@lucascouts/claude-agent-acp-plus 0.15.0 → 0.15.1

package/dist/quota-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quota-cache.d.ts","sourceRoot":"","sources":["../src/quota-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAK5D;6EAC6E;AAC7E,MAAM,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAyB7C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;sDAGsD;AACtD,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAqB9B;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB/F"}
+{"version":3,"file":"quota-cache.d.ts","sourceRoot":"","sources":["../src/quota-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAK5D;6EAC6E;AAC7E,MAAM,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAwC7C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;sDAGsD;AACtD,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAwB9B;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB/F"}

package/dist/quota-cache.js

@@ -29,23 +29,35 @@ import { promises as fs } from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 /**
- * A cache is only shareable between processes answering for the SAME account.
+ * Whether this session may share a sample at all.
  *
- * The api-key entry is the case that makes this mandatory rather than tidy: a
- * session authenticated by `ANTHROPIC_API_KEY` reports `rate_limits_available:
- * false` and no windows at all. Sharing one file with a subscription session
- * would let it publish that emptiness to every other window on the desktop.
+ * It may not when `ANTHROPIC_API_KEY` is set, and the reason is the measurement
+ * behind R8.1 rather than caution: an API-key session reports
+ * `rate_limits_available: false` and emits ZERO `_claude/rateLimit` frames. It
+ * has no plan window to publish and none to gain, so the cache has nothing to do
+ * for it.
  *
- * The key is a digest. The API key itself is hashed before it contributes, so
- * two different keys cannot collide while neither appears in a filename.
+ * That also settles a question the first version answered badly. Two different
+ * API keys can be two different accounts, so they must not share a file --
+ * which the first version enforced by folding a digest of the key into the
+ * filename. CodeQL flagged it (`js/insufficient-password-hash`, alert 27) and
+ * was right to: the rule guards stored, verified credentials, and this was
+ * neither, but "not exploitable" is the argument that ages badly. Excluding the
+ * whole case is stronger than hashing it well -- the credential never reaches a
+ * hash, and the behaviour is the one the wire already described.
+ */
+function sharingDisabled() {
+    return Boolean(process.env.ANTHROPIC_API_KEY);
+}
+/**
+ * A cache is only shareable between processes answering for the SAME account.
+ *
+ * With API keys excluded above, what remains to separate is the configuration
+ * directory: two config scopes can be two logins, and neither should publish
+ * the other's windows.
  */
 function scopeKey() {
-    const apiKey = process.env.ANTHROPIC_API_KEY;
-    const scope = [
-        process.env.ANTHROPIC_CONFIG_DIR ?? "",
-        process.env.CLAUDE_CONFIG_DIR ?? "",
-        apiKey ? createHash("sha256").update(apiKey).digest("hex") : "",
-    ].join("\0");
+    const scope = [process.env.ANTHROPIC_CONFIG_DIR ?? "", process.env.CLAUDE_CONFIG_DIR ?? ""].join("\0");
     return createHash("sha256").update(scope).digest("hex").slice(0, 16);
 }
 /**
@@ -82,6 +94,9 @@ export function quotaCachePath() {
  * broken cache degrades to exactly the behaviour that existed before it.
  */
 export async function readFreshLimits(maxAgeMs, now = Date.now()) {
+    if (sharingDisabled()) {
+        return null;
+    }
     try {
         const raw = await fs.readFile(quotaCachePath(), "utf8");
         const parsed = JSON.parse(raw);
@@ -114,6 +129,9 @@ export async function readFreshLimits(maxAgeMs, now = Date.now()) {
  * are idempotent and the loser's work is simply discarded.
  */
 export async function writeLimits(limits, now = Date.now()) {
+    if (sharingDisabled()) {
+        return;
+    }
     const target = quotaCachePath();
     // Unique per WRITE, not per process. One adapter process serves several
     // sessions, so a turn ending in one can coincide with another's tick: sharing

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "ACP adapter for the Claude Agent SDK with VS Code-parity UX for Zed and other ACP clients — checkbox multi-select questions, refusal consent dialog, dynamic agent name. Fork of claude-agent-acp.",
   "main": "dist/lib.js",
   "types": "dist/lib.d.ts",