@gajae-code/coding-agent 0.16.7 → 0.17.1

package/src/runtime-mcp/config-writer.ts

@@ -3,12 +3,17 @@
  *
  * Utilities for reading/writing .gjc/mcp.json files at user or project level.
  */
+
+import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { exactReplacePath, type NativeExactFileIdentity } from "@gajae-code/natives";
 import { isEnoent } from "@gajae-code/utils";
 import { invalidate as invalidateFsCache } from "../capability/fs";
+import { withFileLock } from "../config/file-lock";
 
 import { validateServerConfig } from "./config";
+import { readMcpBooleanField, restoreMcpBooleanField, writeMcpBooleanField } from "./policy-json-edit";
 import { MCP_CONFIG_SCHEMA_URL, type MCPConfigFile, type MCPServerConfig } from "./types";
 
 function withSchema(config: MCPConfigFile): MCPConfigFile {
@@ -298,3 +303,226 @@ export async function setServerDisabled(filePath: string, name: string, disabled
 
 	await writeMCPConfigFile(filePath, updated);
 }
+
+export interface ExactMcpBooleanUpdate {
+	readonly beforeRaw?: string;
+	readonly beforeIdentity?: NativeExactFileIdentity;
+	readonly beforeValue?: unknown;
+	readonly afterValue: boolean;
+}
+
+interface McpFileSnapshot {
+	readonly raw: string;
+	readonly identity: NativeExactFileIdentity;
+}
+async function exactSnapshot(filePath: string): Promise<McpFileSnapshot | null> {
+	let handle: fs.promises.FileHandle | undefined;
+	try {
+		// O_NONBLOCK prevents `open()` itself from blocking forever if the
+		// lexical path was raced to a FIFO between an earlier lstat and this
+		// open; the immediate fstat below still rejects any non-regular file.
+		handle = await fs.promises.open(
+			filePath,
+			fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK,
+		);
+		const stat = await handle.stat({ bigint: true });
+		const parent = await fs.promises.lstat(path.dirname(filePath), { bigint: true });
+		if (!stat.isFile() || stat.nlink !== 1n || parent.isSymbolicLink() || !parent.isDirectory())
+			throw new Error("MCP config is not an owned regular file");
+		const limit = 1024 * 1024;
+		if (stat.size > BigInt(limit)) throw new Error("MCP config size limit");
+		const bytes = new Uint8Array(limit + 1);
+		let length = 0;
+		while (length < bytes.length) {
+			const next = await handle.read(bytes, length, bytes.length - length, length);
+			if (next.bytesRead === 0) break;
+			length += next.bytesRead;
+		}
+		if (length > limit) throw new Error("MCP config size limit");
+		const after = await handle.stat({ bigint: true });
+		const lexical = await fs.promises.lstat(filePath, { bigint: true });
+		const parentAfter = await fs.promises.lstat(path.dirname(filePath), { bigint: true });
+		if (
+			after.dev !== stat.dev ||
+			after.ino !== stat.ino ||
+			after.mtimeNs !== stat.mtimeNs ||
+			after.ctimeNs !== stat.ctimeNs ||
+			after.size !== stat.size ||
+			after.nlink !== 1n ||
+			lexical.isSymbolicLink() ||
+			lexical.dev !== after.dev ||
+			lexical.ino !== after.ino ||
+			lexical.mtimeNs !== after.mtimeNs ||
+			lexical.ctimeNs !== after.ctimeNs ||
+			parentAfter.isSymbolicLink() ||
+			parentAfter.dev !== parent.dev ||
+			parentAfter.ino !== parent.ino
+		)
+			throw new Error("MCP config identity changed while reading");
+		const contents = bytes.subarray(0, length);
+		const identity = {
+			dev: stat.dev,
+			ino: stat.ino,
+			nlink: stat.nlink,
+			size: stat.size,
+			mtimeNs: stat.mtimeNs,
+			parentDev: parent.dev,
+			parentIno: parent.ino,
+			sha256: crypto.createHash("sha256").update(contents).digest("hex"),
+		};
+		return { raw: new TextDecoder("utf-8", { fatal: true }).decode(contents), identity };
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code === "ENOENT") return null;
+		throw error;
+	} finally {
+		await handle?.close();
+	}
+}
+
+async function exactIdentity(filePath: string): Promise<NativeExactFileIdentity | null> {
+	return (await exactSnapshot(filePath))?.identity ?? null;
+}
+
+/** Exact-field JSON CAS used by doctor; server names are object keys and may contain dots. */
+export async function updateMCPBooleanExact(
+	filePath: string,
+	name: string,
+	field: "autoload" | "enabled",
+	value: boolean,
+	expected: { readonly raw: string; readonly identity: NativeExactFileIdentity },
+): Promise<{ beforeValue: unknown; afterValue: boolean; changed: boolean; afterIdentity?: NativeExactFileIdentity }> {
+	return await withFileLock(filePath, async () => {
+		const snapshot = await exactSnapshot(filePath);
+		const raw = snapshot?.raw;
+		const identity = snapshot?.identity;
+		if (
+			!identity ||
+			raw !== expected.raw ||
+			identity.dev !== expected.identity.dev ||
+			identity.ino !== expected.identity.ino ||
+			identity.size !== expected.identity.size ||
+			identity.mtimeNs !== expected.identity.mtimeNs ||
+			identity.parentDev !== expected.identity.parentDev ||
+			identity.parentIno !== expected.identity.parentIno ||
+			identity.sha256 !== expected.identity.sha256
+		)
+			throw new Error("MCP config compare-and-swap conflict");
+		const edit = writeMcpBooleanField(raw, name, field, value);
+		if (edit.status === "not_found") throw new Error("MCP server not found");
+		if (edit.status === "duplicate_key") throw new Error(`MCP config has a duplicate key at ${edit.path}`);
+		if (edit.status === "malformed") throw new Error("MCP config is not valid JSON");
+		const beforeValue = edit.beforeValue;
+		if (beforeValue === value) return { beforeValue, afterValue: value, changed: false };
+		const tmpPath = `${filePath}.doctor-${crypto.randomUUID()}.tmp`;
+		const handle = await fs.promises.open(
+			tmpPath,
+			fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW,
+			0o600,
+		);
+		try {
+			await handle.writeFile(edit.text, "utf8");
+			await handle.sync();
+		} finally {
+			await handle.close();
+		}
+		const source = await exactIdentity(tmpPath);
+		if (!source) throw new Error("MCP config identity unavailable");
+		const replaced = exactReplacePath(tmpPath, filePath, source, expected.identity);
+		if (!replaced.ok) throw new Error(`MCP config replacement failed: ${replaced.code ?? "unknown"}`);
+		const parentHandle = await fs.promises.open(path.dirname(filePath), "r");
+		try {
+			await parentHandle.sync();
+		} finally {
+			await parentHandle.close();
+		}
+		return {
+			beforeValue,
+			afterValue: value,
+			changed: true,
+			afterIdentity: (await exactIdentity(filePath)) ?? undefined,
+		};
+	});
+}
+
+export type RestoreMCPBooleanResult =
+	| { readonly status: "restored" }
+	| { readonly status: "conflict" }
+	| { readonly status: "failed"; readonly reason: string };
+
+/**
+ * Roll back exactly one `mcpServers.<name>.<field>` token to its captured
+ * `value` (which may be `undefined` to restore an originally-absent field, or
+ * an originally-invalid non-boolean scalar). Binds to the PUBLISHED file's
+ * dev/ino/parent identity captured right after the mutating replace — not the
+ * pre-mutation identity — and to the field's known current (post-mutation)
+ * value, so an unrelated in-place sibling edit made after publication is
+ * preserved rather than reverted by a stale whole-file snapshot. A CAS
+ * precondition mismatch (identity or field drifted) is a `conflict`; any
+ * other unexpected error is reported as `failed` and must never be silently
+ * folded into `conflict`, since only `conflict` means "an independent editor
+ * already resolved this and no action is required".
+ */
+export async function restoreMCPBooleanExact(
+	filePath: string,
+	name: string,
+	field: "autoload" | "enabled",
+	originalRaw: string,
+	expected: { readonly identity: NativeExactFileIdentity; readonly currentValue: boolean },
+): Promise<RestoreMCPBooleanResult> {
+	return await withFileLock(filePath, async () => {
+		let current: McpFileSnapshot | null;
+		try {
+			current = await exactSnapshot(filePath);
+		} catch {
+			return { status: "failed", reason: "restore_snapshot_failed" };
+		}
+		if (
+			!current ||
+			current.identity.dev !== expected.identity.dev ||
+			current.identity.ino !== expected.identity.ino ||
+			current.identity.parentDev !== expected.identity.parentDev ||
+			current.identity.parentIno !== expected.identity.parentIno
+		)
+			return { status: "conflict" };
+		const read = readMcpBooleanField(current.raw, name, field);
+		if (read.status === "duplicate_key") return { status: "failed", reason: `duplicate key at ${read.path}` };
+		if (read.status === "malformed") return { status: "failed", reason: "MCP config is not valid JSON" };
+		if (read.status === "not_found" || read.value !== expected.currentValue) return { status: "conflict" };
+		const edit = restoreMcpBooleanField(current.raw, originalRaw, name, field);
+		if (edit.status !== "ok") return { status: "failed", reason: edit.status };
+		const tmpPath = `${filePath}.doctor-restore-${crypto.randomUUID()}.tmp`;
+		const restoreHandle = await fs.promises.open(
+			tmpPath,
+			fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW,
+			0o600,
+		);
+		try {
+			await restoreHandle.writeFile(edit.text, "utf8");
+			await restoreHandle.sync();
+		} finally {
+			await restoreHandle.close();
+		}
+		const source = await exactIdentity(tmpPath);
+		if (!source) return { status: "failed", reason: "restore identity unavailable" };
+		const replaced = exactReplacePath(tmpPath, filePath, source, current.identity);
+		if (!replaced.ok) return { status: "failed", reason: "restore_publication_unverified" };
+		const verified = await exactSnapshot(filePath);
+		if (!verified) return { status: "failed", reason: "post-restore verification unavailable" };
+		if (
+			verified.raw !== edit.text ||
+			verified.identity.dev !== source.dev ||
+			verified.identity.ino !== source.ino ||
+			verified.identity.parentDev !== source.parentDev ||
+			verified.identity.parentIno !== source.parentIno
+		)
+			return { status: "failed", reason: "post_restore_identity_mismatch" };
+		const parentHandle = await fs.promises.open(path.dirname(filePath), "r");
+		try {
+			await parentHandle.sync();
+		} finally {
+			await parentHandle.close();
+		}
+		return { status: "restored" };
+	});
+}

package/src/runtime-mcp/oauth-discovery.ts

@@ -73,6 +73,108 @@ export function detectAuthError(error: Error): boolean {
 	return false;
 }
 
+const CHALLENGE_KEY_MAX_LENGTH = 64;
+
+function isChallengeKeyStart(code: number): boolean {
+	return (code >= 65 && code <= 90) || (code >= 97 && code <= 122) || code === 95;
+}
+
+function isChallengeKeyPart(code: number): boolean {
+	return isChallengeKeyStart(code) || (code >= 48 && code <= 57) || code === 45;
+}
+
+/**
+ * Scan challenge parameters without retrying an entire identifier run at every
+ * offset. Skipping a failed run is important: a bounded regex could reinterpret
+ * the suffix of an oversized key as a different, recognized parameter.
+ */
+function extractChallengeEntries(errorMessage: string): Array<[string, string]> {
+	const entries: Array<[string, string]> = [];
+	let cursor = 0;
+
+	while (cursor < errorMessage.length) {
+		const keyStart = cursor;
+		if (!isChallengeKeyStart(errorMessage.charCodeAt(keyStart))) {
+			cursor++;
+			continue;
+		}
+
+		let keyEnd = keyStart + 1;
+		while (isChallengeKeyPart(errorMessage.charCodeAt(keyEnd))) keyEnd++;
+
+		if (errorMessage.charCodeAt(keyEnd) !== 61 || errorMessage.charCodeAt(keyEnd + 1) !== 34) {
+			cursor = keyEnd + 1;
+			continue;
+		}
+
+		const valueStart = keyEnd + 2;
+		const valueEnd = errorMessage.indexOf('"', valueStart);
+		if (valueEnd === -1) break;
+		if (valueEnd > valueStart && keyEnd - keyStart <= CHALLENGE_KEY_MAX_LENGTH) {
+			entries.push([errorMessage.slice(keyStart, keyEnd).toLowerCase(), errorMessage.slice(valueStart, valueEnd)]);
+		}
+		cursor = valueEnd + 1;
+	}
+
+	return entries;
+}
+
+interface QuotedParameter {
+	markerStart: number;
+	valueEnd: number;
+	value: string;
+}
+
+function isRegexLineTerminator(code: number): boolean {
+	return code === 10 || code === 13 || code === 0x2028 || code === 0x2029;
+}
+
+function collectQuotedParameters(errorMessage: string, prefix: string): QuotedParameter[] {
+	const entries: QuotedParameter[] = [];
+	for (
+		let markerStart = errorMessage.indexOf(prefix);
+		markerStart !== -1;
+		markerStart = errorMessage.indexOf(prefix, markerStart + 1)
+	) {
+		const valueStart = markerStart + prefix.length;
+		const valueEnd = errorMessage.indexOf('"', valueStart);
+		if (valueEnd === -1) break;
+		if (valueEnd > valueStart)
+			entries.push({ markerStart, valueEnd, value: errorMessage.slice(valueStart, valueEnd) });
+	}
+	return entries;
+}
+
+/**
+ * Preserve the legacy `realm="...".*token_url="..."` fallback without the
+ * greedy wildcard rescanning every later `realm` marker. The wildcard cannot
+ * cross a JavaScript regex line terminator and selects the last valid token on
+ * the matching line.
+ */
+function extractLegacyWwwAuth(errorMessage: string): { authorizationUrl: string; tokenUrl: string } | null {
+	const lineAt = new Uint32Array(errorMessage.length + 1);
+	let line = 0;
+	for (let index = 0; index < errorMessage.length; index++) {
+		lineAt[index] = line;
+		if (isRegexLineTerminator(errorMessage.charCodeAt(index))) line++;
+	}
+	lineAt[errorMessage.length] = line;
+
+	const realms = collectQuotedParameters(errorMessage, 'realm="');
+	const tokens = collectQuotedParameters(errorMessage, 'token_url="');
+	const lastTokenByLine = new Map<number, QuotedParameter>();
+	for (const token of tokens) lastTokenByLine.set(lineAt[token.markerStart]!, token);
+
+	for (const realm of realms) {
+		const token = lastTokenByLine.get(lineAt[realm.valueEnd + 1]!);
+		if (token && token.markerStart > realm.valueEnd) {
+			return { authorizationUrl: realm.value, tokenUrl: token.value };
+		}
+	}
+
+	return null;
+}
+
 /**
  * Extract OAuth endpoints from error response.
  * Looks for WWW-Authenticate header format or JSON error bodies.
@@ -130,9 +232,10 @@ export function extractOAuthEndpoints(error: Error): OAuthEndpoints | null {
 	try {
 		// Try to parse as JSON error response
 		// Many MCP servers return JSON with OAuth endpoints in error body
-		const jsonMatch = errorMsg.match(/\{[\s\S]*\}/);
-		if (jsonMatch) {
-			const errorBody = JSON.parse(jsonMatch[0]) as Record<string, unknown>;
+		const jsonStart = errorMsg.indexOf("{");
+		const jsonEnd = errorMsg.lastIndexOf("}");
+		if (jsonEnd > jsonStart) {
+			const errorBody = JSON.parse(errorMsg.slice(jsonStart, jsonEnd + 1)) as Record<string, unknown>;
 
 			// Check for OAuth endpoints in error body
 			if (errorBody.oauth || errorBody.authorization || errorBody.auth) {
@@ -160,11 +263,11 @@ export function extractOAuthEndpoints(error: Error): OAuthEndpoints | null {
 		// Not JSON, continue with other detection methods
 	}
 
-	const challengeEntries = Array.from(errorMsg.matchAll(/([a-zA-Z_][a-zA-Z0-9_-]*)="([^"]+)"/g));
+	const challengeEntries = extractChallengeEntries(errorMsg);
 	if (challengeEntries.length > 0) {
 		const challengeValues = new Map<string, string>();
-		for (const [, rawKey, value] of challengeEntries) {
-			challengeValues.set(rawKey.toLowerCase(), value);
+		for (const [key, value] of challengeEntries) {
+			challengeValues.set(key, value);
 		}
 
 		const authorizationUrl =
@@ -186,15 +289,12 @@ export function extractOAuthEndpoints(error: Error): OAuthEndpoints | null {
 		}
 	}
 
-	// Try to extract from WWW-Authenticate header format
-	// Example: Bearer realm="https://auth.example.com/oauth/authorize" token_url="https://auth.example.com/oauth/token"
-	const wwwAuthMatch = errorMsg.match(/realm="([^"]+)".*token_url="([^"]+)"/);
-	if (wwwAuthMatch) {
+	const wwwAuth = extractLegacyWwwAuth(errorMsg);
+	if (wwwAuth) {
 		return {
-			authorizationUrl: wwwAuthMatch[1],
-			tokenUrl: wwwAuthMatch[2],
-			clientId: clientIdFromAuthUrl(wwwAuthMatch[1]),
-			scopes: scopeFromAuthUrl(wwwAuthMatch[1]),
+			...wwwAuth,
+			clientId: clientIdFromAuthUrl(wwwAuth.authorizationUrl),
+			scopes: scopeFromAuthUrl(wwwAuth.authorizationUrl),
 		};
 	}
 

package/src/runtime-mcp/policy-json-edit.ts

@@ -0,0 +1,129 @@
+/**
+ * Lossless JSON policy-field editing for `.gjc/mcp.json`.
+ *
+ * Uses `jsonc-parser`'s AST/edit API instead of `JSON.parse`/`JSON.stringify`
+ * so only the selected `mcpServers.<name>.<field>` token is rewritten. Every
+ * other token in the document (unrelated fields, large
+ * integer literals, `-0`, secrets) survives untouched. `JSON.parse` would
+ * silently normalize those values and collapse duplicate keys to "last one
+ * wins", hiding a real authoring bug — so duplicate keys along the selected
+ * path are rejected instead of being silently resolved.
+ */
+import {
+	applyEdits,
+	findNodeAtLocation,
+	getNodeValue,
+	modify,
+	type Node,
+	type ParseError,
+	parseTree,
+} from "jsonc-parser";
+
+export type McpBooleanField = "autoload" | "enabled";
+
+export type McpFieldReadResult =
+	| { readonly status: "ok"; readonly exists: boolean; readonly value: unknown }
+	| { readonly status: "duplicate_key"; readonly path: string }
+	| { readonly status: "malformed" }
+	| { readonly status: "not_found" };
+
+export type McpFieldWriteResult =
+	| { readonly status: "ok"; readonly text: string; readonly beforeValue: unknown }
+	| { readonly status: "duplicate_key"; readonly path: string }
+	| { readonly status: "malformed" }
+	| { readonly status: "not_found" };
+
+/**
+ * Detect a duplicate property name at each level while descending the given
+ * path. Scoped to the selected policy path only — this is not a whole-document
+ * scan; it visits only the objects on the selected path.
+ */
+export function findDuplicateKeyAlongPath(root: Node, path: readonly string[]): string | undefined {
+	let node: Node | undefined = root;
+	for (let depth = 0; depth < path.length; depth++) {
+		if (node?.type !== "object" || !node.children) return undefined;
+		let matched: Node | undefined;
+		for (const property of node.children) {
+			const keyNode = property.children?.[0];
+			if (!keyNode || keyNode.value !== path[depth]) continue;
+			if (matched) return path.slice(0, depth + 1).join(".");
+			matched = property;
+		}
+		node = matched?.children?.[1];
+	}
+	return undefined;
+}
+
+function parsePolicyTree(raw: string): Node | undefined {
+	const errors: ParseError[] = [];
+	const root = parseTree(raw, errors, { disallowComments: true, allowTrailingComma: false });
+	return root && errors.length === 0 ? root : undefined;
+}
+
+/** Read one selected `mcpServers.<name>.<field>` boolean without collapsing duplicate keys. */
+export function readMcpBooleanField(raw: string, serverName: string, field: McpBooleanField): McpFieldReadResult {
+	const root = parsePolicyTree(raw);
+	if (!root) return { status: "malformed" };
+	const path = ["mcpServers", serverName, field];
+	const duplicate = findDuplicateKeyAlongPath(root, path);
+	if (duplicate) return { status: "duplicate_key", path: duplicate };
+	const serverNode = findNodeAtLocation(root, ["mcpServers", serverName]);
+	if (serverNode?.type !== "object") return { status: "not_found" };
+	const fieldNode = findNodeAtLocation(root, path);
+	return { status: "ok", exists: fieldNode !== undefined, value: fieldNode ? getNodeValue(fieldNode) : undefined };
+}
+
+/**
+ * Compute the lossless text after setting `mcpServers.<name>.<field>` to
+ * `value`, or removing it when `value` is `undefined` (used to restore an
+ * originally-absent field). Only the selected token's edit range changes.
+ */
+export function writeMcpBooleanField(
+	raw: string,
+	serverName: string,
+	field: McpBooleanField,
+	/**
+	 * The new field value. `undefined` removes the key, restoring an
+	 * originally-absent field on rollback. A rollback may also need to restore
+	 * an originally-invalid non-boolean scalar, so this intentionally accepts
+	 * any JSON value rather than only `boolean`.
+	 */
+	value: unknown,
+): McpFieldWriteResult {
+	const before = readMcpBooleanField(raw, serverName, field);
+	if (before.status !== "ok") return before;
+	const edits = modify(raw, ["mcpServers", serverName, field], value, {});
+	return { status: "ok", text: applyEdits(raw, edits), beforeValue: before.value };
+}
+
+/** Restore the original token, rather than reserializing its possibly-invalid value. */
+export function restoreMcpBooleanField(
+	raw: string,
+	original: string,
+	serverName: string,
+	field: McpBooleanField,
+): McpFieldWriteResult {
+	const current = readMcpBooleanField(raw, serverName, field);
+	const before = readMcpBooleanField(original, serverName, field);
+	if (current.status !== "ok") return current;
+	if (before.status !== "ok") return before;
+	if (!before.exists) return writeMcpBooleanField(raw, serverName, field, undefined);
+	const currentTree = parsePolicyTree(raw);
+	const originalTree = parsePolicyTree(original);
+	if (!currentTree || !originalTree) return { status: "malformed" };
+	const selected = ["mcpServers", serverName, field];
+	const currentNode = findNodeAtLocation(currentTree, selected);
+	const originalNode = findNodeAtLocation(originalTree, selected);
+	if (!currentNode || !originalNode) return { status: "not_found" };
+	return {
+		status: "ok",
+		beforeValue: current.value,
+		text: applyEdits(raw, [
+			{
+				offset: currentNode.offset,
+				length: currentNode.length,
+				content: original.slice(originalNode.offset, originalNode.offset + originalNode.length),
+			},
+		]),
+	};
+}

package/src/runtime-mcp/startup-policy.ts

@@ -0,0 +1,14 @@
+import type { MCPServerConfig } from "./types";
+
+export type AutoloadStatus = "autoload" | "autoload-off" | "disabled";
+
+/** Pure startup policy shared by runtime-facing CLI inspection and doctor. */
+export function computeAutoloadStatus(
+	name: string,
+	config: Pick<MCPServerConfig, "enabled" | "autoload">,
+	disabledServers: ReadonlySet<string>,
+): AutoloadStatus {
+	if (config.enabled === false || disabledServers.has(name)) return "disabled";
+	if (config.autoload === false) return "autoload-off";
+	return "autoload";
+}

package/src/runtime-mcp/types.ts

@@ -67,8 +67,8 @@ export interface MCPServerConfigBase {
 	 * Whether an explicit runtime MCP consumer should connect this server
 	 * automatically when that consumer starts (default: true). Ordinary
 	 * standalone `gjc`, `gjc --tmux`, and print-mode sessions honor autoload for
-	 * conventional registrations; `autoload: false` keeps a server configured
-	 * for on-demand `/mcp` connection. `--no-mcp` opts a session out entirely.
+	 * conventional registrations; `autoload: false` keeps a server stored but
+	 * unloaded at startup. `--no-mcp` opts a session out entirely.
 	 */
 	autoload?: boolean;
 	/** Connection timeout in milliseconds (default: 30000) */

package/src/sdk/acp/adapter.ts

@@ -198,6 +198,8 @@ export class AcpSdkAdapter {
 	#reverseCancelTtlMs: number;
 	#closed = false;
 	#started = false;
+	/** Reverse-provider leases are enabled only after host origin is authenticated. */
+	#providerActivationAuthorized = false;
 	constructor(options: AcpSdkAdapterOptions) {
 		if ((options.client === undefined) === (options.router === undefined))
 			throw new AcpSdkAdapterError(
@@ -225,6 +227,11 @@ export class AcpSdkAdapter {
 		return adapter;
 	}
 
+	/** Authorize provider registration after the host startup origin is known. */
+	authorizeProviderActivation(): void {
+		this.#providerActivationAuthorized = true;
+	}
+
 	acceptAttachment(attachment: SessionAttachment): void {
 		if (!this.#router || attachment.sessionId !== this.#sessionId)
 			throw new AcpSdkAdapterError("invalid_input", "ACP attachment does not match this session adapter.");
@@ -238,7 +245,8 @@ export class AcpSdkAdapter {
 		this.#connectionId = undefined;
 		this.#routerConnectionReady = false;
 		this.#providersActivated = false;
-		if (attachment.isCurrent()) void this.#activateProviders().catch(error => this.#reportReconnectFailure(error));
+		if (attachment.isCurrent() && this.#providerActivationAuthorized)
+			void this.#activateProviders().catch(error => this.#reportReconnectFailure(error));
 	}
 
 	revokeAttachment(attachment: SessionAttachment): void {
@@ -264,7 +272,7 @@ export class AcpSdkAdapter {
 			this.#providersActivated = false;
 		}
 		if (!attachment.isCurrent()) throw new SessionRouterError("pre_send", "SDK session attachment is stale.");
-		await this.#activateProviders();
+		if (this.#providerActivationAuthorized) await this.#activateProviders();
 	}
 	/**
 	 * Re-register reverse providers on a live attachment without aborting in-flight
@@ -273,7 +281,7 @@ export class AcpSdkAdapter {
 	 * place for the life of the session (#4909).
 	 */
 	async ensureProviders(): Promise<void> {
-		if (this.#closed || this.#providers.length === 0) return;
+		if (!this.#providerActivationAuthorized || this.#closed || this.#providers.length === 0) return;
 		if (this.#ensuring) return await this.#ensuring;
 		const run = (async () => {
 			if (this.#closed) return;
@@ -307,9 +315,15 @@ export class AcpSdkAdapter {
 		return () => this.#frameHandlers.delete(handler);
 	}
 
-	async start(): Promise<void> {
+	async start(options: { activateProviders?: boolean } = {}): Promise<void> {
+		const activateProviders = options.activateProviders !== false;
 		if (this.#closed) throw new AcpSdkAdapterError("connection_closed");
+		if (this.#router && this.#attachment) assertMaintenanceCapability(this.#attachment);
 		if (!this.#started) {
+			// Direct adapter startup owns providers; ACP attachment defers this
+			// authority until runtime origin discovery. Repeated startup cannot
+			// promote a secondary attachment.
+			this.#providerActivationAuthorized = activateProviders;
 			this.#started = true;
 			if (this.#client) {
 				this.#unsubscribe ??= this.#client.onFrame(frame => void this.#onFrame(frame));
@@ -323,12 +337,13 @@ export class AcpSdkAdapter {
 				this.#connectionId = this.#client.connectionId;
 			}
 		}
-		if (this.#router) {
-			if (!this.#attachment?.isCurrent()) return;
-			if (this.#attachment) assertMaintenanceCapability(this.#attachment);
-			await this.#activateProviders();
-		} else {
-			await this.#activateProviders();
+		if (activateProviders) {
+			if (this.#router) {
+				if (!this.#attachment?.isCurrent()) return;
+				if (this.#providerActivationAuthorized) await this.#activateProviders();
+			} else {
+				if (this.#providerActivationAuthorized) await this.#activateProviders();
+			}
 		}
 		this.#heartbeat ??= setInterval(
 			() => void this.#heartbeatLeases().catch(error => this.#reportReconnectFailure(error)),
@@ -575,7 +590,7 @@ export class AcpSdkAdapter {
 	}
 
 	async #activateProviders(force = false): Promise<void> {
-		if (this.#providers.length === 0) return;
+		if (!this.#providerActivationAuthorized || this.#providers.length === 0) return;
 		if (this.#providerActivation) {
 			await this.#providerActivation;
 			if (this.#closed) return;
@@ -656,7 +671,7 @@ export class AcpSdkAdapter {
 	}
 
 	async #reclaimProviders(): Promise<void> {
-		if (this.#closed || !this.#providers.length) return;
+		if (!this.#providerActivationAuthorized || this.#closed || !this.#providers.length) return;
 		if (this.#reclaiming) return await this.#reclaiming;
 		this.#reclaiming = (async () => {
 			this.#abortActiveReverseRequests();