@gaunt-sloth/agent 2.0.0-alpha.38 → 2.0.0-alpha.39

package/dist/modules/acp/acpStdio.js

@@ -1,7 +1,7 @@
 /**
  * @packageDocumentation
  * The stdio entry point both ACP doors go through — the standalone `gaunt-sloth-acp` bin and
- * `gaunt-sloth --acp-agent`.
+ * `gaunt-sloth --acp-agent` — serving whichever protocol version the client speaks.
  *
  * **It is one function on purpose.** Two entry points spelling the same startup twice is how the
  * doors drift, and the thing that would drift here is not cosmetic: it is the stdout guarantee
@@ -23,7 +23,8 @@
  */
 import { Readable } from 'node:stream';
 import * as acp from '@agentclientprotocol/sdk/experimental/v2';
-import { announceAcpStart, createAcpAgentApp } from '#src/modules/acp/acpAgentApp.js';
+import { announceAcpStart } from '#src/modules/acp/acpCommon.js';
+import { createAcpAgentRouter } from '#src/modules/acp/acpRouter.js';
 /**
  * Sends everything written to `process.stdout` to stderr instead, and returns a sink holding the
  * ORIGINAL writer.
@@ -46,7 +47,13 @@ function captureStdoutForProtocol() {
     });
 }
 /**
- * Serves ACP v2 over stdio until the client disconnects.
+ * Serves ACP over stdio until the client disconnects, in whichever protocol version the client
+ * asks for on its first message.
+ *
+ * The dialect is not chosen here and is not configurable: `acpRouter.ts` reads it off the
+ * `initialize` and hands the connection to the matching app. A flag would be the wrong shape —
+ * an editor spawns this command with no arguments, so a version it had to be told would be a
+ * version it never gets.
  *
  * Resolves when the connection closes, so a bin can `await` it and exit cleanly rather than
  * holding the event loop open on a socket nobody is reading.
@@ -57,8 +64,7 @@ export async function startAcpServer(options = {}) {
     // there so the guarantee is exercised on every real start rather than only under test.
     const protocolOut = output ?? captureStdoutForProtocol();
     const protocolIn = input ?? Readable.toWeb(process.stdin);
-    const app = createAcpAgentApp(appOptions);
-    const connection = app.connect(acp.ndJsonStream(protocolOut, protocolIn));
+    const connection = createAcpAgentRouter(appOptions).connect(acp.ndJsonStream(protocolOut, protocolIn));
     announceAcpStart();
     await connection.closed;
 }

package/dist/modules/acp/acpStdio.js.map

@@ -1 +1 @@
-{"version":3,"file":"acpStdio.js","sourceRoot":"","sources":["../../../src/modules/acp/acpStdio.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,GAAG,MAAM,0CAA0C,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AActF;;;;;;;GAOG;AACH,SAAS,wBAAwB;IAC/B,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,8DAA8D;IAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAU,EAAE,GAAG,IAAW,EAAE,EAAE;IACrD,8DAA8D;IAC7D,aAAqB,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAgC,CAAC;IACzE,OAAO,IAAI,cAAc,CAAa;QACpC,KAAK,CAAC,KAAK;YACT,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAO,GAAoB,EAAE;IAChE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC;IACjD,+FAA+F;IAC/F,uFAAuF;IACvF,MAAM,WAAW,GAAG,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACzD,MAAM,UAAU,GAAG,KAAK,IAAK,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAgC,CAAC;IAE1F,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1E,gBAAgB,EAAE,CAAC;IACnB,MAAM,UAAU,CAAC,MAAM,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"acpStdio.js","sourceRoot":"","sources":["../../../src/modules/acp/acpStdio.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,GAAG,MAAM,0CAA0C,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAarE;;;;;;;GAOG;AACH,SAAS,wBAAwB;IAC/B,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,8DAA8D;IAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAU,EAAE,GAAG,IAAW,EAAE,EAAE;IACrD,8DAA8D;IAC7D,aAAqB,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAgC,CAAC;IACzE,OAAO,IAAI,cAAc,CAAa;QACpC,KAAK,CAAC,KAAK;YACT,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAO,GAAoB,EAAE;IAChE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC;IACjD,+FAA+F;IAC/F,uFAAuF;IACvF,MAAM,WAAW,GAAG,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACzD,MAAM,UAAU,GAAG,KAAK,IAAK,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAgC,CAAC;IAE1F,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC,OAAO,CACzD,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,UAAU,CAAC,CAC1C,CAAC;IACF,gBAAgB,EAAE,CAAC;IACnB,MAAM,UAAU,CAAC,MAAM,CAAC;AAC1B,CAAC"}

package/dist/modules/acp/acpToolCalls.d.ts

@@ -0,0 +1,93 @@
+/**
+ * @packageDocumentation
+ * Tool-call identity, shared by both ACP dialects.
+ *
+ * The two dialects disagree about how a tool call is REPORTED — v1 has a distinct `tool_call`
+ * update that creates one and a `tool_call_update` that patches it, v2 folds creation into the
+ * first `tool_call_update` — but they agree completely about what a tool call IS. The kind hint, the
+ * reassembly of streamed argument deltas, and the pairing of a permission request with the call it
+ * is about are the same problem on both surfaces, so they are solved once here.
+ *
+ * **The pairing especially.** {@link AcpToolCallTracker.claimToolCallId} is the piece that took
+ * three attempts to get right, and a second copy of it living in the other dialect's mapper is how
+ * one of them silently regresses to attaching a permission prompt to the wrong row.
+ */
+import type { ToolKind } from '@agentclientprotocol/sdk';
+/**
+ * The ACP tool kind for a gth tool name; `other` for anything not built in.
+ *
+ * Typed against **v1's** `ToolKind`, which is the closed union of the ten defined kinds; v2 widens
+ * the same union with a catch-all for future values. Typing against the stricter one is what lets a
+ * single function serve both — a v1 kind is always a valid v2 kind, and the reverse is not true.
+ */
+export declare function toolKindFor(name: string): ToolKind;
+/**
+ * Tracks the tool calls a turn has opened, so a permission request can name the one it is about.
+ *
+ * A dialect's update mapper extends this and keeps the fields fed: {@link trackToolStart} when the
+ * model announces a call, {@link appendToolArgs} for each argument delta, {@link trackToolSettled}
+ * when a result lands.
+ */
+export declare abstract class AcpToolCallTracker {
+    /**
+     * Streamed argument text per tool call id, reassembled from `tool_args` deltas. Held rather than
+     * forwarded per delta because ACP has no argument-delta update: `rawInput` is a whole value, so
+     * it can only be sent once the deltas stop arriving.
+     */
+    protected readonly toolArgs: Map<string, string>;
+    /**
+     * Tool calls the model has requested but which have neither produced a result nor been claimed by
+     * a permission request, in the order they were announced, as `[toolCallId, toolName]`.
+     *
+     * Kept so the approval bridge can name the tool call a permission request is ABOUT. The gate's
+     * `PendingToolInterrupt` carries the tool's name and arguments but no call id — the graph
+     * suspends inside the middleware wrapping the call, which is downstream of where the id lives —
+     * while the client has already drawn that call from this stream. This queue reconnects the two.
+     */
+    protected readonly openToolCalls: Array<[string, string]>;
+    /** Records a newly announced call and opens its argument buffer. */
+    protected trackToolStart(id: string, name: string): void;
+    /** Accumulates one streamed argument delta. */
+    protected appendToolArgs(id: string, delta: string): void;
+    /** The reassembled arguments for a call, as a value for `rawInput`. */
+    protected rawInputFor(id: string): unknown;
+    /** Forgets a call that has produced its result. */
+    protected trackToolSettled(id: string): void;
+    /**
+     * Takes the id of the unclaimed tool call that matches `name` and `args`, removing it from the
+     * queue, or `undefined` when there is none.
+     *
+     * **Matched on the ARGUMENTS, because position is not a reliable discriminator here.** The
+     * arguments are the one value both sides hold: the gate's `PendingToolInterrupt` carries them, and
+     * this tracker still holds the streamed argument text at claim time (it is only discarded on
+     * `tool_result`, which exists solely on the resumed run).
+     *
+     * **Where the exact match degrades, named rather than implied:** this side is JSON reassembled
+     * from the model's streamed argument deltas, and a local model that ignores
+     * `disable_parallel_tool_use` can merge sibling calls' buffers into invalid JSON (`{}{}`,
+     * `{"steps":3}{}` — see the AG-UI server's `parseToolArguments` note). {@link parseToolArgs}
+     * deliberately does not carry that path's recovery, so such a payload stays a raw string, matches
+     * nothing, and falls back to position — on exactly the model class most likely to emit sloppy
+     * parallel calls. The fallback is still the best remaining answer and the cost is which row a
+     * client attaches the prompt to, never which command the human rules on.
+     *
+     * **Position was tried and is wrong in both directions**, which is why it is only the fallback.
+     * The runner drains suspended calls as a BATCH — every pending call decided in turn before
+     * anything resumes — so a model emitting two parallel calls of one tool has both open and neither
+     * running. Returning "the most recent" handed BOTH requests the second call's id. But plain
+     * oldest-first is no better in the case that is *normal* at the rated rungs: this method is
+     * reached only from the human-approval callback, which sits behind the gate's earlier exits
+     * (not-gated, deny list, bypass, the hardline floor, the allow list, and the rater's own arms), so
+     * a batch where one call is settled without a human and its sibling escalates leaves the settled
+     * call's id unclaimed at the head of the queue — and oldest-first then hands the request the
+     * wrong one, with every upstream ordering assumption perfectly intact.
+     *
+     * **Consuming is right either way**, and the queue order still decides between two calls whose
+     * arguments are genuinely identical, where either answer is equally true.
+     *
+     * Absent rather than guessed when nothing matches — a permission request pointing at the WRONG
+     * call is worse than one pointing at no call, because a client would then attach the answer to a
+     * call the user never saw.
+     */
+    claimToolCallId(name: string, args?: Record<string, unknown>): string | undefined;
+}

package/dist/modules/acp/acpToolCalls.js

@@ -0,0 +1,193 @@
+/**
+ * @packageDocumentation
+ * Tool-call identity, shared by both ACP dialects.
+ *
+ * The two dialects disagree about how a tool call is REPORTED — v1 has a distinct `tool_call`
+ * update that creates one and a `tool_call_update` that patches it, v2 folds creation into the
+ * first `tool_call_update` — but they agree completely about what a tool call IS. The kind hint, the
+ * reassembly of streamed argument deltas, and the pairing of a permission request with the call it
+ * is about are the same problem on both surfaces, so they are solved once here.
+ *
+ * **The pairing especially.** {@link AcpToolCallTracker.claimToolCallId} is the piece that took
+ * three attempts to get right, and a second copy of it living in the other dialect's mapper is how
+ * one of them silently regresses to attaching a permission prompt to the wrong row.
+ */
+/**
+ * ACP tool KIND for a gth tool name — the hint a client uses to pick an icon and a UI treatment.
+ *
+ * Matched by exact name, with `other` as the fallback, because a wrong kind is worse than a
+ * generic one: a client that shows a delete glyph for a read is actively misleading about what the
+ * agent is doing. Unknown names (custom tools, MCP tools) therefore land on `other` rather than
+ * being guessed at from substrings.
+ */
+const TOOL_KINDS = {
+    create_directory: 'edit',
+    delete_directory: 'delete',
+    delete_file: 'delete',
+    directory_tree: 'read',
+    edit_file: 'edit',
+    get_file_info: 'read',
+    gth_read_binary: 'read',
+    gth_status_update: 'think',
+    gth_web_fetch: 'fetch',
+    list_allowed_directories: 'read',
+    list_directory: 'read',
+    list_directory_with_sizes: 'read',
+    move_file: 'move',
+    read_file: 'read',
+    read_multiple_files: 'read',
+    run_build: 'execute',
+    run_lint: 'execute',
+    run_shell_command: 'execute',
+    run_single_test: 'execute',
+    run_tests: 'execute',
+    search_files: 'search',
+    write_file: 'edit',
+};
+/**
+ * The ACP tool kind for a gth tool name; `other` for anything not built in.
+ *
+ * Typed against **v1's** `ToolKind`, which is the closed union of the ten defined kinds; v2 widens
+ * the same union with a catch-all for future values. Typing against the stricter one is what lets a
+ * single function serve both — a v1 kind is always a valid v2 kind, and the reverse is not true.
+ */
+export function toolKindFor(name) {
+    return TOOL_KINDS[name] ?? 'other';
+}
+/**
+ * Tracks the tool calls a turn has opened, so a permission request can name the one it is about.
+ *
+ * A dialect's update mapper extends this and keeps the fields fed: {@link trackToolStart} when the
+ * model announces a call, {@link appendToolArgs} for each argument delta, {@link trackToolSettled}
+ * when a result lands.
+ */
+export class AcpToolCallTracker {
+    /**
+     * Streamed argument text per tool call id, reassembled from `tool_args` deltas. Held rather than
+     * forwarded per delta because ACP has no argument-delta update: `rawInput` is a whole value, so
+     * it can only be sent once the deltas stop arriving.
+     */
+    toolArgs = new Map();
+    /**
+     * Tool calls the model has requested but which have neither produced a result nor been claimed by
+     * a permission request, in the order they were announced, as `[toolCallId, toolName]`.
+     *
+     * Kept so the approval bridge can name the tool call a permission request is ABOUT. The gate's
+     * `PendingToolInterrupt` carries the tool's name and arguments but no call id — the graph
+     * suspends inside the middleware wrapping the call, which is downstream of where the id lives —
+     * while the client has already drawn that call from this stream. This queue reconnects the two.
+     */
+    openToolCalls = [];
+    /** Records a newly announced call and opens its argument buffer. */
+    trackToolStart(id, name) {
+        this.toolArgs.set(id, '');
+        this.openToolCalls.push([id, name]);
+    }
+    /** Accumulates one streamed argument delta. */
+    appendToolArgs(id, delta) {
+        this.toolArgs.set(id, (this.toolArgs.get(id) ?? '') + delta);
+    }
+    /** The reassembled arguments for a call, as a value for `rawInput`. */
+    rawInputFor(id) {
+        return parseToolArgs(this.toolArgs.get(id));
+    }
+    /** Forgets a call that has produced its result. */
+    trackToolSettled(id) {
+        this.toolArgs.delete(id);
+        // A call a permission request already claimed is no longer in the queue; that is expected,
+        // not a miss.
+        const open = this.openToolCalls.findIndex(([openId]) => openId === id);
+        if (open >= 0)
+            this.openToolCalls.splice(open, 1);
+    }
+    /**
+     * Takes the id of the unclaimed tool call that matches `name` and `args`, removing it from the
+     * queue, or `undefined` when there is none.
+     *
+     * **Matched on the ARGUMENTS, because position is not a reliable discriminator here.** The
+     * arguments are the one value both sides hold: the gate's `PendingToolInterrupt` carries them, and
+     * this tracker still holds the streamed argument text at claim time (it is only discarded on
+     * `tool_result`, which exists solely on the resumed run).
+     *
+     * **Where the exact match degrades, named rather than implied:** this side is JSON reassembled
+     * from the model's streamed argument deltas, and a local model that ignores
+     * `disable_parallel_tool_use` can merge sibling calls' buffers into invalid JSON (`{}{}`,
+     * `{"steps":3}{}` — see the AG-UI server's `parseToolArguments` note). {@link parseToolArgs}
+     * deliberately does not carry that path's recovery, so such a payload stays a raw string, matches
+     * nothing, and falls back to position — on exactly the model class most likely to emit sloppy
+     * parallel calls. The fallback is still the best remaining answer and the cost is which row a
+     * client attaches the prompt to, never which command the human rules on.
+     *
+     * **Position was tried and is wrong in both directions**, which is why it is only the fallback.
+     * The runner drains suspended calls as a BATCH — every pending call decided in turn before
+     * anything resumes — so a model emitting two parallel calls of one tool has both open and neither
+     * running. Returning "the most recent" handed BOTH requests the second call's id. But plain
+     * oldest-first is no better in the case that is *normal* at the rated rungs: this method is
+     * reached only from the human-approval callback, which sits behind the gate's earlier exits
+     * (not-gated, deny list, bypass, the hardline floor, the allow list, and the rater's own arms), so
+     * a batch where one call is settled without a human and its sibling escalates leaves the settled
+     * call's id unclaimed at the head of the queue — and oldest-first then hands the request the
+     * wrong one, with every upstream ordering assumption perfectly intact.
+     *
+     * **Consuming is right either way**, and the queue order still decides between two calls whose
+     * arguments are genuinely identical, where either answer is equally true.
+     *
+     * Absent rather than guessed when nothing matches — a permission request pointing at the WRONG
+     * call is worse than one pointing at no call, because a client would then attach the answer to a
+     * call the user never saw.
+     */
+    claimToolCallId(name, args) {
+        const candidates = this.openToolCalls
+            .map(([id, toolName], index) => ({ id, toolName, index }))
+            .filter((candidate) => candidate.toolName === name);
+        if (candidates.length === 0)
+            return undefined;
+        const wanted = args === undefined ? undefined : canonicalJson(args);
+        const matched = wanted === undefined
+            ? undefined
+            : candidates.find((candidate) => canonicalJson(parseToolArgs(this.toolArgs.get(candidate.id))) === wanted);
+        const chosen = matched ?? candidates[0];
+        this.openToolCalls.splice(chosen.index, 1);
+        return chosen.id;
+    }
+}
+/**
+ * A value serialized with object keys in sorted order, so two arguments objects that differ only in
+ * key order compare equal.
+ *
+ * They routinely do: one side is JSON reassembled from a model's streamed argument deltas and the
+ * other is the object the graph handed the gate. Comparing raw `JSON.stringify` output would make
+ * the exact match in {@link AcpToolCallTracker.claimToolCallId} fail for a reason that has nothing
+ * to do with whether the two describe the same call.
+ */
+function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value) ?? 'undefined';
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const entries = Object.keys(value)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`);
+    return `{${entries.join(',')}}`;
+}
+/**
+ * The reassembled tool arguments as a value for `rawInput`, or `undefined` when there is nothing
+ * worth sending.
+ *
+ * Deliberately fail-soft: a model that emits malformed argument JSON is a real and recurring
+ * condition (see the AG-UI server's `parseToolArguments` note), and it must not take down the turn
+ * that reports it. An unparseable payload is passed through as the raw string so the client can
+ * still show what the model asked for.
+ */
+function parseToolArgs(raw) {
+    const text = (raw ?? '').trim();
+    if (text.length === 0)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+//# sourceMappingURL=acpToolCalls.js.map

package/dist/modules/acp/acpToolCalls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acpToolCalls.js","sourceRoot":"","sources":["../../../src/modules/acp/acpToolCalls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH;;;;;;;GAOG;AACH,MAAM,UAAU,GAAuC;IACrD,gBAAgB,EAAE,MAAM;IACxB,gBAAgB,EAAE,QAAQ;IAC1B,WAAW,EAAE,QAAQ;IACrB,cAAc,EAAE,MAAM;IACtB,SAAS,EAAE,MAAM;IACjB,aAAa,EAAE,MAAM;IACrB,eAAe,EAAE,MAAM;IACvB,iBAAiB,EAAE,OAAO;IAC1B,aAAa,EAAE,OAAO;IACtB,wBAAwB,EAAE,MAAM;IAChC,cAAc,EAAE,MAAM;IACtB,yBAAyB,EAAE,MAAM;IACjC,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,MAAM;IACjB,mBAAmB,EAAE,MAAM;IAC3B,SAAS,EAAE,SAAS;IACpB,QAAQ,EAAE,SAAS;IACnB,iBAAiB,EAAE,SAAS;IAC5B,eAAe,EAAE,SAAS;IAC1B,SAAS,EAAE,SAAS;IACpB,YAAY,EAAE,QAAQ;IACtB,UAAU,EAAE,MAAM;CACnB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAgB,kBAAkB;IACtC;;;;OAIG;IACgB,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExD;;;;;;;;OAQG;IACgB,aAAa,GAA4B,EAAE,CAAC;IAE/D,oEAAoE;IAC1D,cAAc,CAAC,EAAU,EAAE,IAAY;QAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,+CAA+C;IACrC,cAAc,CAAC,EAAU,EAAE,KAAa;QAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,uEAAuE;IAC7D,WAAW,CAAC,EAAU;QAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,mDAAmD;IACzC,gBAAgB,CAAC,EAAU;QACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,2FAA2F;QAC3F,cAAc;QACd,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;QACvE,IAAI,IAAI,IAAI,CAAC;YAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,eAAe,CAAC,IAAY,EAAE,IAA8B;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa;aAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;aACzD,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;QACtD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,OAAO,GACX,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,UAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CACxF,CAAC;QACR,MAAM,MAAM,GAAG,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,EAAE,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC;IAC7F,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC;SAC1D,IAAI,EAAE;SACN,GAAG,CACF,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,EAAE,CAC5F,CAAC;IACJ,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,GAAuB;IAC5C,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/modules/acp/acpUpdates.d.ts

@@ -1,7 +1,8 @@
 /**
  * @packageDocumentation
- * Translates the agent runtime's typed {@link AgentStreamEvent} stream into ACP v2
- * `session/update` payloads.
+ * Translates the agent runtime's typed {@link AgentStreamEvent} stream into ACP **v2**
+ * `session/update` payloads. (`acpUpdatesV1.ts` is the v1 half; both extend the tool-call tracker
+ * in `acpToolCalls.ts`, which is where the parts that are not about the dialect live.)
  *
  * Kept as a pure, stateful-but-transport-free mapper rather than inlined in the request handlers
  * for two reasons. It is the half of the ACP surface with real logic — message identity, tool-call
@@ -19,18 +20,17 @@
  * carries only what actually changed — which is what makes a client's rendering of a running tool
  * call correct rather than flickering back to a bare id.
  */
-import type { SessionUpdate, ToolKind } from '@agentclientprotocol/sdk/experimental/v2';
+import type { SessionUpdate } from '@agentclientprotocol/sdk/experimental/v2';
 import type { AgentStreamEvent } from '@gaunt-sloth/core/core/types.js';
-/** The ACP tool kind for a gth tool name; `other` for anything not built in. */
-export declare function toolKindFor(name: string): ToolKind;
+import { AcpToolCallTracker } from '#src/modules/acp/acpToolCalls.js';
 /**
- * Turns one agent run's event stream into ACP `session/update` payloads.
+ * Turns one agent run's event stream into ACP v2 `session/update` payloads.
  *
  * One instance per prompt turn: it holds the message identity of the assistant text run and of the
  * reasoning run, plus the accumulated argument text per tool call. A fresh instance per turn is
  * what makes a new turn a new `messageId`, which is how a client tells two messages apart.
  */
-export declare class AcpUpdateMapper {
+export declare class AcpUpdateMapper extends AcpToolCallTracker {
     /**
      * `messageId` of the assistant text message currently being streamed, or `null` when no text run
      * is open. Cleared whenever something else interrupts the text (a tool call, a reasoning block),
@@ -40,59 +40,6 @@ export declare class AcpUpdateMapper {
     private assistantMessageId;
     /** `messageId` of the reasoning message currently being streamed, or `null` outside one. */
     private thoughtMessageId;
-    /**
-     * Streamed argument text per tool call id, reassembled from `tool_args` deltas. Held rather than
-     * forwarded per delta because ACP has no argument-delta update: `rawInput` is a whole value, so
-     * it can only be sent once the deltas stop arriving.
-     */
-    private readonly toolArgs;
-    /**
-     * Tool calls the model has requested but which have neither produced a result nor been claimed by
-     * a permission request, in the order they were announced, as `[toolCallId, toolName]`.
-     *
-     * Kept so the approval bridge can name the tool call a permission request is ABOUT. The gate's
-     * `PendingToolInterrupt` carries the tool's name and arguments but no call id — the graph
-     * suspends inside the middleware wrapping the call, which is downstream of where the id lives —
-     * while the client has already drawn that call from this stream. This queue reconnects the two.
-     */
-    private readonly openToolCalls;
-    /**
-     * Takes the id of the unclaimed tool call that matches `name` and `args`, removing it from the
-     * queue, or `undefined` when there is none.
-     *
-     * **Matched on the ARGUMENTS, because position is not a reliable discriminator here.** The
-     * arguments are the one value both sides hold: the gate's `PendingToolInterrupt` carries them, and
-     * this mapper still holds the streamed argument text at claim time (it is only discarded on
-     * `tool_result`, which exists solely on the resumed run).
-     *
-     * **Where the exact match degrades, named rather than implied:** the mapper's side is JSON
-     * reassembled from the model's streamed argument deltas, and a local model that ignores
-     * `disable_parallel_tool_use` can merge sibling calls' buffers into invalid JSON (`{}{}`,
-     * `{"steps":3}{}` — see the AG-UI server's `parseToolArguments` note). {@link parseToolArgs}
-     * deliberately does not carry that path's recovery, so such a payload stays a raw string, matches
-     * nothing, and falls back to position — on exactly the model class most likely to emit sloppy
-     * parallel calls. The fallback is still the best remaining answer and the cost is which row a
-     * client attaches the prompt to, never which command the human rules on.
-     *
-     * **Position was tried and is wrong in both directions**, which is why it is only the fallback.
-     * The runner drains suspended calls as a BATCH — every pending call decided in turn before
-     * anything resumes — so a model emitting two parallel calls of one tool has both open and neither
-     * running. Returning "the most recent" handed BOTH requests the second call's id. But plain
-     * oldest-first is no better in the case that is *normal* at the rated rungs: this method is
-     * reached only from the human-approval callback, which sits behind the gate's earlier exits
-     * (not-gated, deny list, bypass, the hardline floor, the allow list, and the rater's own arms), so
-     * a batch where one call is settled without a human and its sibling escalates leaves the settled
-     * call's id unclaimed at the head of the queue — and oldest-first then hands the request the
-     * wrong one, with every upstream ordering assumption perfectly intact.
-     *
-     * **Consuming is right either way**, and the queue order still decides between two calls whose
-     * arguments are genuinely identical, where either answer is equally true.
-     *
-     * Absent rather than guessed when nothing matches — a permission request pointing at the WRONG
-     * call is worse than one pointing at no call, because a client would then attach the answer to a
-     * call the user never saw.
-     */
-    claimToolCallId(name: string, args?: Record<string, unknown>): string | undefined;
     /**
      * The `session/update` payloads one runtime event produces — usually one, sometimes none
      * (`tool_args`, which only accumulates; the reasoning boundaries, which only move state).