@platless/axom-cli 0.1.0 → 0.3.13

package/dist/workstation/oauth/deviceAuthorization.js

@@ -2,6 +2,8 @@ import WebSocket from 'ws';
 import { RetryPolicy } from '../connection/retryPolicy.js';
 import { tryOpenAuthorizationUrl } from './browser.js';
 import { loadDeviceId } from '../../config.js';
+import { DEFAULT_CLI_SCOPES, grantedCliScopes } from '../../authScopes.js';
+import { revokeRefreshToken } from '../../credentials.js';
 export const DEVICE_CODE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
 export class DeviceAuthorizationError extends Error {
 }
@@ -87,7 +89,7 @@ function waitForNotification(socket, sessionId, notificationTicket, deadline, no
         socket.on('error', () => finish('reconnect'));
     });
 }
-async function exchangeDeviceCode(server, clientId, deviceCode, fetch_) {
+async function exchangeDeviceCode(server, clientId, deviceCode, fetch_, requestedScopes) {
     const response = await requestJson(fetch_, new URL('/oauth/token', server), {
         method: 'POST',
         headers: { 'content-type': 'application/x-www-form-urlencoded' },
@@ -98,14 +100,25 @@ async function exchangeDeviceCode(server, clientId, deviceCode, fetch_) {
             device_id: await loadDeviceId(),
         }),
     }, 200, 'Device token exchange');
+    return validateTokenResponse(server, response, requestedScopes, fetch_);
+}
+async function validateTokenResponse(server, response, requestedScopes, fetch_) {
     const accessToken = requireString(response.access_token, 'access_token', 'Device token response');
     const refreshToken = requireString(response.refresh_token, 'refresh_token', 'Device token response');
     if (!Number.isFinite(response.expires_in) || response.expires_in <= 0) {
         throw new DeviceAuthorizationError('Device token response has invalid expires_in');
     }
-    return { accessToken, refreshToken, expiresInSeconds: response.expires_in };
+    let scopes;
+    try {
+        scopes = grantedCliScopes(response.scope, requestedScopes);
+    }
+    catch (error) {
+        await revokeRefreshToken(server, refreshToken, fetch_);
+        throw new DeviceAuthorizationError(error instanceof Error ? error.message : 'Device token response has invalid scopes');
+    }
+    return { accessToken, refreshToken, expiresInSeconds: response.expires_in, scopes };
 }
-async function pollDeviceCode(server, clientId, deviceCode, fetch_) {
+async function pollDeviceCode(server, clientId, deviceCode, fetch_, requestedScopes) {
     const response = await fetch_(new URL('/oauth/token', server), {
         method: 'POST',
         headers: { 'content-type': 'application/x-www-form-urlencoded' },
@@ -128,17 +141,13 @@ async function pollDeviceCode(server, clientId, deviceCode, fetch_) {
     if (response.status !== 200)
         throw new DeviceAuthorizationError(`Device token polling failed: ${response.status}`);
     const token = await response.json();
-    return {
-        accessToken: requireString(token.access_token, 'access_token', 'Device token response'),
-        refreshToken: requireString(token.refresh_token, 'refresh_token', 'Device token response'),
-        expiresInSeconds: token.expires_in,
-    };
+    return validateTokenResponse(server, token, requestedScopes, fetch_);
 }
 /**
  * Uses OAuth Device Authorization for both desktop and headless clients. The notification socket
  * only carries state; the tokens exist only in this call's return value.
  */
-export async function authorizeDevice(server, clientName, hostname, deps = {}) {
+export async function authorizeDevice(server, clientName, hostname, deps = {}, requestedScopes = DEFAULT_CLI_SCOPES) {
     const baseUrl = normalizedServer(server);
     const fetch_ = deps.fetch ?? globalThis.fetch;
     const print = deps.print ?? console.log;
@@ -151,7 +160,7 @@ export async function authorizeDevice(server, clientName, hostname, deps = {}) {
     const authorization = await requestJson(fetch_, new URL('/oauth/device_authorization', baseUrl), {
         method: 'POST',
         headers: { 'content-type': 'application/x-www-form-urlencoded' },
-        body: new URLSearchParams({ client_id: clientId, hostname }),
+        body: new URLSearchParams({ client_id: clientId, hostname, scope: requestedScopes.join(' ') }),
     }, 200, 'Device authorization request');
     const deviceCode = requireString(authorization.device_code, 'device_code', 'Device authorization response');
     const verificationUrl = requireString(authorization.verification_uri_complete, 'verification_uri_complete', 'Device authorization response');
@@ -178,14 +187,14 @@ export async function authorizeDevice(server, clientName, hostname, deps = {}) {
         }
         const status = await waitForNotification(socket, sessionId, notificationTicket, deadline, now, () => retry.recordSuccess());
         if (status === 'approved') {
-            const tokens = await exchangeDeviceCode(baseUrl, clientId, deviceCode, fetch_);
+            const tokens = await exchangeDeviceCode(baseUrl, clientId, deviceCode, fetch_, requestedScopes);
             return { clientId, ...tokens };
         }
         if (status === 'denied')
             throw new DeviceAuthorizationError('Device authorization was denied');
         if (status === 'expired')
             break;
-        const polled = await pollDeviceCode(baseUrl, clientId, deviceCode, fetch_);
+        const polled = await pollDeviceCode(baseUrl, clientId, deviceCode, fetch_, requestedScopes);
         if (polled)
             return { clientId, ...polled };
         const pollingFloor = Math.max(1, authorization.interval ?? 5) * 1_000;

package/dist/workstation/protocol/agent.js

@@ -1,6 +1,18 @@
+import { isRuntimeDiagnostics } from '../qoderAdapter/profile.js';
 import { decodeChannelFrame, hasOptional, hasRequired, isBoolean, isBridgeInfoArray, isNullableAuthMethodInfoArray, isNullableString, isNumber, isObject, isString, isStringArray, isStringRecord, } from './common.js';
 /** Current version and feature floors for the independently negotiated agent protocol. */
-export const AGENT_WIRE_VERSION = 14;
+export const AGENT_WIRE_VERSION = 24;
+/** `agent_delete_native` / `agent_native_deleted`: purge a session Axom created on an external agent. */
+export const AGENT_WIRE_NATIVE_DELETE_VERSION = 24;
+export const AGENT_WIRE_PROVIDER_TASK_VERSION = 23;
+export const AGENT_WIRE_RUNTIME_PROFILE_VERSION = 22;
+export const AGENT_WIRE_DELEGATION_RENEW_VERSION = 21;
+export const AGENT_WIRE_TURN_IDENTITY_VERSION = 20;
+export const AGENT_WIRE_DELEGATION_MCP_VERSION = 19;
+/** Scoped replay/history is enabled only when both peers preserve native origin. */
+export const AGENT_WIRE_SCOPED_ORIGIN_VERSION = 18;
+/** agent_open.requireSessionLoad: reject unsupported/failed load without session/new fallback. */
+export const AGENT_WIRE_STRICT_LOAD_VERSION = 17;
 export const AGENT_WIRE_MIN_VERSION = 1;
 export const AGENT_WIRE_SESSION_LOST_VERSION = 2;
 export const AGENT_WIRE_ADOPTION_VERSION = 3;
@@ -137,6 +149,59 @@ export const AGENT_WIRE_RELOADED_VERSION = 13;
  * is byte-for-byte the frame it always was and still goes out at {@link AGENT_WIRE_STEER_VERSION}.
  */
 export const AGENT_WIRE_STEER_BLOCKS_VERSION = 14;
+/**
+ * The session activity-state push (`agent_session_state`) and the single-background-task stop
+ * request (`agent_async_task_stop`). **Both must be checked before sending — the check just lives
+ * in a different process for each, because the two frames do not share a sender.**
+ *
+ * ## Why both need a floor, not just one
+ *
+ * A version floor answers one question: *before sending, does the peer understand this frame?*
+ * These two frames travel opposite directions, so the check lives on opposite sides:
+ *
+ * - `agent_async_task_stop` is the **server's** request to this client. A v14 *client* has no case
+ *   for it in `AGENT_FRAME_SHAPES` — the same shape as {@link AGENT_WIRE_STEER_VERSION} and
+ *   {@link AGENT_WIRE_INSTALL_VERSION} — so the check lives on the Kotlin server (this constant's
+ *   twin, `AgentChannelSession`, a later task), before every `agent_async_task_stop` it sends. There
+ *   is nothing for this file to check on receipt: this daemon only ever handles the frame, never
+ *   sends it.
+ * - `agent_session_state` is the **client's** push to the server, and getting this half wrong is
+ *   what an earlier revision of this comment did — it argued "an old server just never sees the
+ *   frame" was enough, which is only half the compatibility matrix and not the dangerous half. The
+ *   dangerous direction is **a newer client talking to an older server**: this daemon is a
+ *   separately-installed npm package on the user's machine, so the client upgrading ahead of the
+ *   server is the ordinary update order here, not an edge case. A v15 client sending
+ *   `agent_session_state` to a v14 server hits a decoder that throws on the unrecognised
+ *   discriminator, and because the frame carries a top-level `sessionRef` and no `id`, the server's
+ *   own recovery (`classifyUndecodableAgentFrame`) charges it to `FailSession` — declaring that
+ *   session lost and forcing a reopen. This frame exists to be sent over and over, so on an
+ *   unupgraded server every single push would force a session loss, and a run of them closes the
+ *   whole agent channel — worse than the `agent_auth_url` incident this file already documents,
+ *   since that frame carries no `sessionRef` and only ever reaches `Unattributable`.
+ *
+ *   The correct precedent is {@link AGENT_WIRE_AUTH_URL_VERSION}, not
+ *   {@link AGENT_WIRE_RELOADED_VERSION}: `agent_opened.reloaded` is an **optional key on a frame the
+ *   peer already decodes**, safely absorbed by `ignoreUnknownKeys`, so nothing on the sending side
+ *   needs to check anything. `agent_session_state` is a **new discriminator**, and a decoder throws
+ *   on an unrecognised one before `ignoreUnknownKeys` ever gets a say — the same shape
+ *   `agent_auth_url` is, and that constant's own floor is checked client-side (`serverAgentWire <
+ *   AGENT_WIRE_AUTH_URL_VERSION`, see `agentSessions.ts`'s `onAuthenticate`/`present`/`dismiss`) for
+ *   exactly this reason. `agent_session_state` follows the same rule: the client checks
+ *   `this.serverAgentWire` before sending and **discards** the push below this floor, rather than
+ *   erroring — a level nobody downstream can read is no worse than one that was never collected.
+ *
+ * So both frames are gated, on opposite sides: this file's own send path (a later task) must check
+ * `serverAgentWire` before every `agent_session_state`, and the Kotlin twin must check
+ * `clientAgentWire` before every `agent_async_task_stop`.
+ */
+export const AGENT_WIRE_SESSION_STATE_VERSION = 15;
+/**
+ * Elicitation answers (`agent_elicitation_answer`). Checked before sending, like
+ * {@link AGENT_WIRE_INSTALL_VERSION} and {@link AGENT_WIRE_CONFIG_OPTIONS_VERSION}: a peer below
+ * this floor has no case for the frame at all and would drop it, leaving the agent process blocked
+ * inside `elicitation/create` rather than ever reaching the user's answer.
+ */
+export const AGENT_WIRE_ELICITATION_VERSION = 16;
 /**
  * Every agent frame's shape, as data rather than as a `switch`.
  *
@@ -171,7 +236,10 @@ export const AGENT_FRAME_SHAPES = {
         optional: {
             env: isStringRecord, pathPrepend: isStringArray, agentEnv: isStringRecord, command: isNullableString,
             args: isStringArray, nativeSessionId: isNullableString,
-            resumeFromSeq: isNumber, backfill: isBoolean,
+            resumeFromSeq: isNumber, backfill: isBoolean, requireSessionLoad: isBoolean,
+            delegationMcp: (value) => isObject(value) &&
+                isString(value.url) && isStringRecord(value.headers) && isNumber(value.expiresAtEpochMs) &&
+                (value.bindingId === undefined || isString(value.bindingId)),
         },
     },
     agent_opened: {
@@ -180,6 +248,7 @@ export const AGENT_FRAME_SHAPES = {
         // `false` would be a second spelling of what its absence already says.
         optional: {
             nativeSessionId: isNullableString, error: isNullableString, supportsSteering: isVerifiedTrue,
+            runtimeDiagnostics: isRuntimeDiagnostics,
             // Plain strings, not a closed vocabulary: the sender already dropped everything it did not
             // recognise, and validating the values again here would make a future timing fail the frame
             // rather than be ignored — the opposite of what ruling N4 asks for.
@@ -187,16 +256,36 @@ export const AGENT_FRAME_SHAPES = {
             // `reloaded` is `true`-or-absent for the same reason as `supportsSteering`: a `false` would
             // be a second spelling of what its absence already says.
             reloaded: isVerifiedTrue,
+            delegationExpiresAtEpochMs: isNumber,
+            delegationRefreshPending: isVerifiedTrue,
+            delegationInstanceId: isString, delegationBindingId: isString, delegationRenewalRevision: isNumber,
             agentInfo: isAgentInfo, supportsImageInput: isVerifiedTrue, configOptions: isNullableSessionConfigOptionArray,
             // Same guard as `agent_verified.authMethods`, and the same absent-vs-`[]` reading: a
             // half-decoded method table is worse than none, because the reader would offer a login the
             // agent never named.
             authMethods: isNullableAuthMethodInfoArray,
             errorCode: isNullableJsonRpcErrorCode,
+            // `true`-or-absent, the same rule as `supportsSteering` above: absence already means "no
+            // collector wired up", so a `false` would be a second spelling of it.
+            reportsActivity: isVerifiedTrue,
+            supportsAsyncTaskStop: isVerifiedTrue,
+            // Vendor-verbatim and uninterpreted here (decision L1) -- any object shape is accepted, the
+            // same lenience `agent_event.payload` gets via `isRecord`.
+            activityRaw: isRecord,
         },
     },
-    agent_prompt: { required: { sessionRef: isString, text: isString }, optional: { images: isImageBlockArray } },
+    agent_prompt: { required: { sessionRef: isString, text: isString }, optional: { images: isImageBlockArray, platformTurnId: isString } },
+    agent_delegation_renew: { required: { id: isString, sessionRef: isString, nativeSessionId: isString,
+            instanceId: isString, bindingId: isString, renewalRevision: isNumber, expiresAtEpochMs: isNumber } },
+    agent_delegation_renewed: { required: { id: isString, ok: isBoolean }, optional: { error: isString,
+            nativeSessionId: isString, instanceId: isString, bindingId: isString, renewalRevision: isNumber, expiresAtEpochMs: isNumber } },
     agent_answer: { required: { sessionRef: isString, requestId: isString, outcome: isString } },
+    // `content`'s interior is never validated here -- it is ACP's free-form elicitation payload, and
+    // this table is transport, not translator. `isRecord` only rejects a non-object.
+    agent_elicitation_answer: {
+        required: { sessionRef: isString, requestId: isString, action: isString },
+        optional: { content: isRecord },
+    },
     agent_interrupt: { required: { sessionRef: isString } },
     agent_close: { required: { sessionRef: isString } },
     agent_event: { required: { sessionRef: isString, seq: isNumber, eventName: isString, payload: isRecord } },
@@ -206,6 +295,8 @@ export const AGENT_FRAME_SHAPES = {
             stopReason: isString, nativeSessionId: isNullableString, error: isNullableString,
             authMethods: isNullableAuthMethodInfoArray,
             errorCode: isNullableJsonRpcErrorCode,
+            platformTurnId: isString,
+            executionEnded: isVerifiedTrue,
         },
     },
     agent_event_ack: { required: { sessionRef: isString, throughSeq: isNumber } },
@@ -214,6 +305,12 @@ export const AGENT_FRAME_SHAPES = {
     // to return its protocol-level `ok: false` response. The transport only requires that the
     // field is present; semantic validation remains at the request handler boundary.
     agent_list_native: { required: { id: isString, bridge: isString, query: () => true } },
+    // `query` is as lenient as `agent_list_native`'s, for the same reason.
+    agent_delete_native: { required: { id: isString, bridge: isString, query: () => true, nativeSessionIds: isStringArray } },
+    agent_native_deleted: {
+        required: { id: isString, ok: isBoolean },
+        optional: { results: isNativeDeleteResults, error: isNullableString },
+    },
     agent_native_sessions: {
         required: { id: isString, ok: isBoolean },
         optional: {
@@ -290,9 +387,39 @@ export const AGENT_FRAME_SHAPES = {
         required: { id: isString, ok: isBoolean },
         optional: { configOptions: isNullableSessionConfigOptionArray, error: isNullableString },
     },
+    agent_session_state: { required: { sessionRef: isString, vendor: isString, raw: isRecord } },
+    agent_runtime_profile: { required: { sessionRef: isString, diagnostics: isRuntimeDiagnostics } },
+    agent_provider_task_event: { required: { sessionRef: isString, rootSessionId: isTaskId,
+            runtimeGeneration: isTaskId, taskId: isTaskId, uuid: isTaskId, state: isProviderTaskState,
+            live: isBoolean, stale: isBoolean }, optional: { taskType: isTaskType, background: isBoolean,
+            agentId: isTaskId, launchingToolUseId: isTaskId, status: isProviderTerminalState, summary: isTaskSummary } },
+    agent_provider_task_stop: { required: { id: isTaskId, sessionRef: isTaskId, rootSessionId: isTaskId,
+            runtimeGeneration: isTaskId, taskId: isTaskId, requestId: isTaskId } },
+    agent_provider_task_stopped: { required: { id: isTaskId, state: isProviderStopState },
+        optional: { error: isTaskSummary } },
+    agent_async_task_stop: { required: { sessionRef: isString, asyncTaskId: isString } },
 };
 const DISCRIMINATORS = new Set(Object.keys(AGENT_FRAME_SHAPES));
 function isRecord(value) { return isObject(value); }
+function isTaskId(value) {
+    return typeof value === 'string' && value.length > 0 &&
+        Buffer.byteLength(value, 'utf8') <= 256 && !/[\x00-\x1f\x7f]/.test(value);
+}
+function isTaskType(value) { return isTaskId(value) && Buffer.byteLength(value, 'utf8') <= 128; }
+function isTaskSummary(value) {
+    return typeof value === 'string' &&
+        Buffer.byteLength(value, 'utf8') <= 8192;
+}
+function isProviderTaskState(value) {
+    return value === 'pending' || value === 'paused' || value === 'running' || value === 'completed' ||
+        value === 'stopped' || value === 'failed' || value === 'unknown';
+}
+function isProviderTerminalState(value) {
+    return value === 'completed' || value === 'failed' || value === 'stopped';
+}
+function isProviderStopState(value) {
+    return value === 'accepted' || value === 'unknown' || value === 'rejected';
+}
 function isAgentResumeSession(value) {
     return isObject(value)
         && hasRequired(value, { sessionRef: isString, journalMaxSeq: isNumber, agentAlive: isBoolean });
@@ -448,8 +575,17 @@ function isNativeSession(value) {
         nativeSessionId: isString, title: isString, updatedAtEpochMs: isNumber, cwd: isString,
     });
 }
+function isNativeDeleteResult(value) {
+    return isObject(value)
+        && hasRequired(value, { nativeSessionId: isString, outcome: (o) => o === 'deleted' || o === 'unsupported' || o === 'failed' })
+        && hasOptional(value, { error: isNullableString });
+}
+function isNativeDeleteResults(value) {
+    return Array.isArray(value) && value.every(isNativeDeleteResult);
+}
 function isEvent(value) {
-    return isObject(value) && hasRequired(value, { eventName: isString, payload: isRecord });
+    return isObject(value) && hasRequired(value, { eventName: isString, payload: isRecord })
+        && hasOptional(value, { acpSessionId: isNullableString });
 }
 function isAgentFrame(value) {
     // Cast, not a narrowed lookup: `value.t` is unvetted wire input, so it may not be one of
@@ -588,11 +724,14 @@ export function outboundFailureReply(frame, reason) {
     switch (frame.t) {
         case 'agent_opened': return { t: 'agent_opened', id, ok: false, error };
         case 'agent_native_sessions': return { t: 'agent_native_sessions', id, ok: false, error };
+        case 'agent_native_deleted': return { t: 'agent_native_deleted', id, ok: false, error };
         case 'agent_verified': return { t: 'agent_verified', id, ok: false, error };
         case 'agent_authenticated': return { t: 'agent_authenticated', id, ok: false, error };
         case 'agent_installed': return { t: 'agent_installed', id, ok: false, error };
         case 'agent_steered': return { t: 'agent_steered', id, ok: false, error };
         case 'agent_config_option_set': return { t: 'agent_config_option_set', id, ok: false, error };
+        case 'agent_delegation_renewed': return { t: 'agent_delegation_renewed', id, ok: false, error };
+        case 'agent_provider_task_stopped': return { t: 'agent_provider_task_stopped', id, state: 'unknown', error };
         case 'agent_backfill_done':
         case 'agent_backfill_events': return { t: 'agent_backfill_done', id, ok: false, count: 0, error };
         default: return null;
@@ -602,5 +741,15 @@ export function encodeAgentFrame(frame) {
     return JSON.stringify(frame);
 }
 export function decodeAgentFrame(text) {
-    return decodeChannelFrame(text, DISCRIMINATORS, isAgentFrame);
+    const frame = decodeChannelFrame(text, DISCRIMINATORS, isAgentFrame);
+    if (frame.t === 'agent_provider_task_event') {
+        if ((frame.state === 'completed' || frame.state === 'failed' || frame.state === 'stopped') && frame.live)
+            throw new TypeError('Invalid provider task terminal live state');
+        if (frame.status !== undefined &&
+            (frame.status !== frame.state || !['completed', 'failed', 'stopped'].includes(frame.status)))
+            throw new TypeError('Invalid provider task terminal status');
+        if (frame.summary !== undefined && frame.status === undefined)
+            throw new TypeError('Provider task summary requires terminal status');
+    }
+    return frame;
 }

package/dist/workstation/protocol/common.js

@@ -23,6 +23,9 @@ export function isAuthMethodInfo(value) {
         && hasOptional(value, { type: isNullableString, description: isNullableString, args: isNullableStringArray });
 }
 export const isNullableAuthMethodInfoArray = (value) => value === null || (Array.isArray(value) && value.every(isAuthMethodInfo));
+export function isMissingPrerequisite(value) {
+    return isObject(value) && hasRequired(value, { label: isString }) && hasOptional(value, { hint: isString });
+}
 export function isBridgeInfo(value) {
     return isObject(value)
         && hasRequired(value, { type: isString })
@@ -49,7 +52,10 @@ export function isBridgeInfo(value) {
             // string is all a peer sending it without the flag is asked to satisfy.
             platformTriple: isString,
             // `true` and nothing else, like `supportsSteering`: see `BridgeInfo.recommended`.
+            curated: isTrueOnly,
             recommended: isTrueOnly,
+            detected: isTrueOnly,
+            missingPrerequisite: isMissingPrerequisite,
             defaultName: isNullableString,
             defaultLabel: isNullableString,
             // Optional on purpose: see BridgeInfo's doc comment — absent is "unknown", and a guard that

package/dist/workstation/protocol/computer.js

@@ -1,9 +1,63 @@
-import { decodeChannelFrame, hasOptional, hasRequired, isBoolean, isNumber, isString, isStringArray, isStringRecord } from './common.js';
+import { validDesktopFrame } from '../desktop/protocol.js';
+import { decodeChannelFrame, hasOptional, hasRequired, isBoolean, isNumber, isObject, isString, isStringArray, isStringRecord } from './common.js';
+import { TOOL_REQUEST_BYTES, TOOL_RESULT_BYTES } from '../tools/validation.js';
+export const MAX_COMPUTER_FRAME_BYTES = 8 * 1024 * 1024;
 const DISCRIMINATORS = new Set([
+    'desktop_capability', 'desktop_open', 'desktop_opened', 'desktop_data', 'desktop_credit', 'desktop_close',
     'computer_hello', 'computer_ready', 'heartbeat', 'heartbeat_ack',
-    'exec_request', 'exec_output', 'exec_exit', 'exec_cancel',
+    'exec_request', 'exec_output', 'exec_exit', 'exec_cancel', 'tool_request', 'tool_result',
+    'file_read_request', 'file_read_result', 'file_write_request', 'file_write_result',
+    'file_ls_request', 'file_ls_result', 'file_mkdir_request', 'file_mkdir_result',
 ]);
+const fileErrorCodes = new Set([
+    'invalid_argument', 'invalid_path', 'unsupported_workstation', 'unsupported_protocol',
+    'workstation_offline', 'not_found', 'not_regular_file', 'invalid_encoding', 'line_too_long',
+    'too_large', 'conflict', 'permission_denied', 'io_error', 'outcome_unknown',
+]);
+const isNonnegativeInteger = (value) => Number.isSafeInteger(value) && value >= 0;
+const isPositiveInteger = (value) => Number.isSafeInteger(value) && value >= 1;
+const isSha256 = (value) => typeof value === 'string' && /^[0-9a-f]{64}$/.test(value);
+const onlyKeys = (value, keys) => Object.keys(value).every(key => keys.includes(key));
+function isFileError(value) {
+    return isObject(value) && hasRequired(value, { code: isString, message: isString })
+        && fileErrorCodes.has(value.code) && onlyKeys(value, ['code', 'message']);
+}
+function isReadData(value) {
+    return isObject(value) && hasRequired(value, {
+        path: isString, content: isString, startLine: isPositiveInteger, endLine: isNonnegativeInteger,
+        truncated: isBoolean, sizeBytes: isNonnegativeInteger, sha256: isSha256,
+    }) && hasOptional(value, { nextLine: isPositiveInteger })
+        && onlyKeys(value, ['path', 'content', 'startLine', 'endLine', 'nextLine', 'truncated', 'sizeBytes', 'sha256']);
+}
+function isWriteData(value) {
+    return isObject(value) && hasRequired(value, { path: isString, sizeBytes: isNonnegativeInteger, sha256: isSha256, created: isBoolean })
+        && onlyKeys(value, ['path', 'sizeBytes', 'sha256', 'created']);
+}
+const dirEntryKinds = new Set(['file', 'directory', 'symlink', 'other']);
+function isLsData(value) {
+    return isObject(value) && hasRequired(value, { path: isString, truncated: isBoolean })
+        && hasOptional(value, { nextAfter: isString })
+        && onlyKeys(value, ['path', 'entries', 'truncated', 'nextAfter'])
+        && Array.isArray(value.entries)
+        && value.entries.every((entry) => isObject(entry) && hasRequired(entry, { name: isString, kind: isString })
+            && dirEntryKinds.has(entry.kind)
+            && hasOptional(entry, { sizeBytes: isNonnegativeInteger })
+            && onlyKeys(entry, ['name', 'kind', 'sizeBytes']));
+}
+function isMkdirData(value) {
+    return isObject(value) && hasRequired(value, { path: isString, created: isBoolean })
+        && onlyKeys(value, ['path', 'created']);
+}
+function isFileResult(value, validData) {
+    if (!hasRequired(value, { id: isString }) || !onlyKeys(value, ['t', 'id', 'data', 'error']))
+        return false;
+    const hasData = Object.hasOwn(value, 'data');
+    const hasError = Object.hasOwn(value, 'error');
+    return hasData !== hasError && (hasData ? validData(value.data) : isFileError(value.error));
+}
 function isComputerFrame(value) {
+    if (typeof value.t === 'string' && value.t.startsWith('desktop_'))
+        return validDesktopFrame(value);
     switch (value.t) {
         case 'computer_hello': return hasRequired(value, { ticket: isString });
         case 'computer_ready': return hasRequired(value, { generation: isString, wireVersion: isNumber });
@@ -18,14 +72,49 @@ function isComputerFrame(value) {
             id: isString, exitCode: isNullableNumber, stdout: isString, stderr: isString,
             timedOut: isBoolean, truncated: isBoolean,
         });
+        case 'tool_request': return hasRequired(value, { id: isString, method: isString, params: isObject })
+            && value.id.length > 0 && value.id.length <= 128
+            && value.method.length > 0 && value.method.length <= 64
+            && Buffer.byteLength(JSON.stringify(value)) <= TOOL_REQUEST_BYTES
+            && onlyKeys(value, ['t', 'id', 'method', 'params']);
+        case 'tool_result': return hasRequired(value, { id: isString, ok: isBoolean, result: isObject, error: value => value === null || isString(value) })
+            && value.id.length > 0 && value.id.length <= 128
+            && (value.ok ? value.error === null : typeof value.error === 'string' && value.error.length > 0)
+            && Buffer.byteLength(JSON.stringify(value)) <= TOOL_RESULT_BYTES
+            && onlyKeys(value, ['t', 'id', 'ok', 'result', 'error']);
         case 'exec_cancel': return hasRequired(value, { id: isString });
+        case 'file_read_request': return hasRequired(value, {
+            id: isString, root: isString, path: isString, startLine: isPositiveInteger, maxLines: isPositiveInteger,
+        }) && value.maxLines <= 2000 && onlyKeys(value, ['t', 'id', 'root', 'path', 'startLine', 'maxLines']);
+        case 'file_write_request': return hasRequired(value, {
+            id: isString, root: isString, path: isString, content: isString, mode: isString,
+        }) && (value.mode === 'create' || value.mode === 'replace')
+            && hasOptional(value, { expectedSha256: isSha256 })
+            && onlyKeys(value, ['t', 'id', 'root', 'path', 'content', 'mode', 'expectedSha256']);
+        case 'file_ls_request': return hasRequired(value, {
+            id: isString, root: isString, path: isString, maxEntries: isPositiveInteger,
+        }) && value.maxEntries <= 2000
+            && hasOptional(value, { startAfter: isString })
+            && onlyKeys(value, ['t', 'id', 'root', 'path', 'startAfter', 'maxEntries']);
+        case 'file_mkdir_request': return hasRequired(value, {
+            id: isString, root: isString, path: isString, parents: isBoolean,
+        }) && onlyKeys(value, ['t', 'id', 'root', 'path', 'parents']);
+        case 'file_read_result': return isFileResult(value, isReadData);
+        case 'file_write_result': return isFileResult(value, isWriteData);
+        case 'file_ls_result': return isFileResult(value, isLsData);
+        case 'file_mkdir_result': return isFileResult(value, isMkdirData);
         default: return false;
     }
 }
 function isNullableNumber(value) { return value === null || isNumber(value); }
 export function encodeComputerFrame(frame) {
-    return JSON.stringify(frame);
+    const encoded = JSON.stringify(frame);
+    if (Buffer.byteLength(encoded, 'utf8') > MAX_COMPUTER_FRAME_BYTES)
+        throw new TypeError('Computer frame too large');
+    return encoded;
 }
 export function decodeComputerFrame(text) {
+    if (Buffer.byteLength(text, 'utf8') > MAX_COMPUTER_FRAME_BYTES)
+        throw new TypeError('Computer frame too large');
     return decodeChannelFrame(text, DISCRIMINATORS, isComputerFrame);
 }

package/dist/workstation/qoderAdapter/backgroundProcess.js

@@ -0,0 +1,106 @@
+/** Native Qoder does not forward background child SDK messages through ACP. Read only the
+ * exact transcript named by a validated root launch receipt; never scan or infer ownership. */
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+const object = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+const id = (value) => typeof value === 'string' && /^[a-zA-Z0-9_-]{1,160}$/.test(value);
+const LIMIT = 2 * 1024 * 1024;
+export class BackgroundProcess {
+    options;
+    offset = 0;
+    tail = Buffer.alloc(0);
+    skipLine = false;
+    seen = new Set();
+    tools = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    async poll() {
+        const file = await open(this.options.path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            const stat = await file.stat();
+            if (!stat.isFile())
+                return true;
+            if (stat.size < this.offset) {
+                this.offset = 0;
+                this.tail = Buffer.alloc(0);
+                this.skipLine = false;
+            }
+            const end = Math.min(stat.size, this.offset + 4 * 1024 * 1024);
+            while (this.offset < end) {
+                const chunk = Buffer.alloc(Math.min(64 * 1024, end - this.offset));
+                const { bytesRead } = await file.read(chunk, 0, chunk.length, this.offset);
+                if (!bytesRead)
+                    break;
+                this.offset += bytesRead;
+                this.consumeBytes(chunk.subarray(0, bytesRead));
+            }
+            return this.offset >= stat.size;
+        }
+        finally {
+            await file.close();
+        }
+    }
+    consumeBytes(bytes) {
+        let start = 0;
+        for (let end = bytes.indexOf(10); end >= 0; end = bytes.indexOf(10, start)) {
+            const part = bytes.subarray(start, end);
+            if (!this.skipLine && this.tail.length + part.length <= LIMIT) {
+                try {
+                    this.consume(object(JSON.parse(Buffer.concat([this.tail, part]).toString('utf8'))));
+                }
+                catch { /* not evidence */ }
+            }
+            this.tail = Buffer.alloc(0);
+            this.skipLine = false;
+            start = end + 1;
+        }
+        const part = bytes.subarray(start);
+        if (!this.skipLine && this.tail.length + part.length <= LIMIT)
+            this.tail = Buffer.concat([this.tail, part]);
+        else {
+            this.tail = Buffer.alloc(0);
+            this.skipLine = true;
+        }
+    }
+    consume(row) {
+        const o = this.options;
+        if (row.sessionId !== o.sessionId || row.cwd !== o.cwd || row.agentId !== o.agentId ||
+            row.parent_tool_use_id !== o.parentToolUseId || row.isSidechain !== true || row.version !== '1.1.61' ||
+            !id(row.uuid) || this.seen.has(row.uuid) || this.seen.size >= 4096)
+            return;
+        this.seen.add(row.uuid);
+        const content = object(row.message).content;
+        if (!Array.isArray(content))
+            return;
+        for (const block of content.map(object)) {
+            if (row.type === 'assistant' && block.type === 'tool_use' && id(block.id) && typeof block.name === 'string') {
+                if (this.tools.has(block.id) || this.tools.size >= 4096)
+                    continue;
+                const input = object(block.input);
+                this.tools.set(block.id, { name: block.name, input });
+                this.emit('tool_call', { toolCallId: block.id, name: block.name, title: block.name,
+                    kind: block.name === 'Read' ? 'read' : block.name === 'Bash' ? 'execute' : block.name === 'Agent' ? 'think' : 'other',
+                    rawInput: input, status: 'pending' }, block.name);
+            }
+            else if (row.type === 'user' && block.type === 'tool_result' && id(block.tool_use_id)) {
+                const tool = this.tools.get(block.tool_use_id);
+                if (!tool)
+                    continue;
+                const raw = row.toolUseResult ?? block.content;
+                const text = typeof block.content === 'string' ? block.content : JSON.stringify(block.content ?? '');
+                this.emit('tool_call_update', { toolCallId: block.tool_use_id, name: tool.name,
+                    status: block.is_error === true ? 'failed' : 'completed', rawOutput: raw,
+                    content: [{ type: 'content', content: { type: 'text', text } }] }, tool.name);
+            }
+            else if (row.type === 'assistant' && ((block.type === 'text' && typeof block.text === 'string') ||
+                (block.type === 'thinking' && typeof block.thinking === 'string'))) {
+                this.emit(block.type === 'text' ? 'agent_message_chunk' : 'agent_thought_chunk', { content: { type: 'text', text: block.type === 'text' ? block.text : block.thinking } });
+            }
+        }
+    }
+    emit(eventName, payload, toolName) {
+        this.options.emit({ eventName, payload: { ...payload, _meta: { qoder: { version: 1, source: 'correction',
+                        parentToolUseId: this.options.parentToolUseId, route: 'child', ...(toolName ? { toolName } : {}) } } } });
+    }
+}