@loicngr/kobo 2.1.29 → 2.1.30

package/dist/server/db/mistral-memory-migration.js

@@ -0,0 +1,40 @@
+/** Rebuild only engine CHECK constraints; the migration runner owns the transaction. */
+export function migrateMistralMemoryEngine(db) {
+    // Parents precede children so replacement FKs never point at tables being dropped.
+    const tables = [
+        'memory_entries',
+        'memory_budget_contexts',
+        'memory_proposals',
+        'memory_operations',
+        'memory_contexts',
+    ];
+    const definitions = tables.map((name) => ({
+        name,
+        sql: db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?").get(name)
+            .sql,
+    }));
+    if (definitions.every(({ sql }) => sql.includes("'mistral-vibe'")))
+        return;
+    const indexes = tables.flatMap((name) => db
+        .prepare("SELECT sql FROM sqlite_master WHERE type = 'index' AND tbl_name = ? AND sql IS NOT NULL")
+        .all(name));
+    const sequence = db
+        .prepare("SELECT seq FROM sqlite_sequence WHERE name = 'memory_operations'")
+        .safeIntegers()
+        .get();
+    for (const { name, sql } of definitions) {
+        let replacement = sql.replaceAll("'claude-code', 'codex'", "'claude-code', 'codex', 'mistral-vibe'");
+        for (const table of tables)
+            replacement = replacement.replaceAll(new RegExp(`\\b${table}\\b`, 'g'), `${table}_mistral`);
+        db.exec(replacement);
+        db.exec(`INSERT INTO ${name}_mistral SELECT * FROM ${name}`);
+    }
+    for (const name of [...tables].reverse())
+        db.exec(`DROP TABLE ${name}`);
+    for (const name of tables)
+        db.exec(`ALTER TABLE ${name}_mistral RENAME TO ${name}`);
+    for (const { sql } of indexes)
+        db.exec(sql);
+    if (sequence)
+        db.prepare("UPDATE sqlite_sequence SET seq = ? WHERE name = 'memory_operations'").run(sequence.seq);
+}

package/dist/server/routes/engines.js

@@ -1,5 +1,6 @@
 import { Hono } from 'hono';
 import { listEngines } from '../services/agent/engines/registry.js';
+import { getMistralOptions } from '../services/mistral-options-service.js';
 /** Hono sub-router exposing `GET /` — the list of registered agent engines with capabilities. */
 export const enginesRouter = new Hono();
 enginesRouter.get('/', (c) => c.json(listEngines().map((e) => ({
@@ -7,3 +8,16 @@ enginesRouter.get('/', (c) => c.json(listEngines().map((e) => ({
     displayName: e.displayName,
     capabilities: e.capabilities,
 }))));
+enginesRouter.get('/mistral-vibe/options', async (c) => {
+    try {
+        return c.json(await getMistralOptions({
+            workspaceId: c.req.query('workspaceId'),
+            projectPath: c.req.query('projectPath'),
+            model: c.req.query('model'),
+            agentPermissionMode: c.req.query('agentPermissionMode'),
+        }));
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : 'Native Vibe options unavailable' }, 400);
+    }
+});

package/dist/server/routes/environment.js

@@ -4,7 +4,7 @@ const app = new Hono();
 app.get('/', async (c) => {
     const engine = c.req.query('engine') ?? 'claude-code';
     const projectPath = c.req.query('projectPath')?.trim();
-    if (!['claude-code', 'codex'].includes(engine) ||
+    if (!['claude-code', 'codex', 'mistral-vibe'].includes(engine) ||
         (projectPath && (projectPath.length > 4096 || projectPath.includes('\0')))) {
         return c.json({ error: 'Invalid environment check request' }, 400);
     }

package/dist/server/routes/health.js

@@ -23,7 +23,11 @@ function integrationConfigured(integration, key) {
 }
 async function checkCli(binary) {
     try {
-        const { stdout } = await execFileAsync(binary, ['--version'], { encoding: 'utf-8', timeout: 2_000 });
+        const { stdout } = await execFileAsync(binary, ['--version'], {
+            encoding: 'utf-8',
+            timeout: 2_000,
+            maxBuffer: 64 * 1024,
+        });
         return { available: true, version: stdout.trim() || null };
     }
     catch {
@@ -78,7 +82,13 @@ app.get('/report', async (c) => {
     const db = getDb();
     const dbPath = getDbPath();
     const home = getKoboHome();
-    const cliChecks = Promise.all([checkClaudeCli(), checkCodexCli(), checkCli('gh'), checkCli('glab')]);
+    const cliChecks = Promise.all([
+        checkClaudeCli(),
+        checkCodexCli(),
+        checkCli('vibe-acp'),
+        checkCli('gh'),
+        checkCli('glab'),
+    ]);
     // DB schema version
     const row = db.prepare('SELECT MAX(version) as v FROM schema_migrations').get();
     const dbSchemaVersion = row?.v ?? 0;
@@ -170,7 +180,7 @@ app.get('/report', async (c) => {
         .all();
     const settingsRow = db.prepare('SELECT COUNT(*) as n FROM workspaces').get();
     const archivedRow = db.prepare('SELECT COUNT(*) as n FROM workspaces WHERE archived_at IS NOT NULL').get();
-    const [claudeCli, codexCli, ghCli, glabCli] = await cliChecks;
+    const [claudeCli, codexCli, mistralCli, ghCli, glabCli] = await cliChecks;
     const report = {
         version: getPackageVersion(),
         koboHome: home,
@@ -183,6 +193,7 @@ app.get('/report', async (c) => {
         settings: { schemaVersion: SETTINGS_SCHEMA_VERSION },
         claudeCli,
         codexCli,
+        mistralCli,
         forgeCli: { gh: ghCli, glab: glabCli },
         workspaces: {
             total: settingsRow.n,

package/dist/server/routes/settings.js

@@ -3,7 +3,7 @@ import { isMemoryMode } from '../../shared/memory.js';
 import { isValidSkillSuite } from '../../shared/skill-suite-prompts.js';
 import { isWorkflowPolicy } from '../../shared/workflow-policy.js';
 import { getDb } from '../db/index.js';
-import { getBackendPort } from '../services/agent/orchestrator.js';
+import { getBackendPort, notifyCapacityAvailable } from '../services/agent/orchestrator.js';
 import { DEFAULT_NOTION_INITIAL_PROMPT, DEFAULT_SENTRY_INITIAL_PROMPT, } from '../services/initial-prompt-template-service.js';
 import { getMcpConnectionInfo } from '../services/mcp-connection-info-service.js';
 import { generateToken, getLanUrls } from '../services/network-access-service.js';
@@ -167,7 +167,13 @@ app.put('/global', async (c) => {
             return c.json({ error: 'Invalid workflowPolicy' }, 400);
         if (body.memoryMode !== undefined && !isMemoryMode(body.memoryMode))
             return c.json({ error: 'Invalid memoryMode' }, 400);
+        if ('maxConcurrentAgents' in body &&
+            (!Number.isSafeInteger(body.maxConcurrentAgents) || body.maxConcurrentAgents < 0))
+            return c.json({ error: 'maxConcurrentAgents must be a non-negative safe integer' }, 400);
+        const previousLimit = 'maxConcurrentAgents' in body ? settingsService.getGlobalSettings().maxConcurrentAgents : undefined;
         const updated = settingsService.updateGlobalSettings(body);
+        if (previousLimit && (updated.maxConcurrentAgents === 0 || updated.maxConcurrentAgents > previousLimit))
+            notifyCapacityAvailable();
         // The client assigns this response straight into its store, so echoing the
         // real credentials back would undo the masking on GET the first time
         // anyone saves anything.

package/dist/server/routes/workspaces.js

@@ -4,9 +4,10 @@ import { nanoid } from 'nanoid';
 import { isMergeMethod } from '../../shared/forge-merge.js';
 import { isWorkflowPolicy, resolveWorkflowPolicy, WORKFLOW_ACTIONS, } from '../../shared/workflow-policy.js';
 import * as finalReviewService from '../services/auto-loop-final-review-service.js';
+import { preflightMistralConfiguration } from '../services/mistral-options-service.js';
 import { getReviewReturnStatus } from '../services/review-return-service.js';
 import { getSearchIndexStatus, searchEvents } from '../services/search-service.js';
-import { createSessionHandoff, decideSessionHandoff, getCurrentSessionHandoff, SessionHandoffError, submitSessionHandoff, waitForSessionHandoff, } from '../services/session-handoff-service.js';
+import { createSessionHandoff, decideSessionHandoff, getCurrentSessionHandoff, preflightSessionHandoff, SessionHandoffError, submitSessionHandoff, waitForSessionHandoff, } from '../services/session-handoff-service.js';
 import { AgentStopError, assertAgentStopped } from '../utils/agent-stop-result.js';
 import { withGitRepoLock } from '../utils/git-repo-lock.js';
 import { assertWorkspaceLifecycleAvailable, isWorkspaceLifecycleBusy, workspaceLifecycleReason, } from '../utils/workspace-lifecycle-guard.js';
@@ -18,9 +19,11 @@ import { Hono } from 'hono';
 import { bodyLimit } from 'hono/body-limit';
 import { MAX_ATTACHMENT_REQUEST_BYTES } from '../../shared/attachments.js';
 import { AUTO_LOOP_HARD_RULES, buildAutoLoopGroomingSteps, buildGroomingIntro } from '../../shared/auto-loop-prompts.js';
+import { parseQuestionSelections } from '../../shared/question-selections.js';
 import { getDb } from '../db/index.js';
 import { migrationGuard } from '../middleware/migration-guard.js';
 import { workspaceCreationMaintenance } from '../middleware/workspace-creation-maintenance.js';
+import { assertEngineConfigurationSupported } from '../services/agent/engines/configuration.js';
 import { listEngines } from '../services/agent/engines/registry.js';
 import * as agentManager from '../services/agent/orchestrator.js';
 import * as archiveScriptService from '../services/archive-script-service.js';
@@ -316,7 +319,7 @@ function resolveCreateAgentPermissionMode(bodyValue, _projectPath, globalSetting
     const global = globalSettings.defaultPermissionModeByEngine?.[engineId];
     if (isAgentPermissionMode(global))
         return global;
-    return 'bypass';
+    return engineId === 'mistral-vibe' ? 'interactive' : 'bypass';
 }
 /**
  * Extract the numeric PR/MR number from a forge URL.
@@ -357,7 +360,9 @@ function handoffError(c, error) {
 }
 app.post('/:id/session-handoffs', migrationGuard, async (c) => {
     try {
-        return c.json({ handoff: createSessionHandoff(c.req.param('id'), await c.req.json()) }, 202);
+        const input = await c.req.json();
+        await preflightSessionHandoff(c.req.param('id'), input);
+        return c.json({ handoff: createSessionHandoff(c.req.param('id'), input) }, 202);
     }
     catch (error) {
         return handoffError(c, error);
@@ -418,7 +423,8 @@ app.post('/:id/switch-engine', migrationGuard, async (c) => {
         const engine = listEngines().find((item) => item.id === body.engine);
         if (!engine)
             return c.json({ error: `Unknown engine '${body.engine}'` }, 400);
-        const model = typeof body.model === 'string' && engine.capabilities.models.some((item) => item.id === body.model)
+        const model = typeof body.model === 'string' &&
+            (engine.id === 'mistral-vibe' || engine.capabilities.models.some((item) => item.id === body.model))
             ? body.model
             : engine.capabilities.models[0]?.id;
         if (!model)
@@ -428,6 +434,21 @@ app.post('/:id/switch-engine', migrationGuard, async (c) => {
             return c.json({ error: `Engine '${body.engine}' does not support the selected permission mode` }, 400);
         }
         const effort = typeof body.reasoningEffort === 'string' ? body.reasoningEffort : 'auto';
+        try {
+            assertEngineConfigurationSupported(engine, {
+                model: body.model,
+                reasoningEffort: body.reasoningEffort,
+                agentPermissionMode: body.agentPermissionMode,
+            });
+            await preflightMistralConfiguration(engine.id, { workspaceId: workspace.id }, {
+                model: body.model,
+                reasoningEffort: body.reasoningEffort,
+                agentPermissionMode: body.agentPermissionMode,
+            });
+        }
+        catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : 'Invalid engine configuration' }, 400);
+        }
         const handoff = typeof body.handoff === 'string' && body.handoff.trim()
             ? body.handoff.trim().slice(0, 30_000)
             : await buildEngineHandoff(workspace, workspace.engine, body.engine);
@@ -544,6 +565,48 @@ app.post('/', workspaceCreationMaintenance, migrationGuard, creationBodyLimit, a
                 }
             }
         }
+        if (body.engine === 'mistral-vibe' &&
+            body.agentPermissionMode !== undefined &&
+            !isAgentPermissionMode(body.agentPermissionMode))
+            return c.json({ error: 'Invalid agentPermissionMode', step: 'validate' }, 400);
+        const selectedEngine = listEngines().find((engine) => engine.id === (body.engine ?? 'claude-code'));
+        if (selectedEngine) {
+            try {
+                const mode = resolveCreateAgentPermissionMode(body.agentPermissionMode, body.projectPath, settingsService.getGlobalSettings(), selectedEngine.id);
+                assertEngineConfigurationSupported(selectedEngine, {
+                    model: body.model,
+                    reasoningEffort: body.reasoningEffort,
+                    agentPermissionMode: mode,
+                });
+                await preflightMistralConfiguration(selectedEngine.id, { projectPath: body.worktreePath ?? body.projectPath }, {
+                    model: body.model,
+                    reasoningEffort: body.reasoningEffort,
+                    agentPermissionMode: mode,
+                });
+                assertEngineConfigurationSupported(selectedEngine, {
+                    model: body.brainstormModel,
+                    reasoningEffort: body.brainstormReasoningEffort,
+                });
+                await preflightMistralConfiguration(selectedEngine.id, { projectPath: body.worktreePath ?? body.projectPath }, {
+                    model: body.brainstormModel ?? body.model,
+                    reasoningEffort: body.brainstormReasoningEffort ?? body.reasoningEffort,
+                    agentPermissionMode: mode,
+                });
+                if (body.autoLoopFinalReview) {
+                    const review = finalReviewService.parseFinalReviewConfiguration(body.autoLoopFinalReview);
+                    await preflightMistralConfiguration(review.engine, { projectPath: body.worktreePath ?? body.projectPath }, {
+                        ...review,
+                        agentPermissionMode: 'interactive',
+                    });
+                }
+                body.agentPermissionMode = mode;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'Invalid engine configuration';
+                emitCreateFailed(creationId, 'validate', message);
+                return c.json({ error: message, step: 'validate' }, 400);
+            }
+        }
         // Fetch the source branch from origin first. On failure this is non-fatal:
         // fall back to the local source branch if it exists (offline / no remote),
         // and only hard-block (422) when neither origin nor a local branch is usable.
@@ -1745,7 +1808,10 @@ app.get('/:id/auto-loop/final-review', (c) => {
 app.patch('/:id/auto-loop/final-review', migrationGuard, async (c) => {
     try {
         const body = await c.req.json();
-        return c.json(finalReviewService.configureFinalReview(c.req.param('id'), body?.configuration));
+        const config = finalReviewService.parseFinalReviewConfiguration(body?.configuration);
+        if (config)
+            await preflightMistralConfiguration(config.engine, { workspaceId: c.req.param('id') }, { ...config, agentPermissionMode: 'interactive' });
+        return c.json(finalReviewService.configureFinalReview(c.req.param('id'), config));
     }
     catch (error) {
         return c.json({ error: error instanceof Error ? error.message : 'Invalid request' }, error instanceof ReviewRequestError ? error.status : 400);
@@ -2080,6 +2146,7 @@ app.post('/:id/deferred-tool-use/answer', async (c) => {
         await agentManager.answerPendingQuestion(id, body.answers, body.toolCallId, {
             awaitingFreeForm: body.awaitingFreeForm === true,
             ...(typeof body.response === 'string' ? { response: body.response } : {}),
+            ...(body.selections !== undefined ? { selections: parseQuestionSelections(body.selections) } : {}),
         });
         return c.json({ ok: true });
     }
@@ -2871,6 +2938,25 @@ app.patch('/:id', migrationGuard, async (c) => {
                 }, 400);
             }
         }
+        const selectedEngine = listEngines().find((engine) => engine.id === workspace.engine);
+        if (selectedEngine &&
+            (body.model !== undefined || body.reasoningEffort !== undefined || body.agentPermissionMode !== undefined)) {
+            try {
+                assertEngineConfigurationSupported(selectedEngine, {
+                    model: body.model ?? workspace.model,
+                    reasoningEffort: body.reasoningEffort ?? workspace.reasoningEffort,
+                    agentPermissionMode: body.agentPermissionMode ?? workspace.agentPermissionMode,
+                });
+                await preflightMistralConfiguration(selectedEngine.id, { workspaceId: workspace.id }, {
+                    model: body.model ?? workspace.model,
+                    reasoningEffort: body.reasoningEffort ?? workspace.reasoningEffort,
+                    agentPermissionMode: body.agentPermissionMode ?? workspace.agentPermissionMode,
+                });
+            }
+            catch (error) {
+                return c.json({ error: error instanceof Error ? error.message : 'Invalid engine configuration' }, 400);
+            }
+        }
         if (body.status !== undefined) {
             if (!isWorkspaceStatus(body.status)) {
                 return c.json({ error: `Invalid status. Must be one of: ${VALID_WORKSPACE_STATUSES.join(', ')}` }, 400);
@@ -3415,6 +3501,24 @@ app.post('/:id/start', migrationGuard, async (c) => {
                 error: 'Workspace is compacting its context; wait until compaction finishes before sending a message',
             }, 409);
         }
+        const selectedEngine = listEngines().find((engine) => engine.id === workspaceEngine);
+        if (selectedEngine) {
+            try {
+                assertEngineConfigurationSupported(selectedEngine, {
+                    model: workspace.model,
+                    reasoningEffort: workspace.reasoningEffort,
+                    agentPermissionMode: workspace.agentPermissionMode,
+                });
+                await preflightMistralConfiguration(selectedEngine.id, { workspaceId: workspace.id }, {
+                    model: workspace.model,
+                    reasoningEffort: workspace.reasoningEffort,
+                    agentPermissionMode: workspace.agentPermissionMode,
+                }, resume);
+            }
+            catch (error) {
+                return c.json({ error: error instanceof Error ? error.message : 'Invalid engine configuration' }, 400);
+            }
+        }
         // A manual start supersedes any scheduled retry (quota or transient
         // watchdog recovery). Leaving its timer armed could spawn a second agent
         // after the user has already resumed the workspace.
@@ -4258,7 +4362,8 @@ app.post('/:id/merge-pr', async (c) => {
                 code: `forge_${availability.reason ?? 'unavailable'}`,
             }, 409);
         }
-        const snapshot = await provider.getPrStatus(workspace.worktreePath, workspace.workingBranch);
+        // Record OPEN before merging, even if the watcher has not run since startup.
+        const snapshot = await refreshPrSnapshot(id);
         if (snapshot?.state !== 'OPEN') {
             return c.json({ error: 'No open PR found for this workspace', code: 'pr_not_open' }, 409);
         }
@@ -4302,13 +4407,15 @@ app.post('/:id/delete-remote-branch', async (c) => {
         if (!provider.capabilities.canDeleteRemoteBranch) {
             return c.json({ error: 'This project cannot delete remote branches', code: 'forge_unsupported' }, 409);
         }
-        const availability = await provider.isAvailable(workspace.worktreePath);
+        // The merge watcher may have already archived and purged this worktree.
+        const repoPath = workspace.projectPath;
+        const availability = await provider.isAvailable(repoPath);
         if (!availability.available)
             return c.json({ error: 'Forge CLI unavailable', code: 'forge_unavailable' }, 409);
-        const snapshot = await provider.getPrStatus(workspace.worktreePath, workspace.workingBranch);
+        const snapshot = await provider.getPrStatus(repoPath, workspace.workingBranch);
         if (snapshot?.state !== 'MERGED')
             return c.json({ error: 'The PR is not merged yet', code: 'pr_not_merged' }, 409);
-        await provider.deleteRemoteBranch(workspace.worktreePath, workspace.workingBranch);
+        await provider.deleteRemoteBranch(repoPath, workspace.workingBranch);
         return c.json({ success: true });
     }
     catch (err) {

package/dist/server/services/agent/engines/claude-code/capabilities.js

@@ -18,6 +18,8 @@ export const CLAUDE_CODE_CAPABILITIES = {
     permissionModes: ['plan', 'bypass', 'strict', 'interactive'],
     supportsResume: true,
     supportsMcp: true,
+    supportsLiveSteering: true,
+    supportsReadOnly: true,
     supportsSkills: true,
     supportsSubagents: true,
     supportsQuotaStatus: true,

package/dist/server/services/agent/engines/claude-code/engine.js

@@ -1049,6 +1049,9 @@ export function createClaudeCodeEngine() {
                         // swallow — best effort
                     }
                 },
+                hasPendingUserInput(toolCallId) {
+                    return pendingResolvers.has(toolCallId);
+                },
                 resolvePendingUserInput(toolCallId, response) {
                     const resolver = pendingResolvers.get(toolCallId);
                     if (!resolver)

package/dist/server/services/agent/engines/codex/capabilities.js

@@ -13,6 +13,8 @@ export const CODEX_CAPABILITIES = {
     permissionModes: ['plan', 'bypass', 'strict', 'interactive'],
     supportsResume: true,
     supportsMcp: true,
+    supportsLiveSteering: true,
+    supportsReadOnly: true,
     supportsSkills: false,
     supportsSubagents: true,
     supportsQuotaStatus: true,

package/dist/server/services/agent/engines/codex/engine.js

@@ -692,6 +692,9 @@ export function createCodexEngine() {
                     }
                     await terminateChild();
                 },
+                hasPendingUserInput(callId) {
+                    return pendingByCallId.has(callId);
+                },
                 resolvePendingUserInput(callId, response) {
                     const pending = pendingByCallId.get(callId);
                     if (!pending)

package/dist/server/services/agent/engines/configuration.js

@@ -0,0 +1,14 @@
+import { assertMistralSelection } from './mistral-vibe/configuration.js';
+/** Validate native selections before creating or replacing launch state. */
+export function assertEngineConfigurationSupported(engine, selection) {
+    if (selection.readOnly && !engine.capabilities.supportsReadOnly)
+        throw new Error(`Engine '${engine.id}' does not support read-only launches`);
+    // Native membership is checked contextually and again on the actual ACP session.
+    if (engine.id !== 'mistral-vibe')
+        return;
+    const mode = selection.agentPermissionMode ?? 'interactive';
+    if (!engine.capabilities.permissionModes.some((item) => item === mode))
+        throw new Error(`Engine '${engine.id}' does not support agentPermissionMode '${String(mode)}'`);
+    assertMistralSelection(selection.model, 'model');
+    assertMistralSelection(selection.reasoningEffort, 'thinking');
+}

package/dist/server/services/agent/engines/mistral-vibe/capabilities.js

@@ -0,0 +1,13 @@
+import { MISTRAL_MODELS } from '../../../../../shared/mistral-models.js';
+export const MISTRAL_CAPABILITIES = {
+    models: MISTRAL_MODELS.map((model) => ({ id: model.id, label: model.label })),
+    effortLevels: [{ id: 'auto', label: 'Auto' }],
+    permissionModes: ['interactive', 'strict', 'bypass'],
+    supportsResume: true,
+    supportsMcp: true,
+    supportsLiveSteering: false,
+    supportsReadOnly: false,
+    supportsSkills: false,
+    supportsSubagents: false,
+    supportsQuotaStatus: false,
+};

package/dist/server/services/agent/engines/mistral-vibe/client.js

@@ -0,0 +1,64 @@
+import { Readable, Writable } from 'node:stream';
+import * as acp from '@agentclientprotocol/sdk';
+/** The SDK owns framing and incoming validation. Stderr never enters ACP. */
+export function connectVibeAcp(child, handlers) {
+    if (!child.stdin || !child.stdout)
+        throw new Error('Vibe ACP requires piped stdin and stdout');
+    const app = acp.client({ name: 'kobo' });
+    if (handlers.sessionUpdate)
+        app.onNotification(acp.methods.client.session.update, handlers.sessionUpdate);
+    if (handlers.requestPermission)
+        app.onRequest(acp.methods.client.session.requestPermission, handlers.requestPermission);
+    if (handlers.createElicitation)
+        app.onRequest(acp.methods.client.elicitation.create, handlers.createElicitation);
+    // Node and DOM disagree on BYOB generics; both adapters are standard Web Streams at runtime.
+    const readable = Readable.toWeb(child.stdout);
+    return app.connect(acp.ndJsonStream(Writable.toWeb(child.stdin), readable));
+}
+/** Fluent SDK responses are unchecked; validate the fields this transport consumes. */
+function validateResponse(method, response) {
+    const value = response;
+    if (method === acp.methods.agent.initialize && value?.protocolVersion !== acp.PROTOCOL_VERSION) {
+        throw new Error('Invalid Vibe ACP protocol version; ACP v1 is required');
+    }
+    if (method === acp.methods.agent.session.new &&
+        (typeof value?.sessionId !== 'string' || value.sessionId.trim().length === 0)) {
+        throw new Error('Invalid Vibe ACP session identity');
+    }
+    if (method === acp.methods.agent.session.prompt &&
+        (typeof value?.stopReason !== 'string' ||
+            !['end_turn', 'max_tokens', 'max_turn_requests', 'refusal', 'cancelled'].includes(value.stopReason))) {
+        throw new Error('Invalid Vibe ACP prompt stop reason');
+    }
+}
+/** Use for all requests: initialization/setup are bounded, prompts have no absolute deadline. */
+export async function requestVibeAcp(connection, method, params) {
+    const timeout = method === acp.methods.agent.initialize ? 20000 : 30000;
+    let timer;
+    const pending = connection.agent.request(method, params);
+    try {
+        const response = await (method === acp.methods.agent.session.prompt
+            ? pending
+            : Promise.race([
+                pending,
+                new Promise((_resolve, reject) => {
+                    timer = setTimeout(() => {
+                        const error = new Error(`Vibe ACP ${method} timed out after ${timeout}ms`);
+                        reject(error);
+                    }, timeout);
+                }),
+            ]));
+        validateResponse(method, response);
+        return response;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Pass as runtime.stop's callback; the runtime still ends stdin and confirms process exit. */
+export async function closeVibeAcpSession(connection, session) {
+    if (session.active)
+        await connection.agent.notify(acp.methods.agent.session.cancel, { sessionId: session.sessionId });
+    if (session.canClose)
+        await requestVibeAcp(connection, acp.methods.agent.session.close, { sessionId: session.sessionId });
+}

package/dist/server/services/agent/engines/mistral-vibe/configuration.js

@@ -0,0 +1,76 @@
+export const MISTRAL_MODES = { interactive: 'ask', strict: 'accept-edits', bypass: 'auto-approve' };
+export function assertMistralSelection(value, label) {
+    if (value !== undefined && !text(value))
+        throw new Error(`Invalid Mistral Vibe ${label}; expected a nonempty native value of at most 256 characters`);
+}
+function record(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+function text(value, max = 256) {
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: Native identities and labels must exclude control characters.
+    return typeof value === 'string' && !!value.trim() && value.length <= max && !/[\x00-\x1f\x7f]/.test(value);
+}
+function invalid() {
+    throw new Error('Invalid Vibe ACP configuration options');
+}
+/** SDK responses are unchecked. Keep only bounded, validated native display fields. */
+export function readMistralSelect(response, id, required = true) {
+    if (!record(response) || !Array.isArray(response.configOptions) || response.configOptions.length > 64)
+        return invalid();
+    const ids = new Set();
+    for (const item of response.configOptions) {
+        if (!record(item) || !text(item.id) || ids.has(item.id))
+            return invalid();
+        ids.add(item.id);
+    }
+    const selected = response.configOptions.find((item) => item.id === id);
+    if (!selected && !required)
+        return undefined;
+    if (selected?.type !== 'select' ||
+        !text(selected.currentValue) ||
+        !Array.isArray(selected.options) ||
+        selected.options.length > 256)
+        return invalid();
+    const options = [];
+    const values = new Set();
+    const groups = new Set();
+    const append = (item, group) => {
+        if (!record(item) ||
+            !text(item.value) ||
+            !text(item.name) ||
+            values.has(item.value) ||
+            (item.description != null && !text(item.description, 2048)) ||
+            options.length >= 256)
+            return invalid();
+        values.add(item.value);
+        options.push({
+            value: item.value,
+            name: item.name,
+            ...(typeof item.description === 'string' ? { description: item.description } : {}),
+            ...(group ? { group } : {}),
+        });
+    };
+    for (const item of selected.options) {
+        if (record(item) && 'options' in item) {
+            if (!text(item.group) ||
+                !text(item.name) ||
+                groups.has(item.group) ||
+                !Array.isArray(item.options) ||
+                item.options.length > 256)
+                return invalid();
+            groups.add(item.group);
+            for (const option of item.options)
+                append(option, item.name);
+        }
+        else
+            append(item);
+    }
+    if (!values.has(selected.currentValue))
+        return invalid();
+    return { currentValue: selected.currentValue, options };
+}
+export function requireMistralOption(response, id, value, confirmed = false) {
+    const option = readMistralSelect(response, id);
+    if (!option.options.some((item) => item.value === value) || (confirmed && option.currentValue !== value))
+        throw new Error(`Mistral Vibe ${id} selection is unavailable or overridden by the native profile; refresh native options`);
+}