@vellumai/assistant 0.8.8 → 0.8.9-dev.202606091926.ebb2d62

package/src/acp/agent-process.ts

@@ -34,6 +34,7 @@ export type AcpClientFactory = (agent: Agent) => Client;
 export class AcpAgentProcess {
   private proc: ChildProcess | null = null;
   private connection: acp.ClientSideConnection | null = null;
+  private initializeResponse: InitializeResponse | null = null;
 
   constructor(
     public readonly agentId: string,
@@ -99,7 +100,7 @@ export class AcpAgentProcess {
 
     log.info({ agentId: this.agentId }, "Initializing ACP connection");
 
-    return this.connection.initialize({
+    const response = await this.connection.initialize({
       protocolVersion: acp.PROTOCOL_VERSION,
       clientInfo: { name: "vellum", version: "1.0.0" },
       clientCapabilities: {
@@ -107,6 +108,28 @@ export class AcpAgentProcess {
         terminal: true,
       },
     });
+
+    this.initializeResponse = response;
+    return response;
+  }
+
+  /**
+   * Whether the agent advertised support for `session/load` at initialize.
+   * Returns false before initialize() resolves.
+   */
+  get supportsLoadSession(): boolean {
+    return this.initializeResponse?.agentCapabilities?.loadSession === true;
+  }
+
+  /**
+   * Whether the agent advertised support for `session/resume` at initialize.
+   * Returns false before initialize() resolves.
+   */
+  get supportsSessionResume(): boolean {
+    return (
+      this.initializeResponse?.agentCapabilities?.sessionCapabilities?.resume !=
+      null
+    );
   }
 
   /**
@@ -128,6 +151,41 @@ export class AcpAgentProcess {
     return result.sessionId;
   }
 
+  /**
+   * Loads a previously persisted ACP session via `session/load`.
+   *
+   * Per the ACP spec, the agent replays the session's conversation history
+   * as `session/update` notifications before the load response resolves;
+   * callers should suppress forwarding of those replayed updates (see
+   * VellumAcpClientHandler.beginReplaySuppression).
+   */
+  async loadSession(sessionId: string, cwd: string): Promise<void> {
+    if (!this.connection) {
+      throw new Error(`ACP agent "${this.agentId}" is not spawned`);
+    }
+
+    log.info({ agentId: this.agentId, sessionId, cwd }, "Loading ACP session");
+
+    await this.connection.loadSession({ sessionId, cwd, mcpServers: [] });
+  }
+
+  /**
+   * Resumes a previously persisted ACP session via `session/resume`.
+   *
+   * Unlike `session/load`, resume performs no history replay, so it is
+   * preferred when the agent advertises the capability
+   * (see supportsSessionResume).
+   */
+  async resumeSession(sessionId: string, cwd: string): Promise<void> {
+    if (!this.connection) {
+      throw new Error(`ACP agent "${this.agentId}" is not spawned`);
+    }
+
+    log.info({ agentId: this.agentId, sessionId, cwd }, "Resuming ACP session");
+
+    await this.connection.resumeSession({ sessionId, cwd, mcpServers: [] });
+  }
+
   /**
    * Sends a prompt to an existing ACP session.
    * Returns the prompt response (includes stopReason).
@@ -175,6 +233,7 @@ export class AcpAgentProcess {
       this.proc = null;
     }
     this.connection = null;
+    this.initializeResponse = null;
   }
 
   /**
@@ -205,5 +264,6 @@ export class AcpAgentProcess {
 
     this.proc = null;
     this.connection = null;
+    this.initializeResponse = null;
   }
 }

package/src/acp/auto-install.test.ts

@@ -0,0 +1,280 @@
+/**
+ * Tests for the sandboxed ACP adapter auto-installer.
+ *
+ * `execFile` is stubbed via the shared `installExecFileStub` helper: a
+ * process-global `mock.module("node:child_process", ...)` driven by per-call
+ * scripted responses keyed on `${command} ${args[0]}`. `Bun.which` is stubbed
+ * via `installWhichStub` so each test controls whether `bun` is on PATH and
+ * whether the adapter binary resolves after the install.
+ *
+ * The security-critical assertions live here: the installer must be `bun`
+ * (never `npm`), run in a fresh temp dir (NOT the task cwd), with the ACP
+ * secrets stripped from its env and the registry pinned to the public npm
+ * registry.
+ */
+
+import { tmpdir } from "node:os";
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { installAcpConfigStub } from "./__tests__/helpers/acp-config-stub.js";
+import { installExecFileStub } from "./__tests__/helpers/exec-file-stub.js";
+import { installWhichStub } from "./__tests__/helpers/which-stub.js";
+
+const { execScripts, execFileMock, reset } = installExecFileStub();
+const config = await installAcpConfigStub();
+const which = installWhichStub();
+
+/** Fixed resolved `bun` path so script keys are predictable. */
+const BUN_BIN = "/usr/local/bin/bun";
+/** Key the exec stub uses for the global install. */
+const BUN_ADD_KEY = `${BUN_BIN} add`;
+
+afterAll(() => {
+  which.restore();
+});
+
+// Spread the real module so other test files that load logger consumers
+// (e.g. `truncateForLog` importers) after this process-global mock still
+// resolve every named export.
+const realLogger = await import("../util/logger.js");
+mock.module("../util/logger.js", () => ({
+  ...realLogger,
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+const {
+  ensureAdapterInstalled,
+  resolveAgentWithAutoInstall,
+  _resetAdapterInstallCacheForTests,
+} = await import("./auto-install.js");
+
+/** Latest call's execFile options ({ cwd, env, ... }). */
+function lastInstallOptions(): { cwd?: string; env?: NodeJS.ProcessEnv } {
+  const call = execFileMock.mock.calls.at(-1)!;
+  return call[2] as { cwd?: string; env?: NodeJS.ProcessEnv };
+}
+
+beforeEach(() => {
+  reset();
+  _resetAdapterInstallCacheForTests();
+  config.setConfig({ agents: {} });
+  // Default: bun on PATH, nothing else.
+  which.setWhich({ bun: BUN_BIN });
+});
+
+describe("ensureAdapterInstalled", () => {
+  test("known command: runs `bun add --global <pkg>` and reports installed", async () => {
+    execScripts.set(BUN_ADD_KEY, { stdout: "" });
+
+    const result = await ensureAdapterInstalled("claude-agent-acp");
+
+    expect(result).toEqual({ installed: true });
+    expect(execFileMock).toHaveBeenCalledTimes(1);
+    const [command, args] = execFileMock.mock.calls[0];
+    expect(command).toBe(BUN_BIN);
+    expect(args).toEqual([
+      "add",
+      "--global",
+      "@agentclientprotocol/claude-agent-acp",
+    ]);
+  });
+
+  test("installer never invokes npm", async () => {
+    execScripts.set(BUN_ADD_KEY, { stdout: "" });
+
+    await ensureAdapterInstalled("claude-agent-acp");
+
+    for (const call of execFileMock.mock.calls) {
+      expect(call[0]).not.toBe("npm");
+    }
+  });
+
+  test("runs in a fresh temp dir (NOT the task cwd), token-free env, public registry", async () => {
+    // Seed the secrets on the ambient env so we can assert they are stripped.
+    process.env.CLAUDE_CODE_OAUTH_TOKEN = "should-not-leak";
+    process.env.GEMINI_API_KEY = "should-not-leak-either";
+    execScripts.set(BUN_ADD_KEY, { stdout: "" });
+
+    try {
+      await ensureAdapterInstalled("claude-agent-acp");
+    } finally {
+      delete process.env.CLAUDE_CODE_OAUTH_TOKEN;
+      delete process.env.GEMINI_API_KEY;
+    }
+
+    const { cwd, env } = lastInstallOptions();
+    // Sandboxed cwd: a temp dir under the OS temp root, never the process cwd.
+    expect(cwd).toBeDefined();
+    expect(cwd!.startsWith(tmpdir())).toBe(true);
+    expect(cwd).not.toBe(process.cwd());
+    expect(cwd).toContain("vellum-acp-install-");
+
+    // Secrets stripped, registry pinned.
+    expect(env).toBeDefined();
+    expect(env!.CLAUDE_CODE_OAUTH_TOKEN).toBeUndefined();
+    expect(env!.GEMINI_API_KEY).toBeUndefined();
+    expect(env!.BUN_CONFIG_REGISTRY).toBe("https://registry.npmjs.org/");
+  });
+
+  test("unknown command: never invokes a package manager (security allowlist)", async () => {
+    const result = await ensureAdapterInstalled("some-arbitrary-binary");
+
+    expect(result.installed).toBe(false);
+    expect(result.error).toBeUndefined();
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+
+  test("bun absent: no install attempted, reports not installed", async () => {
+    which.setWhich({}); // bun not on PATH
+
+    const result = await ensureAdapterInstalled("claude-agent-acp");
+
+    expect(result.installed).toBe(false);
+    expect(result.error).toBeUndefined();
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+
+  test("install failure: reports the error and does not install", async () => {
+    execScripts.set(BUN_ADD_KEY, {
+      error: new Error("EACCES: permission denied"),
+    });
+
+    const result = await ensureAdapterInstalled("codex-acp");
+
+    expect(result.installed).toBe(false);
+    expect(result.error).toContain("EACCES");
+  });
+
+  test("failed install is retried on the next call", async () => {
+    execScripts.set(BUN_ADD_KEY, { error: new Error("network down") });
+    const first = await ensureAdapterInstalled("claude-agent-acp");
+    expect(first.installed).toBe(false);
+
+    execScripts.set(BUN_ADD_KEY, { stdout: "" });
+    const second = await ensureAdapterInstalled("claude-agent-acp");
+    expect(second.installed).toBe(true);
+    expect(execFileMock).toHaveBeenCalledTimes(2);
+  });
+
+  test("successful install is cached for the process lifetime", async () => {
+    execScripts.set(BUN_ADD_KEY, { stdout: "" });
+
+    await ensureAdapterInstalled("claude-agent-acp");
+    await ensureAdapterInstalled("claude-agent-acp");
+
+    expect(execFileMock).toHaveBeenCalledTimes(1);
+  });
+
+  test("concurrent calls dedupe to exactly one install", async () => {
+    execScripts.set(BUN_ADD_KEY, { stdout: "" });
+
+    const [a, b, c] = await Promise.all([
+      ensureAdapterInstalled("claude-agent-acp"),
+      ensureAdapterInstalled("claude-agent-acp"),
+      ensureAdapterInstalled("claude-agent-acp"),
+    ]);
+
+    expect(a.installed).toBe(true);
+    expect(b.installed).toBe(true);
+    expect(c.installed).toBe(true);
+    expect(execFileMock).toHaveBeenCalledTimes(1);
+  });
+
+  test("different commands install independently", async () => {
+    execScripts.set(BUN_ADD_KEY, { stdout: "" });
+
+    const [claude, codex] = await Promise.all([
+      ensureAdapterInstalled("claude-agent-acp"),
+      ensureAdapterInstalled("codex-acp"),
+    ]);
+
+    expect(claude.installed).toBe(true);
+    expect(codex.installed).toBe(true);
+    expect(execFileMock).toHaveBeenCalledTimes(2);
+    const installedPackages = execFileMock.mock.calls.map(
+      (call) => (call[1] as string[])[2],
+    );
+    expect(installedPackages.sort()).toEqual([
+      "@agentclientprotocol/claude-agent-acp",
+      "@zed-industries/codex-acp",
+    ]);
+  });
+});
+
+describe("resolveAgentWithAutoInstall - resolution order", () => {
+  test("binary missing + bun present: installs then resolves to the real binary", async () => {
+    let installed = false;
+    which.setWhich((cmd) => {
+      if (cmd === "bun") return BUN_BIN;
+      if (cmd === "claude-agent-acp" && installed) {
+        return "/usr/local/bin/claude-agent-acp";
+      }
+      return null;
+    });
+    execScripts.set(BUN_ADD_KEY, {
+      stdout: "",
+      onCall: () => {
+        installed = true;
+      },
+    });
+
+    const result = await resolveAgentWithAutoInstall("claude");
+
+    expect(result.resolved.ok).toBe(true);
+    if (!result.resolved.ok) return;
+    // The resolved command is the REAL binary, not a `bun x` wrapper.
+    expect(result.resolved.agent.command).toBe("claude-agent-acp");
+    expect(result.autoInstalledPackage).toBe(
+      "@agentclientprotocol/claude-agent-acp",
+    );
+    expect(result.failureMessage).toBeUndefined();
+    expect(execFileMock).toHaveBeenCalledTimes(1);
+    expect(execFileMock.mock.calls[0][0]).toBe(BUN_BIN);
+  });
+
+  test("binary missing + bun absent: no install, plain failure with the hint", async () => {
+    which.setWhich({}); // neither bun nor the adapter on PATH
+
+    const result = await resolveAgentWithAutoInstall("claude");
+
+    expect(result.resolved.ok).toBe(false);
+    expect(result.autoInstalledPackage).toBeUndefined();
+    // No augmented failure message (the plain binary_not_found hint is
+    // surfaced by the caller via formatResolveFailure).
+    expect(result.failureMessage).toBeUndefined();
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+
+  test("install fails: failure message carries the hint and install error, never npm", async () => {
+    which.setWhich({ bun: BUN_BIN });
+    execScripts.set(BUN_ADD_KEY, { error: new Error("network is down") });
+
+    const result = await resolveAgentWithAutoInstall("claude");
+
+    expect(result.resolved.ok).toBe(false);
+    expect(result.failureMessage).toContain("claude-agent-acp is not on PATH");
+    expect(result.failureMessage).toContain(
+      "bun add -g @agentclientprotocol/claude-agent-acp",
+    );
+    expect(result.failureMessage).toContain("network is down");
+    for (const call of execFileMock.mock.calls) {
+      expect(call[0]).not.toBe("npm");
+    }
+  });
+
+  test("codex unaffected: already on PATH resolves with no install", async () => {
+    which.setWhich((cmd) =>
+      cmd === "codex-acp" ? "/usr/local/bin/codex-acp" : null,
+    );
+
+    const result = await resolveAgentWithAutoInstall("codex");
+
+    expect(result.resolved.ok).toBe(true);
+    if (!result.resolved.ok) return;
+    expect(result.resolved.agent.command).toBe("codex-acp");
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+});

package/src/acp/auto-install.ts

@@ -0,0 +1,232 @@
+/**
+ * Sandboxed auto-install for known ACP adapter binaries.
+ *
+ * When a spawn fails preflight with `binary_not_found`, callers (the
+ * `acp_spawn` tool and the `/v1/acp/spawn` route) call
+ * `resolveAgentWithAutoInstall(agentId)`, which performs a ONE-TIME global
+ * install of the mapped adapter package via `bun`, then re-resolves and
+ * continues. After the install the adapter is a normal trusted binary on
+ * PATH, and the session manager spawns it the usual way (project cwd, token
+ * injected only at spawn).
+ *
+ * Security boundaries (this is the ATL-808 fix):
+ *  - Only commands present in `DEFAULT_AGENT_NPM_PACKAGES` are ever
+ *    installed. The package names are vendored constants, NOT user input.
+ *  - The install runs `bun` with cwd = a FRESH empty daemon-owned temp dir,
+ *    never the untrusted task project dir. A clean cwd has no project-local
+ *    `node_modules/.bin`, `bunfig.toml`, or `.npmrc`, so none of the
+ *    cwd-based package-resolution hijacks apply.
+ *  - The installer env is a SANITIZED copy of `process.env` with
+ *    `CLAUDE_CODE_OAUTH_TOKEN` and `GEMINI_API_KEY` stripped, so the secret
+ *    is never in scope during package resolution, and `BUN_CONFIG_REGISTRY`
+ *    forced to the public npm registry so a redirected registry cannot serve
+ *    a malicious package.
+ *  - The token is injected ONLY later, at spawn time, on the real installed
+ *    binary (see `prepare-agent-env.ts`). `prepareAgentEnv` is never called
+ *    here.
+ */
+
+import { execFile } from "node:child_process";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { DEFAULT_AGENT_NPM_PACKAGES } from "../config/acp-defaults.js";
+import { getLogger } from "../util/logger.js";
+import {
+  resolveAcpAgent,
+  type ResolveAcpAgentResult,
+} from "./resolve-agent.js";
+
+const log = getLogger("acp:auto-install");
+
+/** Per-install timeout for the global install. Generous: cold caches are slow. */
+const BUN_INSTALL_TIMEOUT_MS = 120_000;
+
+/**
+ * The trusted public npm registry. Forced via `BUN_CONFIG_REGISTRY` on the
+ * installer env so a stray `.npmrc`/`bunfig.toml` in the ambient environment
+ * cannot redirect package downloads to an attacker-controlled registry.
+ */
+const PUBLIC_NPM_REGISTRY = "https://registry.npmjs.org/";
+
+export interface AdapterInstallResult {
+  installed: boolean;
+  error?: string;
+}
+
+/**
+ * Per-command install promises. Concurrent spawns for the same missing
+ * binary dedupe to a single global install; successful results are cached for
+ * the process lifetime. Failed installs are evicted so a later spawn can
+ * retry (e.g. after the user fixes network or install permissions).
+ */
+const installPromises = new Map<string, Promise<AdapterInstallResult>>();
+
+/**
+ * Run `execFile` with an AbortController-driven timeout. Returns the stdout
+ * on success; throws on error or timeout. The optional `cwd`/`env` let the
+ * installer run in a sandboxed working directory with a sanitized env.
+ */
+function execFileWithTimeout(
+  command: string,
+  args: string[],
+  timeoutMs: number,
+  options?: { cwd?: string; env?: NodeJS.ProcessEnv },
+): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    execFile(
+      command,
+      args,
+      {
+        signal: controller.signal,
+        encoding: "utf8",
+        cwd: options?.cwd,
+        env: options?.env,
+      },
+      (err, stdout) => {
+        clearTimeout(timer);
+        if (err) {
+          reject(err);
+          return;
+        }
+        resolve(stdout);
+      },
+    );
+  });
+}
+
+/**
+ * A copy of `process.env` safe to hand to the package installer: the ACP
+ * secrets are stripped so they can never leak into a resolved package's
+ * lifecycle/runtime, and the registry is pinned to the trusted public one.
+ */
+function sanitizedInstallEnv(): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = { ...process.env };
+  delete env.CLAUDE_CODE_OAUTH_TOKEN;
+  delete env.GEMINI_API_KEY;
+  env.BUN_CONFIG_REGISTRY = PUBLIC_NPM_REGISTRY;
+  return env;
+}
+
+/**
+ * Install the npm-registry package mapped to `command` via a sandboxed `bun`
+ * global install, if (and only if) the command is a known adapter binary and
+ * `bun` is on PATH. Unknown commands, or hosts without `bun`, resolve to
+ * `{ installed: false }` without ever invoking a package manager (see the
+ * security boundary note in the module doc).
+ */
+export function ensureAdapterInstalled(
+  command: string,
+): Promise<AdapterInstallResult> {
+  const packageName = DEFAULT_AGENT_NPM_PACKAGES[command];
+  if (!packageName) {
+    return Promise.resolve({ installed: false });
+  }
+
+  const bunPath = Bun.which("bun");
+  if (!bunPath) {
+    return Promise.resolve({ installed: false });
+  }
+
+  const inFlight = installPromises.get(command);
+  if (inFlight) return inFlight;
+
+  const promise = runInstall(bunPath, command, packageName).then((result) => {
+    if (!result.installed) installPromises.delete(command);
+    return result;
+  });
+  installPromises.set(command, promise);
+  return promise;
+}
+
+async function runInstall(
+  bunPath: string,
+  command: string,
+  packageName: string,
+): Promise<AdapterInstallResult> {
+  log.info({ command, packageName }, "Auto-installing missing ACP adapter");
+  // Fresh empty dir guaranteed to have no project-local node_modules,
+  // bunfig.toml, or .npmrc - this neutralizes the cwd-based resolution
+  // hijacks the untrusted task dir would otherwise enable.
+  const installDir = await mkdtemp(join(tmpdir(), "vellum-acp-install-"));
+  try {
+    await execFileWithTimeout(
+      bunPath,
+      // `bun add --global` installs AND links the package bin into bun's
+      // global bin dir (on PATH in every image).
+      ["add", "--global", packageName],
+      BUN_INSTALL_TIMEOUT_MS,
+      { cwd: installDir, env: sanitizedInstallEnv() },
+    );
+    log.info({ command, packageName }, "ACP adapter auto-install succeeded");
+    return { installed: true };
+  } catch (err) {
+    const error = err instanceof Error ? err.message : String(err);
+    log.warn(
+      { err, command, packageName },
+      "ACP adapter auto-install failed (falling back to install hint)",
+    );
+    return { installed: false, error };
+  } finally {
+    await rm(installDir, { recursive: true, force: true }).catch(() => {});
+  }
+}
+
+export interface ResolveWithAutoInstallResult {
+  /** The final resolver outcome (post-install re-resolve when applicable). */
+  resolved: ResolveAcpAgentResult;
+  /** Set when a missing adapter binary was silently installed via bun. */
+  autoInstalledPackage?: string;
+  /**
+   * Set when the auto-install itself failed: the original install hint
+   * augmented with the install failure reason. Callers should surface this
+   * instead of re-deriving a message from `resolved`.
+   */
+  failureMessage?: string;
+}
+
+/**
+ * Resolve an ACP agent id, silently auto-installing the mapped adapter
+ * package when (and only when) the failure is a missing allowlisted binary.
+ * Shared by the `acp_spawn` tool and the `/v1/acp/spawn` route so the
+ * resolve-install-re-resolve flow has a single implementation; callers map
+ * the result to their transport (tool error result vs. HTTP error class).
+ */
+export async function resolveAgentWithAutoInstall(
+  agentId: string,
+): Promise<ResolveWithAutoInstallResult> {
+  const resolved = resolveAcpAgent(agentId);
+  if (resolved.ok || resolved.reason !== "binary_not_found") {
+    return { resolved };
+  }
+
+  const { command, hint } = resolved;
+  const install = await ensureAdapterInstalled(command);
+  if (install.installed) {
+    const retried = resolveAcpAgent(agentId);
+    if (retried.ok) {
+      log.info(
+        { agentId, command },
+        "Auto-installed missing ACP adapter binary",
+      );
+      return {
+        resolved: retried,
+        autoInstalledPackage: DEFAULT_AGENT_NPM_PACKAGES[command],
+      };
+    }
+  } else if (install.error) {
+    return {
+      resolved,
+      failureMessage: `${command} is not on PATH. ${hint} (auto-install failed: ${install.error})`,
+    };
+  }
+  return { resolved };
+}
+
+/** @internal: exposed for tests only. */
+export function _resetAdapterInstallCacheForTests(): void {
+  installPromises.clear();
+}

package/src/acp/client-handler.ts

@@ -51,6 +51,7 @@ interface TerminalState {
 export class VellumAcpClientHandler implements Client {
   private terminals = new Map<string, TerminalState>();
   private accumulatedText = "";
+  private suppressForwarding = false;
   /** Tracks pending ACP permission requestIds for cleanup on session close. */
   readonly pendingRequestIds = new Set<string>();
 
@@ -65,8 +66,38 @@ export class VellumAcpClientHandler implements Client {
     private readonly parentConversationId: string,
   ) {}
 
+  /**
+   * Begins suppressing session updates from being forwarded to Vellum.
+   *
+   * Per the ACP spec, `session/load` replays the entire conversation history
+   * as `session/update` notifications before the load response resolves. The
+   * parent conversation already received those events during the original
+   * run, so re-forwarding them would duplicate them into the conversation and
+   * the ring buffer. Callers wrap `loadSession` in
+   * beginReplaySuppression()/endReplaySuppression() to drop the replay.
+   * `session/resume` performs no replay, which is why it is preferred when
+   * the agent supports it.
+   */
+  beginReplaySuppression(): void {
+    this.suppressForwarding = true;
+  }
+
+  /** Ends replay suppression; subsequent updates flow normally. */
+  endReplaySuppression(): void {
+    this.suppressForwarding = false;
+  }
+
   async sessionUpdate(params: SessionNotification): Promise<void> {
     const update = params.update;
+
+    if (this.suppressForwarding) {
+      log.debug(
+        { acpSessionId: this.acpSessionId, updateType: update.sessionUpdate },
+        "Dropping replayed session update during suppression",
+      );
+      return;
+    }
+
     log.debug(
       { acpSessionId: this.acpSessionId, updateType: update.sessionUpdate },
       "ACP session update received",