@sayknow-cli/coding-agent 0.4.7 → 0.5.1

package/src/runtime-mcp/transports/http.ts

@@ -16,6 +16,15 @@ import type {
 	MCPTransport,
 } from "../../runtime-mcp/types";
 import { MCPExpectedFailure, toJsonRpcError } from "../../runtime-mcp/types";
+import {
+	cancelMCPStream,
+	MCP_MAX_CONTENT_BYTES,
+	MCP_MAX_ERROR_BYTES,
+	MCP_MAX_SSE_BATCH_MESSAGES,
+	MCP_MAX_SSE_REQUEST_MESSAGES,
+	readMCPResponseText,
+} from "../content-limits";
+import { fetchPluginMcpRequest, isPluginMcpPublicNetworkBound } from "../plugin-network-boundary";
 
 /**
  * HTTP transport for MCP servers.
@@ -54,6 +63,12 @@ export class HttpTransport implements MCPTransport {
 		this.#connected = true;
 	}
 
+	#fetch(init: BunFetchRequestInit): Promise<Response> {
+		return isPluginMcpPublicNetworkBound(this.config)
+			? fetchPluginMcpRequest(this.config.url, init)
+			: fetch(this.config.url, init);
+	}
+
 	#trackReader(promise: Promise<void>, controller?: AbortController): void {
 		if (controller) this.#streamControllers.add(controller);
 		this.#streamReaders.add(promise);
@@ -73,6 +88,9 @@ export class HttpTransport implements MCPTransport {
 		if (this.#sseConnection) return;
 
 		const sseConnection = new AbortController();
+		const headerController = new AbortController();
+		const headerTimeout = this.config.timeout ?? 30000;
+		const headerTimeoutId = setTimeout(() => headerController.abort(), headerTimeout);
 		this.#sseConnection = sseConnection;
 		const headers: Record<string, string> = {
 			Accept: "text/event-stream",
@@ -85,21 +103,25 @@ export class HttpTransport implements MCPTransport {
 
 		let response: Response;
 		try {
-			response = await fetch(this.config.url, {
+			response = await this.#fetch({
 				method: "GET",
 				headers,
-				signal: sseConnection.signal,
+				signal: AbortSignal.any([sseConnection.signal, headerController.signal]),
 			});
 		} catch (error) {
 			this.#sseConnection = this.#sseConnection === sseConnection ? null : this.#sseConnection;
-			if (error instanceof Error && error.name !== "AbortError") {
+			if (headerController.signal.aborted && !sseConnection.signal.aborted) {
+				this.onError?.(new Error(`SSE connection timeout after ${headerTimeout}ms`));
+			} else if (error instanceof Error && error.name !== "AbortError") {
 				this.onError?.(error);
 			}
 			return;
+		} finally {
+			clearTimeout(headerTimeoutId);
 		}
 
 		if (response.status === 405 || !response.ok || !response.body) {
-			await response.body?.cancel().catch(() => {});
+			cancelMCPStream(response.body);
 			this.#sseConnection = this.#sseConnection === sseConnection ? null : this.#sseConnection;
 			return;
 		}
@@ -117,8 +139,13 @@ export class HttpTransport implements MCPTransport {
 	}
 	async #readSSEStream(body: ReadableStream<Uint8Array>, signal: AbortSignal): Promise<void> {
 		try {
-			for await (const message of readSseJson<JsonRpcMessage>(body, signal)) {
+			for await (const message of readSseJson<JsonRpcMessage>(body, signal, undefined, {
+				maxEventBytes: MCP_MAX_CONTENT_BYTES,
+			})) {
 				if (!this.#connected) break;
+				if (Array.isArray(message) && message.length > MCP_MAX_SSE_BATCH_MESSAGES) {
+					throw new Error("MCP SSE batch exceeds message limit");
+				}
 				this.#dispatchSSEMessage(message);
 			}
 		} catch (error) {
@@ -207,7 +234,7 @@ export class HttpTransport implements MCPTransport {
 			: abortController.signal;
 
 		try {
-			const response = await fetch(this.config.url, {
+			const response = await this.#fetch({
 				method: "POST",
 				headers,
 				body: JSON.stringify(body),
@@ -221,7 +248,7 @@ export class HttpTransport implements MCPTransport {
 			}
 
 			if (!response.ok) {
-				const text = await response.text();
+				const text = await readMCPResponseText(response, MCP_MAX_ERROR_BYTES, true, operationSignal);
 				const wwwAuthenticate = response.headers.get("WWW-Authenticate");
 				const mcpAuthServer = response.headers.get("Mcp-Auth-Server");
 				const authHints = [
@@ -245,7 +272,9 @@ export class HttpTransport implements MCPTransport {
 			if (!response.body) {
 				throw new MCPExpectedFailure();
 			}
-			const parsedResult = await response.json();
+			const parsedResult = JSON.parse(
+				await readMCPResponseText(response, MCP_MAX_CONTENT_BYTES, false, operationSignal),
+			) as unknown;
 
 			if (
 				typeof parsedResult !== "object" ||
@@ -293,6 +322,7 @@ export class HttpTransport implements MCPTransport {
 
 		const { promise, resolve, reject } = Promise.withResolvers<T>();
 		let captured = false;
+		let messageCount = 0;
 
 		// Drain this per-request SSE response from a single iterator. Once the
 		// matching response arrives, resolve/reject and abort the reader so the
@@ -304,8 +334,20 @@ export class HttpTransport implements MCPTransport {
 		this.#streamControllers.add(drainController);
 		const drain = async (): Promise<void> => {
 			try {
-				for await (const raw of readSseJson<JsonRpcMessage | JsonRpcMessage[]>(response.body!, operationSignal)) {
+				for await (const raw of readSseJson<JsonRpcMessage | JsonRpcMessage[]>(
+					response.body!,
+					operationSignal,
+					undefined,
+					{
+						maxEventBytes: MCP_MAX_CONTENT_BYTES,
+						maxTotalBytes: MCP_MAX_CONTENT_BYTES,
+					},
+				)) {
 					const messages = Array.isArray(raw) ? raw : [raw];
+					if (messages.length > MCP_MAX_SSE_BATCH_MESSAGES) throw new Error("MCP SSE batch exceeds message limit");
+					messageCount += messages.length;
+					if (messageCount > MCP_MAX_SSE_REQUEST_MESSAGES)
+						throw new Error("MCP SSE response exceeds message limit");
 					for (const message of messages) {
 						if (
 							!captured &&
@@ -352,7 +394,7 @@ export class HttpTransport implements MCPTransport {
 			} finally {
 				clearTimeout(timeoutId);
 				this.#streamControllers.delete(drainController);
-				await response.body?.cancel().catch(() => {});
+				cancelMCPStream(response.body);
 			}
 		};
 
@@ -388,7 +430,7 @@ export class HttpTransport implements MCPTransport {
 			headers["Mcp-Session-Id"] = this.#sessionId;
 		}
 		try {
-			const resp = await fetch(this.config.url, {
+			const resp = await this.#fetch({
 				method: "POST",
 				headers,
 				body: JSON.stringify(body),
@@ -396,23 +438,23 @@ export class HttpTransport implements MCPTransport {
 			});
 			// Retry once on auth failure if onAuthError is wired
 			if (this.onAuthError && (resp.status === 401 || resp.status === 403)) {
-				await resp.body?.cancel();
+				cancelMCPStream(resp.body);
 				const newHeaders = await this.onAuthError();
 				if (newHeaders) {
 					this.config.headers ??= {};
 					Object.assign(this.config.headers, newHeaders);
 					Object.assign(headers, newHeaders);
-					const retry = await fetch(this.config.url, {
+					const retry = await this.#fetch({
 						method: "POST",
 						headers,
 						body: JSON.stringify(body),
 						signal: AbortSignal.timeout(this.config.timeout ?? 30000),
 					});
-					await retry.body?.cancel();
+					cancelMCPStream(retry.body);
 					return;
 				}
 			}
-			await resp.body?.cancel();
+			cancelMCPStream(resp.body);
 		} catch {
 			// Best-effort response delivery — server may have disconnected
 		}
@@ -445,18 +487,16 @@ export class HttpTransport implements MCPTransport {
 		const timeoutId = setTimeout(() => abortController.abort(), timeout);
 
 		try {
-			const response = await fetch(this.config.url, {
+			const response = await this.#fetch({
 				method: "POST",
 				headers,
 				body: JSON.stringify(body),
 				signal: abortController.signal,
 			});
 
-			clearTimeout(timeoutId);
-
 			// 202 Accepted is success for notifications
 			if (!response.ok && response.status !== 202) {
-				const text = await response.text();
+				const text = await readMCPResponseText(response, MCP_MAX_ERROR_BYTES, true, abortController.signal);
 				throw new Error(`HTTP ${response.status}: ${text}`);
 			}
 
@@ -472,14 +512,15 @@ export class HttpTransport implements MCPTransport {
 				const reader = this.#readSSEStream(response.body, AbortSignal.any(signals));
 				this.#trackReader(reader, streamController);
 			} else {
-				await response.body?.cancel();
+				cancelMCPStream(response.body);
 			}
 		} catch (error) {
-			clearTimeout(timeoutId);
 			if (error instanceof Error && error.name === "AbortError") {
 				throw new MCPExpectedFailure(new Error(`Notify timeout after ${timeout}ms`));
 			}
 			throw error instanceof MCPExpectedFailure ? error : new MCPExpectedFailure(error);
+		} finally {
+			clearTimeout(timeoutId);
 		}
 	}
 
@@ -508,7 +549,7 @@ export class HttpTransport implements MCPTransport {
 					"Mcp-Session-Id": this.#sessionId,
 				};
 
-				await fetch(this.config.url, {
+				await this.#fetch({
 					method: "DELETE",
 					headers,
 					signal: AbortSignal.timeout(timeout),

package/src/sdk/acp/adapter.ts

@@ -179,7 +179,14 @@ export class AcpSdkAdapter {
 		this.#assertGenericDisposition("global", operation);
 		if (isLifecycleOperation(operation) && !idempotencyKey)
 			throw new AcpSdkAdapterError("invalid_input", "idempotencyKey is required for lifecycle operations.");
-		return await this.#client.global(operation, input, { idempotencyKey });
+		const readinessTimeoutMs =
+			typeof input.readinessTimeoutMs === "number" && Number.isSafeInteger(input.readinessTimeoutMs)
+				? input.readinessTimeoutMs
+				: undefined;
+		return await this.#client.global(operation, input, {
+			idempotencyKey,
+			...(readinessTimeoutMs ? { timeoutMs: readinessTimeoutMs + 1_000 } : {}),
+		});
 	}
 
 	async sdkControl(params: { operation: string; input?: JsonObject }): Promise<unknown> {

package/src/sdk/acp/final-text.ts

@@ -0,0 +1,40 @@
+export const ACP_FINAL_TEXT_LIMIT = 100_000;
+
+export interface BoundedAcpFinalText {
+	text: string;
+	truncated: boolean;
+}
+
+export type AcpFinalTextResolution =
+	| { kind: "none"; final: BoundedAcpFinalText }
+	| { kind: "emit"; final: BoundedAcpFinalText; text: string }
+	| { kind: "divergent"; final: BoundedAcpFinalText };
+
+export function boundAcpFinalText(value: string): BoundedAcpFinalText {
+	if (value.length <= ACP_FINAL_TEXT_LIMIT) return { text: value, truncated: false };
+	let text = value.slice(0, ACP_FINAL_TEXT_LIMIT);
+	const finalCodeUnit = text.charCodeAt(text.length - 1);
+	if (finalCodeUnit >= 0xd800 && finalCodeUnit <= 0xdbff) text = text.slice(0, -1);
+	return { text, truncated: true };
+}
+
+export function acpFinalTextFromMessage(message: unknown): BoundedAcpFinalText {
+	const content = (message as { content?: unknown } | null | undefined)?.content;
+	if (typeof content === "string") return boundAcpFinalText(content);
+	if (!Array.isArray(content)) return { text: "", truncated: false };
+	const parts: string[] = [];
+	for (const block of content) {
+		if (!block || typeof block !== "object" || (block as { type?: unknown }).type !== "text") continue;
+		const text = (block as { text?: unknown }).text;
+		if (typeof text === "string") parts.push(text);
+	}
+	return boundAcpFinalText(parts.join(""));
+}
+
+export function resolveAcpFinalText(streamed: string, finalText: string): AcpFinalTextResolution {
+	const final = boundAcpFinalText(finalText);
+	if (!final.text || streamed === final.text || streamed.includes(final.text)) return { kind: "none", final };
+	if (!streamed) return { kind: "emit", final, text: final.text };
+	if (final.text.startsWith(streamed)) return { kind: "emit", final, text: final.text.slice(streamed.length) };
+	return { kind: "divergent", final };
+}

package/src/sdk/acp/mcp.ts

@@ -0,0 +1,26 @@
+export const ACP_MCP_REQUEST_TIMEOUT_MS = 30_000;
+export const ACP_MCP_LIFECYCLE_TIMEOUT_MS = ACP_MCP_REQUEST_TIMEOUT_MS + 500;
+/**
+ * Slice of the readiness budget reserved for the work that follows MCP startup
+ * (session wiring, marker publication). The ACP MCP startup ceiling is the
+ * remaining time to `semanticReadyDeadlineAt` minus this headroom, so a slow
+ * MCP handshake cannot consume the whole readiness window.
+ */
+export const ACP_MCP_STARTUP_HEADROOM_MS = 250;
+
+export interface SessionLifecycleMcpStdioServer {
+	type?: "stdio";
+	name: string;
+	command: string;
+	args: string[];
+	env?: Record<string, string>;
+}
+
+export interface SessionLifecycleMcpRemoteServer {
+	type: "http" | "sse";
+	name: string;
+	url: string;
+	headers?: Record<string, string>;
+}
+
+export type SessionLifecycleMcpServer = SessionLifecycleMcpStdioServer | SessionLifecycleMcpRemoteServer;

package/src/sdk/broker/broker.ts

@@ -1,7 +1,9 @@
 import { createHash, randomBytes } from "node:crypto";
+import type { BigIntStats } from "node:fs";
 import * as fs from "node:fs/promises";
 import path from "node:path";
 import type { NativeDirectoryTreeSnapshot } from "@sayknow-cli/natives";
+import type { ModelProfileErrorDetails } from "../../config/model-profile-contract";
 import {
 	type DirectoryMigrationPolicy,
 	listManagedSessionCandidates,
@@ -141,6 +143,7 @@ export type BrokerResponse =
 			error: {
 				code: BrokerErrorCode;
 				message: string;
+				details?: ModelProfileErrorDetails;
 				endpoint?: "unavailable";
 				cleanup?: BrokerCleanupEvidence;
 			};
@@ -362,6 +365,7 @@ type BrokerLockSnapshot = {
 	ownerId?: string;
 	pid: number;
 	identity: string;
+	lockIdentity: string;
 };
 
 const BROKER_PUBLICATION_CADENCE_MS = 5_000;
@@ -415,7 +419,7 @@ export class Broker {
 	#lockRecordPath(): string {
 		return path.join(this.#lock, BROKER_LOCK_RECORD);
 	}
-	#lockSnapshot(raw: string): BrokerLockSnapshot {
+	async #lockSnapshot(raw: string, lockIdentity: string): Promise<BrokerLockSnapshot> {
 		try {
 			const lock = JSON.parse(raw) as { ownerId?: unknown; pid?: unknown };
 			if (
@@ -425,32 +429,37 @@ export class Broker {
 				Number.isInteger(lock.pid) &&
 				lock.pid > 0
 			)
-				return { ownerId: lock.ownerId, pid: lock.pid, identity: `owner:${lock.ownerId}` };
+				return { ownerId: lock.ownerId, pid: lock.pid, identity: `owner:${lock.ownerId}`, lockIdentity };
 		} catch {}
-		return { pid: 0, identity: `contents:${createHash("sha256").update(raw).digest("hex")}` };
+		return { pid: 0, identity: `contents:${createHash("sha256").update(raw).digest("hex")}`, lockIdentity };
 	}
 	async #readLock(): Promise<BrokerLockSnapshot | null> {
+		let lock: BigIntStats;
 		try {
-			return this.#lockSnapshot(await fs.readFile(this.#lockRecordPath(), "utf8"));
+			lock = await fs.lstat(this.#lock, { bigint: true });
 		} catch (e) {
-			const code = (e as NodeJS.ErrnoException).code;
-			if (code === "ENOTDIR") {
-				try {
-					return this.#lockSnapshot(await fs.readFile(this.#lock, "utf8"));
-				} catch (legacyError) {
-					if ((legacyError as NodeJS.ErrnoException).code === "ENOENT") return null;
-					throw legacyError;
-				}
-			}
-			if (code !== "ENOENT") throw e;
+			if ((e as NodeJS.ErrnoException).code === "ENOENT") return null;
+			throw e;
 		}
+		const lockIdentity = `${lock.dev}:${lock.ino}`;
+		let raw: string;
 		try {
-			const lock = await fs.stat(this.#lock);
-			return lock.isDirectory() ? { pid: 0, identity: `directory:${lock.dev}:${lock.ino}` } : null;
+			raw = lock.isDirectory()
+				? await fs.readFile(path.join(this.#lock, BROKER_LOCK_RECORD), "utf8")
+				: await fs.readFile(this.#lock, "utf8");
+		} catch (e) {
+			if ((e as NodeJS.ErrnoException).code !== "ENOENT") throw e;
+			raw = "";
+		}
+		try {
+			const current = await fs.lstat(this.#lock, { bigint: true });
+			if (`${current.dev}:${current.ino}` !== lockIdentity || current.isDirectory() !== lock.isDirectory())
+				return null;
 		} catch (e) {
 			if ((e as NodeJS.ErrnoException).code === "ENOENT") return null;
 			throw e;
 		}
+		return this.#lockSnapshot(raw, lockIdentity);
 	}
 	async #createLock(): Promise<void> {
 		await fs.mkdir(this.#lock, { mode: 0o700 });
@@ -478,13 +487,18 @@ export class Broker {
 	}
 	async #reclaimStaleLock(snapshot: BrokerLockSnapshot): Promise<void> {
 		const current = await this.#readLock();
-		if (!current || current.identity !== snapshot.identity || (current.pid > 0 && isPidAlive(current.pid))) return;
+		if (
+			!current ||
+			current.identity !== snapshot.identity ||
+			current.lockIdentity !== snapshot.lockIdentity ||
+			(current.pid > 0 && isPidAlive(current.pid))
+		)
+			return;
 
-		// Keep the tombstone: its immutable-owner-derived pathname prevents a contender
-		// holding an old snapshot from renaming a newly-created directory lock.
+		// Snapshot validation and the deterministic instance suffix protect successor locks.
 		const tombstone = path.join(
 			path.dirname(this.#lock),
-			`.broker.lock.stale-${createHash("sha256").update(snapshot.identity).digest("hex")}`,
+			`.broker.lock.stale-${createHash("sha256").update(snapshot.lockIdentity).digest("hex")}`,
 		);
 		try {
 			await fs.rename(this.#lock, tombstone);

package/src/sdk/broker/identity.ts

@@ -11,20 +11,30 @@ export function brokerIdentityPath(agentDir: string): string {
 export async function getBrokerIdentityKey(agentDir: string): Promise<string> {
 	const file = brokerIdentityPath(agentDir);
 	await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
-	try {
-		const key = (await fs.readFile(file, "utf8")).trim();
-		if (/^[0-9a-f]{64}$/i.test(key)) return key;
-		throw new Error(`Invalid broker identity key at ${file}`);
-	} catch (error) {
-		if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+	while (true) {
+		try {
+			const key = (await fs.readFile(file, "utf8")).trim();
+			if (/^[0-9a-f]{64}$/i.test(key)) return key;
+			throw new Error(`Invalid broker identity key at ${file}`);
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+		}
+
 		const key = randomBytes(32).toString("hex");
+		const temporary = path.join(path.dirname(file), `.broker.identity-${randomBytes(16).toString("hex")}`);
 		try {
-			await fs.writeFile(file, `${key}\n`, { encoding: "utf8", mode: MODE, flag: "wx" });
-			await fs.chmod(file, MODE);
-			return key;
-		} catch (writeError) {
-			if ((writeError as NodeJS.ErrnoException).code !== "EEXIST") throw writeError;
-			return getBrokerIdentityKey(agentDir);
+			await fs.writeFile(temporary, `${key}\n`, { encoding: "utf8", mode: MODE, flag: "wx" });
+			await fs.chmod(temporary, MODE);
+			try {
+				// Link publishes a fully written key without exposing a partial target.
+				// Same-directory hard-link support is required (standard on Linux, macOS, and Windows NTFS).
+				await fs.link(temporary, file);
+				return key;
+			} catch (linkError) {
+				if ((linkError as NodeJS.ErrnoException).code !== "EEXIST") throw linkError;
+			}
+		} finally {
+			await fs.rm(temporary, { force: true });
 		}
 	}
 }