@wrongstack/acp 0.286.0 → 0.289.0

package/README.md

@@ -1,15 +1,19 @@
 # @wrongstack/acp — ACP v1 SDK
 
-Agent Client Protocol (ACP) v1 implementation for WrongStack, wrapping the official
-[`@agentclientprotocol/sdk`](https://github.com/agentclientprotocol/typescript-sdk).
+Agent Client Protocol (ACP) v1 implementation for WrongStack. The live client and
+server use WrongStack's JSON-RPC implementation; the `/sdk` export provides the official
+[`@agentclientprotocol/sdk`](https://github.com/agentclientprotocol/typescript-sdk) APIs.
 
-**100% spec coverage.** Both client and server sides fully implemented.
+WrongStack implements the ACP v1 client and server session flows, with stdio and
+WebSocket support plus an HTTP server transport. Some optional protocol surfaces
+are intentionally unavailable; see [COMPLIANCE.md](COMPLIANCE.md) for the tested
+surface and current limitations.
 
 ## Compliance
 
-[![ACP v1 Compliant](https://img.shields.io/badge/ACP%20v1-100%25%20compliant-2ea44f)](COMPLIANCE.md)
-
-**143 compliance checks — 0 failures.** See [COMPLIANCE.md](COMPLIANCE.md) for the full audit report.
+The package test suite includes client/server protocol tests and an in-process
+JSON round-trip loopback test. See [COMPLIANCE.md](COMPLIANCE.md) for the method
+matrix and the distinction between wire handling and functional behavior.
 
 ## Installation
 
@@ -43,7 +47,7 @@ await session.close();
 ### ACP Server (expose WrongStack as an ACP agent)
 
 ```typescript
-import { WrongStackACPServer, makeACPServerAgentTurn } from '@wrongstack/acp';
+import { WrongStackACPServer, makeACPServerAgentTurn } from '@wrongstack/acp/agent';
 
 const agentFor = async (sessionId: string) => {
   // Create a WrongStack Agent instance for this session
@@ -64,8 +68,8 @@ await server.start();
 import { ACPSession, AcpServer, createWebSocketStream } from '@wrongstack/acp/sdk';
 ```
 
-The `/sdk` entry point re-exports everything from `@agentclientprotocol/sdk` alongside
-WrongStack's own implementation.
+The `/sdk` entry point re-exports the official SDK's public high-level APIs, method
+constants, and experimental Node/WebSocket helpers alongside WrongStack's implementation.
 
 ## Architecture
 
@@ -217,7 +221,7 @@ Exposes WrongStack as an ACP-compatible agent:
 import {
   WrongStackACPServer,
   makeACPServerAgentTurn,
-} from '@wrongstack/acp';
+} from '@wrongstack/acp/agent';
 
 const server = new WrongStackACPServer({
   runTurn: makeACPServerAgentTurn({
@@ -248,7 +252,7 @@ curl -X POST http://127.0.0.1:7788 \
 ### Session Persistence
 
 ```typescript
-import { ACPSessionStore } from '@wrongstack/acp';
+import { ACPSessionStore } from '@wrongstack/acp/agent';
 
 const store = new ACPSessionStore({ dir: './.acp-sessions' });
 await store.init();
@@ -300,7 +304,7 @@ const result = await agent.run(prompt, { signal });
 
 | Method | Handler | Status |
 |--------|---------|--------|
-| `session/update` | Stream pump (11 discriminators) | ✅ |
+| `session/update` | Stream pump (11 stable discriminators; unknown/unstable updates are tolerated) | ✅ |
 | `session/request_permission` | Permission policy callback | ✅ |
 | `fs/read_text_file` | FileServer (sandboxed) | ✅ |
 | `fs/write_text_file` | FileServer (sandboxed) | ✅ |
@@ -328,13 +332,13 @@ const result = await agent.run(prompt, { signal });
 | `session/cancel` | Notification handler | ✅ |
 | `session/set_mode` | `handleSetMode` | ✅ |
 | `session/set_config_option` | `handleSetConfigOption` | ✅ |
-| `providers/list` | `handleProvidersList` | ✅ |
-| `providers/set` | `handleProvidersSet` | ✅ |
-| `providers/disable` | `handleProvidersDisable` | ✅ |
-| `mcp/message` | `handleMcpMessage` | ✅ |
-| `document/*` | Auto-acknowledged | ✅ |
-| `nes/*` | Auto-acknowledged | ✅ |
-| `elicitation/*` | Auto-acknowledged | ✅ |
+| `providers/list` | Returns an empty provider list; provider configuration stays in `wstack auth` | Limited |
+| `providers/set` | Returns an error directing callers to `wstack auth` | Unsupported |
+| `providers/disable` | Acknowledges without changing CLI provider configuration | Limited |
+| `mcp/message` | Returns an unavailable error | Unsupported |
+| `document/*` | Standard method-not-found response | Unsupported |
+| `nes/*` | Standard method-not-found response | Unsupported |
+| `elicitation/*` | Standard method-not-found response | Unsupported |
 | `$/cancel_request` | Notification handler | ✅ |
 
 ## Transport
@@ -342,9 +346,9 @@ const result = await agent.run(prompt, { signal });
 | Transport | Client | Server | Library |
 |-----------|--------|--------|---------|
 | stdio | ✅ `ACPSession.start()` | ✅ `WrongStackACPServer` | Built-in |
-| HTTP | ✅ Via `ACPSession` + fetch | ✅ `transport: <port>` | Built-in |
-| WebSocket | ✅ `createWebSocketStream()` | ✅ `AcpServer` + `createNodeWebSocketUpgradeHandler()` | Official SDK |
-| SSE | ✅ Via `AcpServer` | ✅ Via `AcpServer` | Official SDK |
+| HTTP | ❌ No `ACPSession` HTTP client | ✅ `transport: <port>` | Built-in server |
+| WebSocket | ✅ `ACPSession.connectWebSocket()` | ✅ via the CLI `--ws` bridge | Built-in |
+| SSE | SDK exports only; no WrongStack command wires it | SDK exports only; no WrongStack command wires it | Official SDK re-export |
 
 ## Error Handling
 
@@ -373,4 +377,4 @@ try {
 
 - [ACP Specification](https://agentclientprotocol.com)
 - [Official TypeScript SDK](https://github.com/agentclientprotocol/typescript-sdk)
-- [WrongStack CLI (`wstack acp`)](../../packages/cli/src/slash-commands/acp.md)
+- [WrongStack CLI (`wstack acp`)](../../docs/subcommands/acp.md)

package/dist/agent/wrongstack-acp-agent.d.ts

@@ -11,6 +11,13 @@ export interface WrongStackACPServerOptions {
     transport?: 'stdio' | number | undefined;
     /** Host for HTTP transport. Defaults to '127.0.0.1'. */
     host?: string | undefined;
+    /**
+     * Bearer token required for HTTP transport authentication. When set,
+     * every HTTP request must include `Authorization: Bearer <token>` or
+     * `?token=<token>` in the query string. When unset, the server is
+     * unauthenticated (acceptable for loopback-only development).
+     */
+    authToken?: string | undefined;
     /** Emit the pre-v1 startup marker on stdio. Defaults to false. */
     legacyStartupMarker?: boolean | undefined;
     /**

package/dist/agent/wrongstack-acp-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wrongstack-acp-agent.d.ts","sourceRoot":"","sources":["../../src/agent/wrongstack-acp-agent.ts"],"names":[],"mappings":"AA8BA,OAAO,EAEL,KAAK,OAAO,EAEZ,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAG/B,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IACzC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,kEAAkE;IAClE,mBAAmB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GAAG,SAAS,CAAC;IACpG;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACjH;;;OAGG;IACH,KAAK,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACxC;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,+CAA+C;IAC/C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,OAAO,CAAS;IAExB,YAAY,IAAI,GAAE,0BAA+B,EAahD;IAED;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAO3B;YAEa,UAAU;YAcV,SAAS;IAkGvB,uBAAuB;IACvB,IAAI,IAAI,IAAI,CAOX;CACF"}
+{"version":3,"file":"wrongstack-acp-agent.d.ts","sourceRoot":"","sources":["../../src/agent/wrongstack-acp-agent.ts"],"names":[],"mappings":"AA8BA,OAAO,EAEL,KAAK,OAAO,EAEZ,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAG/B,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IACzC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,kEAAkE;IAClE,mBAAmB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GAAG,SAAS,CAAC;IACpG;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACjH;;;OAGG;IACH,KAAK,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACxC;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,+CAA+C;IAC/C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,OAAO,CAAS;IAExB,YAAY,IAAI,GAAE,0BAA+B,EAahD;IAED;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAO3B;YAEa,UAAU;YAcV,SAAS;IAmKvB,uBAAuB;IACvB,IAAI,IAAI,IAAI,CAOX;CACF"}

package/dist/agent.js

@@ -1145,7 +1145,21 @@ var WrongStackACPServer = class {
   async startHttp(port) {
     const host = this.options.host ?? "127.0.0.1";
     const handler = this.handler;
+    const authToken = this.options.authToken;
+    let httpChain = Promise.resolve();
     this.httpServer = createServer(async (req, res) => {
+      if (authToken) {
+        const url = new URL(req.url ?? "/", `http://${host}:${port}`);
+        const queryToken = url.searchParams.get("token");
+        const authHeader = req.headers["authorization"];
+        const bearerToken = Array.isArray(authHeader) ? authHeader[0]?.replace(/^Bearer\s+/i, "") : authHeader?.replace(/^Bearer\s+/i, "");
+        const supplied = queryToken ?? bearerToken ?? "";
+        if (supplied !== authToken) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: { code: -32001, message: "Unauthorized" } }));
+          return;
+        }
+      }
       const selfOrigin = `http://${host}:${port}`;
       const reqOrigin = Array.isArray(req.headers.origin) ? req.headers.origin[0] : req.headers.origin;
       if (reqOrigin && reqOrigin !== selfOrigin) {
@@ -1155,7 +1169,7 @@ var WrongStackACPServer = class {
       }
       if (reqOrigin) res.setHeader("Access-Control-Allow-Origin", reqOrigin);
       res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
-      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id");
+      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id, Authorization");
       if (req.method === "OPTIONS") {
         res.writeHead(204);
         res.end();
@@ -1166,10 +1180,23 @@ var WrongStackACPServer = class {
         res.end(JSON.stringify({ error: "method not allowed" }));
         return;
       }
+      const MAX_HTTP_BODY = 10 * 1024 * 1024;
       let body = "";
+      let bodyBytes = 0;
+      let tooLarge = false;
       for await (const chunk of req) {
+        bodyBytes += chunk.length;
+        if (bodyBytes > MAX_HTTP_BODY) {
+          tooLarge = true;
+          break;
+        }
         body += chunk;
       }
+      if (tooLarge) {
+        res.writeHead(413, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: { code: -32700, message: "Request body too large" } }));
+        return;
+      }
       let msg;
       try {
         msg = JSON.parse(body);
@@ -1178,26 +1205,43 @@ var WrongStackACPServer = class {
         res.end(JSON.stringify({ error: { code: -32700, message: "Parse error" } }));
         return;
       }
-      const notifications = [];
-      let response = null;
-      const originalSend = this.transport.send.bind(this.transport);
-      this.transport.send = async (m) => {
-        if (m.id !== void 0 && (m.result !== void 0 || m.error !== void 0)) {
-          response = m;
-        } else if (m.method === "session/update") {
-          notifications.push(m.params);
-        } else {
-          notifications.push(m);
+      const isNotification = typeof msg === "object" && msg !== null && msg.id === void 0 && typeof msg.method === "string";
+      if (isNotification) {
+        try {
+          await handler.handleMessage(msg);
+        } catch {
         }
-      };
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ notifications: [] }));
+        return;
+      }
+      const requestPromise = httpChain.then(async () => {
+        const notifications = [];
+        let response = null;
+        const originalSend = this.transport.send.bind(this.transport);
+        this.transport.send = async (m) => {
+          if (m.id !== void 0 && (m.result !== void 0 || m.error !== void 0)) {
+            response = m;
+          } else if (m.method === "session/update") {
+            notifications.push(m.params);
+          } else {
+            notifications.push(m);
+          }
+        };
+        try {
+          await handler.handleMessage(msg);
+        } finally {
+          this.transport.send = originalSend;
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        const responseBody = response !== null ? { ...response, notifications } : { notifications };
+        res.end(JSON.stringify(responseBody));
+      });
+      httpChain = requestPromise.catch(() => void 0);
       try {
-        await handler.handleMessage(msg);
-      } finally {
-        this.transport.send = originalSend;
+        await requestPromise;
+      } catch {
       }
-      res.writeHead(200, { "Content-Type": "application/json" });
-      const responseBody = response !== null ? { ...response, notifications } : { notifications };
-      res.end(JSON.stringify(responseBody));
     });
     return new Promise((resolve) => {
       this.httpServer.listen(port, host, () => {