@sweny-ai/core 0.1.148 → 0.1.149

package/dist/cli/config.js

@@ -1,14 +1,14 @@
 import { execSync } from "node:child_process";
 import * as fs from "node:fs";
 import { hasCodexLogin } from "../agent-env.js";
-import { unsupportedAgentError } from "../harness/agents.js";
+import { parseAcpAgent, unsupportedAgentError } from "../harness/agents.js";
 export function registerTriageCommand(program) {
     // NOTE: File-eligible options omit Commander defaults so parseCliInputs() can
     // distinguish "user passed flag" from "not passed" and fall through to .sweny.yml.
     return program
         .command("triage")
         .description("Run the SWEny triage workflow")
-        .option("--agent <provider>", "Coding agent: claude (default), codex, or pi (experimental)")
+        .option("--agent <provider>", "Coding agent: claude (default), codex, pi (experimental), or acp:<command> for any ACP agent (experimental)")
         .option("--coding-agent-provider <provider>", "Coding agent provider (alias for --agent)")
         .option("--observability-provider <provider>", "Observability provider (default: none)")
         .option("--issue-tracker-provider <provider>", "Issue tracker provider (default: github-issues)")
@@ -243,6 +243,9 @@ export function validateInputs(config) {
             // there is no single credential to check here; pi reports its own auth error.
             break;
         default:
+            // An ACP agent (`acp:<command>`, #416) brings its own auth; it says so itself when it is missing.
+            if (parseAcpAgent(config.codingAgentProvider) !== undefined)
+                break;
             // Honest --agent (#330): only agents with an adapter are accepted.
             // Anything else would silently run a different agent under that name.
             errors.push(unsupportedAgentError(config.codingAgentProvider));
@@ -662,7 +665,7 @@ export function registerImplementCommand(program) {
     return program
         .command("implement <issueId>")
         .description("Implement a fix for a specific issue and open a PR")
-        .option("--agent <provider>", "Coding agent: claude (default), codex, or pi (experimental)")
+        .option("--agent <provider>", "Coding agent: claude (default), codex, pi (experimental), or acp:<command> for any ACP agent (experimental)")
         .option("--coding-agent-provider <provider>", "Coding agent provider (alias for --agent)")
         .option("--issue-tracker-provider <provider>", "Issue tracker (linear|jira|github-issues|file)")
         .option("--source-control-provider <provider>", "Source control (github|gitlab|file)")

package/dist/harness/acp-rpc.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Newline-delimited JSON-RPC 2.0 over a child process's stdio: the ACP stdio
+ * transport (agentclientprotocol.com/protocol/v1/transports, schema v1.24.1).
+ *
+ * - The client launches the agent as a subprocess and writes one JSON-RPC
+ *   message per line to its stdin; the agent answers on stdout.
+ * - Messages MUST NOT contain embedded newlines (`JSON.stringify` never emits
+ *   one).
+ * - The agent MAY log on stderr. It MUST NOT write anything but ACP messages
+ *   to stdout; real agents sometimes do, so a stdout line that is not JSON is
+ *   logged and skipped instead of ending the run.
+ *
+ * Hand-rolled on purpose: the wire is four message shapes, so sweny takes no
+ * SDK dependency for it, and the contract fake speaks the raw wire, which means
+ * the suite checks the protocol itself and not an SDK's reading of it.
+ *
+ * No agent SDK imports.
+ */
+import type { ChildProcess } from "node:child_process";
+/** JSON-RPC / ACP error codes (schema `ErrorCode`). */
+export declare const RPC_ERROR: {
+    readonly parse: -32700;
+    readonly invalidRequest: -32600;
+    readonly methodNotFound: -32601;
+    readonly invalidParams: -32602;
+    readonly internal: -32603;
+    readonly requestCancelled: -32800;
+    readonly authRequired: -32000;
+    readonly resourceNotFound: -32002;
+};
+/** An error response from the peer (or a local failure reaching it). */
+export declare class RpcError extends Error {
+    readonly code: number;
+    readonly data?: unknown | undefined;
+    constructor(message: string, code: number, data?: unknown | undefined);
+}
+export interface RpcHandlers {
+    /** A request from the peer. Resolve with the `result`, or throw {@link RpcError} for an error response. */
+    onRequest(method: string, params: unknown): Promise<unknown>;
+    /** A notification from the peer. */
+    onNotification(method: string, params: unknown): void;
+    /** A stdout line that was not a JSON-RPC message (debug only). */
+    onJunk?(line: string): void;
+}
+/**
+ * One JSON-RPC connection. Requests from us are matched to responses by id;
+ * requests from the peer are answered through {@link RpcHandlers.onRequest}.
+ * When the peer goes away every pending request rejects.
+ */
+export declare class RpcPeer {
+    private readonly child;
+    private readonly handlers;
+    private nextId;
+    private pending;
+    private buf;
+    private ended;
+    constructor(child: Pick<ChildProcess, "stdin" | "stdout">, handlers: RpcHandlers);
+    private onData;
+    private onLine;
+    private answer;
+    private write;
+    /** Send a request and wait for its response. */
+    request<T = unknown>(method: string, params: unknown): Promise<T>;
+    /** Send a notification (no response). */
+    notify(method: string, params: unknown): void;
+    /** The peer is gone: reject everything still waiting. Idempotent. */
+    end(reason: string): void;
+}
+/**
+ * Split a command line into argv: whitespace separates words, single and
+ * double quotes group, backslash escapes the next character outside single
+ * quotes. No expansion of any kind (no globbing, no variables, no shell), so
+ * the string after `acp:` can never run anything but the program it names.
+ */
+export declare function splitCommandLine(input: string): string[];

package/dist/harness/acp-rpc.js

@@ -0,0 +1,204 @@
+/**
+ * Newline-delimited JSON-RPC 2.0 over a child process's stdio: the ACP stdio
+ * transport (agentclientprotocol.com/protocol/v1/transports, schema v1.24.1).
+ *
+ * - The client launches the agent as a subprocess and writes one JSON-RPC
+ *   message per line to its stdin; the agent answers on stdout.
+ * - Messages MUST NOT contain embedded newlines (`JSON.stringify` never emits
+ *   one).
+ * - The agent MAY log on stderr. It MUST NOT write anything but ACP messages
+ *   to stdout; real agents sometimes do, so a stdout line that is not JSON is
+ *   logged and skipped instead of ending the run.
+ *
+ * Hand-rolled on purpose: the wire is four message shapes, so sweny takes no
+ * SDK dependency for it, and the contract fake speaks the raw wire, which means
+ * the suite checks the protocol itself and not an SDK's reading of it.
+ *
+ * No agent SDK imports.
+ */
+/** JSON-RPC / ACP error codes (schema `ErrorCode`). */
+export const RPC_ERROR = {
+    parse: -32700,
+    invalidRequest: -32600,
+    methodNotFound: -32601,
+    invalidParams: -32602,
+    internal: -32603,
+    requestCancelled: -32800,
+    authRequired: -32000,
+    resourceNotFound: -32002,
+};
+/** An error response from the peer (or a local failure reaching it). */
+export class RpcError extends Error {
+    code;
+    data;
+    constructor(message, code, data) {
+        super(message);
+        this.code = code;
+        this.data = data;
+        this.name = "RpcError";
+    }
+}
+/**
+ * One JSON-RPC connection. Requests from us are matched to responses by id;
+ * requests from the peer are answered through {@link RpcHandlers.onRequest}.
+ * When the peer goes away every pending request rejects.
+ */
+export class RpcPeer {
+    child;
+    handlers;
+    nextId = 1;
+    pending = new Map();
+    buf = "";
+    ended;
+    constructor(child, handlers) {
+        this.child = child;
+        this.handlers = handlers;
+        child.stdout?.setEncoding("utf8");
+        child.stdout?.on("data", (chunk) => this.onData(chunk));
+        child.stdin?.on("error", () => {
+            // The agent exited before reading; the exit handling reports why.
+        });
+    }
+    onData(chunk) {
+        this.buf += chunk;
+        let nl;
+        while ((nl = this.buf.indexOf("\n")) !== -1) {
+            const line = this.buf.slice(0, nl);
+            this.buf = this.buf.slice(nl + 1);
+            this.onLine(line);
+        }
+    }
+    onLine(raw) {
+        const line = raw.trim();
+        if (!line)
+            return;
+        let msg;
+        try {
+            const parsed = JSON.parse(line);
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                throw new Error("not an object");
+            msg = parsed;
+        }
+        catch {
+            this.handlers.onJunk?.(line.length > 200 ? line.slice(0, 199) + "..." : line);
+            return;
+        }
+        const id = msg.id;
+        const hasId = typeof id === "number" || typeof id === "string";
+        if (typeof msg.method === "string") {
+            if (hasId)
+                void this.answer(id, msg.method, msg.params);
+            else
+                this.handlers.onNotification(msg.method, msg.params);
+            return;
+        }
+        if (!hasId)
+            return;
+        const p = this.pending.get(id);
+        if (!p)
+            return;
+        this.pending.delete(id);
+        const err = msg.error;
+        if (err && typeof err === "object") {
+            p.reject(new RpcError(typeof err.message === "string" ? err.message : `${p.method} failed`, typeof err.code === "number" ? err.code : RPC_ERROR.internal, err.data));
+        }
+        else {
+            p.resolve(msg.result);
+        }
+    }
+    async answer(id, method, params) {
+        try {
+            const result = await this.handlers.onRequest(method, params);
+            this.write({ jsonrpc: "2.0", id, result: result ?? null });
+        }
+        catch (err) {
+            const e = err instanceof RpcError
+                ? err
+                : new RpcError(err instanceof Error ? err.message : String(err), RPC_ERROR.internal);
+            this.write({ jsonrpc: "2.0", id, error: { code: e.code, message: e.message } });
+        }
+    }
+    write(msg) {
+        const stdin = this.child.stdin;
+        if (!stdin || stdin.destroyed || !stdin.writable)
+            return;
+        stdin.write(JSON.stringify(msg) + "\n");
+    }
+    /** Send a request and wait for its response. */
+    request(method, params) {
+        if (this.ended !== undefined)
+            return Promise.reject(new RpcError(this.ended, RPC_ERROR.internal));
+        const id = this.nextId++;
+        return new Promise((resolve, reject) => {
+            this.pending.set(id, { resolve: (v) => resolve(v), reject, method });
+            this.write({ jsonrpc: "2.0", id, method, params });
+        });
+    }
+    /** Send a notification (no response). */
+    notify(method, params) {
+        if (this.ended !== undefined)
+            return;
+        this.write({ jsonrpc: "2.0", method, params });
+    }
+    /** The peer is gone: reject everything still waiting. Idempotent. */
+    end(reason) {
+        if (this.ended !== undefined)
+            return;
+        this.ended = reason;
+        // A final line without a newline is complete only if it parses.
+        if (this.buf.trim())
+            this.onLine(this.buf);
+        this.buf = "";
+        const pending = [...this.pending.values()];
+        this.pending.clear();
+        for (const p of pending)
+            p.reject(new RpcError(reason, RPC_ERROR.internal));
+    }
+}
+/**
+ * Split a command line into argv: whitespace separates words, single and
+ * double quotes group, backslash escapes the next character outside single
+ * quotes. No expansion of any kind (no globbing, no variables, no shell), so
+ * the string after `acp:` can never run anything but the program it names.
+ */
+export function splitCommandLine(input) {
+    const out = [];
+    let cur = "";
+    let started = false;
+    let quote = null;
+    for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            else if (ch === "\\" && quote === '"' && i + 1 < input.length)
+                cur += input[++i];
+            else
+                cur += ch;
+        }
+        else if (ch === '"' || ch === "'") {
+            quote = ch;
+            started = true;
+        }
+        else if (ch === "\\" && i + 1 < input.length) {
+            cur += input[++i];
+            started = true;
+        }
+        else if (/\s/.test(ch)) {
+            if (started) {
+                out.push(cur);
+                cur = "";
+                started = false;
+            }
+        }
+        else {
+            cur += ch;
+            started = true;
+        }
+    }
+    if (quote)
+        throw new Error(`unterminated ${quote} quote in "${input}"`);
+    if (started)
+        out.push(cur);
+    return out;
+}

package/dist/harness/acp.d.ts

@@ -0,0 +1,189 @@
+/**
+ * ACP harness (#416): runs a node on any Agent Client Protocol agent
+ * (`--agent acp:<command>`, for example `acp:opencode acp`,
+ * `acp:hermes acp`, `acp:goose acp`, `acp:gemini --experimental-acp`).
+ *
+ * ACP is the long-tail adapter. It is JSON-RPC 2.0 over the agent's stdio and
+ * carries a prompt and a stream of updates; it does not carry sweny's
+ * opinions. Read from agentclientprotocol/agent-client-protocol at tag
+ * schema-v1.24.1 (`schema/v1/schema.json`, `docs/protocol/v1/*.mdx`):
+ * - transports: newline-delimited JSON over stdio (`transports.mdx`).
+ * - `initialize` negotiates `protocolVersion` (1) and capabilities
+ *   (`initialization.mdx`); `InitializeRequest` / `InitializeResponse`.
+ * - `session/new {cwd, mcpServers}` returns `{sessionId}`; every agent MUST
+ *   support stdio MCP servers, http and sse are optional
+ *   (`session-setup.mdx`, `McpServerStdio`, `McpServerHttp`).
+ * - `session/prompt {sessionId, prompt: ContentBlock[]}` streams
+ *   `session/update` notifications (`agent_message_chunk`, `tool_call`,
+ *   `tool_call_update`, `usage_update`, ...) and ends with
+ *   `{stopReason}`; `PromptResponse` has no other field (`prompt-turn.mdx`).
+ * - `session/cancel` (notification) ends a turn with stopReason `cancelled`
+ *   (`prompt-turn.mdx`, Cancellation); pending permission requests get the
+ *   `cancelled` outcome.
+ * - `session/request_permission {toolCall, options}` is how an agent MAY ask
+ *   before a tool runs; the client picks an option or answers `cancelled`
+ *   (`tool-calls.mdx`, `RequestPermissionResponse`).
+ * - `fs/read_text_file` and `fs/write_text_file` are client methods an agent
+ *   may use only when the client advertised them (`file-system.mdx`).
+ *
+ * Every sweny opinion is enforced by sweny here, refused or reported as
+ * `degraded` by `policyGate` (see ACP_CAPABILITIES for the honest list):
+ * - Structured output: the schema rides in the prompt; sweny parses the last
+ *   JSON object, checks it and asks once more before giving up.
+ * - Tool deny and read-only: best effort through `session/request_permission`
+ *   (denied classes and every non-read tool under `readOnly` are rejected),
+ *   plus a refusal of every `fs/write_text_file`. The protocol has no deny list
+ *   and an agent that does not ask is not stopped, so `policyGate` still
+ *   reports deny and read-only as unenforced; strict refuses the node unless
+ *   the process wrapper provides the read-only mount.
+ * - Sandbox and egress: none in the protocol. The whole agent process runs
+ *   inside the sandbox wrapper (sandbox-wrapper.ts); strict refuses without it.
+ * - Env: sweny spawns the agent with the scoped env (agent-env.ts).
+ * - Skill tools: passed in `session/new` as the stdio MCP server of the tool
+ *   bridge (#414), so the executor still observes every call.
+ * - Turn limit: a watchdog counts tool calls and cancels past the budget.
+ * - Timeout: `session/cancel`, a grace period, then the process is killed.
+ */
+import type { Logger, McpServerConfig, ToolContext } from "../types.js";
+import { type SandboxMode } from "../agent-env.js";
+import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessId, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
+import { ACP_CAPABILITIES } from "./capabilities.js";
+import { type HarnessPolicyMode } from "./policy.js";
+import { type SandboxWrapper } from "./sandbox-wrapper.js";
+export { ACP_CAPABILITIES };
+/** The ACP major version sweny speaks (`InitializeRequest.protocolVersion`). */
+export declare const ACP_PROTOCOL_VERSION = 1;
+export interface AcpHarnessOptions {
+    /**
+     * The agent to run: a command line (`"opencode acp"`, the part after `acp:`)
+     * or an explicit `{command, args}`. Never run through a shell.
+     */
+    acpCommand?: string | {
+        command: string;
+        args: string[];
+    };
+    /** Tool-call budget the watchdog enforces when a node sets no `max_turns` (default: 20). */
+    maxTurns?: number;
+    /** Working directory (default: process.cwd()). */
+    cwd?: string;
+    logger?: Logger;
+    /** Default tool context for standalone usage (not via the executor). */
+    defaultContext?: ToolContext;
+    /** Catalog defaults, overridden by per-run skill servers and explicit mcpServers. */
+    defaultMcpServers?: Record<string, McpServerConfig>;
+    /** Explicit external MCP servers, overriding defaults and per-run skill servers. */
+    mcpServers?: Record<string, McpServerConfig>;
+    /** Extra env var names passed through (see agent-env.ts). Default: `SWENY_ENV_PASSTHROUGH`. */
+    envPassthrough?: string[];
+    /** The agent's own auth env var names, always passed through when scoping (none are assumed). */
+    authVars?: string[];
+    /** Scope the agent env to the allowlist. Default: `SWENY_ENV_SCOPE`, else on in CI. */
+    envScope?: boolean;
+    /** Process sandbox mode. Default: `SWENY_SANDBOX`, else `auto` in CI and `off` locally. */
+    sandbox?: SandboxMode;
+    /** The host's process sandbox wrapper (#360 step 2). `undefined` = detect srt once per process; `null` = none (test seam). */
+    sandboxWrapper?: SandboxWrapper | null;
+    /** `strict` refuses a node with unenforceable opinions. Default: {@link resolveHarnessPolicy}. */
+    policy?: HarnessPolicyMode;
+    /** Hosts the agent itself needs (its model API), allowed through the sandbox wrapper. */
+    egress?: string[];
+    /** Shim command override for the tool bridge (test seam). */
+    toolBridgeShim?: {
+        command: string;
+        args: string[];
+    };
+    /** Grace period between SIGTERM and SIGKILL, and for the agent to exit on its own (default: 2000 ms). */
+    killGraceMs?: number;
+    /** How long the agent gets to answer `session/cancel` before it is killed (default: 5000 ms). */
+    cancelGraceMs?: number;
+    /** How long `initialize` and `session/new` may take (default: 60000 ms). */
+    startupTimeoutMs?: number;
+}
+/** Portable tool classes an ACP tool call can be, from its `kind` (schema `ToolKind`) and name. */
+export declare function classifyAcpTool(kind: string | null | undefined, name: string | null | undefined): {
+    classes: ToolClass[];
+    readOnlySafe: boolean;
+};
+/** Does this tool call name one of sweny's skill tools (they reach the agent as MCP tools of the tool bridge)? */
+export declare function isSkillToolCall(names: readonly (string | null | undefined)[], skillTools: readonly string[]): boolean;
+interface PermissionOption {
+    optionId: string;
+    kind: string;
+}
+/** The permission outcome for an option list: the first option of a wanted kind, else `cancelled`. */
+export declare function pickPermissionOutcome(options: readonly PermissionOption[], allow: boolean): {
+    outcome: "selected";
+    optionId: string;
+} | {
+    outcome: "cancelled";
+};
+/** A loosely typed JSON object, for reading what the agent sends. */
+type Obj = Record<string, any>;
+/** `McpServerConfig` map to the ACP `mcpServers` array (schema `McpServer`). Returns what the agent cannot load too. */
+export declare function toAcpMcpServers(servers: Record<string, McpServerConfig>, agentHttp: boolean): {
+    list: Obj[];
+    unsupported: string[];
+};
+export declare class AcpHarness implements AgentHarness {
+    readonly id: HarnessId;
+    readonly capabilities: HarnessCapabilities;
+    /** Empty on purpose: judges use the agent's own default model. */
+    readonly defaultJudgeModel = "";
+    readonly logger: Logger;
+    private agent;
+    private maxTurns;
+    private cwd;
+    private defaultContext;
+    private mcpServers;
+    private defaultMcpServers;
+    private envPassthrough;
+    private authVars;
+    private envScope;
+    private sandboxMode;
+    private sandboxWrapper;
+    private policyMode;
+    private egress;
+    private toolBridgeShim;
+    private killGraceMs;
+    private cancelGraceMs;
+    private startupTimeoutMs;
+    private agentVersion;
+    constructor(opts?: AcpHarnessOptions);
+    info(): HarnessInfo;
+    /**
+     * Is the agent command there? Deliberately does not start it: it would run
+     * outside the sandbox wrapper. The version comes from `initialize` on the
+     * first run (`agentInfo.version`).
+     */
+    preflight(): Promise<{
+        ok: true;
+        version: string;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** Env for the agent process: scoped like Claude Code's, with only the auth vars the operator named. */
+    private buildEnv;
+    /** The node policy, with the harness policy mode and the watchdog budget applied. */
+    private compilePolicy;
+    /**
+     * Talk to one agent process from `initialize` to the last `session/prompt`
+     * response, then stop it. Never throws: every failure is on the result.
+     */
+    private converse;
+    /**
+     * Run a node. The gate runs first: in strict mode a node whose opinions an
+     * ACP agent cannot honor is refused before the agent starts. The agent
+     * process runs inside the host's sandbox wrapper (#360 step 2) when the
+     * sandbox mode asks for one and the host has one.
+     */
+    run(req: HarnessRunRequest): Promise<HarnessRunResult>;
+    /** Map one conversation onto a NodeResult with Claude Code's semantics. */
+    private toResult;
+    /**
+     * One completion: a fresh session with no MCP servers, every permission
+     * request rejected, and any tool call over budget. null when it failed
+     * (callers fail closed).
+     */
+    complete(req: HarnessCompleteRequest): Promise<string | null>;
+}