@platless/axom-cli 0.1.0 → 0.3.13

package/dist/workstation/acp/acpClient.js

@@ -3,8 +3,13 @@ import { randomUUID } from 'node:crypto';
 import { Readable, Writable } from 'node:stream';
 import { client, ndJsonStream, PROTOCOL_VERSION, RequestError } from '@agentclientprotocol/sdk';
 import { sniffAuthUrl } from './authUrlSniffer.js';
+import { metaTerminalAuthArgs, terminalLoginSpecOf } from './terminalLogin.js';
 import { airCapabilityMeta, asSdkClientCapabilities, AIR_ASYNC_TASKS_CAPABILITY, AIR_NATIVE_SUBAGENT_SESSIONS_CAPABILITY, DRAFT_SUBAGENTS_CAPABILITY, } from './draftSubagents.js';
 import { interceptDraftUpdates } from './draftInterceptor.js';
+import { claudeActivityRaw } from './activityReporting.js';
+import { findOnPath, probeEnvironment } from './installProbe.js';
+import { parseQoderProfile, sameProfileIdentity } from '../qoderAdapter/profile.js';
+import { parseTaskObservation, taskEventMatchesHost } from '../qoderAdapter/taskEvent.js';
 export class UnsupportedNodeVersionError extends Error {
 }
 /**
@@ -251,7 +256,7 @@ const STDERR_TAIL_LIMIT = 8_192;
  */
 const STDERR_FLUSH_GRACE_MS = 250;
 /**
- * 把子进程的 stderr 接出来:一边原样转发到本进程的 stderr,一边留一份有界的尾巴给启动期的报错带上,
+ * 把子进程的 stderr 接出来:普通连接原样转发,托管 MCP 请求后的输出逐行脱敏,并留一份有界的安全尾巴给报错带上,
  * 一边逐行喂给 {@link sniffAuthUrl} —— 有的 agent(实测 antigravity)不走 `elicitation/create` 递
  * 登录链接,而是直接打到 stderr 上(见 `authUrlSniffer.ts` 的文件头注释)。
  *
@@ -269,9 +274,37 @@ const STDERR_FLUSH_GRACE_MS = 250;
  */
 function captureChildStderr(stream, present) {
     if (!stream)
-        return { text: () => '', flushed: () => Promise.resolve() };
+        return { text: () => '', flushed: () => Promise.resolve(), redactSecret: () => { } };
     let tail = '';
     let lineBuffer = '';
+    let protectedLine = '';
+    let droppingLongLine = false;
+    const secrets = new Set();
+    const forward = (value) => {
+        tail = (tail + value).slice(-STDERR_TAIL_LIMIT);
+        process.stderr.write(value);
+    };
+    const forwardProtected = (value) => {
+        protectedLine += value;
+        let newline;
+        while ((newline = protectedLine.indexOf('\n')) >= 0) {
+            if (droppingLongLine) {
+                droppingLongLine = false;
+            }
+            else {
+                let safe = protectedLine.slice(0, newline + 1);
+                for (const secret of secrets)
+                    safe = safe.replaceAll(secret, '[REDACTED]');
+                forward(safe);
+            }
+            protectedLine = protectedLine.slice(newline + 1);
+        }
+        if (protectedLine.length > STDERR_TAIL_LIMIT) {
+            protectedLine = '';
+            droppingLongLine = true;
+            forward('[acp] child stderr line omitted\n');
+        }
+    };
     // One login can print its own URL more than once — the ordinary shape of an OAuth CLI is "here's
     // the link" immediately followed by "if your browser didn't open, here it is again", verbatim
     // the same URL. Without this, that becomes two permanent, identical, un-retractable cards for a
@@ -315,19 +348,40 @@ function captureChildStderr(stream, present) {
     };
     stream.on('data', (chunk) => {
         const text = chunk.toString();
-        tail = (tail + text).slice(-STDERR_TAIL_LIMIT);
-        process.stderr.write(chunk);
-        scanForAuthUrl(text);
+        if (secrets.size > 0)
+            forwardProtected(text);
+        else {
+            tail = (tail + text).slice(-STDERR_TAIL_LIMIT);
+            process.stderr.write(chunk);
+            scanForAuthUrl(text);
+        }
     });
     // 读端出错(SIGKILL 掉子进程时管子会断)没有谁需要处理,但一个没有监听器的 `'error'` 会把整个
     // 守护进程掀翻 —— 这行不是防御性代码,是 EventEmitter 的硬性要求。
     stream.on('error', () => { });
     // A final unterminated line (no trailing `\n` before the process exits) is still a real line —
     // scan whatever is left in the buffer once the stream itself says there is no more coming.
-    void ended.then(() => scanForAuthUrl('\n'));
+    void ended.then(() => {
+        if (protectedLine && !droppingLongLine) {
+            let safe = protectedLine;
+            for (const secret of secrets)
+                safe = safe.replaceAll(secret, '[REDACTED]');
+            forward(safe);
+        }
+        if (secrets.size === 0)
+            scanForAuthUrl('\n');
+    });
     return {
         text: () => tail,
         flushed: (ms) => settledWithin(ended, ms).then(() => undefined),
+        redactSecret: (secret) => {
+            if (!secret)
+                return;
+            lineBuffer = '';
+            secrets.add(secret);
+            if (secret.startsWith('Bearer '))
+                secrets.add(secret.slice('Bearer '.length));
+        },
     };
 }
 /**
@@ -471,17 +525,21 @@ export async function closeAgentTransport(child, connection, graceMs = CHILD_EXI
  * Dropping rather than repairing: `id` is the value `authenticate` is called with, so inventing
  * one would trade a missing sign-in method for a broken one.
  */
-function toAuthMethodSnapshot(method) {
+export function toAuthMethodSnapshot(method) {
     if (typeof method.id !== 'string' || typeof method.name !== 'string')
         return null;
+    // Terminal by shape (spec 2026-09-24 D6): a top-level `type: "terminal"`, or a `_meta
+    // ["terminal-auth"]` object from an agent that advertises its terminal login only there.
+    const terminal = terminalLoginSpecOf(method) !== undefined;
+    const args = 'args' in method && Array.isArray(method.args) ? method.args : terminal ? metaTerminalAuthArgs(method) : undefined;
     return {
         id: method.id,
         name: method.name,
-        ...('type' in method && method.type === 'terminal' ? { type: 'terminal' } : {}),
+        ...(terminal ? { type: 'terminal' } : {}),
         ...(method.description != null ? { description: method.description } : {}),
-        // `args` only exists on `AuthMethodTerminal` — an `agent`-type method has no such field, and
-        // `'args' in method` is false for it, which is exactly "nothing to show" (see `AgentAuthMethod`).
-        ...('args' in method && Array.isArray(method.args) ? { args: method.args } : {}),
+        // `args` only exists on a terminal method — top-level, or under `_meta["terminal-auth"]` when
+        // that is the only place the agent put it. Never the `_meta` command: see `terminalLogins`.
+        ...(args ? { args } : {}),
     };
 }
 const DEFAULT_INITIALIZE_TIMEOUT_MS = 30_000;
@@ -494,14 +552,19 @@ const DEFAULT_INITIALIZE_TIMEOUT_MS = 30_000;
  */
 export async function connectAgent(spec, env, agentEnv, options = {}) {
     assertNodeVersionSupported(spec, options.nodeVersion);
+    const processEnv = { ...process.env, ...spec.env, ...env, ...agentEnv };
     const child = spawn(spec.command, spec.args, {
         // stderr 是 `pipe` 而不是 `inherit`,而且**依然不接进协议流** —— 它被 `captureChildStderr`
         // 单独读走:原样转发到 daemon.log(`inherit` 以前免费提供的那件事),同时留一份尾巴给启动期的
         // 报错。启动失败时 npm 写在这里的文字是唯一的一手证据。
         stdio: ['pipe', 'pipe', 'pipe'],
-        env: { ...process.env, ...spec.env, ...env, ...agentEnv },
+        env: processEnv,
     });
     const stderrTail = captureChildStderr(child.stderr, options.present);
+    for (const secret of options.stderrSecrets ?? [])
+        stderrTail.redactSecret(secret);
+    if (options.onProcessExit)
+        child.once('exit', options.onProcessExit);
     const lifecycle = watchChildLifecycle(child, spec.command, stderrTail);
     // Argument order reads backwards from what the names suggest: argument 1 is the child's stdin
     // (we write to it), argument 2 is the child's stdout (we read from it). Swapping them still
@@ -510,13 +573,50 @@ export async function connectAgent(spec, env, agentEnv, options = {}) {
     // Filled in by `bindDraftUpdates` once a session exists. Held in closure variables rather than
     // passed in, because the interceptor has to be in place before `initialize` — the agent may send
     // its first update before anyone has had a chance to register anything.
+    let updateCapture = null;
     let ownSessionId = null;
+    let diagnostics = {
+        generation: randomUUID(), revision: 0, available: true,
+        launch: { source: options.launchSource ?? 'direct',
+            executable: (findOnPath(spec.command, probeEnvironment(processEnv)) ?? spec.command).slice(0, 4096),
+            platform: process.platform, architecture: process.arch, transport: 'stdio' },
+    };
+    const diagnosticListeners = new Set();
+    const providerTaskListeners = new Set();
+    child.once('exit', () => {
+        diagnostics = { ...diagnostics, available: false, revision: diagnostics.revision + 1,
+            profile: diagnostics.profile ? { ...diagnostics.profile, observerHealthy: false, rootConfirmed: false } : undefined };
+        for (const listener of diagnosticListeners)
+            listener(diagnostics);
+    });
+    let adapterRevision = 0;
+    const pendingProfiles = new Map();
+    const applyProfile = (sessionId, revision, profile) => {
+        const previous = diagnostics.profile;
+        if (!previous || !diagnostics.available || sessionId !== ownSessionId || revision <= adapterRevision ||
+            !sameProfileIdentity(previous, profile) || profile.rootSessionId !== ownSessionId ||
+            (previous.runtimeGeneration !== undefined && profile.runtimeGeneration !== previous.runtimeGeneration) ||
+            (profile.rootConfirmed === true && !profile.runtimeGeneration))
+            return;
+        adapterRevision = revision;
+        diagnostics = { ...diagnostics, revision: diagnostics.revision + 1, profile };
+        for (const listener of diagnosticListeners)
+            listener(diagnostics);
+    };
     let draftSink = null;
+    // Same "filled in later" shape as `draftSink`, for `bindActivity` — see that method's own doc
+    // comment on `AcpConnection`.
+    let activitySink = null;
     // Sessions this connection handles by some route other than an `AcpSession` — today only
     // adoption's replay. Kept beside `ownSessionId` rather than folded into it because they mean
     // different things: one is "the session we drive", these are "sessions someone else on this
     // connection is already reading".
     const knownSessionIds = new Set();
+    // p3-fix7 N9: updates diverted before any session is bound. An agent may push its first `session/update` (Claude's
+    // `available_commands_update`) before this client has processed the `session/new` response that names the session,
+    // so it reads as a stranger's. Dropping it lost the command table of every first probe (run 4 and run 5 daemon
+    // logs); kept here, bounded, and replayed to the sink once the session binds.
+    const preBind = [];
     const stream = ndJsonStream(Writable.toWeb(child.stdin), 
     // The child's stdout, minus the notifications the pinned SDK cannot deliver. Everything else
     // reaches it byte-for-byte; see `draftInterceptor.ts` for the measurements behind this.
@@ -525,19 +625,66 @@ export async function connectAgent(spec, env, agentEnv, options = {}) {
         // not been told about as our own would send its frames to the SDK, which drops them silently.
         // Diverting is the recoverable direction — the sink can decide, and it can log.
         isOwnSession: (sessionId) => (ownSessionId !== null && sessionId === ownSessionId) || knownSessionIds.has(sessionId),
+        captureUpdate: (notification) => updateCapture?.(notification) ?? false,
         onDiverted: (update) => {
             if (draftSink) {
                 draftSink(update);
                 return;
             }
-            // No sink yet: say so once per update rather than dropping in silence. This is reachable
-            // only before the session is bound, which is before any prompt, so it should stay rare —
-            // and if it stops being rare, that is worth seeing.
-            console.warn(`[acp] dropped a ${update.reason} session/update for '${update.sessionId}': ` +
-                'no session is bound to this connection yet');
+            // No sink yet: keep it until the session binds (bounded), then replay what is ours.
+            if (preBind.length >= PRE_BIND_MAX_UPDATES) {
+                const dropped = preBind.shift();
+                warnDroppedPreBind(dropped.update, 'too many updates arrived before the session was bound');
+            }
+            preBind.push({ update, at: Date.now() });
         },
     }));
     const app = client({ name: 'axom' });
+    app.onNotification('_axom/qoder/profile', (params) => (params ?? {}), (ctx) => {
+        const params = ctx.params;
+        const profile = parseQoderProfile(params.profile);
+        if (!diagnostics.profile || !profile || typeof params.sessionId !== 'string' ||
+            profile.rootSessionId !== params.sessionId || !Number.isSafeInteger(params.revision) ||
+            params.revision <= 0 || !sameProfileIdentity(diagnostics.profile, profile))
+            return;
+        if (ownSessionId) {
+            applyProfile(params.sessionId, params.revision, profile);
+        }
+        else {
+            // ACP may notify before its new/load reply. Retain only bounded typed candidates;
+            // no candidate becomes evidence until the response binds this connection's exact root.
+            const previous = pendingProfiles.get(params.sessionId);
+            if (previous && (params.revision <= previous.revision ||
+                profile.runtimeGeneration !== previous.profile.runtimeGeneration))
+                return;
+            if (!previous && pendingProfiles.size >= 8)
+                return;
+            pendingProfiles.set(params.sessionId, { revision: params.revision, profile });
+        }
+    });
+    app.onNotification('_qoder/task_event', (params) => params, (ctx) => {
+        const event = parseTaskObservation(ctx.params);
+        if (!event || !taskEventMatchesHost(event, {
+            selected: options.providerTaskAdapterSelected === true, available: diagnostics.available,
+            confirmed: diagnostics.profile?.rootConfirmed === true, rootSessionId: ownSessionId,
+            runtimeGeneration: diagnostics.profile?.runtimeGeneration,
+        }))
+            return;
+        for (const listener of providerTaskListeners)
+            listener(event);
+    });
+    // claude-agent-acp's raw-SDK-message channel (design §5.1/§2.1): registered unconditionally on
+    // every connection, before `options.configure?.(app)` and before `initialize` — `_claude/sdkMessage`
+    // is not a built-in ACP method, so `ClientApp.onNotification` needs the custom-method overload (a
+    // parser plus a handler) rather than the typed-literal one `registerPermissionHandlers` uses. The
+    // method name is vendor-specific, so this handler simply never fires on a connection to any other
+    // agent — there is no need to gate the registration on `agentInfo`, which in any case is not yet
+    // known this early (`initialize` has not happened).
+    app.onNotification('_claude/sdkMessage', (params) => (params ?? {}), (ctx) => {
+        const raw = claudeActivityRaw(ctx.params);
+        if (raw)
+            activitySink?.(raw);
+    });
     options.configure?.(app);
     const connection = app.connect(stream);
     const timeoutMs = options.initializeTimeoutMs ?? DEFAULT_INITIALIZE_TIMEOUT_MS;
@@ -595,7 +742,14 @@ export async function connectAgent(spec, env, agentEnv, options = {}) {
                     // `clientCapabilities?.elicitation?.url != null`. Without declaring it, Codex never offers
                     // that method and `elicitation/create` with `mode: 'url'` never arrives to answer (see
                     // `permission.ts`'s `handleCreateElicitation`).
-                    elicitation: { url: {} },
+                    //
+                    // `form` (`ElicitationFormCapabilities`, `types.gen.d.ts:4455`) is what keeps Claude's
+                    // AskUserQuestion alive: without it the adapter puts the tool in `disallowedTools`
+                    // (`claude-agent-acp/dist/acp-agent.js:5959`), so the model never has it at all — the
+                    // symptom is prose questions, not an unrendered card. This is the trigger for the whole
+                    // elicitation-standardization plan: everything through Task 17 built the machinery to
+                    // answer `elicitation/create` once it arrives; this line is what makes it arrive at all.
+                    elicitation: { url: {}, form: {} },
                     _meta: {
                         'subagent-transcript': true,
                         ...airCapabilityMeta(AIR_NATIVE_SUBAGENT_SESSIONS_CAPABILITY, AIR_ASYNC_TASKS_CAPABILITY),
@@ -630,12 +784,14 @@ export async function connectAgent(spec, env, agentEnv, options = {}) {
         throw error;
     }
     const sessionCapabilities = initResponse.agentCapabilities?.sessionCapabilities;
+    diagnostics = { ...diagnostics, profile: parseQoderProfile(initResponse._meta?.qoderProfile) };
     const capabilities = {
         // Capability markers are empty objects (`{ _meta? }`); supplying `{}` means "supported", and
         // omitting the field (or explicit `null`) means "not supported". A truthiness check reads `{}`
         // correctly by accident but reads `null`/`undefined` correctly too, which hides the real bug:
         // this must stay an explicit `!= null`, never `Boolean(...)` or a bare truthy test.
         list: sessionCapabilities?.list != null,
+        delete: sessionCapabilities?.delete != null,
         resume: sessionCapabilities?.resume != null,
         loadSession: initResponse.agentCapabilities?.loadSession === true,
         logout: initResponse.agentCapabilities?.auth?.logout != null,
@@ -649,6 +805,7 @@ export async function connectAgent(spec, env, agentEnv, options = {}) {
          * is a field nobody can act on.
          */
         promptImage: initResponse.agentCapabilities?.promptCapabilities?.image === true,
+        mcpHttp: initResponse.agentCapabilities?.mcpCapabilities?.http === true,
     };
     // Honour the advertised capability, not what the agent happens to route: some adapters (e.g.
     // codex-acp routing `session/fork`) implement more than they declare in `agentCapabilities`.
@@ -658,6 +815,12 @@ export async function connectAgent(spec, env, agentEnv, options = {}) {
     const authMethods = advertisedAuthMethods
         .map(toAuthMethodSnapshot)
         .filter((method) => method !== null);
+    const terminalLogins = new Map();
+    for (const method of advertisedAuthMethods) {
+        const spec = terminalLoginSpecOf(method);
+        if (spec && typeof method.id === 'string')
+            terminalLogins.set(method.id, spec);
+    }
     if (authMethods.length !== advertisedAuthMethods.length) {
         // Named and counted rather than dropped in silence: the user loses a sign-in method they can
         // see advertised in the agent's own docs, and the only honest answer to "why" is which agent
@@ -669,16 +832,60 @@ export async function connectAgent(spec, env, agentEnv, options = {}) {
             'id/name; ignoring them');
     }
     return {
+        get runtimeDiagnostics() { return diagnostics; },
+        providerTaskAdapterSelected: options.providerTaskAdapterSelected === true,
+        publishCallbacks(snapshot) {
+            if (snapshot.rootSessionId !== ownSessionId)
+                return;
+            diagnostics = { ...diagnostics, revision: diagnostics.revision + 1, callbacks: snapshot };
+            for (const listener of diagnosticListeners)
+                listener(diagnostics);
+        },
+        onRuntimeDiagnostics(cb) { diagnosticListeners.add(cb); },
+        onProviderTaskEvent(cb) { providerTaskListeners.add(cb); },
         capabilities,
         authMethods,
+        terminalLogins,
         supportsSteering: steeringAdvertised(initResponse._meta),
         steeringTimings: steeringTimings(initResponse._meta),
         agentInfo: initResponse.agentInfo ?? undefined,
         connection,
+        redactStderrSecret: (secret) => stderrTail.redactSecret(secret),
         agentProcessAlive: () => child.exitCode === null && child.signalCode === null,
+        captureSessionUpdates(sink) {
+            if (updateCapture)
+                throw new Error('A session replay is already active on this connection');
+            updateCapture = sink;
+            return () => { if (updateCapture === sink)
+                updateCapture = null; };
+        },
         bindDraftUpdates(sessionId, sink) {
             ownSessionId = sessionId;
             draftSink = sink;
+            const current = diagnostics.profile;
+            if (current?.rootSessionId && current.rootSessionId !== sessionId) {
+                diagnostics = { ...diagnostics, profile: { ...current, rootSessionId: undefined,
+                        runtimeGeneration: undefined, rootConfirmed: false, initialized: false, observerHealthy: false } };
+            }
+            const pending = pendingProfiles.get(sessionId);
+            pendingProfiles.clear();
+            if (pending)
+                applyProfile(sessionId, pending.revision, pending.profile);
+            // p3-fix7 N9: replay what arrived before this moment. Our own session's updates go to the sink as `pre-bind`
+            // (they are ours, not a child's); anything else, or anything older than the window, is dropped with the
+            // warning it always had.
+            const now = Date.now();
+            for (const { update, at } of preBind.splice(0)) {
+                if (update.sessionId === sessionId && now - at <= PRE_BIND_MAX_AGE_MS) {
+                    sink(update.reason === 'foreign-session' ? { ...update, reason: 'pre-bind' } : update);
+                }
+                else {
+                    warnDroppedPreBind(update, 'no session is bound to this connection yet');
+                }
+            }
+        },
+        bindActivity(sink) {
+            activitySink = sink;
         },
         markSessionKnown(sessionId) {
             knownSessionIds.add(sessionId);
@@ -689,3 +896,10 @@ export async function connectAgent(spec, env, agentEnv, options = {}) {
         close: () => closeAgentTransport(child, connection),
     };
 }
+/** p3-fix7 N9: how many updates, and for how long, a connection keeps before its session is bound. */
+const PRE_BIND_MAX_UPDATES = 32;
+const PRE_BIND_MAX_AGE_MS = 5_000;
+/** Says so once per update rather than dropping in silence; it should stay rare, and if it stops being rare it is worth seeing. */
+function warnDroppedPreBind(update, why) {
+    console.warn(`[acp] dropped a ${update.reason} session/update for '${update.sessionId}': ${why}`);
+}