat model, but a long-lived process holding every
+   * credential it ever brokered is a self-inflicted one.
+   */
+  forget() {
+    this.#resolved.clear();
+  }
+
+  get held() {
+    return this.#resolved.size;
+  }
+}

package/src/core/uds.mjs

@@ -0,0 +1,383 @@
+/**
+ * The local control socket.
+ *
+ * A Unix Domain Socket (a named pipe on Windows) speaking JSON-RPC, so any
+ * process on this machine can ask Cirvix "may I do this" without speaking MCP
+ * and without linking the SDK. It is what makes the runtime agent-neutral in
+ * practice rather than in principle: a Python agent, a Go CLI, a shell wrapper,
+ * or an editor plugin all get the same decision from the same rule set.
+ *
+ *   client ──▶ {"method":"cirvix/authorize","params":{"tool":"shell.exec",…}}
+ *   cirvix ──▶ {"result":{"decision":"deny","policy":"deny-destructive",…}}
+ *
+ * WHY A SOCKET RATHER THAN A LOCAL HTTP PORT
+ *
+ * A TCP port on localhost is reachable by every process on the machine, by
+ * every container sharing the network namespace, and — via DNS rebinding — by a
+ * web page the user has open. A UDS is a filesystem object with an owner and a
+ * mode, so "who may ask for decisions" becomes a question the operating system
+ * already knows how to answer.
+ *
+ * THIS SOCKET IS A SECURITY BOUNDARY, NOT A CONVENIENCE
+ *
+ * Whatever can talk to it can ask for secret substitution. Three things
+ * therefore hold, and each is enforced rather than documented:
+ *
+ *   1. The socket file is created with mode 0600 and in a directory the
+ *      current user owns. On POSIX that is the whole access-control story.
+ *   2. Every connection must present the session token from `--state`, which
+ *      is written 0600. This is what carries the property to Windows, where
+ *      named pipes do not inherit filesystem permissions and the default DACL
+ *      is more generous than it looks. Without the token nothing is served.
+ *   3. `cirvix/vault.issue` is not exposed. A client may spend a handle it was
+ *      given; it may never mint one, and it may never read material back. The
+ *      socket cannot be used to exfiltrate the vault, because there is no
+ *      method that returns a secret.
+ */
+
+import { createServer } from "node:net";
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { dirname, join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { MessageFramer, serialize } from "./jsonrpc.mjs";
+import { DECISION } from "./decisions.mjs";
+import { SOURCE } from "./normalize.mjs";
+
+/** JSON-RPC error codes this server returns. */
+export const UDS_ERROR = {
+  UNAUTHORIZED: -32004,
+  METHOD_NOT_FOUND: -32601,
+  INVALID_PARAMS: -32602,
+  INTERNAL: -32603,
+};
+
+/**
+ * The default endpoint for a state directory.
+ *
+ * On Windows a named pipe is not a filesystem path, so the socket lives in the
+ * pipe namespace and only the token file is on disk. The pipe name is derived
+ * from the state directory so two projects on one machine do not collide.
+ */
+export function defaultEndpoint(stateDir) {
+  if (process.platform === "win32") {
+    const slug = String(stateDir).replace(/[^A-Za-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(-64);
+    return `\\\\.\\pipe\\cirvix-${slug || "default"}`;
+  }
+  // A socket path is capped near 104 bytes on macOS and BSD. A deep project
+  // directory blows past that, and the failure is an opaque EINVAL at bind
+  // time — so a long path falls back to the temp directory with a stable name.
+  const preferred = join(stateDir, "cirvix.sock");
+  if (Buffer.byteLength(preferred) < 100) return preferred;
+  const slug = String(stateDir).replace(/[^A-Za-z0-9]+/g, "-").slice(-32);
+  return join(tmpdir(), `cirvix-${slug}.sock`);
+}
+
+export function tokenPath(stateDir) {
+  return join(stateDir, "socket.token");
+}
+
+/** Mints and persists the session token, 0600. */
+export async function writeToken(stateDir) {
+  const token = randomBytes(32).toString("hex");
+  const path = tokenPath(stateDir);
+  await mkdir(dirname(path), { recursive: true }).catch(() => {});
+  await writeFile(path, token, "utf8");
+  await chmod(path, 0o600).catch(() => {});
+  return token;
+}
+
+export async function readToken(stateDir) {
+  return (await readFile(tokenPath(stateDir), "utf8")).trim();
+}
+
+function sameToken(a, b) {
+  const x = Buffer.from(String(a ?? ""));
+  const y = Buffer.from(String(b ?? ""));
+  if (x.length !== y.length || x.length === 0) return false;
+  return timingSafeEqual(x, y);
+}
+
+/* -------------------------------------------------------------------------- */
+
+export class UdsServer {
+  #connections = new Set();
+
+  /**
+   * @param {object} opts
+   * @param {import("./pipeline.mjs").Pipeline} opts.pipeline
+   * @param {string} opts.endpoint
+   * @param {string} opts.token
+   * @param {(m:string,extra?:object)=>void} [opts.log]
+   * @param {() => object} [opts.status]  supplies `cirvix/status`
+   * @param {() => Promise<Array>} [opts.recent]  supplies `cirvix/logs`
+   */
+  constructor({ pipeline, endpoint, token, log = () => {}, status = () => ({}), recent = async () => [] }) {
+    this.pipeline = pipeline;
+    this.endpoint = endpoint;
+    this.token = token;
+    this.log = log;
+    this.status = status;
+    this.recent = recent;
+    this.server = null;
+    this.stats = { connections: 0, requests: 0, rejected: 0 };
+  }
+
+  async start() {
+    // A socket file left behind by a killed process makes bind fail with
+    // EADDRINUSE even though nothing is listening. Removing it is safe here
+    // because the mode-0600 parent directory means only this user could have
+    // created it.
+    if (process.platform !== "win32") {
+      await rm(this.endpoint, { force: true }).catch(() => {});
+      await mkdir(dirname(this.endpoint), { recursive: true }).catch(() => {});
+    }
+
+    this.server = createServer((socket) => this.#onConnection(socket));
+
+    await new Promise((resolve, reject) => {
+      this.server.once("error", reject);
+      this.server.listen(this.endpoint, () => {
+        this.server.removeListener("error", reject);
+        resolve();
+      });
+    });
+
+    if (process.platform !== "win32") {
+      await chmod(this.endpoint, 0o600).catch(() => {});
+    }
+
+    this.log(`control socket listening on ${this.endpoint}`);
+    return this;
+  }
+
+  #onConnection(socket) {
+    this.stats.connections++;
+    this.#connections.add(socket);
+
+    /** Per-connection: a client is unauthenticated until it presents the token. */
+    let authenticated = false;
+
+    const write = (message) => {
+      if (socket.writable) socket.write(serialize(message));
+    };
+
+    const framer = new MessageFramer({
+      onMessage: (message) => {
+        void (async () => {
+          try {
+            const response = await this.#dispatch(message, {
+              authenticated,
+              authenticate: () => {
+                authenticated = true;
+              },
+            });
+            if (response) write(response);
+          } catch (err) {
+            write({
+              jsonrpc: "2.0",
+              id: message?.id ?? null,
+              error: { code: UDS_ERROR.INTERNAL, message: err.message },
+            });
+          }
+        })();
+      },
+      onInvalid: (line) => this.log(`control socket: unparseable frame (${line.length} bytes)`),
+    });
+
+    socket.on("data", (chunk) => framer.push(chunk));
+    socket.on("error", () => {});
+    socket.on("close", () => this.#connections.delete(socket));
+  }
+
+  async #dispatch(message, session) {
+    const id = message?.id ?? null;
+    const ok = (result) => ({ jsonrpc: "2.0", id, result });
+    const fail = (code, msg) => ({ jsonrpc: "2.0", id, error: { code, message: msg } });
+
+    // Notifications get no reply, by JSON-RPC rule.
+    if (id === null && message?.method) return null;
+
+    this.stats.requests++;
+
+    if (message?.method === "initialize" || message?.method === "cirvix/hello") {
+      if (!sameToken(message.params?.token, this.token)) {
+        this.stats.rejected++;
+        this.log("control socket: rejected a connection with a bad or missing token");
+        return fail(
+          UDS_ERROR.UNAUTHORIZED,
+          "This socket requires the session token from <state>/socket.token.",
+        );
+      }
+      session.authenticate();
+      return ok({
+        protocol: "cirvix/1",
+        server: "cirvix-uds",
+        methods: ["cirvix/authorize", "cirvix/result", "cirvix/status", "cirvix/logs"],
+        mode: this.pipeline.mode,
+      });
+    }
+
+    if (!session.authenticated) {
+      this.stats.rejected++;
+      return fail(UDS_ERROR.UNAUTHORIZED, "Call initialize with the session token first.");
+    }
+
+    switch (message.method) {
+      /* ----------------------------------------------------------------- */
+      case "cirvix/authorize": {
+        const params = message.params ?? {};
+        if (!params.tool) return fail(UDS_ERROR.INVALID_PARAMS, "authorize needs a tool name.");
+
+        const { event, decision, arguments: outgoing } = await this.pipeline.submit(
+          { tool: params.tool, server: params.server ?? null, arguments: params.arguments ?? {} },
+          {
+            agent: params.agent,
+            source: params.source ?? SOURCE.UDS,
+            environment: params.environment,
+            /*
+             * The delegation the caller is acting under, if any.
+             *
+             * This was not forwarded, and the effect was not a missing feature.
+             * Delegation only ever NARROWS, so dropping it here handed every
+             * caller the full authority policy allowed — an agent delegated
+             * `fs.read` could write the database over this socket, and the
+             * audit record showed an ordinary permitted write with no chain on
+             * it. Presenting a grant is the only way an agent can ask to be
+             * held to less than policy permits, and the request was being
+             * discarded.
+             *
+             * Forging it buys nothing: the grant is signed, and `resolve`
+             * refuses one presented by anybody but its subject.
+             */
+            delegation: params.delegation ?? null,
+          },
+        );
+
+        return ok({
+          request_id: event.request_id,
+          decision: event.decision,
+          // `allowed` is the one-bit answer a shell wrapper needs; everything
+          // else is for a client that can render more.
+          allowed: event.decision === DECISION.ALLOW || event.decision === DECISION.SANITIZE || event.decision === DECISION.AUDIT_ONLY,
+          risk: event.risk,
+          policy: event.policy,
+          reason: event.reason,
+          remediation: decision.remediation ?? null,
+          approval_id: event.approval_id ?? null,
+          approvers: decision.approvers ?? [],
+          latency_ms: event.latency_ms,
+          enforced: event.enforced,
+          // Substituted arguments go back so the client sends what Cirvix
+          // authorized rather than what it proposed.
+          arguments: outgoing,
+        });
+      }
+
+      /* ----------------------------------------------------------------- */
+      case "cirvix/result": {
+        const params = message.params ?? {};
+        const scrubbed = this.pipeline.scrubResult(params.result, params.decision ?? {});
+        return ok({
+          request_id: params.request_id ?? null,
+          result: scrubbed.payload,
+          findings: scrubbed.findings.map((f) => ({
+            kind: f.kind,
+            detector: f.detector ?? f.rule ?? null,
+            path: f.path ?? null,
+            masked: f.masked ?? null,
+          })),
+        });
+      }
+
+      /* ----------------------------------------------------------------- */
+      case "cirvix/status":
+        return ok(await this.status());
+
+      case "cirvix/logs": {
+        const limit = Number(message.params?.limit ?? 50);
+        const risk = message.params?.risk ?? null;
+        const events = await this.recent({ limit, risk });
+        return ok({ events });
+      }
+
+      default:
+        return fail(UDS_ERROR.METHOD_NOT_FOUND, `Unknown method "${message.method}".`);
+    }
+  }
+
+  async stop() {
+    for (const socket of this.#connections) socket.destroy();
+    this.#connections.clear();
+    await new Promise((resolve) => (this.server ? this.server.close(resolve) : resolve()));
+    if (process.platform !== "win32") await rm(this.endpoint, { force: true }).catch(() => {});
+  }
+}
+
+/* -------------------------------------------------------------------------- */
+/*  Client                                                                     */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * A minimal client, used by `cirvix status`, the demo, and the tests.
+ *
+ * Deliberately one-shot: connect, ask, close. A pooled connection to a local
+ * socket saves microseconds and costs a whole class of lifecycle bug.
+ */
+export class UdsClient {
+  constructor({ endpoint, token, timeoutMs = 10_000 }) {
+    this.endpoint = endpoint;
+    this.token = token;
+    this.timeoutMs = timeoutMs;
+  }
+
+  async call(method, params = {}) {
+    const { connect } = await import("node:net");
+
+    return new Promise((resolve, reject) => {
+      const socket = connect(this.endpoint);
+      let nextId = 1;
+      let settled = false;
+
+      const finish = (fn, value) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        socket.destroy();
+        fn(value);
+      };
+
+      const timer = setTimeout(
+        () => finish(reject, new Error(`Timed out talking to ${this.endpoint}.`)),
+        this.timeoutMs,
+      );
+
+      const pending = new Map();
+      const framer = new MessageFramer({
+        onMessage: (m) => {
+          const entry = pending.get(m.id);
+          if (!entry) return;
+          pending.delete(m.id);
+          if (m.error) finish(reject, new Error(m.error.message));
+          else entry(m.result);
+        },
+      });
+
+      const send = (m, onResult) => {
+        const id = nextId++;
+        pending.set(id, onResult);
+        socket.write(serialize({ jsonrpc: "2.0", id, ...m }));
+      };
+
+      socket.on("data", (c) => framer.push(c));
+      socket.on("error", (err) => finish(reject, err));
+
+      socket.on("connect", () => {
+        send({ method: "initialize", params: { token: this.token } }, () => {
+          send({ method, params }, (result) => finish(resolve, result));
+        });
+      });
+    });
+  }
+}