@wrongstack/acp 0.287.0 → 0.291.0

package/dist/client/acp-session.d.ts

@@ -326,6 +326,23 @@ export declare class ACPSession {
     private scratch;
     private resetScratch;
     private handlePermissionRequest;
+    /**
+     * Enforce authorization at privileged callback sinks (fs/write,
+     * terminal/create). Unlike `handlePermissionRequest` which responds to
+     * agent-initiated `session/request_permission` messages, this method is
+     * called by the handler BEFORE dispatching to FileServer/TerminalServer,
+     * closing the gap where the agent simply skips the voluntary permission
+     * request and sends the privileged callback directly.
+     *
+     * Uses the session's permission policy. The default policy
+     * (`defaultPermissionPolicy`) auto-approves everything — this is correct
+     * for trusted local agents (CLI `acp spawn`, Director fan-out). For
+     * untrusted/remote agents, the host should inject
+     * `readOnlyPermissionPolicy` or an interactive policy.
+     *
+     * Returns true if the callback is authorized, false if denied.
+     */
+    private authorizeCallback;
     private handleFsRequest;
     private handleTerminalRequest;
 }

package/dist/client/acp-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acp-session.d.ts","sourceRoot":"","sources":["../../src/client/acp-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEvF,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EAEf,KAAK,cAAc,EAEnB,KAAK,QAAQ,EACb,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAChD,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC5B,MAAM,EAAE,cAAc,CAAC;IACvB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;IACjF,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;IAC/B,kEAAkE;IAClE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,+CAA+C;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;AAEnE,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,EAAE,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;KAAE,CAAA;CAAE,GACtF;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE9C,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,uBAAuB,GACvB,eAAe,GACf,aAAa,GACb,eAAe,GACf,SAAS,GACT,QAAQ,GACR,YAAY,GACZ,wBAAwB,CAAC;AAE7B,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,SAAkB,KAAK,EAAE,OAAO,CAAC;IACjC,YAAY,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAKtE;CACF;AA2BD,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IAEzC,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,SAAS,CAA0B;IAC3C,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IACtE,OAAO,CAAC,MAAM,CAAK;IACnB,0CAA0C;IAC1C,OAAO,CAAC,MAAM,CAAS;IAGvB,OAAO,CAAC,iBAAiB,CAAyB;IAClD,OAAO,CAAC,SAAS,CAA8E;IAC/F,OAAO,CAAC,WAAW,CAAoB;IACvC,oEAAoE;IACpE,OAAO,CAAC,iBAAiB,CAAgC;IAEzD,OAAO,eAoBN;IAMD,uDAAuD;IACvD,eAAe,IAAI,iBAAiB,CAEnC;IAED,sDAAsD;IACtD,cAAc,IAAI,UAAU,EAAE,CAE7B;IAED,yDAAyD;IACzD,YAAY,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAEnF;IAED,oEAAoE;IACpE,YAAY,IAAI,OAAO,CAEtB;IAED,yCAAyC;IACzC,YAAY,IAAI,SAAS,GAAG,IAAI,CAE/B;IAED,qDAAqD;IACrD,oBAAoB,IAAI,MAAM,CAE7B;IAMD;;;OAGG;IACH,OAAa,KAAK,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAW/D;IAED;;;;;OAKG;IACH,OAAa,gBAAgB,CAC3B,MAAM,EAAE,+BAA+B,EACvC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,UAAU,CAAC,CAGrB;IAED;;;OAGG;IACH,OAAa,OAAO,CAClB,SAAS,EAAE,kBAAkB,EAC7B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,UAAU,CAAC,CAErB;IAED,6EAA6E;mBACxD,MAAM;YAgCb,UAAU;IAkDxB;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBlD;IAED;;;OAGG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAiB5B;IAMD;;;;;;;;;OASG;IACG,WAAW,CACf,SAAS,EAAE,SAAS,EACpB,UAAU,CAAC,EAAE,SAAS,EAAE,EACxB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CA2Bf;IAED;;;;;;;;OAQG;IACG,aAAa,CACjB,SAAS,EAAE,SAAS,EACpB,UAAU,CAAC,EAAE,SAAS,EAAE,EACxB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAyBf;IAED;;;;OAIG;IACG,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAwBvH;IAED;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBvD;IAED;;OAEG;IACG,WAAW,CACf,eAAe,EAAE,SAAS,EAC1B,GAAG,CAAC,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,SAAS,EAAE,GACvB,OAAO,CAAC,SAAS,CAAC,CAkBpB;IAED;;OAEG;IACG,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjE;IAED;;OAEG;IACG,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS1F;IAED;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CASzF;IAED;;OAEG;IACG,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAQzF;IAED;;OAEG;IACG,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOrF;IAED;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAOrC;IAMD;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CACV,MAAM,EAAE,YAAY,EAAE,EACtB,MAAM,EAAE,WAAW,EACnB,UAAU,CAAC,EAAE,kBAAkB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAgF9B;YAEa,aAAa;IAyB3B;;;;;;OAMG;YACW,YAAY;IAmB1B,wDAAwD;IAClD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CA0B3B;IAMD;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,OAAO;YAID,WAAW;IAmCzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,UAAU;IAIlB,wEAAwE;IACxE,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,aAAa;IA4ErB,OAAO,CAAC,YAAY;IA6DpB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IA+CvB,OAAO,CAAC,YAAY;IASpB,6EAA6E;IAC7E,OAAO,CAAC,eAAe,CAAmC;IAG1D,OAAO,CAAC,OAAO,CAOiD;IAEhE,OAAO,CAAC,YAAY;YAIN,uBAAuB;YA0BvB,eAAe;YA8Bf,qBAAqB;CAyDpC;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAEzE"}
+{"version":3,"file":"acp-session.d.ts","sourceRoot":"","sources":["../../src/client/acp-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEvF,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EAEf,KAAK,cAAc,EAEnB,KAAK,QAAQ,EACb,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAChD,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC5B,MAAM,EAAE,cAAc,CAAC;IACvB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;IACjF,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;IAC/B,kEAAkE;IAClE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,+CAA+C;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;AAEnE,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,EAAE,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;KAAE,CAAA;CAAE,GACtF;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE9C,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,uBAAuB,GACvB,eAAe,GACf,aAAa,GACb,eAAe,GACf,SAAS,GACT,QAAQ,GACR,YAAY,GACZ,wBAAwB,CAAC;AAE7B,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,SAAkB,KAAK,EAAE,OAAO,CAAC;IACjC,YAAY,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAKtE;CACF;AA2BD,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IAEzC,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,SAAS,CAA0B;IAC3C,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IACtE,OAAO,CAAC,MAAM,CAAK;IACnB,0CAA0C;IAC1C,OAAO,CAAC,MAAM,CAAS;IAGvB,OAAO,CAAC,iBAAiB,CAAyB;IAClD,OAAO,CAAC,SAAS,CAA8E;IAC/F,OAAO,CAAC,WAAW,CAAoB;IACvC,oEAAoE;IACpE,OAAO,CAAC,iBAAiB,CAAgC;IAEzD,OAAO,eAoBN;IAMD,uDAAuD;IACvD,eAAe,IAAI,iBAAiB,CAEnC;IAED,sDAAsD;IACtD,cAAc,IAAI,UAAU,EAAE,CAE7B;IAED,yDAAyD;IACzD,YAAY,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAEnF;IAED,oEAAoE;IACpE,YAAY,IAAI,OAAO,CAEtB;IAED,yCAAyC;IACzC,YAAY,IAAI,SAAS,GAAG,IAAI,CAE/B;IAED,qDAAqD;IACrD,oBAAoB,IAAI,MAAM,CAE7B;IAMD;;;OAGG;IACH,OAAa,KAAK,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAW/D;IAED;;;;;OAKG;IACH,OAAa,gBAAgB,CAC3B,MAAM,EAAE,+BAA+B,EACvC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,UAAU,CAAC,CAGrB;IAED;;;OAGG;IACH,OAAa,OAAO,CAClB,SAAS,EAAE,kBAAkB,EAC7B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,UAAU,CAAC,CAErB;IAED,6EAA6E;mBACxD,MAAM;YAgCb,UAAU;IAkDxB;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBlD;IAED;;;OAGG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAiB5B;IAMD;;;;;;;;;OASG;IACG,WAAW,CACf,SAAS,EAAE,SAAS,EACpB,UAAU,CAAC,EAAE,SAAS,EAAE,EACxB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CA2Bf;IAED;;;;;;;;OAQG;IACG,aAAa,CACjB,SAAS,EAAE,SAAS,EACpB,UAAU,CAAC,EAAE,SAAS,EAAE,EACxB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAyBf;IAED;;;;OAIG;IACG,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAwBvH;IAED;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBvD;IAED;;OAEG;IACG,WAAW,CACf,eAAe,EAAE,SAAS,EAC1B,GAAG,CAAC,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,SAAS,EAAE,GACvB,OAAO,CAAC,SAAS,CAAC,CAkBpB;IAED;;OAEG;IACG,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjE;IAED;;OAEG;IACG,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS1F;IAED;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CASzF;IAED;;OAEG;IACG,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAQzF;IAED;;OAEG;IACG,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOrF;IAED;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAOrC;IAMD;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CACV,MAAM,EAAE,YAAY,EAAE,EACtB,MAAM,EAAE,WAAW,EACnB,UAAU,CAAC,EAAE,kBAAkB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAgF9B;YAEa,aAAa;IAyB3B;;;;;;OAMG;YACW,YAAY;IAmB1B,wDAAwD;IAClD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CA0B3B;IAMD;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,OAAO;YAID,WAAW;IAmCzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,UAAU;IAIlB,wEAAwE;IACxE,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,aAAa;IA4ErB,OAAO,CAAC,YAAY;IA6DpB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IA+CvB,OAAO,CAAC,YAAY;IASpB,6EAA6E;IAC7E,OAAO,CAAC,eAAe,CAAmC;IAG1D,OAAO,CAAC,OAAO,CAOiD;IAEhE,OAAO,CAAC,YAAY;YAIN,uBAAuB;IA0BrC;;;;;;;;;;;;;;;OAeG;YACW,iBAAiB;YA8BjB,eAAe;YA8Cf,qBAAqB;CAqEpC;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAEzE"}

package/dist/client/file-server.d.ts

@@ -3,6 +3,17 @@ export interface FileServerOptions {
     projectRoot: string;
     /** Per-call timeout, default 30s. */
     timeoutMs?: number;
+    /**
+     * Hard cap on the number of bytes that may be read in a single
+     * `readTextFile` call. Protects against a malicious agent requesting a
+     * gigantic file to exhaust host memory. Default 5 MiB.
+     */
+    maxReadBytes?: number;
+    /**
+     * Hard cap on the number of bytes that may be written in a single
+     * `writeTextFile` call. Default 5 MiB.
+     */
+    maxWriteBytes?: number;
 }
 export interface ReadFileParams {
     sessionId: string;
@@ -13,7 +24,7 @@ export interface WriteFileParams {
     path: string;
     content: string;
 }
-export type FsErrorCode = 'ENOENT' | 'EACCES' | 'OUTSIDE_ROOT' | 'TIMEOUT' | 'INVALID_PATH';
+export type FsErrorCode = 'ENOENT' | 'EACCES' | 'OUTSIDE_ROOT' | 'TIMEOUT' | 'INVALID_PATH' | 'TOO_LARGE';
 /**
  * Thrown for protocol-level rejections (path outside root, etc.).
  * The session converts these into JSON-RPC error responses.
@@ -25,7 +36,10 @@ export declare class FsError extends Error {
 }
 export declare class FileServer {
     private readonly root;
+    private readonly realRoot;
     private readonly timeoutMs;
+    private readonly maxReadBytes;
+    private readonly maxWriteBytes;
     constructor(opts: FileServerOptions);
     /** Read a text file. Returns the content as a string. */
     readTextFile(params: ReadFileParams): Promise<{
@@ -34,11 +48,19 @@ export declare class FileServer {
     /** Write a text file. Atomic via write-then-rename. */
     writeTextFile(params: WriteFileParams): Promise<void>;
     /**
-     * Resolve a path; throw `FsError('OUTSIDE_ROOT')` if the result is
-     * not under the project root. Symlinks are not followed here — we
-     * operate on the textual path. A future hardening pass can
-     * `fs.realpath` each access to catch symlink escapes.
+     * Resolve a path and verify it is inside the project root by realpath.
+     * Rejects with `FsError` if the textual path, the resolved path, or the
+     * real (symlink-resolved) path escapes the project root.
+     *
+     * For files that don't exist yet (e.g. a write to a new file), the
+     * nearest existing ancestor directory is realpath-checked instead.
      */
     private resolveInside;
+    /**
+     * Resolve `resolvedPath` through `fs.realpath` and verify the result is
+     * inside `realRoot`. For non-existent paths (new files), walk up to the
+     * nearest existing ancestor and check that instead.
+     */
+    private assertRealInside;
 }
 //# sourceMappingURL=file-server.d.ts.map

package/dist/client/file-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-server.d.ts","sourceRoot":"","sources":["../../src/client/file-server.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,GAAG,cAAc,CAAC;AAE5F;;;GAGG;AACH,qBAAa,OAAQ,SAAQ,KAAK;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,YAAY,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAK3D;CACF;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YAAY,IAAI,EAAE,iBAAiB,EAGlC;IAED,yDAAyD;IACnD,YAAY,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAkBvE;IAED,uDAAuD;IACjD,aAAa,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB1D;IAED;;;;;OAKG;IACH,OAAO,CAAC,aAAa;CAetB"}
+{"version":3,"file":"file-server.d.ts","sourceRoot":"","sources":["../../src/client/file-server.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR,QAAQ,GACR,cAAc,GACd,SAAS,GACT,cAAc,GACd,WAAW,CAAC;AAKhB;;;GAGG;AACH,qBAAa,OAAQ,SAAQ,KAAK;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,YAAY,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAK3D;CACF;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC,YAAY,IAAI,EAAE,iBAAiB,EAWlC;IAED,yDAAyD;IACnD,YAAY,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CA8BvE;IAED,uDAAuD;IACjD,aAAa,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA4C1D;IAED;;;;;;;OAOG;YACW,aAAa;IAmB3B;;;;OAIG;YACW,gBAAgB;CAwB/B"}

package/dist/client/terminal-server.d.ts

@@ -4,6 +4,13 @@ export interface TerminalServerOptions {
     commandTimeoutMs?: number;
     /** Bytes of output to retain per terminal. Default 1 MiB. */
     outputByteLimit?: number;
+    /**
+     * Hard maximum cap on the per-call `outputByteLimit`. The agent can request
+     * a lower limit per terminal/create, but it can never raise it above this
+     * host-configured ceiling. Protects against memory exhaustion from a
+     * malicious agent requesting `outputByteLimit: Infinity`. Default 16 MiB.
+     */
+    maxOutputByteLimit?: number;
     /** Optional abort signal that kills ALL active terminals. */
     signal?: AbortSignal;
 }
@@ -12,6 +19,7 @@ export declare class TerminalServer {
     private readonly projectRoot;
     private readonly commandTimeoutMs;
     private readonly outputByteLimit;
+    private readonly maxOutputByteLimit;
     private nextId;
     constructor(opts: TerminalServerOptions);
     /** Spawn a new terminal. Returns the agent-facing id. */
@@ -50,5 +58,12 @@ export declare class TerminalServer {
     releaseAll(): void;
     private resolveCwd;
     private buildEnv;
+    /**
+     * Clamp an agent-supplied numeric to a finite positive safe integer, falling
+     * back to `defaultValue` for undefined/NaN/non-finite values. Prevents
+     * negative, NaN, or Infinity values from disabling output caps or causing
+     * unbounded memory growth.
+     */
+    private clampFiniteInt;
 }
 //# sourceMappingURL=terminal-server.d.ts.map

package/dist/client/terminal-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terminal-server.d.ts","sourceRoot":"","sources":["../../src/client/terminal-server.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAoBD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,MAAM,CAAK;IAEnB,YAAY,IAAI,EAAE,qBAAqB,EAOtC;IAED,yDAAyD;IACzD,MAAM,CAAC,MAAM,EAAE;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,GAAG,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACxC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAgGzB;IAED,iEAAiE;IACjE,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAA;KAAE,CAQlI;IAED,oEAAoE;IAC9D,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAIjG;IAED,mFAAmF;IACnF,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAQ7B;IAED,uDAAuD;IACvD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAahC;IAED,wDAAwD;IACxD,UAAU,IAAI,IAAI,CAIjB;IAED,OAAO,CAAC,UAAU;IAYlB,OAAO,CAAC,QAAQ;CAuBjB"}
+{"version":3,"file":"terminal-server.d.ts","sourceRoot":"","sources":["../../src/client/terminal-server.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,6DAA6D;IAC7D,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAoBD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,MAAM,CAAK;IAEnB,YAAY,IAAI,EAAE,qBAAqB,EAQtC;IAED,yDAAyD;IACzD,MAAM,CAAC,MAAM,EAAE;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,GAAG,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACxC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAmGzB;IAED,iEAAiE;IACjE,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAA;KAAE,CAQlI;IAED,oEAAoE;IAC9D,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAIjG;IAED,mFAAmF;IACnF,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAQ7B;IAED,uDAAuD;IACvD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAahC;IAED,wDAAwD;IACxD,UAAU,IAAI,IAAI,CAIjB;IAED,OAAO,CAAC,UAAU;IAwBlB,OAAO,CAAC,QAAQ;IAwBhB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;CASvB"}

package/dist/client.js

@@ -42,7 +42,7 @@ var ClientTransport = class {
   }
   async start() {
     if (this.child) return;
-    const [{ spawn: spawn2 }, { buildChildEnv }, os] = await Promise.all([
+    const [{ spawn: spawn2 }, { buildChildEnv: buildChildEnv2 }, os] = await Promise.all([
       import("node:child_process"),
       import("@wrongstack/core"),
       import("node:os")
@@ -59,7 +59,7 @@ var ClientTransport = class {
         const childArgs = this.opts.args ?? [];
         const shim = process.platform === "win32" ? buildWin32CmdShimInvocation(this.opts.command, childArgs) : null;
         this.child = spawn2(shim?.command ?? this.opts.command, shim?.args ?? childArgs, {
-          env: { ...buildChildEnv(), ...this.opts.env },
+          env: { ...buildChildEnv2(), ...this.opts.env },
           cwd: spawnCwd,
           stdio: ["pipe", "pipe", "pipe"],
           windowsHide: true,
@@ -366,8 +366,12 @@ var ToolTranslator = class {
 var ACP_PROTOCOL_VERSION = 1;
 
 // src/client/file-server.ts
+import { randomBytes } from "node:crypto";
+import { realpathSync } from "node:fs";
 import * as fsp from "node:fs/promises";
 import * as path from "node:path";
+var DEFAULT_MAX_READ_BYTES = 5 * 1024 * 1024;
+var DEFAULT_MAX_WRITE_BYTES = 5 * 1024 * 1024;
 var FsError = class extends Error {
   code;
   path;
@@ -380,23 +384,40 @@ var FsError = class extends Error {
 };
 var FileServer = class {
   root;
+  realRoot;
   timeoutMs;
+  maxReadBytes;
+  maxWriteBytes;
   constructor(opts) {
     this.root = path.resolve(opts.projectRoot);
+    this.realRoot = safeRealpathSync(this.root);
     this.timeoutMs = opts.timeoutMs ?? 3e4;
+    this.maxReadBytes = opts.maxReadBytes ?? DEFAULT_MAX_READ_BYTES;
+    this.maxWriteBytes = opts.maxWriteBytes ?? DEFAULT_MAX_WRITE_BYTES;
   }
   /** Read a text file. Returns the content as a string. */
   async readTextFile(params) {
-    const safe = this.resolveInside(params.path);
+    const safe = await this.resolveInside(params.path);
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     try {
+      const stat2 = await fsp.stat(safe).catch((err) => {
+        throw mapFsError(err, safe);
+      });
+      if (stat2.size > this.maxReadBytes) {
+        throw new FsError(
+          "TOO_LARGE",
+          safe,
+          `file is ${stat2.size} bytes, max read is ${this.maxReadBytes} bytes`
+        );
+      }
       const content = await fsp.readFile(safe, {
         encoding: "utf8",
         signal: controller.signal
       });
       return { content };
     } catch (err) {
+      if (err instanceof FsError) throw err;
       if (controller.signal.aborted) {
         throw new FsError("TIMEOUT", safe, `readTextFile timed out after ${this.timeoutMs}ms`);
       }
@@ -407,17 +428,31 @@ var FileServer = class {
   }
   /** Write a text file. Atomic via write-then-rename. */
   async writeTextFile(params) {
-    const safe = this.resolveInside(params.path);
+    const byteLength = Buffer.byteLength(params.content, "utf8");
+    if (byteLength > this.maxWriteBytes) {
+      throw new FsError(
+        "TOO_LARGE",
+        params.path,
+        `content is ${byteLength} bytes, max write is ${this.maxWriteBytes} bytes`
+      );
+    }
+    const safe = await this.resolveInside(params.path);
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-    const tmp = `${safe}.${randomHex(4)}.tmp`;
+    const tmp = `${safe}.${randomBytes(6).toString("hex")}.tmp`;
     try {
       await fsp.writeFile(tmp, params.content, {
         encoding: "utf8",
         signal: controller.signal
       });
+      await this.assertRealInside(tmp);
+      await this.assertRealInside(path.dirname(safe));
       await fsp.rename(tmp, safe);
     } catch (err) {
+      if (err instanceof FsError) {
+        await fsp.unlink(tmp).catch(() => void 0);
+        throw err;
+      }
       try {
         await fsp.unlink(tmp);
       } catch {
@@ -431,12 +466,14 @@ var FileServer = class {
     }
   }
   /**
-   * Resolve a path; throw `FsError('OUTSIDE_ROOT')` if the result is
-   * not under the project root. Symlinks are not followed here — we
-   * operate on the textual path. A future hardening pass can
-   * `fs.realpath` each access to catch symlink escapes.
+   * Resolve a path and verify it is inside the project root by realpath.
+   * Rejects with `FsError` if the textual path, the resolved path, or the
+   * real (symlink-resolved) path escapes the project root.
+   *
+   * For files that don't exist yet (e.g. a write to a new file), the
+   * nearest existing ancestor directory is realpath-checked instead.
    */
-  resolveInside(p) {
+  async resolveInside(p) {
     if (typeof p !== "string" || p.length === 0) {
       throw new FsError("INVALID_PATH", p, "path is empty or not a string");
     }
@@ -448,8 +485,38 @@ var FileServer = class {
     if (resolved !== this.root && !resolved.startsWith(rootWithSep)) {
       throw new FsError("OUTSIDE_ROOT", resolved, "path is outside the project root");
     }
+    await this.assertRealInside(resolved);
     return resolved;
   }
+  /**
+   * Resolve `resolvedPath` through `fs.realpath` and verify the result is
+   * inside `realRoot`. For non-existent paths (new files), walk up to the
+   * nearest existing ancestor and check that instead.
+   */
+  async assertRealInside(resolvedPath) {
+    let probe = resolvedPath;
+    for (; ; ) {
+      let real;
+      try {
+        real = await fsp.realpath(probe);
+      } catch (err) {
+        const code = err.code;
+        if (code === "ENOENT") {
+          const parent = path.dirname(probe);
+          if (parent === probe) return;
+          probe = parent;
+          continue;
+        }
+        throw mapFsError(err, resolvedPath);
+      }
+      if (real === this.realRoot || real.startsWith(this.realRoot + path.sep)) return;
+      throw new FsError(
+        "OUTSIDE_ROOT",
+        resolvedPath,
+        "path resolves through a symlink outside the project root"
+      );
+    }
+  }
 };
 function mapFsError(err, p) {
   const code = err?.code;
@@ -460,12 +527,12 @@ function mapFsError(err, p) {
   const msg = err instanceof Error ? err.message : String(err);
   return new FsError("INVALID_PATH", p, msg);
 }
-function randomHex(bytes) {
-  let out = "";
-  for (let i = 0; i < bytes * 2; i++) {
-    out += Math.floor(Math.random() * 16).toString(16);
+function safeRealpathSync(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
   }
-  return out;
 }
 
 // src/client/permission.ts
@@ -514,17 +581,21 @@ function makePermissionPolicy(decide) {
 
 // src/client/terminal-server.ts
 import { spawn } from "node:child_process";
+import { realpathSync as realpathSync2 } from "node:fs";
 import * as path2 from "node:path";
+import { buildChildEnv } from "@wrongstack/core/utils";
 var TerminalServer = class {
   terminals = /* @__PURE__ */ new Map();
   projectRoot;
   commandTimeoutMs;
   outputByteLimit;
+  maxOutputByteLimit;
   nextId = 1;
   constructor(opts) {
     this.projectRoot = path2.resolve(opts.projectRoot);
     this.commandTimeoutMs = opts.commandTimeoutMs ?? 5 * 6e4;
     this.outputByteLimit = opts.outputByteLimit ?? 1024 * 1024;
+    this.maxOutputByteLimit = opts.maxOutputByteLimit ?? 16 * 1024 * 1024;
     if (opts.signal) {
       opts.signal.addEventListener("abort", () => this.releaseAll());
     }
@@ -578,12 +649,15 @@ var TerminalServer = class {
           state.exitStatus = exitStatus;
           state.output += `[spawn error] ${err.message}
 `;
-          state.retainedBytes += Buffer.byteLength(state.output, "utf8");
+          state.retainedBytes = Buffer.byteLength(state.output, "utf8");
           resolve3(exitStatus);
         });
       })
     };
-    const perCallByteLimit = params.outputByteLimit ?? this.outputByteLimit;
+    const perCallByteLimit = Math.min(
+      Math.max(1, this.clampFiniteInt(params.outputByteLimit, this.outputByteLimit)),
+      this.maxOutputByteLimit
+    );
     proc.stdout?.setEncoding("utf8");
     proc.stderr?.setEncoding("utf8");
     const onData = (chunk) => {
@@ -663,24 +737,57 @@ var TerminalServer = class {
     if (resolved !== this.projectRoot && !resolved.startsWith(rootWithSep)) {
       return this.projectRoot;
     }
-    return resolved;
-  }
-  buildEnv(agentEnv) {
-    const env = { ...process.env };
-    if (process.platform === "win32") {
-      if (env.Path !== void 0 && env.PATH === void 0) env.PATH = env.Path;
-      if (env.PATHEXT !== void 0 && env.PATHEXT_CASE === void 0) {
-        env.PATHEXT_CASE = env.PATHEXT;
+    try {
+      const realRoot = realpathSync2(this.projectRoot);
+      const realCwd = realpathSync2(resolved);
+      const realRootWithSep = realRoot.endsWith(path2.sep) ? realRoot : realRoot + path2.sep;
+      if (realCwd !== realRoot && !realCwd.startsWith(realRootWithSep)) {
+        return realRoot;
       }
+      return realCwd;
+    } catch {
+      return this.projectRoot;
     }
+  }
+  buildEnv(agentEnv) {
+    const env = buildChildEnv();
     if (agentEnv) {
       for (const { name, value } of agentEnv) {
+        const upper = name.toUpperCase();
+        if (DENIED_AGENT_ENV_KEYS.has(upper)) continue;
         env[name] = value;
       }
     }
     return env;
   }
+  /**
+   * Clamp an agent-supplied numeric to a finite positive safe integer, falling
+   * back to `defaultValue` for undefined/NaN/non-finite values. Prevents
+   * negative, NaN, or Infinity values from disabling output caps or causing
+   * unbounded memory growth.
+   */
+  clampFiniteInt(value, defaultValue) {
+    if (value === void 0 || !Number.isFinite(value) || value < 1) {
+      return defaultValue;
+    }
+    return Math.trunc(value);
+  }
 };
+var DENIED_AGENT_ENV_KEYS = /* @__PURE__ */ new Set([
+  "NODE_OPTIONS",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "DYLD_INSERT_LIBRARIES",
+  "DYLD_LIBRARY_PATH",
+  "DYLD_FALLBACK_LIBRARY_PATH",
+  "PATH",
+  "PYTHONPATH",
+  "PYTHONSTARTUP",
+  "PERL5OPT",
+  "PERLLIB",
+  "RUBYOPT",
+  "RUBYLIB"
+]);
 
 // src/client/acp-session.ts
 var ACPSessionError = class extends Error {
@@ -1542,6 +1649,43 @@ var ACPSession = class _ACPSession {
       await this.sendErrorResponse(id, -32603, `permission policy failed: ${message}`);
     }
   }
+  /**
+   * Enforce authorization at privileged callback sinks (fs/write,
+   * terminal/create). Unlike `handlePermissionRequest` which responds to
+   * agent-initiated `session/request_permission` messages, this method is
+   * called by the handler BEFORE dispatching to FileServer/TerminalServer,
+   * closing the gap where the agent simply skips the voluntary permission
+   * request and sends the privileged callback directly.
+   *
+   * Uses the session's permission policy. The default policy
+   * (`defaultPermissionPolicy`) auto-approves everything — this is correct
+   * for trusted local agents (CLI `acp spawn`, Director fan-out). For
+   * untrusted/remote agents, the host should inject
+   * `readOnlyPermissionPolicy` or an interactive policy.
+   *
+   * Returns true if the callback is authorized, false if denied.
+   */
+  async authorizeCallback(partial) {
+    try {
+      const outcome = await this.permissionPolicy({
+        toolCall: {
+          sessionUpdate: "tool_call_update",
+          toolCallId: partial.toolCallId,
+          title: partial.title,
+          kind: partial.kind,
+          status: "pending"
+        },
+        options: [
+          { optionId: "allow", name: "Allow", kind: "allow_once" },
+          { optionId: "reject", name: "Reject", kind: "reject_once" }
+        ],
+        signal: new AbortController().signal
+      });
+      return outcome.outcome === "selected" && outcome.optionId !== "reject" && outcome.optionId !== "reject_once" && outcome.optionId !== "reject_always";
+    } catch {
+      return false;
+    }
+  }
   async handleFsRequest(msg) {
     const id = msg.id;
     if (id === void 0) return;
@@ -1550,6 +1694,17 @@ var ACPSession = class _ACPSession {
       await this.sendErrorResponse(id, -32602, "path is required");
       return;
     }
+    if (msg.method === "fs/write_text_file") {
+      const allowed = await this.authorizeCallback({
+        toolCallId: `acp-fs-write-${id}`,
+        title: `Write file: ${params.path}`,
+        kind: "edit"
+      });
+      if (!allowed) {
+        await this.sendErrorResponse(id, -32602, "filesystem write denied by permission policy");
+        return;
+      }
+    }
     try {
       if (msg.method === "fs/read_text_file") {
         const result = await this.fileServer.readTextFile({
@@ -1578,6 +1733,15 @@ var ACPSession = class _ACPSession {
     try {
       switch (msg.method) {
         case "terminal/create": {
+          const allowed = await this.authorizeCallback({
+            toolCallId: `acp-terminal-create-${id}`,
+            title: `Run command: ${String(params.command ?? "")} ${(Array.isArray(params.args) ? params.args : []).join(" ")}`.trim(),
+            kind: "execute"
+          });
+          if (!allowed) {
+            await this.sendErrorResponse(id, -32602, "terminal create denied by permission policy");
+            return;
+          }
           const createOpts = {
             sessionId: String(params.sessionId ?? ""),
             command: String(params.command ?? ""),