@wrongstack/acp 0.287.0 → 0.289.0

package/dist/index.js

@@ -130,7 +130,7 @@ var ClientTransport = class {
   }
   async start() {
     if (this.child) return;
-    const [{ spawn: spawn3 }, { buildChildEnv }, os] = await Promise.all([
+    const [{ spawn: spawn3 }, { buildChildEnv: buildChildEnv2 }, os] = await Promise.all([
       import("node:child_process"),
       import("@wrongstack/core"),
       import("node:os")
@@ -147,7 +147,7 @@ var ClientTransport = class {
         const childArgs = this.opts.args ?? [];
         const shim = process.platform === "win32" ? buildWin32CmdShimInvocation(this.opts.command, childArgs) : null;
         this.child = spawn3(shim?.command ?? this.opts.command, shim?.args ?? childArgs, {
-          env: { ...buildChildEnv(), ...this.opts.env },
+          env: { ...buildChildEnv2(), ...this.opts.env },
           cwd: spawnCwd,
           stdio: ["pipe", "pipe", "pipe"],
           windowsHide: true,
@@ -1132,7 +1132,21 @@ var WrongStackACPServer = class {
   async startHttp(port) {
     const host = this.options.host ?? "127.0.0.1";
     const handler = this.handler;
+    const authToken = this.options.authToken;
+    let httpChain = Promise.resolve();
     this.httpServer = createServer(async (req, res) => {
+      if (authToken) {
+        const url = new URL(req.url ?? "/", `http://${host}:${port}`);
+        const queryToken = url.searchParams.get("token");
+        const authHeader = req.headers["authorization"];
+        const bearerToken = Array.isArray(authHeader) ? authHeader[0]?.replace(/^Bearer\s+/i, "") : authHeader?.replace(/^Bearer\s+/i, "");
+        const supplied = queryToken ?? bearerToken ?? "";
+        if (supplied !== authToken) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: { code: -32001, message: "Unauthorized" } }));
+          return;
+        }
+      }
       const selfOrigin = `http://${host}:${port}`;
       const reqOrigin = Array.isArray(req.headers.origin) ? req.headers.origin[0] : req.headers.origin;
       if (reqOrigin && reqOrigin !== selfOrigin) {
@@ -1142,7 +1156,7 @@ var WrongStackACPServer = class {
       }
       if (reqOrigin) res.setHeader("Access-Control-Allow-Origin", reqOrigin);
       res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
-      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id");
+      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id, Authorization");
       if (req.method === "OPTIONS") {
         res.writeHead(204);
         res.end();
@@ -1153,10 +1167,23 @@ var WrongStackACPServer = class {
         res.end(JSON.stringify({ error: "method not allowed" }));
         return;
       }
+      const MAX_HTTP_BODY = 10 * 1024 * 1024;
       let body = "";
+      let bodyBytes = 0;
+      let tooLarge = false;
       for await (const chunk of req) {
+        bodyBytes += chunk.length;
+        if (bodyBytes > MAX_HTTP_BODY) {
+          tooLarge = true;
+          break;
+        }
         body += chunk;
       }
+      if (tooLarge) {
+        res.writeHead(413, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: { code: -32700, message: "Request body too large" } }));
+        return;
+      }
       let msg;
       try {
         msg = JSON.parse(body);
@@ -1165,26 +1192,43 @@ var WrongStackACPServer = class {
         res.end(JSON.stringify({ error: { code: -32700, message: "Parse error" } }));
         return;
       }
-      const notifications = [];
-      let response = null;
-      const originalSend = this.transport.send.bind(this.transport);
-      this.transport.send = async (m) => {
-        if (m.id !== void 0 && (m.result !== void 0 || m.error !== void 0)) {
-          response = m;
-        } else if (m.method === "session/update") {
-          notifications.push(m.params);
-        } else {
-          notifications.push(m);
+      const isNotification = typeof msg === "object" && msg !== null && msg.id === void 0 && typeof msg.method === "string";
+      if (isNotification) {
+        try {
+          await handler.handleMessage(msg);
+        } catch {
         }
-      };
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ notifications: [] }));
+        return;
+      }
+      const requestPromise = httpChain.then(async () => {
+        const notifications = [];
+        let response = null;
+        const originalSend = this.transport.send.bind(this.transport);
+        this.transport.send = async (m) => {
+          if (m.id !== void 0 && (m.result !== void 0 || m.error !== void 0)) {
+            response = m;
+          } else if (m.method === "session/update") {
+            notifications.push(m.params);
+          } else {
+            notifications.push(m);
+          }
+        };
+        try {
+          await handler.handleMessage(msg);
+        } finally {
+          this.transport.send = originalSend;
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        const responseBody = response !== null ? { ...response, notifications } : { notifications };
+        res.end(JSON.stringify(responseBody));
+      });
+      httpChain = requestPromise.catch(() => void 0);
       try {
-        await handler.handleMessage(msg);
-      } finally {
-        this.transport.send = originalSend;
+        await requestPromise;
+      } catch {
       }
-      res.writeHead(200, { "Content-Type": "application/json" });
-      const responseBody = response !== null ? { ...response, notifications } : { notifications };
-      res.end(JSON.stringify(responseBody));
     });
     return new Promise((resolve3) => {
       this.httpServer.listen(port, host, () => {
@@ -1396,8 +1440,12 @@ var ToolTranslator = class {
 };
 
 // src/client/file-server.ts
+import { randomBytes } from "node:crypto";
+import { realpathSync } from "node:fs";
 import * as fsp from "node:fs/promises";
 import * as path from "node:path";
+var DEFAULT_MAX_READ_BYTES = 5 * 1024 * 1024;
+var DEFAULT_MAX_WRITE_BYTES = 5 * 1024 * 1024;
 var FsError = class extends Error {
   code;
   path;
@@ -1410,23 +1458,40 @@ var FsError = class extends Error {
 };
 var FileServer = class {
   root;
+  realRoot;
   timeoutMs;
+  maxReadBytes;
+  maxWriteBytes;
   constructor(opts) {
     this.root = path.resolve(opts.projectRoot);
+    this.realRoot = safeRealpathSync(this.root);
     this.timeoutMs = opts.timeoutMs ?? 3e4;
+    this.maxReadBytes = opts.maxReadBytes ?? DEFAULT_MAX_READ_BYTES;
+    this.maxWriteBytes = opts.maxWriteBytes ?? DEFAULT_MAX_WRITE_BYTES;
   }
   /** Read a text file. Returns the content as a string. */
   async readTextFile(params) {
-    const safe = this.resolveInside(params.path);
+    const safe = await this.resolveInside(params.path);
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     try {
+      const stat2 = await fsp.stat(safe).catch((err) => {
+        throw mapFsError(err, safe);
+      });
+      if (stat2.size > this.maxReadBytes) {
+        throw new FsError(
+          "TOO_LARGE",
+          safe,
+          `file is ${stat2.size} bytes, max read is ${this.maxReadBytes} bytes`
+        );
+      }
       const content = await fsp.readFile(safe, {
         encoding: "utf8",
         signal: controller.signal
       });
       return { content };
     } catch (err) {
+      if (err instanceof FsError) throw err;
       if (controller.signal.aborted) {
         throw new FsError("TIMEOUT", safe, `readTextFile timed out after ${this.timeoutMs}ms`);
       }
@@ -1437,17 +1502,31 @@ var FileServer = class {
   }
   /** Write a text file. Atomic via write-then-rename. */
   async writeTextFile(params) {
-    const safe = this.resolveInside(params.path);
+    const byteLength = Buffer.byteLength(params.content, "utf8");
+    if (byteLength > this.maxWriteBytes) {
+      throw new FsError(
+        "TOO_LARGE",
+        params.path,
+        `content is ${byteLength} bytes, max write is ${this.maxWriteBytes} bytes`
+      );
+    }
+    const safe = await this.resolveInside(params.path);
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-    const tmp = `${safe}.${randomHex(4)}.tmp`;
+    const tmp = `${safe}.${randomBytes(6).toString("hex")}.tmp`;
     try {
       await fsp.writeFile(tmp, params.content, {
         encoding: "utf8",
         signal: controller.signal
       });
+      await this.assertRealInside(tmp);
+      await this.assertRealInside(path.dirname(safe));
       await fsp.rename(tmp, safe);
     } catch (err) {
+      if (err instanceof FsError) {
+        await fsp.unlink(tmp).catch(() => void 0);
+        throw err;
+      }
       try {
         await fsp.unlink(tmp);
       } catch {
@@ -1461,12 +1540,14 @@ var FileServer = class {
     }
   }
   /**
-   * Resolve a path; throw `FsError('OUTSIDE_ROOT')` if the result is
-   * not under the project root. Symlinks are not followed here — we
-   * operate on the textual path. A future hardening pass can
-   * `fs.realpath` each access to catch symlink escapes.
+   * Resolve a path and verify it is inside the project root by realpath.
+   * Rejects with `FsError` if the textual path, the resolved path, or the
+   * real (symlink-resolved) path escapes the project root.
+   *
+   * For files that don't exist yet (e.g. a write to a new file), the
+   * nearest existing ancestor directory is realpath-checked instead.
    */
-  resolveInside(p) {
+  async resolveInside(p) {
     if (typeof p !== "string" || p.length === 0) {
       throw new FsError("INVALID_PATH", p, "path is empty or not a string");
     }
@@ -1478,8 +1559,38 @@ var FileServer = class {
     if (resolved !== this.root && !resolved.startsWith(rootWithSep)) {
       throw new FsError("OUTSIDE_ROOT", resolved, "path is outside the project root");
     }
+    await this.assertRealInside(resolved);
     return resolved;
   }
+  /**
+   * Resolve `resolvedPath` through `fs.realpath` and verify the result is
+   * inside `realRoot`. For non-existent paths (new files), walk up to the
+   * nearest existing ancestor and check that instead.
+   */
+  async assertRealInside(resolvedPath) {
+    let probe = resolvedPath;
+    for (; ; ) {
+      let real;
+      try {
+        real = await fsp.realpath(probe);
+      } catch (err) {
+        const code = err.code;
+        if (code === "ENOENT") {
+          const parent = path.dirname(probe);
+          if (parent === probe) return;
+          probe = parent;
+          continue;
+        }
+        throw mapFsError(err, resolvedPath);
+      }
+      if (real === this.realRoot || real.startsWith(this.realRoot + path.sep)) return;
+      throw new FsError(
+        "OUTSIDE_ROOT",
+        resolvedPath,
+        "path resolves through a symlink outside the project root"
+      );
+    }
+  }
 };
 function mapFsError(err, p) {
   const code = err?.code;
@@ -1490,12 +1601,12 @@ function mapFsError(err, p) {
   const msg = err instanceof Error ? err.message : String(err);
   return new FsError("INVALID_PATH", p, msg);
 }
-function randomHex(bytes) {
-  let out = "";
-  for (let i = 0; i < bytes * 2; i++) {
-    out += Math.floor(Math.random() * 16).toString(16);
+function safeRealpathSync(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
   }
-  return out;
 }
 
 // src/client/permission.ts
@@ -1544,17 +1655,21 @@ function makePermissionPolicy(decide) {
 
 // src/client/terminal-server.ts
 import { spawn } from "node:child_process";
+import { realpathSync as realpathSync2 } from "node:fs";
 import * as path2 from "node:path";
+import { buildChildEnv } from "@wrongstack/core/utils";
 var TerminalServer = class {
   terminals = /* @__PURE__ */ new Map();
   projectRoot;
   commandTimeoutMs;
   outputByteLimit;
+  maxOutputByteLimit;
   nextId = 1;
   constructor(opts) {
     this.projectRoot = path2.resolve(opts.projectRoot);
     this.commandTimeoutMs = opts.commandTimeoutMs ?? 5 * 6e4;
     this.outputByteLimit = opts.outputByteLimit ?? 1024 * 1024;
+    this.maxOutputByteLimit = opts.maxOutputByteLimit ?? 16 * 1024 * 1024;
     if (opts.signal) {
       opts.signal.addEventListener("abort", () => this.releaseAll());
     }
@@ -1608,12 +1723,15 @@ var TerminalServer = class {
           state.exitStatus = exitStatus;
           state.output += `[spawn error] ${err.message}
 `;
-          state.retainedBytes += Buffer.byteLength(state.output, "utf8");
+          state.retainedBytes = Buffer.byteLength(state.output, "utf8");
           resolve3(exitStatus);
         });
       })
     };
-    const perCallByteLimit = params.outputByteLimit ?? this.outputByteLimit;
+    const perCallByteLimit = Math.min(
+      Math.max(1, this.clampFiniteInt(params.outputByteLimit, this.outputByteLimit)),
+      this.maxOutputByteLimit
+    );
     proc.stdout?.setEncoding("utf8");
     proc.stderr?.setEncoding("utf8");
     const onData = (chunk) => {
@@ -1693,24 +1811,57 @@ var TerminalServer = class {
     if (resolved !== this.projectRoot && !resolved.startsWith(rootWithSep)) {
       return this.projectRoot;
     }
-    return resolved;
-  }
-  buildEnv(agentEnv) {
-    const env = { ...process.env };
-    if (process.platform === "win32") {
-      if (env.Path !== void 0 && env.PATH === void 0) env.PATH = env.Path;
-      if (env.PATHEXT !== void 0 && env.PATHEXT_CASE === void 0) {
-        env.PATHEXT_CASE = env.PATHEXT;
+    try {
+      const realRoot = realpathSync2(this.projectRoot);
+      const realCwd = realpathSync2(resolved);
+      const realRootWithSep = realRoot.endsWith(path2.sep) ? realRoot : realRoot + path2.sep;
+      if (realCwd !== realRoot && !realCwd.startsWith(realRootWithSep)) {
+        return realRoot;
       }
+      return realCwd;
+    } catch {
+      return this.projectRoot;
     }
+  }
+  buildEnv(agentEnv) {
+    const env = buildChildEnv();
     if (agentEnv) {
       for (const { name, value } of agentEnv) {
+        const upper = name.toUpperCase();
+        if (DENIED_AGENT_ENV_KEYS.has(upper)) continue;
         env[name] = value;
       }
     }
     return env;
   }
+  /**
+   * Clamp an agent-supplied numeric to a finite positive safe integer, falling
+   * back to `defaultValue` for undefined/NaN/non-finite values. Prevents
+   * negative, NaN, or Infinity values from disabling output caps or causing
+   * unbounded memory growth.
+   */
+  clampFiniteInt(value, defaultValue) {
+    if (value === void 0 || !Number.isFinite(value) || value < 1) {
+      return defaultValue;
+    }
+    return Math.trunc(value);
+  }
 };
+var DENIED_AGENT_ENV_KEYS = /* @__PURE__ */ new Set([
+  "NODE_OPTIONS",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "DYLD_INSERT_LIBRARIES",
+  "DYLD_LIBRARY_PATH",
+  "DYLD_FALLBACK_LIBRARY_PATH",
+  "PATH",
+  "PYTHONPATH",
+  "PYTHONSTARTUP",
+  "PERL5OPT",
+  "PERLLIB",
+  "RUBYOPT",
+  "RUBYLIB"
+]);
 
 // src/client/acp-session.ts
 var ACPSessionError = class extends Error {
@@ -2572,6 +2723,43 @@ var ACPSession = class _ACPSession {
       await this.sendErrorResponse(id, -32603, `permission policy failed: ${message}`);
     }
   }
+  /**
+   * Enforce authorization at privileged callback sinks (fs/write,
+   * terminal/create). Unlike `handlePermissionRequest` which responds to
+   * agent-initiated `session/request_permission` messages, this method is
+   * called by the handler BEFORE dispatching to FileServer/TerminalServer,
+   * closing the gap where the agent simply skips the voluntary permission
+   * request and sends the privileged callback directly.
+   *
+   * Uses the session's permission policy. The default policy
+   * (`defaultPermissionPolicy`) auto-approves everything — this is correct
+   * for trusted local agents (CLI `acp spawn`, Director fan-out). For
+   * untrusted/remote agents, the host should inject
+   * `readOnlyPermissionPolicy` or an interactive policy.
+   *
+   * Returns true if the callback is authorized, false if denied.
+   */
+  async authorizeCallback(partial) {
+    try {
+      const outcome = await this.permissionPolicy({
+        toolCall: {
+          sessionUpdate: "tool_call_update",
+          toolCallId: partial.toolCallId,
+          title: partial.title,
+          kind: partial.kind,
+          status: "pending"
+        },
+        options: [
+          { optionId: "allow", name: "Allow", kind: "allow_once" },
+          { optionId: "reject", name: "Reject", kind: "reject_once" }
+        ],
+        signal: new AbortController().signal
+      });
+      return outcome.outcome === "selected" && outcome.optionId !== "reject" && outcome.optionId !== "reject_once" && outcome.optionId !== "reject_always";
+    } catch {
+      return false;
+    }
+  }
   async handleFsRequest(msg) {
     const id = msg.id;
     if (id === void 0) return;
@@ -2580,6 +2768,17 @@ var ACPSession = class _ACPSession {
       await this.sendErrorResponse(id, -32602, "path is required");
       return;
     }
+    if (msg.method === "fs/write_text_file") {
+      const allowed = await this.authorizeCallback({
+        toolCallId: `acp-fs-write-${id}`,
+        title: `Write file: ${params.path}`,
+        kind: "edit"
+      });
+      if (!allowed) {
+        await this.sendErrorResponse(id, -32602, "filesystem write denied by permission policy");
+        return;
+      }
+    }
     try {
       if (msg.method === "fs/read_text_file") {
         const result = await this.fileServer.readTextFile({
@@ -2608,6 +2807,15 @@ var ACPSession = class _ACPSession {
     try {
       switch (msg.method) {
         case "terminal/create": {
+          const allowed = await this.authorizeCallback({
+            toolCallId: `acp-terminal-create-${id}`,
+            title: `Run command: ${String(params.command ?? "")} ${(Array.isArray(params.args) ? params.args : []).join(" ")}`.trim(),
+            kind: "execute"
+          });
+          if (!allowed) {
+            await this.sendErrorResponse(id, -32602, "terminal create denied by permission policy");
+            return;
+          }
           const createOpts = {
             sessionId: String(params.sessionId ?? ""),
             command: String(params.command ?? ""),
@@ -2899,6 +3107,28 @@ var AGENTS_CATALOG = [
     },
     integration: "experimental",
     docs: "https://cursor.com"
+  },
+  // ── Moonshot AI (Kimi) ─────────────────────────────────────────────
+  {
+    id: "kimi",
+    displayName: "Kimi Code CLI",
+    vendor: "moonshot",
+    probe: { command: "kimi", args: ["--version"] },
+    // Kimi Code CLI speaks ACP behind `kimi acp`. The user must complete
+    // terminal login (`kimi` → `/login`) before launching `kimi acp`;
+    // otherwise session creation fails with `Authentication required`.
+    // The adapter reuses the CLI's existing auth state — WrongStack does
+    // NOT capture or replay the Kimi OAuth tokens.
+    // Docs: https://www.kimi.com/code/docs/en/kimi-code-cli/reference/kimi-acp.html
+    acp: { command: "kimi", args: ["acp"] },
+    supports: {
+      loadSession: true,
+      promptImages: true,
+      terminal: true,
+      fs: true
+    },
+    integration: "native",
+    docs: "https://www.kimi.com/code/docs/en/kimi-code-cli/guides/ides.html"
   }
 ];
 function findAgentDescriptor(id) {
@@ -3115,7 +3345,11 @@ var REGISTRY_ID_ALIASES = {
   "claude-code": "claude-acp",
   "gemini-cli": "gemini",
   "codex-cli": "codex-acp",
-  copilot: "github-copilot-cli"
+  copilot: "github-copilot-cli",
+  // Kimi's live registry id is `kimi` — same as our catalog id, so the
+  // alias is identity. Listed explicitly so `resolveAcpAgentCommand`
+  // finds the live entry when the registry is synced.
+  kimi: "kimi"
 };
 function resolveAcpAgentCommand(id, overrides, live) {
   const ov = overrides?.[id];
@@ -3461,6 +3695,7 @@ function inferVendor(entry) {
   if (hay.includes("google") || hay.includes("gemini")) return "google";
   if (hay.includes("openai") || hay.includes("codex")) return "openai";
   if (hay.includes("github") || hay.includes("copilot")) return "github";
+  if (hay.includes("moonshot") || hay.includes("kimi")) return "moonshot";
   return "community";
 }
 async function fetchAcpRegistry(opts = {}) {