@platless/axom-cli 0.3.13 → 0.5.9

package/dist/workstation/qoderAdapter/backgroundTerminalFold.js

@@ -0,0 +1,372 @@
+export const MAX_TASKS = 512;
+export const MAX_RESULT = 128 * 1024;
+export const MAX_RESULTS = 4 * 1024 * 1024;
+/** Child transcript rows remembered per background Agent (`BackgroundProcess`' `seen` bound). */
+export const CHILD_ROW_LIMIT = 4096;
+const TERMINALS = new Set(['completed', 'failed', 'cancelled']);
+export function object(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+export function address(value) {
+    return typeof value === 'string' && /^[a-zA-Z0-9_-]{1,160}$/.test(value) ? value : undefined;
+}
+function own(record, key) {
+    return Object.hasOwn(record, key) ? record[key] : undefined;
+}
+function put(record, key, value) {
+    Object.defineProperty(record, key, { value, enumerable: true, writable: true, configurable: true });
+}
+/** UTF-8 length of a string, as `Buffer.byteLength` counts it (a lone surrogate is 3 bytes). */
+export function utf8Length(text) {
+    let bytes = 0;
+    for (let index = 0; index < text.length; index += 1) {
+        const code = text.charCodeAt(index);
+        if (code < 0x80)
+            bytes += 1;
+        else if (code < 0x800)
+            bytes += 2;
+        else if (code >= 0xd800 && code <= 0xdbff && index + 1 < text.length
+            && text.charCodeAt(index + 1) >= 0xdc00 && text.charCodeAt(index + 1) <= 0xdfff) {
+            bytes += 4;
+            index += 1;
+        }
+        else
+            bytes += 3;
+    }
+    return bytes;
+}
+/**
+ * The facts in one root transcript row — `BackgroundTerminalRepair.consume` up to the point where it
+ * consulted its own memory (that half is {@link TerminalRepairFold.apply}).
+ */
+export function rootRowFacts(row, context) {
+    if (row.sessionId !== context.nativeSessionId || row.cwd !== context.cwd || row.isSidechain !== false)
+        return [];
+    const content = object(row.message).content;
+    if (!Array.isArray(content))
+        return [];
+    const facts = [];
+    // resume deliberately sends no historical ACP openings. Recover only certified root Agent
+    // background inputs; no opening is emitted and the existing exact-ID notification rules apply.
+    if (context.restoreCalls && row.type === 'assistant') {
+        for (const block of content.map(object)) {
+            const input = object(block.input), id = address(block.id);
+            if (block.type === 'tool_use' && block.name === 'Agent' && id && input.run_in_background === true &&
+                typeof input.prompt === 'string' && (input.subagent_type == null || typeof input.subagent_type === 'string')) {
+                facts.push({ kind: 'call', toolUseId: id, input });
+            }
+        }
+        return facts;
+    }
+    if (row.type !== 'user')
+        return facts;
+    const output = object(row.toolUseResult);
+    if (output.isAsync === true && output.status === 'async_launched') {
+        const results = content.map(object).filter(c => c.type === 'tool_result');
+        const id = results.length === 1 ? address(results[0].tool_use_id) : undefined;
+        const agent = address(output.agentId);
+        if (id)
+            facts.push({ kind: 'launch', toolUseId: id, ...(agent ? { agentId: agent } : {}) });
+        return facts;
+    }
+    if (row.isMeta !== true || object(row.origin).kind !== 'task-notification')
+        return facts;
+    for (const block of content.map(object)) {
+        if (block.type !== 'text' || typeof block.text !== 'string' ||
+            !block.text.startsWith('[SYSTEM NOTIFICATION - NOT USER INPUT]\n'))
+            continue;
+        // Match the authoritative envelope before result text; tags inside a result cannot change IDs.
+        const match = block.text.match(/<task-notification>\n<task-id>([a-zA-Z0-9_-]{1,160})<\/task-id>\n<tool-use-id>([a-zA-Z0-9_-]{1,160})<\/tool-use-id>\n(?:<output-file>[^\n]*<\/output-file>\n)?<status>(completed|failed|cancelled)<\/status>\n<summary>[^\n]*<\/summary>\n<result>([\s\S]*)<\/result>\n(?:<usage>[^\n]*<\/usage>\n)?<\/task-notification>\s*$/);
+        if (match && utf8Length(match[4]) <= MAX_RESULT) {
+            facts.push({ kind: 'terminal', toolUseId: match[2], taskId: match[1], state: match[3], result: match[4] });
+        }
+    }
+    return facts;
+}
+export function newTerminalRepairData(options) {
+    return {
+        nativeSessionId: options.nativeSessionId, restoreCalls: options.restoreCalls === true, includeProcess: options.includeProcess === true,
+        calls: {}, callCount: 0, launches: [], terminals: [], delivered: {}, pendingProcesses: {}, resultBytes: 0, childRows: {}, polledProcesses: {},
+    };
+}
+export class TerminalRepairFold {
+    data;
+    constructor(data) {
+        this.data = data;
+    }
+    call(id) { return own(this.data.calls, id); }
+    agentOf(id) { return this.data.launches.find(([toolUseId]) => toolUseId === id)?.[1]; }
+    /** Every ACP event the session routes or emits (live or load history): learns the certified Agent calls. */
+    observe(event) {
+        if ((event.acpSessionId && event.acpSessionId !== this.data.nativeSessionId) ||
+            !['tool_call', 'tool_call_update'].includes(event.eventName))
+            return;
+        const payload = event.payload;
+        const id = address(payload.toolCallId);
+        if (!id)
+            return;
+        let call = this.call(id);
+        const input = object(payload.rawInput);
+        if (!call && input.run_in_background === true && typeof input.prompt === 'string' &&
+            (input.subagent_type == null || typeof input.subagent_type === 'string') && payload.kind === 'think' &&
+            object(object(payload._meta).qoder).toolName === 'Agent' && this.data.callCount < MAX_TASKS) {
+            const meta = object(object(payload._meta).qoder);
+            call = { input, invocationComplete: false, nativeTerminal: false,
+                process: this.data.includeProcess && meta.version === 1 && meta.source === 'native-acp-patch' };
+            put(this.data.calls, id, call);
+            this.data.callCount += 1;
+        }
+        if (!call)
+            return;
+        if (payload.status === 'completed')
+            call.invocationComplete = true;
+        const output = object(payload.rawOutput);
+        if (output.kind === 'agent-result' && (TERMINALS.has(String(output.state)) || output.state === 'error')) {
+            call.nativeTerminal = true; // Upstream's structured evidence always wins.
+            // Never published now: its input, child rows and status are dead (checkpointed state).
+            this.forget(id, call);
+        }
+    }
+    /** A known call has no result yet: the reader keeps polling the root transcript. */
+    active() {
+        return Object.entries(this.data.calls).some(([id, call]) => !Object.hasOwn(this.data.delivered, id) && !call.nativeTerminal);
+    }
+    /** This call's child transcript is still followed. */
+    wantsProcess(toolUseId) {
+        const call = this.call(toolUseId);
+        return call !== undefined && call.process && !Object.hasOwn(this.data.delivered, toolUseId) && !call.nativeTerminal;
+    }
+    /** Fold one fact; returns the ACP events to emit now (a child row's, or the results a poll's end publishes). */
+    apply(fact) {
+        const data = this.data;
+        switch (fact.kind) {
+            case 'call':
+                if (data.restoreCalls && !this.call(fact.toolUseId) && data.callCount < MAX_TASKS) {
+                    put(data.calls, fact.toolUseId, { input: fact.input, invocationComplete: false, nativeTerminal: false, process: false });
+                    data.callCount += 1;
+                }
+                return [];
+            case 'launch': {
+                const call = this.call(fact.toolUseId);
+                if (data.restoreCalls && call)
+                    call.invocationComplete = true;
+                if (fact.agentId && data.launches.length < MAX_TASKS && this.agentOf(fact.toolUseId) === undefined) {
+                    data.launches.push([fact.toolUseId, fact.agentId]);
+                }
+                return [];
+            }
+            case 'terminal': {
+                const bytes = utf8Length(fact.result);
+                if (bytes <= MAX_RESULT && data.resultBytes + bytes <= MAX_RESULTS && data.terminals.length < MAX_TASKS &&
+                    !data.terminals.some((terminal) => terminal.toolUseId === fact.toolUseId)) {
+                    data.resultBytes += bytes;
+                    data.terminals.push({ toolUseId: fact.toolUseId, taskId: fact.taskId, state: fact.state, result: fact.result });
+                }
+                return [];
+            }
+            case 'child': {
+                // Only a transcript the repair still follows (the reader asked the same question before reading).
+                if (!this.wantsProcess(fact.toolUseId) || this.agentOf(fact.toolUseId) === undefined)
+                    return [];
+                let seen = own(data.childRows, fact.toolUseId);
+                if (!seen)
+                    put(data.childRows, fact.toolUseId, seen = []);
+                if (seen.includes(fact.uuid) || seen.length >= CHILD_ROW_LIMIT)
+                    return [];
+                seen.push(fact.uuid);
+                return [...fact.events];
+            }
+            case 'child_status':
+                if (!this.wantsProcess(fact.toolUseId) || this.agentOf(fact.toolUseId) === undefined)
+                    return [];
+                if (fact.caughtUp)
+                    delete data.pendingProcesses[fact.toolUseId];
+                else
+                    put(data.pendingProcesses, fact.toolUseId, true);
+                put(data.polledProcesses, fact.toolUseId, true);
+                return [];
+            case 'poll_end':
+                return this.publish();
+        }
+    }
+    publish() {
+        const data = this.data;
+        const events = [];
+        for (const terminal of data.terminals) {
+            const id = terminal.toolUseId;
+            const call = this.call(id), agentId = this.agentOf(id);
+            if (call?.nativeTerminal)
+                terminal.result = '';
+            if (Object.hasOwn(data.delivered, id) || Object.hasOwn(data.pendingProcesses, id) || !call?.invocationComplete ||
+                call.nativeTerminal || !agentId || (call.process && !Object.hasOwn(data.polledProcesses, id)))
+                continue;
+            put(data.delivered, id, true);
+            events.push({ eventName: 'tool_call_update', payload: {
+                    name: 'Agent', kind: 'think', toolCallId: id, rawInput: call.input, status: 'completed',
+                    rawOutput: { kind: 'agent-result', state: terminal.state, agentId, result: terminal.result },
+                    content: [{ type: 'content', content: { type: 'text', text: terminal.result } }],
+                    _meta: { qoder: { toolName: 'Agent' }, axomNativeTerminalRepair: {
+                            patch: 'qoder-background-terminal', nativeSessionId: data.nativeSessionId,
+                            taskId: terminal.taskId, source: 'native-task-notification',
+                        } },
+                } });
+            // Delivered results are never published again; their text need not stay in a checkpoint.
+            terminal.result = '';
+            this.forget(id, call);
+        }
+        return events;
+    }
+    /**
+     * A delivered or natively finished call is never published and its child never followed again
+     * (`wantsProcess` is false for good), so what only those two read goes: the input (read by
+     * `publish` alone), the child rows' uuids and status. The call entry itself stays — `observe` must
+     * not register the same id afresh — and so do the launch and result entries, whose presence is what
+     * keeps a restarted reader's repeats from being taken as new.
+     */
+    forget(id, call) {
+        call.input = {};
+        delete this.data.childRows[id];
+        delete this.data.pendingProcesses[id];
+        delete this.data.polledProcesses[id];
+    }
+}
+// ---- notes ------------------------------------------------------------------------------------
+/**
+ * The note kinds (spec §5.4: "Qoder 侧文件推导出的事件" enter the log as notes):
+ * - `qoder_terminal_repair{nativeSessionId, restoreCalls?}` — the daemon enabled the certified repair
+ *   for this session (where today's path calls `enableBackgroundTerminalRepair`).
+ * - `qoder_side{fact}`, or for a fact too large for one note, consecutive
+ *   `qoder_side{chunk: {index, count, text}}` notes whose `text`s concatenate to the fact's JSON.
+ */
+export const REPAIR_NOTE = 'qoder_terminal_repair';
+export const SIDE_NOTE = 'qoder_side';
+/** Equal to the processor's `NOTE_MAX_BYTES` (asserted in a test; this module does not import the processor). */
+export const SIDE_NOTE_MAX_BYTES = 64 * 1024;
+/**
+ * A fact larger than this (serialized) is not recorded (the reader counts it). A child row's line is
+ * ≤ 2 MiB and re-serializes no larger, but its text can appear twice (`rawOutput` and `content`), so a
+ * fact stays ≤ ~4 MiB; 8 MiB keeps every fact the live driver would have emitted. Its chunk buffer can be
+ * that large while a chunked fact is half-read: T19 does not cut a checkpoint then (`sideChunk !== null`).
+ */
+export const MAX_SIDE_FACT_BYTES = 8 * 1024 * 1024;
+/** Enough for a {@link MAX_SIDE_FACT_BYTES} fact even when chunking doubles it (escaped quotes). */
+export const MAX_SIDE_CHUNKS = 512;
+/** Bytes `JSON.stringify` spends on one code unit (or pair) inside a string literal. */
+function escapedBytes(text, index) {
+    const code = text.charCodeAt(index);
+    if (code === 0x22 || code === 0x5c || code === 0x08 || code === 0x0c || code === 0x0a || code === 0x0d || code === 0x09)
+        return { bytes: 2, units: 1 };
+    if (code < 0x20)
+        return { bytes: 6, units: 1 };
+    if (code < 0x80)
+        return { bytes: 1, units: 1 };
+    if (code < 0x800)
+        return { bytes: 2, units: 1 };
+    if (code >= 0xd800 && code <= 0xdbff && index + 1 < text.length) {
+        const next = text.charCodeAt(index + 1);
+        if (next >= 0xdc00 && next <= 0xdfff)
+            return { bytes: 4, units: 2 };
+    }
+    if (code >= 0xd800 && code <= 0xdfff)
+        return { bytes: 6, units: 1 };
+    return { bytes: 3, units: 1 };
+}
+/**
+ * The notes that record one fact: one `{fact}` note when it fits {@link SIDE_NOTE_MAX_BYTES}, otherwise
+ * consecutive `{chunk}` notes, each within the limit. `[]` for a fact over {@link MAX_SIDE_FACT_BYTES}.
+ */
+export function sideNotes(fact) {
+    const whole = { type: SIDE_NOTE, fact };
+    if (utf8Length(JSON.stringify(whole)) <= SIDE_NOTE_MAX_BYTES)
+        return [whole];
+    const json = JSON.stringify(fact);
+    if (utf8Length(json) > MAX_SIDE_FACT_BYTES)
+        return [];
+    const overhead = utf8Length(JSON.stringify({ type: SIDE_NOTE, chunk: { index: MAX_SIDE_CHUNKS, count: MAX_SIDE_CHUNKS, text: '' } }));
+    const budget = SIDE_NOTE_MAX_BYTES - overhead;
+    const pieces = [];
+    let start = 0, used = 0;
+    for (let index = 0; index < json.length;) {
+        const { bytes, units } = escapedBytes(json, index);
+        if (used + bytes > budget) {
+            pieces.push(json.slice(start, index));
+            start = index;
+            used = 0;
+        }
+        used += bytes;
+        index += units;
+    }
+    pieces.push(json.slice(start));
+    if (pieces.length > MAX_SIDE_CHUNKS)
+        return [];
+    return pieces.map((text, index) => ({ type: SIDE_NOTE, chunk: { index, count: pieces.length, text } }));
+}
+function isEvent(value) {
+    const event = object(value);
+    return value === event && typeof event.eventName === 'string' && object(event.payload) === event.payload
+        && (event.acpSessionId === undefined || typeof event.acpSessionId === 'string');
+}
+/** A fact read back from a note, shape-checked (the log is the daemon's own, but a note is still data). */
+export function parseSideFact(value) {
+    const fact = object(value);
+    if (value !== fact)
+        return undefined;
+    const id = address(fact.toolUseId);
+    switch (fact.kind) {
+        case 'call':
+            return id && object(fact.input) === fact.input ? { kind: 'call', toolUseId: id, input: fact.input } : undefined;
+        case 'launch':
+            if (!id || (fact.agentId !== undefined && address(fact.agentId) === undefined))
+                return undefined;
+            return { kind: 'launch', toolUseId: id, ...(fact.agentId !== undefined ? { agentId: fact.agentId } : {}) };
+        case 'terminal':
+            return id && address(fact.taskId) && TERMINALS.has(String(fact.state)) && typeof fact.result === 'string'
+                ? { kind: 'terminal', toolUseId: id, taskId: fact.taskId, state: fact.state, result: fact.result }
+                : undefined;
+        case 'child':
+            return id && address(fact.uuid) && Array.isArray(fact.events) && fact.events.every(isEvent)
+                ? { kind: 'child', toolUseId: id, uuid: fact.uuid, events: fact.events }
+                : undefined;
+        case 'child_status':
+            return id && typeof fact.caughtUp === 'boolean' ? { kind: 'child_status', toolUseId: id, caughtUp: fact.caughtUp } : undefined;
+        case 'poll_end':
+            return { kind: 'poll_end' };
+        default:
+            return undefined;
+    }
+}
+/**
+ * Read one `qoder_side` note against the reassembly buffer. A `{fact}` note (or a chunk with index 0)
+ * abandons any half-read chunked fact — a reader that restarted re-reads from the start, so the
+ * fact comes again. `malformed` when the note could not be used (shape, order, or JSON).
+ */
+export function readSideNote(buffer, note) {
+    if (Object.hasOwn(note, 'fact')) {
+        const fact = parseSideFact(note.fact);
+        return fact ? { buffer: null, fact, malformed: false } : { buffer: null, malformed: true };
+    }
+    const chunk = object(note.chunk);
+    const { index, count, text } = chunk;
+    if (note.chunk !== chunk || !Number.isSafeInteger(index) || !Number.isSafeInteger(count) || typeof text !== 'string'
+        || count < 2 || count > MAX_SIDE_CHUNKS || index < 0 || index >= count) {
+        return { buffer, malformed: true };
+    }
+    let next;
+    if (index === 0)
+        next = { count: count, next: 1, text };
+    else if (buffer && buffer.count === count && buffer.next === index)
+        next = { count: buffer.count, next: buffer.next + 1, text: buffer.text + text };
+    else
+        return { buffer: null, malformed: true };
+    if (next.next < next.count)
+        return { buffer: next, malformed: false };
+    let parsed;
+    try {
+        parsed = JSON.parse(next.text);
+    }
+    catch {
+        return { buffer: null, malformed: true };
+    }
+    const fact = parseSideFact(parsed);
+    return fact ? { buffer: null, fact, malformed: false } : { buffer: null, malformed: true };
+}

package/dist/workstation/qoderAdapter/callbackContext.js

@@ -0,0 +1,76 @@
+/** A permission card whose tool call carries the SDK adapter's callback metadata. */
+export function isSdkCallbackCard(toolCall) {
+    const meta = toolCall && typeof toolCall === 'object' && !Array.isArray(toolCall)
+        ? toolCall._meta : undefined;
+    return !!meta && typeof meta === 'object' && !Array.isArray(meta) &&
+        Object.prototype.hasOwnProperty.call(meta, 'qoderSdk');
+}
+/**
+ * The callback snapshot's `connectionGeneration` on the processor path: one ACP session per adapter
+ * process, so it derives from the keeper's `spawnId` (spec §5.4), distinct from `hostGeneration`
+ * (= the `spawnId` itself).
+ */
+export function connectionGenerationOf(spawnId) {
+    return `session:${spawnId}`;
+}
+/** `AcpSession.callbackContextFor`, as a pure function. `undefined` = the card cannot carry a callback. */
+export function permissionCallbackContext(input) {
+    const { rootSessionId, diagnostics, requestId, toolCall, pendingRpcRequestId } = input;
+    if (input.origin !== rootSessionId)
+        return;
+    const profile = diagnostics.profile;
+    const callbacks = diagnostics.callbacks;
+    if (!diagnostics.available || profile?.mode !== 'sdk-adapter' || profile.initialized !== true ||
+        profile.rootConfirmed !== true || profile.rootSessionId !== rootSessionId ||
+        !profile.runtimeGeneration || callbacks?.complete !== true ||
+        callbacks.rootSessionId !== rootSessionId ||
+        typeof requestId !== 'string' || pendingRpcRequestId === undefined ||
+        !toolCall || typeof toolCall !== 'object' || Array.isArray(toolCall))
+        return;
+    const call = toolCall;
+    const sdkMeta = call._meta && typeof call._meta === 'object' && !Array.isArray(call._meta)
+        ? call._meta.qoderSdk : undefined;
+    if (!sdkMeta || typeof sdkMeta !== 'object' || Array.isArray(sdkMeta))
+        return;
+    const sdk = sdkMeta;
+    const origin = sdk.origin;
+    if (sdk.version !== 1 || sdk.blockingScope !== 'root' || sdk.callbackOnly !== true ||
+        typeof sdk.requestId !== 'string' || !/^[0-9a-f-]{36}$/i.test(sdk.requestId) ||
+        !origin || typeof origin !== 'object' || Array.isArray(origin))
+        return;
+    const source = origin;
+    const toolUseId = call.toolCallId;
+    const agentId = source.agentId;
+    if (source.rootSessionId !== rootSessionId || source.runtimeGeneration !== profile.runtimeGeneration ||
+        typeof toolUseId !== 'string' || source.toolUseId !== toolUseId ||
+        !toolUseId || utf8Length(toolUseId) > 256 ||
+        (agentId !== undefined && (typeof agentId !== 'string' || !agentId || utf8Length(agentId) > 256)))
+        return;
+    const pending = callbacks.pending.find((entry) => entry.requestId === requestId &&
+        entry.originNativeSessionId === rootSessionId);
+    if (!pending || callbacks.pending.length > 64 || pendingRpcRequestId !== pending.rpcRequestId)
+        return;
+    return { rootSessionId, hostGeneration: diagnostics.generation,
+        connectionGeneration: callbacks.connectionGeneration, requestId,
+        runtimeGeneration: profile.runtimeGeneration, toolUseId,
+        ...(agentId ? { agentId } : {}), independent: false };
+}
+/** `Buffer.byteLength(text, 'utf8')` in plain JS (a lone surrogate is 3 bytes). */
+function utf8Length(text) {
+    let bytes = 0;
+    for (let index = 0; index < text.length; index += 1) {
+        const code = text.charCodeAt(index);
+        if (code < 0x80)
+            bytes += 1;
+        else if (code < 0x800)
+            bytes += 2;
+        else if (code >= 0xd800 && code <= 0xdbff && index + 1 < text.length
+            && text.charCodeAt(index + 1) >= 0xdc00 && text.charCodeAt(index + 1) <= 0xdfff) {
+            bytes += 4;
+            index += 1;
+        }
+        else
+            bytes += 3;
+    }
+    return bytes;
+}

package/dist/workstation/qoderAdapter/foregroundOutput.js

@@ -4,27 +4,33 @@ export function certifiedRuntime(identity) {
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
+export function newForegroundOutputData() {
+    return { pending: {} };
+}
 export class ForegroundOutputBoundary {
     nativeSessionId;
-    pending = new Set();
-    constructor(nativeSessionId) {
+    data;
+    constructor(nativeSessionId, data = newForegroundOutputData()) {
         this.nativeSessionId = nativeSessionId;
+        this.data = data;
     }
     accept(event) {
         if (event.acpSessionId && event.acpSessionId !== this.nativeSessionId)
             return true;
-        const p = event.payload, input = record(p.rawInput);
+        const p = event.payload, input = record(p.rawInput), pending = this.data.pending;
         if (event.eventName === 'tool_call' && p.kind === 'think' && record(record(p._meta).qoder).toolName === 'Agent' &&
             typeof p.toolCallId === 'string' && typeof input.prompt === 'string' &&
-            (input.run_in_background === undefined || input.run_in_background === false))
-            this.pending.add(p.toolCallId);
+            (input.run_in_background === undefined || input.run_in_background === false)) {
+            Object.defineProperty(pending, p.toolCallId, { value: true, enumerable: true, writable: true, configurable: true });
+        }
         if (event.eventName === 'tool_call_update' && typeof p.toolCallId === 'string' &&
-            ['completed', 'failed', 'cancelled'].includes(String(p.status)))
-            this.pending.delete(p.toolCallId);
+            ['completed', 'failed', 'cancelled'].includes(String(p.status)) && Object.hasOwn(pending, p.toolCallId))
+            delete pending[p.toolCallId];
         // Identified/draft child streams and controls keep their existing handling. Never assign an
         // unaddressed chunk to whichever child happens to finish first.
-        return !this.pending.size || !['agent_message_chunk', 'agent_thought_chunk'].includes(event.eventName) ||
+        return Object.keys(pending).length === 0 || !['agent_message_chunk', 'agent_thought_chunk'].includes(event.eventName) ||
             typeof p.messageId === 'string' || p._meta != null;
     }
-    endTurn() { this.pending.clear(); }
+    endTurn() { for (const id of Object.keys(this.data.pending))
+        delete this.data.pending[id]; }
 }

package/dist/workstation/qoderAdapter/history.js

@@ -1,4 +1,3 @@
-import { getSubagentMessages, listSubagents } from '@qoder-ai/qoder-agent-sdk';
 const DEFAULT_LIMIT = 50;
 const MAX_LIMIT = 200;
 const MAX_OFFSET = 100_000;
@@ -7,7 +6,6 @@ const DEFAULT_TIMEOUT_MS = 5_000;
 const MAX_TIMEOUT_MS = 30_000;
 const DEFAULT_MAX_BYTES = 4 * 1024 * 1024;
 const MAX_BYTES = 8 * 1024 * 1024;
-const sdkReader = { listSubagents, getSubagentMessages };
 const safeIdentity = (value) => typeof value === 'string' &&
     value.length > 0 && value.length <= 256 && !/[\x00-\x1f\x7f\\/]/.test(value) &&
     /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(value);
@@ -43,7 +41,7 @@ function normalizeMessage(rootSessionId, agentId, message) {
  * `offset` is a page offset, never a durable tail cursor. The SDK may read the full
  * transcript before applying it; maxBytes bounds returned data, not bytes read on disk.
  */
-export async function readChildHistory(rootSessionId, agentId, page, reader = sdkReader) {
+export async function readChildHistory(rootSessionId, agentId, page, reader) {
     const offset = page?.offset ?? 0;
     const limit = page?.limit ?? DEFAULT_LIMIT;
     const timeoutMs = page?.timeoutMs ?? DEFAULT_TIMEOUT_MS;

package/dist/workstation/qoderAdapter/main.js

@@ -4,6 +4,7 @@ import { mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { loadSdkDriver } from './sdkDriver.js';
+import { loadPreparedSdkRuntime } from './sdkRuntime.js';
 import { QoderAdapterSession } from './session.js';
 import { supportsQoderSdkSteering } from './sdkDriver.js';
 const stopRequest = (value) => {
@@ -79,9 +80,10 @@ export function createQoderAgent(options) {
     return { app, close };
 }
 export async function runQoderAdapter(executable) {
-    const driver = await loadSdkDriver(executable);
+    const { sdk } = await loadPreparedSdkRuntime();
+    const driver = await loadSdkDriver(executable, sdk);
     const runDir = await mkdtemp(join(tmpdir(), 'axom-qoder-acp-'));
-    const server = createQoderAgent({ driver, runDir });
+    const server = createQoderAgent({ driver, runDir, historyReader: sdk });
     try {
         const connection = server.app.connect(ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin)));
         await connection.closed;

package/dist/workstation/qoderAdapter/sdkDriver.js

@@ -14,7 +14,7 @@ export const QODER_SDK_STEERING_CLI_VERSIONS = ['1.1.61', '1.1.64'];
 export function supportsQoderSdkSteering(cliVersion) {
     return QODER_SDK_STEERING_CLI_VERSIONS.includes(cliVersion);
 }
-export async function loadSdkDriver(executable, queryFactory) {
+export async function loadSdkDriver(executable, sdk, queryFactory) {
     if (!isAbsolute(executable))
         throw new Error('Qoder executable must be an absolute local path');
     let selected;
@@ -36,7 +36,6 @@ export async function loadSdkDriver(executable, queryFactory) {
     }
     if (!supportsQoderSdkSteering(version))
         throw new Error(`Qoder executable must report a supported version (${QODER_SDK_STEERING_CLI_VERSIONS.join(' or ')})`);
-    const sdk = await import('@qoder-ai/qoder-agent-sdk');
     return { executable: selected, sdkVersion: '1.0.50', cliVersion: version,
         create: ({ prompt, options }) => (queryFactory ?? sdk.query)({ prompt, options: {
                 cwd: options.cwd, sessionId: options.sessionId, plugins: options.plugins,

package/dist/workstation/qoderAdapter/sdkRuntime.js

@@ -0,0 +1,93 @@
+import { createHash } from 'node:crypto';
+import { readFile, realpath, lstat } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { clientDir } from '../config.js';
+export const QODER_SDK_VERSION = '1.0.50';
+export const QODER_SDK_PACKAGE = '@qoder-ai/qoder-agent-sdk';
+export const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+export async function sdkRecipe(options = {}) {
+    const directory = options.recipeDir ?? fileURLToPath(new URL(import.meta.url.endsWith('.ts') ? '../../../runtime-deps/qoder-sdk/' : '../../runtime-deps/qoder-sdk/', import.meta.url));
+    const [manifest, lock] = await Promise.all(['package.json', 'package-lock.json'].map(file => readFile(join(directory, file))));
+    const pkg = JSON.parse(manifest.toString());
+    const parsed = JSON.parse(lock.toString());
+    if (pkg.dependencies?.[QODER_SDK_PACKAGE] !== QODER_SDK_VERSION ||
+        parsed.packages?.['']?.dependencies?.[QODER_SDK_PACKAGE] !== QODER_SDK_VERSION ||
+        parsed.packages?.[`node_modules/${QODER_SDK_PACKAGE}`]?.version !== QODER_SDK_VERSION)
+        throw new Error('Invalid bundled Qoder SDK recipe');
+    const digest = sha256(Buffer.concat([Buffer.from('axom-qoder-sdk-v1\0'), manifest, Buffer.from('\0'), lock]));
+    return { manifest, lock, digest, packages: parsed.packages,
+        root: resolve(options.configDir ?? clientDir(), 'acp-adapters', 'qoder-sdk', digest, `${process.platform}-${process.arch}-node${process.versions.node.split('.')[0]}`) };
+}
+function inside(root, file) {
+    const rel = relative(root, file);
+    return rel !== '' && rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+/** Validate the selected instance, never a package found in an ancestor or global prefix. */
+export async function validateSdkInstance(instance, recipe) {
+    const canonical = await realpath(instance);
+    if (!(await lstat(instance)).isDirectory())
+        throw new Error('SDK instance must not be a symlink');
+    for (const [file, bytes] of [['package.json', recipe.manifest], ['package-lock.json', recipe.lock]]) {
+        if (!(await readFile(join(instance, file))).equals(bytes))
+            throw new Error(`SDK ${file} does not match recipe`);
+    }
+    for (const [key, metadata] of Object.entries(recipe.packages)) {
+        if (key === '')
+            continue;
+        if (!key.startsWith('node_modules/') || key.split('/').includes('..') || metadata.link)
+            throw new Error('Invalid SDK lockfile package path');
+        const directory = join(instance, key);
+        let actual;
+        try {
+            if (!inside(canonical, await realpath(directory)))
+                throw new Error('SDK dependency escapes its instance');
+            actual = JSON.parse(await readFile(join(directory, 'package.json'), 'utf8'));
+        }
+        catch (error) {
+            if (metadata.optional && error.code === 'ENOENT')
+                continue;
+            throw error;
+        }
+        const name = key.slice(key.lastIndexOf('node_modules/') + 'node_modules/'.length);
+        if (actual.name !== name || actual.version !== metadata.version)
+            throw new Error(`SDK dependency mismatch: ${name}`);
+    }
+    const require = createRequire(join(instance, 'package.json'));
+    const entry = await realpath(require.resolve(QODER_SDK_PACKAGE));
+    if (!inside(join(canonical, 'node_modules', QODER_SDK_PACKAGE), entry))
+        throw new Error('SDK entry escapes its package');
+    return { entry, entrySha256: sha256(await readFile(entry)) };
+}
+export function assertSdkApi(sdk) {
+    const api = sdk;
+    if (!api || ['query', 'qodercliAuth', 'listSubagents', 'getSubagentMessages'].some(key => typeof api[key] !== 'function') || !api.ProcessTransport?.default)
+        throw new Error('Prepared Qoder SDK is missing required APIs');
+}
+export async function readPreparedSdkRuntime(options = {}) {
+    const recipe = await sdkRecipe(options);
+    const pointer = JSON.parse(await readFile(join(recipe.root, 'current.json'), 'utf8'));
+    if (pointer.digest !== recipe.digest || !/^[a-f0-9-]{36}$/.test(pointer.installationId ?? ''))
+        throw new Error('Invalid SDK installation pointer');
+    const instance = join(recipe.root, 'instances', pointer.installationId);
+    const receipt = JSON.parse(await readFile(join(instance, 'receipt.json'), 'utf8'));
+    const validated = await validateSdkInstance(instance, recipe);
+    if (receipt.schema !== 1 || receipt.digest !== recipe.digest || receipt.version !== QODER_SDK_VERSION ||
+        receipt.installationId !== pointer.installationId || receipt.entrySha256 !== validated.entrySha256 ||
+        receipt.lockSha256 !== sha256(recipe.lock))
+        throw new Error('Prepared SDK receipt does not match installation');
+    return { instance, ...validated };
+}
+/** Read-only: ACP serving must never install dependencies or fall back to the developer SDK. */
+export async function loadPreparedSdkRuntime(options = {}) {
+    try {
+        const prepared = await readPreparedSdkRuntime(options);
+        const sdk = await import(pathToFileURL(prepared.entry).href);
+        assertSdkApi(sdk);
+        return { ...prepared, sdk };
+    }
+    catch (cause) {
+        throw new Error(`Qoder SDK is not prepared or is damaged. Run axom qoder-acp --prepare-sdk as the same user with AXOM_WORKSTATION_CONFIG_DIR=${options.configDir ?? clientDir()}`, { cause });
+    }
+}