@wrongstack/acp 0.292.1 → 0.295.0

package/dist/client.js

@@ -1,5 +1,5 @@
 // src/agent/stdio-transport.ts
-import { expectDefined, writeErr } from "@wrongstack/core";
+import { expectDefined, writeErr } from "@wrongstack/core/utils";
 
 // src/win32-cmd.ts
 var WIN32_CMD_META = /[&|<>"\r\n\0]/;
@@ -26,6 +26,11 @@ function quoteWin32CmdArg(arg) {
 }
 
 // src/agent/stdio-transport.ts
+var DEFAULT_MAX_FRAME_CHARS = 20 * 1024 * 1024;
+var DEFAULT_MAX_QUEUED_MESSAGES = 1e3;
+function positiveLimit(value, fallback) {
+  return Number.isFinite(value) && (value ?? 0) > 0 ? Math.floor(value) : fallback;
+}
 var ClientTransport = class {
   child = null;
   buffer = "";
@@ -34,17 +39,24 @@ var ClientTransport = class {
   resolveRead = null;
   messageQueue = [];
   opts;
+  maxFrameChars;
+  maxQueuedMessages;
   constructor(options) {
     this.opts = {
       handshakeTimeoutMs: 3e4,
       ...options
     };
+    this.maxFrameChars = positiveLimit(options.maxFrameChars, DEFAULT_MAX_FRAME_CHARS);
+    this.maxQueuedMessages = positiveLimit(
+      options.maxQueuedMessages,
+      DEFAULT_MAX_QUEUED_MESSAGES
+    );
   }
   async start() {
     if (this.child) return;
     const [{ spawn: spawn2 }, { buildChildEnv: buildChildEnv2 }, os] = await Promise.all([
       import("node:child_process"),
-      import("@wrongstack/core"),
+      import("@wrongstack/core/utils"),
       import("node:os")
     ]);
     return new Promise((resolve3, reject) => {
@@ -139,10 +151,16 @@ var ClientTransport = class {
     return () => this.handlers.delete(handler);
   }
   stop() {
-    if (!this.child) return;
     this.closed = true;
+    this.resolveRead?.(null);
+    this.resolveRead = null;
+    this.buffer = "";
+    this.messageQueue.length = 0;
+    this.handlers.clear();
+    const child = this.child;
+    if (!child) return;
     try {
-      this.child.kill();
+      child.kill();
     } catch {
     }
     this.child = null;
@@ -151,8 +169,20 @@ var ClientTransport = class {
     this.buffer += chunk;
     const lines = this.buffer.split("\n");
     this.buffer = lines.pop() ?? "";
+    if (this.buffer.length > this.maxFrameChars) {
+      writeErr(`[acp-child pending frame exceeds ${this.maxFrameChars} characters]
+`);
+      this.stop();
+      return;
+    }
     for (const raw of lines) {
       if (!raw.trim()) continue;
+      if (raw.length > this.maxFrameChars) {
+        writeErr(`[acp-child frame exceeds ${this.maxFrameChars} characters]
+`);
+        this.stop();
+        return;
+      }
       try {
         this.dispatch(JSON.parse(raw));
       } catch {
@@ -166,6 +196,9 @@ var ClientTransport = class {
     this.closed = true;
     this.resolveRead?.(null);
     this.resolveRead = null;
+    this.buffer = "";
+    this.messageQueue.length = 0;
+    this.handlers.clear();
     if (code !== 0 && code !== null) {
       writeErr(`[acp-child exited with code ${code}]
 `);
@@ -176,7 +209,13 @@ var ClientTransport = class {
       const resolve3 = this.resolveRead;
       this.resolveRead = null;
       resolve3(msg);
-    } else {
+    } else if (this.handlers.size === 0) {
+      if (this.messageQueue.length >= this.maxQueuedMessages) {
+        writeErr(`[acp-child message queue exceeds ${this.maxQueuedMessages} entries]
+`);
+        this.stop();
+        return;
+      }
       this.messageQueue.push(msg);
     }
     for (const handler of this.handlers) {
@@ -188,180 +227,6 @@ var ClientTransport = class {
   }
 };
 
-// src/client/websocket-transport.ts
-var WebSocketClientTransport = class {
-  ws = null;
-  handlers = /* @__PURE__ */ new Set();
-  closed = false;
-  opts;
-  constructor(opts) {
-    this.opts = opts;
-  }
-  start() {
-    const WS = globalThis.WebSocket;
-    if (!WS) {
-      return Promise.reject(
-        new Error(
-          "global WebSocket is not available \u2014 Node \u2265 22 is required for the remote ACP transport"
-        )
-      );
-    }
-    const timeoutMs = this.opts.handshakeTimeoutMs ?? 3e4;
-    return new Promise((resolve3, reject) => {
-      let settled = false;
-      const ws = new WS(this.opts.url, this.opts.protocols);
-      this.ws = ws;
-      const timer = setTimeout(() => {
-        if (settled) return;
-        settled = true;
-        try {
-          ws.close();
-        } catch {
-        }
-        reject(new Error(`WebSocket failed to open within ${timeoutMs}ms`));
-      }, timeoutMs);
-      ws.addEventListener("open", () => {
-        if (settled) return;
-        settled = true;
-        clearTimeout(timer);
-        resolve3();
-      });
-      ws.addEventListener("error", (ev) => {
-        if (settled) {
-          this.closed = true;
-          return;
-        }
-        settled = true;
-        clearTimeout(timer);
-        const message = ev && typeof ev === "object" && "message" in ev ? String(ev.message) : "WebSocket error";
-        reject(new Error(message));
-      });
-      ws.addEventListener("close", () => {
-        this.closed = true;
-      });
-      ws.addEventListener("message", (ev) => {
-        this.onData(ev.data);
-      });
-    });
-  }
-  send(msg) {
-    if (this.closed || !this.ws) {
-      return Promise.reject(new Error("WebSocket transport is not open"));
-    }
-    try {
-      this.ws.send(JSON.stringify(msg));
-      return Promise.resolve();
-    } catch (err) {
-      return Promise.reject(err instanceof Error ? err : new Error(String(err)));
-    }
-  }
-  onMessage(handler) {
-    this.handlers.add(handler);
-    return () => this.handlers.delete(handler);
-  }
-  stop() {
-    this.closed = true;
-    if (this.ws) {
-      try {
-        this.ws.close();
-      } catch {
-      }
-      this.ws = null;
-    }
-  }
-  onData(data) {
-    const text = typeof data === "string" ? data : data instanceof ArrayBuffer ? Buffer.from(data).toString("utf8") : Buffer.isBuffer(data) ? data.toString("utf8") : String(data);
-    if (!text.trim()) return;
-    let msg;
-    try {
-      msg = JSON.parse(text);
-    } catch {
-      for (const line of text.split("\n")) {
-        if (!line.trim()) continue;
-        try {
-          this.dispatch(JSON.parse(line));
-        } catch {
-        }
-      }
-      return;
-    }
-    this.dispatch(msg);
-  }
-  dispatch(msg) {
-    for (const handler of [...this.handlers]) {
-      try {
-        handler(msg);
-      } catch {
-      }
-    }
-  }
-};
-
-// src/client/tool-translator.ts
-import { expectDefined as expectDefined2 } from "@wrongstack/core";
-var DEFAULT_OPTIONS = {
-  asyncTools: true,
-  pollIntervalMs: 500,
-  totalTimeoutMs: 12e4
-};
-var ToolTranslator = class {
-  opts;
-  pending = /* @__PURE__ */ new Map();
-  constructor(opts = {}) {
-    this.opts = { ...DEFAULT_OPTIONS, ...opts };
-  }
-  /**
-   * Start listening to a transport for tool responses and cancellations.
-   * Call this once after constructing the translator and before sending tasks.
-   */
-  attachToTransport(transport) {
-    transport.onMessage((msg) => {
-      if (msg.method === "tools/call" && msg.id !== void 0) {
-        const pending = this.pending.get(msg.id);
-        if (pending) {
-          clearTimeout(pending.timeout);
-          this.pending.delete(expectDefined2(msg.id));
-          pending.resolve(msg);
-        }
-      }
-      if (msg.method === "cancel" && msg.id !== void 0) {
-        const pending = this.pending.get(msg.id);
-        if (pending) {
-          clearTimeout(pending.timeout);
-          this.pending.delete(expectDefined2(msg.id));
-          pending.reject(new Error("Call cancelled by client"));
-        }
-      }
-    });
-  }
-  /**
-   * Send a tool call over the transport and wait for a response.
-   * If asyncTools is true, polls for progress and resolves when the final
-   * response arrives.
-   */
-  async callTool(transport, name, args, callId = crypto.randomUUID()) {
-    await transport.send({
-      jsonrpc: "2.0",
-      method: "tools/call",
-      id: callId,
-      params: { name, arguments: args }
-    });
-    return new Promise((resolve3, reject) => {
-      const timeout = setTimeout(() => {
-        this.pending.delete(callId);
-        reject(new Error(`Tool call ${name} timed out after ${this.opts.totalTimeoutMs}ms`));
-      }, this.opts.totalTimeoutMs);
-      this.pending.set(callId, { resolve: resolve3, reject, timeout });
-    });
-  }
-  cancelAll() {
-    for (const [, p] of this.pending) {
-      clearTimeout(p.timeout);
-    }
-    this.pending.clear();
-  }
-};
-
 // src/types/acp-v1.ts
 var ACP_PROTOCOL_VERSION = 1;
 
@@ -584,26 +449,42 @@ import { spawn } from "node:child_process";
 import { realpathSync as realpathSync2 } from "node:fs";
 import * as path2 from "node:path";
 import { buildChildEnv } from "@wrongstack/core/utils";
+var EMPTY_BUFFER = Buffer.alloc(0);
 var TerminalServer = class {
   terminals = /* @__PURE__ */ new Map();
   projectRoot;
   commandTimeoutMs;
   outputByteLimit;
   maxOutputByteLimit;
+  maxTerminals;
+  abortSignal;
+  abortHandler = () => this.releaseAll();
   nextId = 1;
   constructor(opts) {
     this.projectRoot = path2.resolve(opts.projectRoot);
     this.commandTimeoutMs = opts.commandTimeoutMs ?? 5 * 6e4;
     this.outputByteLimit = opts.outputByteLimit ?? 1024 * 1024;
     this.maxOutputByteLimit = opts.maxOutputByteLimit ?? 16 * 1024 * 1024;
+    this.maxTerminals = this.clampFiniteInt(opts.maxTerminals, 32);
+    if (this.maxTerminals < 1) throw new RangeError("maxTerminals must be at least 1");
+    this.abortSignal = opts.signal;
     if (opts.signal) {
-      opts.signal.addEventListener("abort", () => this.releaseAll());
+      opts.signal.addEventListener("abort", this.abortHandler, { once: true });
     }
   }
   /** Spawn a new terminal. Returns the agent-facing id. */
   create(params) {
+    if (this.terminals.size >= this.maxTerminals) {
+      throw new Error(
+        `terminal limit reached (${this.maxTerminals}); release an existing terminal before creating another`
+      );
+    }
     const id = `term_${this.nextId++}`;
     const cwd = this.resolveCwd(params.cwd);
+    const perCallByteLimit = Math.min(
+      Math.max(1, this.clampFiniteInt(params.outputByteLimit, this.outputByteLimit)),
+      this.maxOutputByteLimit
+    );
     const proc = spawn(params.command, params.args ?? [], {
       cwd,
       env: this.buildEnv(params.env),
@@ -622,7 +503,8 @@ var TerminalServer = class {
       cwd,
       command: params.command,
       args: params.args ?? [],
-      output: "",
+      outputChunks: [],
+      outputHead: 0,
       retainedBytes: 0,
       truncated: false,
       exitStatus: void 0,
@@ -647,31 +529,44 @@ var TerminalServer = class {
           }
           const exitStatus = { exitCode: 127, signal: null };
           state.exitStatus = exitStatus;
-          state.output += `[spawn error] ${err.message}
-`;
-          state.retainedBytes = Buffer.byteLength(state.output, "utf8");
+          let errorOutput = Buffer.from(`[spawn error] ${err.message}
+`, "utf8");
+          if (errorOutput.length > perCallByteLimit) {
+            let start = errorOutput.length - perCallByteLimit;
+            while (start < errorOutput.length && (errorOutput[start] & 192) === 128) start++;
+            errorOutput = errorOutput.subarray(start);
+            state.truncated = true;
+          }
+          state.outputChunks.push(errorOutput);
+          state.retainedBytes = errorOutput.length;
           resolve3(exitStatus);
         });
       })
     };
-    const perCallByteLimit = Math.min(
-      Math.max(1, this.clampFiniteInt(params.outputByteLimit, this.outputByteLimit)),
-      this.maxOutputByteLimit
-    );
     proc.stdout?.setEncoding("utf8");
     proc.stderr?.setEncoding("utf8");
     const onData = (chunk) => {
-      state.output += chunk;
-      state.retainedBytes = Buffer.byteLength(state.output, "utf8");
-      while (state.retainedBytes > perCallByteLimit) {
-        const trimmed = state.output.slice(1);
-        state.output = trimmed;
-        const newBytes = Buffer.byteLength(state.output, "utf8");
-        if (newBytes >= state.retainedBytes) {
-          break;
+      const outputChunk = Buffer.from(chunk, "utf8");
+      state.outputChunks.push(outputChunk);
+      state.retainedBytes += outputChunk.length;
+      if (state.retainedBytes > perCallByteLimit) state.truncated = true;
+      while (state.retainedBytes > perCallByteLimit && state.outputHead < state.outputChunks.length) {
+        const first = state.outputChunks[state.outputHead];
+        const overflow = state.retainedBytes - perCallByteLimit;
+        if (first.length <= overflow) {
+          state.outputChunks[state.outputHead] = EMPTY_BUFFER;
+          state.outputHead++;
+          state.retainedBytes -= first.length;
+          continue;
         }
-        state.retainedBytes = newBytes;
-        state.truncated = true;
+        let start = overflow;
+        while (start < first.length && (first[start] & 192) === 128) start++;
+        state.outputChunks[state.outputHead] = first.subarray(start);
+        state.retainedBytes -= start;
+      }
+      if (state.outputHead >= 256 && state.outputHead * 2 >= state.outputChunks.length) {
+        state.outputChunks = state.outputChunks.slice(state.outputHead);
+        state.outputHead = 0;
       }
     };
     proc.stdout?.on("data", onData);
@@ -690,7 +585,10 @@ var TerminalServer = class {
     const state = this.terminals.get(terminalId);
     if (!state) throw new Error(`unknown terminal: ${terminalId}`);
     return {
-      output: state.output,
+      output: Buffer.concat(
+        state.outputChunks.slice(state.outputHead),
+        state.retainedBytes
+      ).toString("utf8"),
       truncated: state.truncated,
       ...state.exitStatus ? { exitStatus: state.exitStatus } : {}
     };
@@ -726,6 +624,7 @@ var TerminalServer = class {
   }
   /** Kill all active terminals. Used on session close. */
   releaseAll() {
+    this.abortSignal?.removeEventListener("abort", this.abortHandler);
     for (const id of [...this.terminals.keys()]) {
       this.release(id);
     }
@@ -789,6 +688,213 @@ var DENIED_AGENT_ENV_KEYS = /* @__PURE__ */ new Set([
   "RUBYLIB"
 ]);
 
+// src/client/trust-boundary-permission.ts
+function pickOption(options, allowed) {
+  const kinds = allowed ? ["allow_once", "allow_always"] : ["reject_once", "reject_always"];
+  for (const kind of kinds) {
+    const option = options.find((candidate) => candidate.kind === kind);
+    if (option) return { outcome: "selected", optionId: option.optionId };
+  }
+  return { outcome: "cancelled" };
+}
+function riskFor(kind) {
+  if (kind === "read" || kind === "search" || kind === "fetch" || kind === "think") return "low";
+  if (kind === "edit" || kind === "move") return "elevated";
+  if (kind === "delete" || kind === "execute") return "high";
+  return "elevated";
+}
+function capabilityFor(request) {
+  const raw = request.toolCall.rawInput;
+  if (typeof raw?.path === "string") {
+    return request.toolCall.kind === "read" || request.toolCall.kind === "search" ? "filesystem.read" : "filesystem.write";
+  }
+  if (typeof raw?.command === "string" || request.toolCall.kind === "execute")
+    return "process.spawn";
+  if (request.toolCall.kind === "fetch") return "network.fetch";
+  return `tool.${request.toolCall.kind ?? "unknown"}`;
+}
+function subjectFor(request) {
+  const raw = request.toolCall.rawInput;
+  const title = request.toolCall.title ?? `ACP tool call ${String(request.toolCall.toolCallId)}`;
+  if (typeof raw?.path === "string") {
+    return { kind: "path", id: raw.path, attributes: { toolKind: request.toolCall.kind ?? null } };
+  }
+  if (typeof raw?.command === "string") {
+    return {
+      kind: "command",
+      id: raw.command,
+      attributes: { toolKind: request.toolCall.kind ?? null }
+    };
+  }
+  return {
+    kind: "resource",
+    id: title,
+    attributes: { toolKind: request.toolCall.kind ?? null }
+  };
+}
+function isAllowed(decision) {
+  return decision.kind === "allow" || decision.kind === "scoped-token";
+}
+function toTrustBoundaryRequest(request, options) {
+  const rawSessionId = request.toolCall.rawInput?.sessionId;
+  const sessionId = typeof rawSessionId === "string" && rawSessionId.length > 0 ? rawSessionId : options.actor?.sessionId;
+  return {
+    version: 1,
+    requestId: String(request.toolCall.toolCallId),
+    actor: {
+      ...options.actor ?? { kind: "agent" },
+      ...sessionId ? { sessionId } : {}
+    },
+    surface: "acp",
+    capability: capabilityFor(request),
+    subject: subjectFor(request),
+    risk: riskFor(request.toolCall.kind),
+    scope: {
+      ...options.scope ?? {},
+      ...sessionId ? { sessionId } : {}
+    },
+    ...options.authContext ? { authContext: options.authContext } : {},
+    metadata: {
+      ...request.toolCall.title ? { title: request.toolCall.title } : {},
+      toolKind: request.toolCall.kind ?? null
+    }
+  };
+}
+function makeTrustBoundaryPermissionPolicy(options) {
+  return async (request) => {
+    if (request.signal.aborted) return { outcome: "cancelled" };
+    const decision = await options.boundary.evaluate(toTrustBoundaryRequest(request, options));
+    if (request.signal.aborted) return { outcome: "cancelled" };
+    return pickOption(request.options, isAllowed(decision));
+  };
+}
+
+// src/client/websocket-transport.ts
+var WebSocketClientTransport = class {
+  ws = null;
+  handlers = /* @__PURE__ */ new Set();
+  closed = false;
+  opts;
+  maxBufferedBytes;
+  maxMessageChars;
+  constructor(opts) {
+    this.opts = opts;
+    this.maxBufferedBytes = finitePositiveLimit(opts.maxBufferedBytes, 32 * 1024 * 1024);
+    this.maxMessageChars = finitePositiveLimit(opts.maxMessageChars, 20 * 1024 * 1024);
+  }
+  start() {
+    const WS = globalThis.WebSocket;
+    if (!WS) {
+      return Promise.reject(
+        new Error(
+          "global WebSocket is not available \u2014 Node \u2265 22 is required for the remote ACP transport"
+        )
+      );
+    }
+    const timeoutMs = this.opts.handshakeTimeoutMs ?? 3e4;
+    return new Promise((resolve3, reject) => {
+      let settled = false;
+      const ws = new WS(this.opts.url, this.opts.protocols);
+      this.ws = ws;
+      const timer = setTimeout(() => {
+        if (settled) return;
+        settled = true;
+        try {
+          ws.close();
+        } catch {
+        }
+        reject(new Error(`WebSocket failed to open within ${timeoutMs}ms`));
+      }, timeoutMs);
+      ws.addEventListener("open", () => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        resolve3();
+      });
+      ws.addEventListener("error", (ev) => {
+        if (settled) {
+          this.closed = true;
+          return;
+        }
+        settled = true;
+        clearTimeout(timer);
+        const message = ev && typeof ev === "object" && "message" in ev ? String(ev.message) : "WebSocket error";
+        reject(new Error(message));
+      });
+      ws.addEventListener("close", () => {
+        this.closed = true;
+      });
+      ws.addEventListener("message", (ev) => {
+        this.onData(ev.data);
+      });
+    });
+  }
+  send(msg) {
+    if (this.closed || !this.ws) {
+      return Promise.reject(new Error("WebSocket transport is not open"));
+    }
+    try {
+      const serialized = JSON.stringify(msg);
+      const buffered = Number.isFinite(this.ws.bufferedAmount) ? this.ws.bufferedAmount ?? 0 : 0;
+      if (buffered + Buffer.byteLength(serialized, "utf8") > this.maxBufferedBytes) {
+        this.stop();
+        return Promise.reject(new Error("WebSocket transport send buffer limit exceeded"));
+      }
+      this.ws.send(serialized);
+      return Promise.resolve();
+    } catch (err) {
+      return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+    }
+  }
+  onMessage(handler) {
+    this.handlers.add(handler);
+    return () => this.handlers.delete(handler);
+  }
+  stop() {
+    this.closed = true;
+    if (this.ws) {
+      try {
+        this.ws.close();
+      } catch {
+      }
+      this.ws = null;
+    }
+  }
+  onData(data) {
+    const text = typeof data === "string" ? data : data instanceof ArrayBuffer ? Buffer.from(data).toString("utf8") : Buffer.isBuffer(data) ? data.toString("utf8") : String(data);
+    if (text.length > this.maxMessageChars) {
+      this.stop();
+      return;
+    }
+    if (!text.trim()) return;
+    let msg;
+    try {
+      msg = JSON.parse(text);
+    } catch {
+      for (const line of text.split("\n")) {
+        if (!line.trim()) continue;
+        try {
+          this.dispatch(JSON.parse(line));
+        } catch {
+        }
+      }
+      return;
+    }
+    this.dispatch(msg);
+  }
+  dispatch(msg) {
+    for (const handler of [...this.handlers]) {
+      try {
+        handler(msg);
+      } catch {
+      }
+    }
+  }
+};
+function finitePositiveLimit(value, fallback) {
+  return Number.isFinite(value) && (value ?? 0) > 0 ? Math.floor(value) : fallback;
+}
+
 // src/client/acp-session.ts
 var ACPSessionError = class extends Error {
   kind;
@@ -810,6 +916,7 @@ var ACPSession = class _ACPSession {
   permissionPolicy;
   timeoutMs;
   opts;
+  transportOff = null;
   state = "init";
   sessionId = null;
   /** Pending outbound requests (initialize, session/new, session/prompt, etc). */
@@ -841,8 +948,19 @@ var ACPSession = class _ACPSession {
     if (opts.terminalOutputByteLimit !== void 0) {
       termOpts.outputByteLimit = opts.terminalOutputByteLimit;
     }
+    if (opts.terminalMaxCount !== void 0) {
+      termOpts.maxTerminals = opts.terminalMaxCount;
+    }
     this.terminalServer = new TerminalServer(termOpts);
-    this.permissionPolicy = opts.permissionPolicy ?? defaultPermissionPolicy;
+    if (opts.permissionPolicy && opts.trustBoundary) {
+      throw new TypeError("permissionPolicy and trustBoundary are mutually exclusive");
+    }
+    this.permissionPolicy = opts.trustBoundary ? makeTrustBoundaryPermissionPolicy({
+      boundary: opts.trustBoundary,
+      ...opts.trustActor ? { actor: opts.trustActor } : {},
+      scope: opts.trustScope ?? { cwd: opts.projectRoot },
+      ...opts.trustAuthContext ? { authContext: opts.trustAuthContext } : {}
+    }) : opts.permissionPolicy ?? readOnlyPermissionPolicy;
   }
   // ──────────────────────────────────────────────────────────────────────
   // Public accessors
@@ -916,10 +1034,12 @@ var ACPSession = class _ACPSession {
       throw new ACPSessionError("spawn_failed", `${spawnErrLabel}: ${msg}`, err);
     }
     const session = new _ACPSession(opts, transport);
-    transport.onMessage((msg) => session.handleMessage(msg));
+    session.transportOff = transport.onMessage((msg) => session.handleMessage(msg));
     try {
       await session.initialize();
     } catch (err) {
+      session.transportOff?.();
+      session.transportOff = null;
       try {
         transport.stop();
       } catch {
@@ -1083,7 +1203,11 @@ var ACPSession = class _ACPSession {
       mcpServers: servers
     });
     if (isJsonRpcError(result)) {
-      throw new ACPSessionError("prompt_failed", `session/resume failed: ${result.message}`, result);
+      throw new ACPSessionError(
+        "prompt_failed",
+        `session/resume failed: ${result.message}`,
+        result
+      );
     }
     this.sessionId = sessionId;
   }
@@ -1134,7 +1258,11 @@ var ACPSession = class _ACPSession {
     const id = this.allocId();
     const result = await this.sendRequest(id, "session/delete", { sessionId });
     if (isJsonRpcError(result)) {
-      throw new ACPSessionError("prompt_failed", `session/delete failed: ${result.message}`, result);
+      throw new ACPSessionError(
+        "prompt_failed",
+        `session/delete failed: ${result.message}`,
+        result
+      );
     }
     if (this.sessionId === sessionId) {
       this.sessionId = null;
@@ -1169,7 +1297,11 @@ var ACPSession = class _ACPSession {
     const id = this.allocId();
     const result = await this.sendRequest(id, "session/set_mode", { sessionId, modeId });
     if (isJsonRpcError(result)) {
-      throw new ACPSessionError("prompt_failed", `session/set_mode failed: ${result.message}`, result);
+      throw new ACPSessionError(
+        "prompt_failed",
+        `session/set_mode failed: ${result.message}`,
+        result
+      );
     }
   }
   /**
@@ -1184,7 +1316,11 @@ var ACPSession = class _ACPSession {
       value
     });
     if (isJsonRpcError(result)) {
-      throw new ACPSessionError("prompt_failed", `session/set_config_option failed: ${result.message}`, result);
+      throw new ACPSessionError(
+        "prompt_failed",
+        `session/set_config_option failed: ${result.message}`,
+        result
+      );
     }
   }
   /**
@@ -1195,7 +1331,11 @@ var ACPSession = class _ACPSession {
     const id = this.allocId();
     const result = await this.sendRequest(id, "providers/list", {});
     if (isJsonRpcError(result)) {
-      throw new ACPSessionError("prompt_failed", `providers/list failed: ${result.message}`, result);
+      throw new ACPSessionError(
+        "prompt_failed",
+        `providers/list failed: ${result.message}`,
+        result
+      );
     }
     const r = result;
     return { providers: r.providers ?? [], currentProviderId: r.currentProviderId ?? null };
@@ -1231,7 +1371,11 @@ var ACPSession = class _ACPSession {
     const id = this.allocId();
     const result = await this.sendRequest(id, "providers/disable", {});
     if (isJsonRpcError(result)) {
-      throw new ACPSessionError("prompt_failed", `providers/disable failed: ${result.message}`, result);
+      throw new ACPSessionError(
+        "prompt_failed",
+        `providers/disable failed: ${result.message}`,
+        result
+      );
     }
   }
   // ──────────────────────────────────────────────────────────────────────
@@ -1338,11 +1482,7 @@ var ACPSession = class _ACPSession {
     }
     const sessionId = result.sessionId;
     if (typeof sessionId !== "string" || sessionId.length === 0) {
-      throw new ACPSessionError(
-        "protocol_error",
-        "session/new returned no sessionId",
-        result
-      );
+      throw new ACPSessionError("protocol_error", "session/new returned no sessionId", result);
     }
     this.sessionId = sessionId;
   }
@@ -1385,6 +1525,8 @@ var ACPSession = class _ACPSession {
       p.reject(new ACPSessionError("closed", "session was closed"));
     }
     this.pending.clear();
+    this.transportOff?.();
+    this.transportOff = null;
     try {
       this.transport.stop();
     } catch {
@@ -1420,10 +1562,7 @@ var ACPSession = class _ACPSession {
       const handle = setTimeout(() => {
         this.pending.delete(id);
         reject(
-          new ACPSessionError(
-            "protocol_error",
-            `${method} timed out after ${effectiveTimeout}ms`
-          )
+          new ACPSessionError("protocol_error", `${method} timed out after ${effectiveTimeout}ms`)
         );
       }, effectiveTimeout);
       this.pending.set(id, {
@@ -1657,11 +1796,12 @@ var ACPSession = class _ACPSession {
    * closing the gap where the agent simply skips the voluntary permission
    * request and sends the privileged callback directly.
    *
-   * Uses the session's permission policy. The default policy
-   * (`defaultPermissionPolicy`) auto-approves everything — this is correct
-   * for trusted local agents (CLI `acp spawn`, Director fan-out). For
-   * untrusted/remote agents, the host should inject
-   * `readOnlyPermissionPolicy` or an interactive policy.
+   * Uses the session's permission policy. The default
+   * (`readOnlyPermissionPolicy`) auto-approves only side-effect-free tool
+   * calls (read/search/fetch/think) and rejects everything else — this is
+   * the safe-by-default posture. For trusted local agents (CLI `acp spawn`,
+   * Director fan-out), inject `defaultPermissionPolicy` to grant
+   * write/execute access.
    *
    * Returns true if the callback is authorized, false if denied.
    */
@@ -1673,7 +1813,8 @@ var ACPSession = class _ACPSession {
           toolCallId: partial.toolCallId,
           title: partial.title,
           kind: partial.kind,
-          status: "pending"
+          status: "pending",
+          ...partial.rawInput ? { rawInput: partial.rawInput } : {}
         },
         options: [
           { optionId: "allow", name: "Allow", kind: "allow_once" },
@@ -1698,7 +1839,8 @@ var ACPSession = class _ACPSession {
       const allowed = await this.authorizeCallback({
         toolCallId: `acp-fs-write-${id}`,
         title: `Write file: ${params.path}`,
-        kind: "edit"
+        kind: "edit",
+        rawInput: { path: params.path, sessionId: params.sessionId }
       });
       if (!allowed) {
         await this.sendErrorResponse(id, -32602, "filesystem write denied by permission policy");
@@ -1736,7 +1878,13 @@ var ACPSession = class _ACPSession {
           const allowed = await this.authorizeCallback({
             toolCallId: `acp-terminal-create-${id}`,
             title: `Run command: ${String(params.command ?? "")} ${(Array.isArray(params.args) ? params.args : []).join(" ")}`.trim(),
-            kind: "execute"
+            kind: "execute",
+            rawInput: {
+              command: params.command,
+              args: params.args,
+              cwd: params.cwd,
+              sessionId: params.sessionId
+            }
           });
           if (!allowed) {
             await this.sendErrorResponse(id, -32602, "terminal create denied by permission policy");
@@ -1963,6 +2111,71 @@ function isRetryable(kind) {
       return false;
   }
 }
+
+// src/client/tool-translator.ts
+import { expectDefined as expectDefined2 } from "@wrongstack/core/utils";
+var DEFAULT_OPTIONS = {
+  asyncTools: true,
+  pollIntervalMs: 500,
+  totalTimeoutMs: 12e4
+};
+var ToolTranslator = class {
+  opts;
+  pending = /* @__PURE__ */ new Map();
+  constructor(opts = {}) {
+    this.opts = { ...DEFAULT_OPTIONS, ...opts };
+  }
+  /**
+   * Start listening to a transport for tool responses and cancellations.
+   * Call this once after constructing the translator and before sending tasks.
+   */
+  attachToTransport(transport) {
+    transport.onMessage((msg) => {
+      if (msg.method === "tools/call" && msg.id !== void 0) {
+        const pending = this.pending.get(msg.id);
+        if (pending) {
+          clearTimeout(pending.timeout);
+          this.pending.delete(expectDefined2(msg.id));
+          pending.resolve(msg);
+        }
+      }
+      if (msg.method === "cancel" && msg.id !== void 0) {
+        const pending = this.pending.get(msg.id);
+        if (pending) {
+          clearTimeout(pending.timeout);
+          this.pending.delete(expectDefined2(msg.id));
+          pending.reject(new Error("Call cancelled by client"));
+        }
+      }
+    });
+  }
+  /**
+   * Send a tool call over the transport and wait for a response.
+   * If asyncTools is true, polls for progress and resolves when the final
+   * response arrives.
+   */
+  async callTool(transport, name, args, callId = crypto.randomUUID()) {
+    await transport.send({
+      jsonrpc: "2.0",
+      method: "tools/call",
+      id: callId,
+      params: { name, arguments: args }
+    });
+    return new Promise((resolve3, reject) => {
+      const timeout = setTimeout(() => {
+        this.pending.delete(callId);
+        reject(new Error(`Tool call ${name} timed out after ${this.opts.totalTimeoutMs}ms`));
+      }, this.opts.totalTimeoutMs);
+      this.pending.set(callId, { resolve: resolve3, reject, timeout });
+    });
+  }
+  cancelAll() {
+    for (const [, p] of this.pending) {
+      clearTimeout(p.timeout);
+    }
+    this.pending.clear();
+  }
+};
 export {
   ACPSession,
   ACPSessionError,
@@ -1974,7 +2187,9 @@ export {
   imageContent,
   makeACPSubagentRunner,
   makePermissionPolicy,
+  makeTrustBoundaryPermissionPolicy,
   readOnlyPermissionPolicy,
-  textContent
+  textContent,
+  toTrustBoundaryRequest
 };
 //# sourceMappingURL=client.js.map