@wrongstack/acp 0.287.0 → 0.291.0

package/dist/agent/server-agent-turn.d.ts

@@ -62,7 +62,7 @@ export interface ACPServerAgentTurnOptions {
     timeoutMs?: number | undefined;
 }
 /** A recorded conversation turn, replayable on `session/load`. */
-export interface SessionReplayUpdate {
+interface SessionReplayUpdate {
     sessionUpdate: 'user_message_chunk' | 'agent_message_chunk';
     content: {
         type: 'text';
@@ -105,4 +105,5 @@ export declare function makeACPServerAgentTurn(opts: ACPServerAgentTurnOptions):
 export declare function disposeACPServerAgentTurn(opts: {
     agents: Map<string, Agent>;
 }): Promise<void>;
+export {};
 //# sourceMappingURL=server-agent-turn.d.ts.map

package/dist/agent/server-agent-turn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-agent-turn.d.ts","sourceRoot":"","sources":["../../src/agent/server-agent-turn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAE,KAAK,EAAc,MAAM,kBAAkB,CAAC;AAQ1D,OAAO,KAAK,EACV,OAAO,EACP,UAAU,EACV,aAAa,EACd,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,CACR,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,GAAG,CAAC,EAAE,UAAU,KACb,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,oBAAoB,GAAG,qBAAqB,CAAC;IAC5D,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACpH,8DAA8D;IAC9D,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACjD;;;;;OAKG;IACH,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;CACpG;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,yBAAyB,GAC9B,kBAAkB,CA8JpB;AAwFD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE;IAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CAAE,GACnC,OAAO,CAAC,IAAI,CAAC,CAIf"}
+{"version":3,"file":"server-agent-turn.d.ts","sourceRoot":"","sources":["../../src/agent/server-agent-turn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAE,KAAK,EAAc,MAAM,kBAAkB,CAAC;AAQ1D,OAAO,KAAK,EACV,OAAO,EACP,UAAU,EACV,aAAa,EACd,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,CACR,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,GAAG,CAAC,EAAE,UAAU,KACb,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,kEAAkE;AAClE,UAAU,mBAAmB;IAC3B,aAAa,EAAE,oBAAoB,GAAG,qBAAqB,CAAC;IAC5D,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACpH,8DAA8D;IAC9D,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACjD;;;;;OAKG;IACH,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;CACpG;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,yBAAyB,GAC9B,kBAAkB,CA8JpB;AAwFD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE;IAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CAAE,GACnC,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/dist/agent/session-store.d.ts

@@ -1,6 +1,6 @@
 import type { SessionState } from './protocol-handler.js';
 /** A persisted conversation turn (user/agent message chunk) for replay. */
-export interface PersistedHistoryUpdate {
+interface PersistedHistoryUpdate {
     sessionUpdate: string;
     content: unknown;
 }
@@ -50,4 +50,5 @@ export declare class ACPSessionStore {
     /** Get the store directory path. */
     getDirectory(): string;
 }
+export {};
 //# sourceMappingURL=session-store.d.ts.map

package/dist/agent/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/agent/session-store.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D,2EAA2E;AAC3E,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,uEAAuE;AACvE,MAAM,WAAW,gBAAiB,SAAQ,OAAO,CAAC,YAAY,CAAC;IAC7D,OAAO,CAAC,EAAE,sBAAsB,EAAE,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,WAAW,CAAS;IAE5B,YAAY,IAAI,GAAE,mBAAwB,EAEzC;IAED,sEAAsE;IAChE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAI1B;IAED;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBnF;IAED,wEAAwE;IAClE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAO9D;IAED,mCAAmC;IAC7B,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAsC9D;IAED,0EAA0E;IAC1E,OAAO,CAAC,SAAS;IAIjB,yEAAyE;YAC3D,SAAS;IAwBvB,sEAAsE;YACxD,UAAU;IAOxB,wEAAwE;YAC1D,WAAW;IAiBzB,6BAA6B;IACvB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB7C;IAED,oCAAoC;IACpC,YAAY,IAAI,MAAM,CAErB;CACF"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/agent/session-store.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D,2EAA2E;AAC3E,UAAU,sBAAsB;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,uEAAuE;AACvE,MAAM,WAAW,gBAAiB,SAAQ,OAAO,CAAC,YAAY,CAAC;IAC7D,OAAO,CAAC,EAAE,sBAAsB,EAAE,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,WAAW,CAAS;IAE5B,YAAY,IAAI,GAAE,mBAAwB,EAEzC;IAED,sEAAsE;IAChE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAI1B;IAED;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBnF;IAED,wEAAwE;IAClE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAO9D;IAED,mCAAmC;IAC7B,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAsC9D;IAED,0EAA0E;IAC1E,OAAO,CAAC,SAAS;IAIjB,yEAAyE;YAC3D,SAAS;IAwBvB,sEAAsE;YACxD,UAAU;IAOxB,wEAAwE;YAC1D,WAAW;IAiBzB,6BAA6B;IACvB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB7C;IAED,oCAAoC;IACpC,YAAY,IAAI,MAAM,CAErB;CACF"}

package/dist/agent/wrongstack-acp-agent.d.ts

@@ -11,6 +11,13 @@ export interface WrongStackACPServerOptions {
     transport?: 'stdio' | number | undefined;
     /** Host for HTTP transport. Defaults to '127.0.0.1'. */
     host?: string | undefined;
+    /**
+     * Bearer token required for HTTP transport authentication. When set,
+     * every HTTP request must include `Authorization: Bearer <token>` or
+     * `?token=<token>` in the query string. When unset, the server is
+     * unauthenticated (acceptable for loopback-only development).
+     */
+    authToken?: string | undefined;
     /** Emit the pre-v1 startup marker on stdio. Defaults to false. */
     legacyStartupMarker?: boolean | undefined;
     /**

package/dist/agent/wrongstack-acp-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wrongstack-acp-agent.d.ts","sourceRoot":"","sources":["../../src/agent/wrongstack-acp-agent.ts"],"names":[],"mappings":"AA8BA,OAAO,EAEL,KAAK,OAAO,EAEZ,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAG/B,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IACzC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,kEAAkE;IAClE,mBAAmB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GAAG,SAAS,CAAC;IACpG;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACjH;;;OAGG;IACH,KAAK,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACxC;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,+CAA+C;IAC/C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,OAAO,CAAS;IAExB,YAAY,IAAI,GAAE,0BAA+B,EAahD;IAED;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAO3B;YAEa,UAAU;YAcV,SAAS;IAkGvB,uBAAuB;IACvB,IAAI,IAAI,IAAI,CAOX;CACF"}
+{"version":3,"file":"wrongstack-acp-agent.d.ts","sourceRoot":"","sources":["../../src/agent/wrongstack-acp-agent.ts"],"names":[],"mappings":"AA8BA,OAAO,EAEL,KAAK,OAAO,EAEZ,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAG/B,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IACzC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,kEAAkE;IAClE,mBAAmB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GAAG,SAAS,CAAC;IACpG;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACjH;;;OAGG;IACH,KAAK,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACxC;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,+CAA+C;IAC/C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,OAAO,CAAS;IAExB,YAAY,IAAI,GAAE,0BAA+B,EAahD;IAED;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAO3B;YAEa,UAAU;YAcV,SAAS;IAmKvB,uBAAuB;IACvB,IAAI,IAAI,IAAI,CAOX;CACF"}

package/dist/agent.js

@@ -1145,7 +1145,21 @@ var WrongStackACPServer = class {
   async startHttp(port) {
     const host = this.options.host ?? "127.0.0.1";
     const handler = this.handler;
+    const authToken = this.options.authToken;
+    let httpChain = Promise.resolve();
     this.httpServer = createServer(async (req, res) => {
+      if (authToken) {
+        const url = new URL(req.url ?? "/", `http://${host}:${port}`);
+        const queryToken = url.searchParams.get("token");
+        const authHeader = req.headers["authorization"];
+        const bearerToken = Array.isArray(authHeader) ? authHeader[0]?.replace(/^Bearer\s+/i, "") : authHeader?.replace(/^Bearer\s+/i, "");
+        const supplied = queryToken ?? bearerToken ?? "";
+        if (supplied !== authToken) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: { code: -32001, message: "Unauthorized" } }));
+          return;
+        }
+      }
       const selfOrigin = `http://${host}:${port}`;
       const reqOrigin = Array.isArray(req.headers.origin) ? req.headers.origin[0] : req.headers.origin;
       if (reqOrigin && reqOrigin !== selfOrigin) {
@@ -1155,7 +1169,7 @@ var WrongStackACPServer = class {
       }
       if (reqOrigin) res.setHeader("Access-Control-Allow-Origin", reqOrigin);
       res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
-      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id");
+      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id, Authorization");
       if (req.method === "OPTIONS") {
         res.writeHead(204);
         res.end();
@@ -1166,10 +1180,23 @@ var WrongStackACPServer = class {
         res.end(JSON.stringify({ error: "method not allowed" }));
         return;
       }
+      const MAX_HTTP_BODY = 10 * 1024 * 1024;
       let body = "";
+      let bodyBytes = 0;
+      let tooLarge = false;
       for await (const chunk of req) {
+        bodyBytes += chunk.length;
+        if (bodyBytes > MAX_HTTP_BODY) {
+          tooLarge = true;
+          break;
+        }
         body += chunk;
       }
+      if (tooLarge) {
+        res.writeHead(413, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: { code: -32700, message: "Request body too large" } }));
+        return;
+      }
       let msg;
       try {
         msg = JSON.parse(body);
@@ -1178,26 +1205,43 @@ var WrongStackACPServer = class {
         res.end(JSON.stringify({ error: { code: -32700, message: "Parse error" } }));
         return;
       }
-      const notifications = [];
-      let response = null;
-      const originalSend = this.transport.send.bind(this.transport);
-      this.transport.send = async (m) => {
-        if (m.id !== void 0 && (m.result !== void 0 || m.error !== void 0)) {
-          response = m;
-        } else if (m.method === "session/update") {
-          notifications.push(m.params);
-        } else {
-          notifications.push(m);
+      const isNotification = typeof msg === "object" && msg !== null && msg.id === void 0 && typeof msg.method === "string";
+      if (isNotification) {
+        try {
+          await handler.handleMessage(msg);
+        } catch {
         }
-      };
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ notifications: [] }));
+        return;
+      }
+      const requestPromise = httpChain.then(async () => {
+        const notifications = [];
+        let response = null;
+        const originalSend = this.transport.send.bind(this.transport);
+        this.transport.send = async (m) => {
+          if (m.id !== void 0 && (m.result !== void 0 || m.error !== void 0)) {
+            response = m;
+          } else if (m.method === "session/update") {
+            notifications.push(m.params);
+          } else {
+            notifications.push(m);
+          }
+        };
+        try {
+          await handler.handleMessage(msg);
+        } finally {
+          this.transport.send = originalSend;
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        const responseBody = response !== null ? { ...response, notifications } : { notifications };
+        res.end(JSON.stringify(responseBody));
+      });
+      httpChain = requestPromise.catch(() => void 0);
       try {
-        await handler.handleMessage(msg);
-      } finally {
-        this.transport.send = originalSend;
+        await requestPromise;
+      } catch {
       }
-      res.writeHead(200, { "Content-Type": "application/json" });
-      const responseBody = response !== null ? { ...response, notifications } : { notifications };
-      res.end(JSON.stringify(responseBody));
     });
     return new Promise((resolve) => {
       this.httpServer.listen(port, host, () => {