@wrongstack/acp 0.292.1 → 0.295.0

package/dist/index.js

@@ -1,628 +1,526 @@
-// src/agent/stdio-transport.ts
-import { expectDefined, writeErr } from "@wrongstack/core";
-
-// src/win32-cmd.ts
-var WIN32_CMD_META = /[&|<>"\r\n\0]/;
-function buildWin32CmdShimInvocation(command, args = []) {
-  assertSafeWin32CmdArgs([command, ...args]);
-  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
-  return {
-    command: process.env["COMSPEC"] ?? "cmd.exe",
-    args: ["/d", "/c", line],
-    windowsVerbatimArguments: true
-  };
+// src/types/acp-v1.ts
+var ACP_PROTOCOL_VERSION = 1;
+function assertNeverSessionUpdate(x) {
+  throw new Error(
+    `Unhandled sessionUpdate: ${JSON.stringify(x)}`
+  );
 }
-function assertSafeWin32CmdArgs(args) {
-  for (const arg of args) {
-    if (typeof arg === "string" && WIN32_CMD_META.test(arg)) {
-      throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
-      );
+
+// src/version.ts
+import { createRequire } from "node:module";
+var require2 = createRequire(import.meta.url);
+function readPackageVersion() {
+  try {
+    const packageJson = require2("../package.json");
+    if (typeof packageJson.version === "string" && packageJson.version.length > 0) {
+      return packageJson.version;
     }
+  } catch {
   }
+  return "dev";
 }
-function quoteWin32CmdArg(arg) {
-  return `"${arg}"`;
+var ACP_PACKAGE_VERSION = readPackageVersion();
+
+// src/agent/protocol-contract.ts
+function toWire(msg) {
+  return msg;
 }
+var WRONGSTACK_VERSION = ACP_PACKAGE_VERSION;
 
-// src/agent/stdio-transport.ts
-var StdioTransport = class {
-  stdin = process.stdin;
-  stdout = process.stdout;
-  stderr = process.stderr;
-  buffer = "";
-  handlers = /* @__PURE__ */ new Set();
-  closed = false;
-  resolveRead = null;
-  messageQueue = [];
-  constructor() {
-    this.stdin.resume();
-    this.stdin.setEncoding("utf8");
-    this.stdin.on("data", (chunk) => this.onData(chunk));
-    this.stdin.on("end", () => this.handleClose());
-    this.stdin.on("error", (err) => this.failAll(err));
+// src/agent/protocol-handler.ts
+var WRONGSTACK_AUTH_METHODS = [
+  {
+    id: "wrongstack-auth",
+    name: "Run wstack auth",
+    description: "Configure a WrongStack model provider in an interactive terminal.",
+    type: "terminal",
+    args: ["auth"]
   }
-  sendStartupMarker() {
-    this.stdout.write("[wstack-acp]\n", "utf8");
+];
+var DEFAULT_MODE_ID = "code";
+var DEFAULT_MAX_SESSIONS = 64;
+var DEFAULT_MODES = [
+  {
+    id: DEFAULT_MODE_ID,
+    name: "Code",
+    description: "Default agent mode for code-generation tasks."
   }
-  send(msg) {
-    if (this.closed) return Promise.resolve();
-    return new Promise((resolve3) => {
-      const line = JSON.stringify(msg) + "\n";
-      this.stdout.write(line, "utf8", () => resolve3());
+];
+var ACPProtocolHandler = class {
+  transport;
+  defaultCwd;
+  runTurn;
+  onSessionNew;
+  modes;
+  configOptions;
+  agentName;
+  replayFor;
+  seedFor;
+  disposeFor;
+  maxSessions;
+  store;
+  initialized = false;
+  clientCapabilities = {};
+  sessions = /* @__PURE__ */ new Map();
+  nextId = 1;
+  // Outbound request correlation (server → client requests, e.g.
+  // session/request_permission). Keyed by our own `srv_N` ids.
+  pendingOut = /* @__PURE__ */ new Map();
+  nextOutId = 1;
+  constructor(opts) {
+    this.transport = opts.transport;
+    this.defaultCwd = opts.defaultCwd;
+    this.runTurn = opts.runTurn;
+    this.onSessionNew = opts.onSessionNew ?? (() => {
     });
+    this.modes = opts.modes ?? DEFAULT_MODES;
+    this.configOptions = opts.configOptions ?? [];
+    this.agentName = opts.agentName ?? "wrongstack";
+    this.replayFor = opts.replayFor;
+    this.seedFor = opts.seedFor;
+    this.disposeFor = opts.disposeFor;
+    this.maxSessions = Number.isFinite(opts.maxSessions) && (opts.maxSessions ?? 0) > 0 ? Math.floor(opts.maxSessions) : DEFAULT_MAX_SESSIONS;
+    this.store = opts.store;
+    if (typeof this.transport.onMessage === "function") {
+      this.transport.onMessage((m) => this.maybeResolvePending(m));
+    }
   }
-  sendRaw(chunk) {
-    this.stdout.write(chunk, "utf8");
-  }
-  read() {
-    if (this.messageQueue.length > 0) return Promise.resolve(expectDefined(this.messageQueue.shift()));
-    if (this.closed) return Promise.resolve(null);
-    return new Promise((resolve3) => {
-      this.resolveRead = resolve3;
+  /**
+   * Send a request to the client and await its response. Used for
+   * server-initiated calls like `session/request_permission`. Rejects on
+   * timeout or transport error so the caller can pick a safe fallback.
+   */
+  request(method, params, timeoutMs = 6e4) {
+    const id = `srv_${this.nextOutId++}`;
+    return new Promise((resolve3, reject) => {
+      const timer = setTimeout(() => {
+        this.pendingOut.delete(id);
+        reject(new Error(`${method} timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
+      this.pendingOut.set(id, { resolve: resolve3, reject, timer });
+      this.transport.send(toWire({ jsonrpc: "2.0", id, method, params })).catch((e) => {
+        clearTimeout(timer);
+        this.pendingOut.delete(id);
+        reject(e instanceof Error ? e : new Error(String(e)));
+      });
     });
   }
-  onMessage(handler) {
-    this.handlers.add(handler);
-    return () => this.handlers.delete(handler);
+  maybeResolvePending(m) {
+    const id = m.id;
+    if (typeof id !== "string") return;
+    const pending = this.pendingOut.get(id);
+    if (!pending) return;
+    this.pendingOut.delete(id);
+    clearTimeout(pending.timer);
+    const err = m.error;
+    if (err) pending.reject(new Error(err.message ?? "client request failed"));
+    else pending.resolve(m.result);
+  }
+  /**
+   * Process one inbound message. Returns true if this was a terminal
+   * message (rare; reserved for future use by the server's own
+   * shutdown signal).
+   */
+  async handleMessage(msg) {
+    if (typeof msg !== "object" || msg === null) return false;
+    const m = msg;
+    if (m.id !== void 0 && (m.result !== void 0 || m.error !== void 0)) {
+      return false;
+    }
+    if (m.id !== void 0 && typeof m.method === "string") {
+      return this.handleRequest(m.id, m.method, m.params);
+    }
+    if (typeof m.method === "string") {
+      return this.handleNotification(m.method, m.params);
+    }
+    return false;
   }
+  /** Abort all active turns and drop session state. */
   close() {
-    this.closed = true;
-    this.stdin.pause();
-    this.resolveRead?.(null);
-    this.resolveRead = null;
+    for (const [sessionId, session] of this.sessions) {
+      session.abort.abort();
+      this.disposeSession(sessionId);
+    }
+    this.sessions.clear();
+    for (const [, p] of this.pendingOut) {
+      clearTimeout(p.timer);
+      p.reject(new Error("protocol handler closed"));
+    }
+    this.pendingOut.clear();
   }
-  onData(chunk) {
-    this.buffer += chunk;
-    const lines = this.buffer.split("\n");
-    this.buffer = lines.pop() ?? "";
-    for (const raw of lines) {
-      if (!raw.trim()) continue;
-      try {
-        this.dispatch(JSON.parse(raw));
-      } catch (err) {
-        this.stderr.write(`[wstack-acp parse error] ${err}
-`, "utf8");
-      }
+  disposeSession(sessionId) {
+    try {
+      this.disposeFor?.(sessionId);
+    } catch {
     }
   }
-  dispatch(msg) {
-    if (this.resolveRead) {
-      const resolve3 = this.resolveRead;
-      this.resolveRead = null;
-      resolve3(msg);
-    } else {
-      this.messageQueue.push(msg);
+  // ────────────────────────────────────────────────────────────────────
+  // Requests
+  // ────────────────────────────────────────────────────────────────────
+  async handleRequest(id, method, params) {
+    if (method !== "initialize" && !this.initialized) {
+      await this.sendError(id, -32e3, "Not initialized");
+      return false;
     }
-    for (const handler of this.handlers) {
-      try {
-        handler(msg);
-      } catch (err) {
-        this.stderr.write(`[wstack-acp handler error] ${err}
-`, "utf8");
+    try {
+      switch (method) {
+        case "initialize":
+          return await this.handleInitialize(id, params);
+        case "authenticate":
+          return await this.handleAuthenticate(id, params);
+        case "logout":
+          return await this.handleLogout(id, params);
+        case "session/new":
+          return await this.handleSessionNew(id, params);
+        case "session/load":
+          return await this.handleSessionLoad(id, params);
+        case "session/resume":
+          return await this.handleSessionResume(id, params);
+        case "session/close":
+          return await this.handleSessionClose(id, params);
+        case "session/delete":
+          return await this.handleSessionDelete(id, params);
+        case "session/prompt":
+          return await this.handleSessionPrompt(id, params);
+        case "session/set_mode":
+          return await this.handleSetMode(id, params);
+        case "session/set_config_option":
+          return await this.handleSetConfigOption(id, params);
+        case "session/list":
+          return await this.handleSessionList(id);
+        case "session/fork":
+          return await this.handleSessionFork(id, params);
+        case "providers/list":
+          return await this.handleProvidersList(id, params);
+        case "providers/set":
+          return await this.handleProvidersSet(id, params);
+        case "providers/disable":
+          return await this.handleProvidersDisable(id, params);
+        case "mcp/message":
+          return await this.handleMcpMessage(id, params);
+        default:
+          await this.sendError(id, -32601, `Unknown method: ${method}`);
+          return false;
       }
+    } catch (err) {
+      const { code, message, data } = errorToJsonRpc(err);
+      await this.sendError(id, code, message, data);
+      return false;
     }
   }
-  handleClose() {
-    this.closed = true;
-    this.resolveRead?.(null);
-    this.resolveRead = null;
-  }
-  failAll(err) {
-    this.stderr.write(`[wstack-acp stdin error] ${err.message}
-`, "utf8");
-    this.close();
-  }
-};
-var ClientTransport = class {
-  child = null;
-  buffer = "";
-  handlers = /* @__PURE__ */ new Set();
-  closed = false;
-  resolveRead = null;
-  messageQueue = [];
-  opts;
-  constructor(options) {
-    this.opts = {
-      handshakeTimeoutMs: 3e4,
-      ...options
-    };
-  }
-  async start() {
-    if (this.child) return;
-    const [{ spawn: spawn3 }, { buildChildEnv: buildChildEnv2 }, os] = await Promise.all([
-      import("node:child_process"),
-      import("@wrongstack/core"),
-      import("node:os")
-    ]);
-    return new Promise((resolve3, reject) => {
-      const timeout = setTimeout(() => {
-        reject(
-          new Error(`ACP child process failed to start within ${this.opts.handshakeTimeoutMs}ms`)
-        );
-      }, this.opts.handshakeTimeoutMs);
-      const isPkgLauncher = this.opts.command === "npx" || this.opts.command === "uvx";
-      const spawnCwd = isPkgLauncher ? os.homedir() : this.opts.cwd;
-      try {
-        const childArgs = this.opts.args ?? [];
-        const shim = process.platform === "win32" ? buildWin32CmdShimInvocation(this.opts.command, childArgs) : null;
-        this.child = spawn3(shim?.command ?? this.opts.command, shim?.args ?? childArgs, {
-          env: { ...buildChildEnv2(), ...this.opts.env },
-          cwd: spawnCwd,
-          stdio: ["pipe", "pipe", "pipe"],
-          windowsHide: true,
-          ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
-        });
-      } catch (err) {
-        clearTimeout(timeout);
-        reject(err);
-        return;
-      }
-      const child = this.child;
-      child.stdout.setEncoding("utf8");
-      let settled = false;
-      const onSpawnFailure = (err) => {
-        if (settled) {
-          this.closed = true;
-          return;
-        }
-        settled = true;
-        clearTimeout(timeout);
-        reject(err);
-      };
-      child.on("error", onSpawnFailure);
-      child.stdout.on("error", onSpawnFailure);
-      if (this.opts.skipHandshakeMarker) {
-        child.stdout.on("data", (c) => this.onChildData(c));
-        child.stderr.on("data", (c) => this.onChildError(c));
-        child.on("close", (code) => this.onChildClose(code));
-        child.once("spawn", () => {
-          if (settled) return;
-          settled = true;
-          clearTimeout(timeout);
-          resolve3();
-        });
-        return;
-      }
-      const onReady = () => {
-        if (settled) return;
-        settled = true;
-        child.stdout.on("data", (c) => this.onChildData(c));
-        child.stderr.on("data", (c) => this.onChildError(c));
-        child.on("close", (code) => this.onChildClose(code));
-        clearTimeout(timeout);
-        resolve3();
-      };
-      const waitForMarker = (chunk) => {
-        this.buffer += chunk;
-        const idx = this.buffer.indexOf("[wstack-acp]\n");
-        if (idx !== -1) {
-          this.buffer = this.buffer.slice(idx + "[wstack-acp]\n".length);
-          child.stdout.removeListener("data", waitForMarker);
-          onReady();
-        }
-      };
-      child.stdout.on("data", waitForMarker);
-    });
-  }
-  send(msg) {
-    if (!this.child) return Promise.reject(new Error("ClientTransport not started"));
-    return new Promise((resolve3, reject) => {
-      const line = JSON.stringify(msg) + "\n";
-      this.child?.stdin.write(line, "utf8", (err) => {
-        if (err) reject(err);
-        else resolve3();
-      });
-    });
-  }
-  read() {
-    if (this.messageQueue.length > 0) return Promise.resolve(expectDefined(this.messageQueue.shift()));
-    if (this.closed) return Promise.resolve(null);
-    return new Promise((resolve3) => {
-      this.resolveRead = resolve3;
-    });
-  }
-  onMessage(handler) {
-    this.handlers.add(handler);
-    return () => this.handlers.delete(handler);
-  }
-  stop() {
-    if (!this.child) return;
-    this.closed = true;
-    try {
-      this.child.kill();
-    } catch {
+  async handleInitialize(id, params) {
+    const p = params ?? {};
+    if (p.clientCapabilities && typeof p.clientCapabilities === "object") {
+      this.clientCapabilities = p.clientCapabilities;
     }
-    this.child = null;
-  }
-  onChildData(chunk) {
-    this.buffer += chunk;
-    const lines = this.buffer.split("\n");
-    this.buffer = lines.pop() ?? "";
-    for (const raw of lines) {
-      if (!raw.trim()) continue;
-      try {
-        this.dispatch(JSON.parse(raw));
-      } catch {
+    this.initialized = true;
+    await this.transport.send(toWire({
+      jsonrpc: "2.0",
+      id,
+      result: {
+        protocolVersion: ACP_PROTOCOL_VERSION,
+        agentCapabilities: {
+          loadSession: true,
+          promptCapabilities: {
+            // We route ACP image blocks into the core agent's multimodal
+            // input (server-agent-turn.promptToAgentInput); whether the
+            // model can see them is the configured provider's concern.
+            image: true,
+            audio: false,
+            embeddedContext: true
+          },
+          mcpCapabilities: {
+            http: false,
+            sse: false
+          },
+          sessionCapabilities: {
+            close: {},
+            list: {},
+            delete: {},
+            resume: {},
+            fork: {}
+          },
+          auth: {
+            logout: {}
+          }
+        },
+        agentInfo: {
+          name: this.agentName,
+          title: "WrongStack",
+          version: WRONGSTACK_VERSION
+        },
+        authMethods: WRONGSTACK_AUTH_METHODS,
+        modes: this.modes,
+        configOptions: this.configOptions
       }
-    }
+    }));
+    return false;
   }
-  onChildError(chunk) {
-    writeErr(`[acp-child stderr] ${chunk}`);
+  async handleAuthenticate(id, _params) {
+    await this.transport.send(toWire({
+      jsonrpc: "2.0",
+      id,
+      result: { outcome: "unauthenticated" }
+    }));
+    return false;
   }
-  onChildClose(code) {
-    this.closed = true;
-    this.resolveRead?.(null);
-    this.resolveRead = null;
-    if (code !== 0 && code !== null) {
-      writeErr(`[acp-child exited with code ${code}]
-`);
-    }
+  async handleLogout(id, _params) {
+    await this.transport.send(toWire({
+      jsonrpc: "2.0",
+      id,
+      result: {}
+    }));
+    return false;
   }
-  dispatch(msg) {
-    if (this.resolveRead) {
-      const resolve3 = this.resolveRead;
-      this.resolveRead = null;
-      resolve3(msg);
-    } else {
-      this.messageQueue.push(msg);
+  async handleSessionNew(id, params) {
+    if (this.sessions.size >= this.maxSessions) {
+      await this.sendError(id, -32e3, `active session limit reached (${this.maxSessions})`);
+      return false;
     }
-    for (const handler of this.handlers) {
-      try {
-        handler(msg);
-      } catch {
+    const p = params ?? {};
+    const cwd = typeof p.cwd === "string" ? p.cwd : this.defaultCwd;
+    const sessionId = `sess_${this.allocId()}`;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const state = {
+      id: sessionId,
+      cwd,
+      abort: new AbortController(),
+      modeId: DEFAULT_MODE_ID,
+      createdAt: now,
+      updatedAt: now
+    };
+    this.sessions.set(sessionId, state);
+    this.onSessionNew(state);
+    await this.persist(state);
+    await this.sendNotification({
+      sessionId,
+      update: {
+        sessionUpdate: "current_mode_update",
+        modeId: this.modes[0]?.id ?? DEFAULT_MODE_ID
       }
+    });
+    if (this.configOptions.length > 0) {
+      await this.sendNotification({
+        sessionId,
+        update: {
+          sessionUpdate: "config_option_update",
+          configOptions: [...this.configOptions]
+        }
+      });
     }
+    await this.transport.send(toWire({
+      jsonrpc: "2.0",
+      id,
+      result: {
+        sessionId,
+        modes: this.modes,
+        configOptions: this.configOptions
+      }
+    }));
+    return false;
   }
-};
-
-// src/agent/tools-registry.ts
-var ACPToolsRegistry = class {
-  tools = /* @__PURE__ */ new Map();
-  owner;
-  constructor(owner = "wrongstack") {
-    this.owner = owner;
-  }
-  /**
-   * Register one or more tools.
-   * Throws on duplicate name unless force=true.
-   */
-  register(tools) {
-    for (const tool of tools) {
-      this.tools.set(tool.name, tool);
+  async handleSessionLoad(id, params) {
+    const p = params ?? {};
+    const sessionId = typeof p.sessionId === "string" ? p.sessionId : null;
+    const loadCwd = typeof p.cwd === "string" ? p.cwd : void 0;
+    const existing = sessionId ? this.sessions.get(sessionId) : void 0;
+    if (!existing && sessionId && this.store) {
+      const persisted = await this.store.load(sessionId);
+      if (persisted) {
+        if (this.sessions.size >= this.maxSessions) {
+          await this.sendError(id, -32e3, `active session limit reached (${this.maxSessions})`);
+          return false;
+        }
+        const restored = {
+          id: sessionId,
+          cwd: persisted.cwd ?? loadCwd ?? this.defaultCwd,
+          abort: new AbortController(),
+          modeId: persisted.modeId ?? DEFAULT_MODE_ID,
+          createdAt: persisted.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          ...persisted.title !== void 0 ? { title: persisted.title } : {}
+        };
+        this.sessions.set(sessionId, restored);
+        this.seedFor?.(sessionId, persisted.history ?? []);
+        for (const update of persisted.history ?? []) {
+          await this.sendNotification({ sessionId, update });
+        }
+        await this.sendNotification({
+          sessionId,
+          update: { sessionUpdate: "current_mode_update", modeId: restored.modeId }
+        });
+        await this.transport.send(toWire({
+          jsonrpc: "2.0",
+          id,
+          result: {
+            initialMode: { currentModeId: restored.modeId, availableModes: this.modes }
+          }
+        }));
+        return false;
+      }
     }
-  }
-  /**
-   * Replace the current tool set.
-   */
-  setTools(tools) {
-    this.tools.clear();
-    for (const tool of tools) this.tools.set(tool.name, tool);
-  }
-  get(name) {
-    return this.tools.get(name);
-  }
-  has(name) {
-    return this.tools.has(name);
-  }
-  list() {
-    return Array.from(this.tools.values());
-  }
-  /** Build the ACP tools/list payload from registered tools. */
-  buildToolList() {
-    return {
-      tools: Array.from(this.tools.values()).map(
-        (t) => toACPToolDefinition(t, this.owner)
-      )
-    };
-  }
-  /**
-   * Execute a tool by name and return ACP-formatted result.
-   * Returns null if the tool is not found.
-   */
-  async execute(name, args, ctx, signal) {
-    const tool = this.tools.get(name);
-    if (!tool) return null;
-    try {
-      const result = await tool.execute(args, ctx, {
-        signal
+    if (existing) {
+      existing.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const replay = sessionId ? this.replayFor?.(sessionId) : void 0;
+      if (replay) {
+        for (const update of replay) {
+          await this.sendNotification({ sessionId, update });
+        }
+      }
+      await this.sendNotification({
+        sessionId,
+        update: {
+          sessionUpdate: "session_info_update",
+          updatedAt: existing.updatedAt
+        }
       });
-      return toACPToolResult(result);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      return { content: [{ type: "text", text: msg }], isError: true };
+      await this.sendNotification({
+        sessionId,
+        update: {
+          sessionUpdate: "current_mode_update",
+          modeId: existing.modeId
+        }
+      });
+      await this.transport.send(toWire({
+        jsonrpc: "2.0",
+        id,
+        result: {
+          initialMode: {
+            currentModeId: existing.modeId,
+            availableModes: this.modes
+          }
+        }
+      }));
+      return false;
     }
+    await this.sendError(id, -32e3, `session not found: ${sessionId}`);
+    return false;
   }
-};
-function toACPToolDefinition(tool, _owner) {
-  return {
-    name: tool.name,
-    description: tool.description,
-    inputSchema: toACPInputSchema(tool.inputSchema),
-    annotations: {
-      title: tool.name,
-      description: tool.usageHint ?? tool.description,
-      priority: toolToPriority(tool),
-      alwaysAccept: tool.permission === "auto"
+  async handleSessionResume(id, params) {
+    const p = params ?? {};
+    const sessionId = typeof p.sessionId === "string" ? p.sessionId : null;
+    const existing = sessionId ? this.sessions.get(sessionId) : void 0;
+    if (existing) {
+      existing.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      await this.transport.send(toWire({
+        jsonrpc: "2.0",
+        id,
+        result: {
+          initialMode: {
+            currentModeId: existing.modeId,
+            availableModes: this.modes
+          }
+        }
+      }));
+      return false;
     }
-  };
-}
-function toACPInputSchema(src) {
-  if (!src || typeof src !== "object") {
-    return {};
+    await this.sendError(id, -32e3, `session not found: ${sessionId}`);
+    return false;
   }
-  const s = src;
-  const out = {};
-  if (typeof s.type === "string") out.type = s.type;
-  if (Array.isArray(s.enum)) out.enum = s.enum;
-  if (typeof s.description === "string") out.description = s.description;
-  if ("default" in s) out.default = s.default;
-  if (typeof s.minimum === "number") out.minimum = s.minimum;
-  if (typeof s.maximum === "number") out.maximum = s.maximum;
-  if (s.items) out.items = toACPInputSchema(s.items);
-  if (s.properties && typeof s.properties === "object") {
-    const props = {};
-    for (const [k, v] of Object.entries(s.properties)) {
-      props[k] = toACPInputSchema(v);
+  async handleSessionClose(id, params) {
+    const p = params ?? {};
+    const sessionId = typeof p.sessionId === "string" ? p.sessionId : null;
+    const session = sessionId ? this.sessions.get(sessionId) : void 0;
+    if (!session) {
+      await this.sendError(id, -32e3, `session not found: ${sessionId}`);
+      return false;
     }
-    out.properties = props;
-    if (Array.isArray(s.required)) out.required = s.required;
-  }
-  return out;
-}
-function toACPToolResult(result) {
-  const blocks = [];
-  if (result === void 0 || result === null) {
-    return { content: [{ type: "text", text: "ok" }] };
-  }
-  if (typeof result === "string") {
-    blocks.push({ type: "text", text: result });
-  } else if (typeof result === "object") {
-    blocks.push({ type: "text", text: JSON.stringify(result, null, 2) });
-  } else {
-    blocks.push({ type: "text", text: String(result) });
-  }
-  return { content: blocks };
-}
-function toolToPriority(tool) {
-  if (tool.riskTier === "destructive") return "high";
-  if (tool.riskTier === "standard" || tool.permission === "confirm") return "medium";
-  return "low";
-}
-
-// src/types/acp-v1.ts
-var ACP_PROTOCOL_VERSION = 1;
-
-// src/agent/protocol-handler.ts
-function toWire(msg) {
-  return msg;
-}
-var WRONGSTACK_VERSION = "0.274.1";
-var WRONGSTACK_AUTH_METHODS = [
-  {
-    id: "wrongstack-auth",
-    name: "Run wstack auth",
-    description: "Configure a WrongStack model provider in an interactive terminal.",
-    type: "terminal",
-    args: ["auth"]
+    session.abort.abort();
+    if (sessionId) {
+      this.sessions.delete(sessionId);
+      this.disposeSession(sessionId);
+    }
+    await this.transport.send(toWire({
+      jsonrpc: "2.0",
+      id,
+      result: {}
+    }));
+    return false;
   }
-];
-var DEFAULT_MODE_ID = "code";
-var DEFAULT_MODES = [
-  {
-    id: DEFAULT_MODE_ID,
-    name: "Code",
-    description: "Default agent mode for code-generation tasks."
+  async handleSessionDelete(id, params) {
+    const p = params ?? {};
+    const sessionId = typeof p.sessionId === "string" ? p.sessionId : null;
+    if (!sessionId) {
+      await this.sendError(id, -32e3, `session not found: ${sessionId}`);
+      return false;
+    }
+    if (!this.sessions.has(sessionId)) {
+      await this.transport.send(toWire({ jsonrpc: "2.0", id, result: { configOptions: [...this.configOptions] } }));
+      return false;
+    }
+    const session = this.sessions.get(sessionId);
+    session.abort.abort();
+    this.sessions.delete(sessionId);
+    this.disposeSession(sessionId);
+    await this.transport.send(toWire({
+      jsonrpc: "2.0",
+      id,
+      result: {}
+    }));
+    return false;
   }
-];
-var ACPProtocolHandler = class {
-  transport;
-  defaultCwd;
-  runTurn;
-  onSessionNew;
-  modes;
-  configOptions;
-  agentName;
-  replayFor;
-  seedFor;
-  store;
-  initialized = false;
-  clientCapabilities = {};
-  sessions = /* @__PURE__ */ new Map();
-  nextId = 1;
-  // Outbound request correlation (server → client requests, e.g.
-  // session/request_permission). Keyed by our own `srv_N` ids.
-  pendingOut = /* @__PURE__ */ new Map();
-  nextOutId = 1;
-  constructor(opts) {
-    this.transport = opts.transport;
-    this.defaultCwd = opts.defaultCwd;
-    this.runTurn = opts.runTurn;
-    this.onSessionNew = opts.onSessionNew ?? (() => {
-    });
-    this.modes = opts.modes ?? DEFAULT_MODES;
-    this.configOptions = opts.configOptions ?? [];
-    this.agentName = opts.agentName ?? "wrongstack";
-    this.replayFor = opts.replayFor;
-    this.seedFor = opts.seedFor;
-    this.store = opts.store;
-    if (typeof this.transport.onMessage === "function") {
-      this.transport.onMessage((m) => this.maybeResolvePending(m));
-    }
-  }
-  /**
-   * Send a request to the client and await its response. Used for
-   * server-initiated calls like `session/request_permission`. Rejects on
-   * timeout or transport error so the caller can pick a safe fallback.
-   */
-  request(method, params, timeoutMs = 6e4) {
-    const id = `srv_${this.nextOutId++}`;
-    return new Promise((resolve3, reject) => {
-      const timer = setTimeout(() => {
-        this.pendingOut.delete(id);
-        reject(new Error(`${method} timed out after ${timeoutMs}ms`));
-      }, timeoutMs);
-      this.pendingOut.set(id, { resolve: resolve3, reject, timer });
-      this.transport.send(toWire({ jsonrpc: "2.0", id, method, params })).catch((e) => {
-        clearTimeout(timer);
-        this.pendingOut.delete(id);
-        reject(e instanceof Error ? e : new Error(String(e)));
-      });
-    });
-  }
-  maybeResolvePending(m) {
-    const id = m.id;
-    if (typeof id !== "string") return;
-    const pending = this.pendingOut.get(id);
-    if (!pending) return;
-    this.pendingOut.delete(id);
-    clearTimeout(pending.timer);
-    const err = m.error;
-    if (err) pending.reject(new Error(err.message ?? "client request failed"));
-    else pending.resolve(m.result);
-  }
-  /**
-   * Process one inbound message. Returns true if this was a terminal
-   * message (rare; reserved for future use by the server's own
-   * shutdown signal).
-   */
-  async handleMessage(msg) {
-    if (typeof msg !== "object" || msg === null) return false;
-    const m = msg;
-    if (m.id !== void 0 && (m.result !== void 0 || m.error !== void 0)) {
-      return false;
-    }
-    if (m.id !== void 0 && typeof m.method === "string") {
-      return this.handleRequest(m.id, m.method, m.params);
-    }
-    if (typeof m.method === "string") {
-      return this.handleNotification(m.method, m.params);
-    }
-    return false;
-  }
-  /** Abort all active turns and drop session state. */
-  close() {
-    for (const [, session] of this.sessions) {
-      session.abort.abort();
-    }
-    this.sessions.clear();
-    for (const [, p] of this.pendingOut) {
-      clearTimeout(p.timer);
-      p.reject(new Error("protocol handler closed"));
-    }
-    this.pendingOut.clear();
-  }
-  // ────────────────────────────────────────────────────────────────────
-  // Requests
-  // ────────────────────────────────────────────────────────────────────
-  async handleRequest(id, method, params) {
-    if (method !== "initialize" && !this.initialized) {
-      await this.sendError(id, -32e3, "Not initialized");
+  async handleSessionFork(id, params) {
+    const p = params ?? {};
+    const sourceId = typeof p.sessionId === "string" ? p.sessionId : null;
+    const source = sourceId ? this.sessions.get(sourceId) : void 0;
+    if (!sourceId || !source) {
+      await this.sendError(id, -32e3, `session not found: ${sourceId}`);
       return false;
     }
-    try {
-      switch (method) {
-        case "initialize":
-          return await this.handleInitialize(id, params);
-        case "authenticate":
-          return await this.handleAuthenticate(id, params);
-        case "logout":
-          return await this.handleLogout(id, params);
-        case "session/new":
-          return await this.handleSessionNew(id, params);
-        case "session/load":
-          return await this.handleSessionLoad(id, params);
-        case "session/resume":
-          return await this.handleSessionResume(id, params);
-        case "session/close":
-          return await this.handleSessionClose(id, params);
-        case "session/delete":
-          return await this.handleSessionDelete(id, params);
-        case "session/prompt":
-          return await this.handleSessionPrompt(id, params);
-        case "session/set_mode":
-          return await this.handleSetMode(id, params);
-        case "session/set_config_option":
-          return await this.handleSetConfigOption(id, params);
-        case "session/list":
-          return await this.handleSessionList(id);
-        case "session/fork":
-          return await this.handleSessionFork(id, params);
-        case "providers/list":
-          return await this.handleProvidersList(id, params);
-        case "providers/set":
-          return await this.handleProvidersSet(id, params);
-        case "providers/disable":
-          return await this.handleProvidersDisable(id, params);
-        case "mcp/message":
-          return await this.handleMcpMessage(id, params);
-        default:
-          await this.sendError(id, -32601, `Unknown method: ${method}`);
-          return false;
-      }
-    } catch (err) {
-      const { code, message, data } = errorToJsonRpc(err);
-      await this.sendError(id, code, message, data);
+    if (this.sessions.size >= this.maxSessions) {
+      await this.sendError(id, -32e3, `active session limit reached (${this.maxSessions})`);
       return false;
     }
-  }
-  async handleInitialize(id, params) {
-    const p = params ?? {};
-    if (p.clientCapabilities && typeof p.clientCapabilities === "object") {
-      this.clientCapabilities = p.clientCapabilities;
-    }
-    this.initialized = true;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const sessionId = `sess_${this.allocId()}`;
+    const forked = {
+      id: sessionId,
+      cwd: typeof p.cwd === "string" ? p.cwd : source.cwd,
+      abort: new AbortController(),
+      modeId: source.modeId,
+      createdAt: now,
+      updatedAt: now,
+      ...source.title !== void 0 ? { title: source.title } : {}
+    };
+    const history = (this.replayFor?.(sourceId) ?? []).map((update) => ({
+      sessionUpdate: update.sessionUpdate,
+      content: structuredClone(update.content)
+    }));
+    this.sessions.set(sessionId, forked);
+    this.seedFor?.(sessionId, history);
+    this.onSessionNew(forked);
+    await this.persist(forked, history);
+    await this.sendNotification({
+      sessionId,
+      update: { sessionUpdate: "current_mode_update", modeId: forked.modeId }
+    });
     await this.transport.send(toWire({
       jsonrpc: "2.0",
       id,
       result: {
-        protocolVersion: ACP_PROTOCOL_VERSION,
-        agentCapabilities: {
-          loadSession: true,
-          promptCapabilities: {
-            // We route ACP image blocks into the core agent's multimodal
-            // input (server-agent-turn.promptToAgentInput); whether the
-            // model can see them is the configured provider's concern.
-            image: true,
-            audio: false,
-            embeddedContext: true
-          },
-          mcpCapabilities: {
-            http: false,
-            sse: false
-          },
-          sessionCapabilities: {
-            close: {},
-            list: {},
-            delete: {},
-            resume: {},
-            fork: {}
-          },
-          auth: {
-            logout: {}
-          }
-        },
-        agentInfo: {
-          name: this.agentName,
-          title: "WrongStack",
-          version: WRONGSTACK_VERSION
-        },
-        authMethods: WRONGSTACK_AUTH_METHODS,
+        sessionId,
         modes: this.modes,
         configOptions: this.configOptions
       }
     }));
     return false;
   }
-  async handleAuthenticate(id, _params) {
+  async handleProvidersList(id, _params) {
     await this.transport.send(toWire({
       jsonrpc: "2.0",
       id,
-      result: { outcome: "unauthenticated" }
+      result: {
+        providers: [],
+        currentProviderId: null
+      }
     }));
     return false;
   }
-  async handleLogout(id, _params) {
+  async handleProvidersSet(id, _params) {
+    await this.sendError(id, -32e3, "provider configuration not available through ACP; use wstack auth");
+    return false;
+  }
+  async handleProvidersDisable(id, _params) {
     await this.transport.send(toWire({
       jsonrpc: "2.0",
       id,
@@ -630,251 +528,11 @@ var ACPProtocolHandler = class {
     }));
     return false;
   }
-  async handleSessionNew(id, params) {
-    const p = params ?? {};
-    const cwd = typeof p.cwd === "string" ? p.cwd : this.defaultCwd;
-    const sessionId = `sess_${this.allocId()}`;
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const state = {
-      id: sessionId,
-      cwd,
-      abort: new AbortController(),
-      modeId: DEFAULT_MODE_ID,
-      createdAt: now,
-      updatedAt: now
-    };
-    this.sessions.set(sessionId, state);
-    this.onSessionNew(state);
-    await this.persist(state);
-    await this.sendNotification({
-      sessionId,
-      update: {
-        sessionUpdate: "current_mode_update",
-        modeId: this.modes[0]?.id ?? DEFAULT_MODE_ID
-      }
-    });
-    if (this.configOptions.length > 0) {
-      await this.sendNotification({
-        sessionId,
-        update: {
-          sessionUpdate: "config_option_update",
-          configOptions: [...this.configOptions]
-        }
-      });
-    }
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: {
-        sessionId,
-        modes: this.modes,
-        configOptions: this.configOptions
-      }
-    }));
-    return false;
-  }
-  async handleSessionLoad(id, params) {
-    const p = params ?? {};
-    const sessionId = typeof p.sessionId === "string" ? p.sessionId : null;
-    const loadCwd = typeof p.cwd === "string" ? p.cwd : void 0;
-    const existing = sessionId ? this.sessions.get(sessionId) : void 0;
-    if (!existing && sessionId && this.store) {
-      const persisted = await this.store.load(sessionId);
-      if (persisted) {
-        const restored = {
-          id: sessionId,
-          cwd: persisted.cwd ?? loadCwd ?? this.defaultCwd,
-          abort: new AbortController(),
-          modeId: persisted.modeId ?? DEFAULT_MODE_ID,
-          createdAt: persisted.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          ...persisted.title !== void 0 ? { title: persisted.title } : {}
-        };
-        this.sessions.set(sessionId, restored);
-        this.seedFor?.(sessionId, persisted.history ?? []);
-        for (const update of persisted.history ?? []) {
-          await this.sendNotification({ sessionId, update });
-        }
-        await this.sendNotification({
-          sessionId,
-          update: { sessionUpdate: "current_mode_update", modeId: restored.modeId }
-        });
-        await this.transport.send(toWire({
-          jsonrpc: "2.0",
-          id,
-          result: {
-            initialMode: { currentModeId: restored.modeId, availableModes: this.modes }
-          }
-        }));
-        return false;
-      }
-    }
-    if (existing) {
-      existing.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-      const replay = sessionId ? this.replayFor?.(sessionId) : void 0;
-      if (replay) {
-        for (const update of replay) {
-          await this.sendNotification({ sessionId, update });
-        }
-      }
-      await this.sendNotification({
-        sessionId,
-        update: {
-          sessionUpdate: "session_info_update",
-          updatedAt: existing.updatedAt
-        }
-      });
-      await this.sendNotification({
-        sessionId,
-        update: {
-          sessionUpdate: "current_mode_update",
-          modeId: existing.modeId
-        }
-      });
-      await this.transport.send(toWire({
-        jsonrpc: "2.0",
-        id,
-        result: {
-          initialMode: {
-            currentModeId: existing.modeId,
-            availableModes: this.modes
-          }
-        }
-      }));
-      return false;
-    }
-    await this.sendError(id, -32e3, `session not found: ${sessionId}`);
-    return false;
-  }
-  async handleSessionResume(id, params) {
-    const p = params ?? {};
-    const sessionId = typeof p.sessionId === "string" ? p.sessionId : null;
-    const existing = sessionId ? this.sessions.get(sessionId) : void 0;
-    if (existing) {
-      existing.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-      await this.transport.send(toWire({
-        jsonrpc: "2.0",
-        id,
-        result: {
-          initialMode: {
-            currentModeId: existing.modeId,
-            availableModes: this.modes
-          }
-        }
-      }));
-      return false;
-    }
-    await this.sendError(id, -32e3, `session not found: ${sessionId}`);
-    return false;
-  }
-  async handleSessionClose(id, params) {
-    const p = params ?? {};
-    const sessionId = typeof p.sessionId === "string" ? p.sessionId : null;
-    const session = sessionId ? this.sessions.get(sessionId) : void 0;
-    if (!session) {
-      await this.sendError(id, -32e3, `session not found: ${sessionId}`);
-      return false;
-    }
-    session.abort.abort();
-    if (sessionId) this.sessions.delete(sessionId);
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: {}
-    }));
-    return false;
-  }
-  async handleSessionDelete(id, params) {
-    const p = params ?? {};
-    const sessionId = typeof p.sessionId === "string" ? p.sessionId : null;
-    if (!sessionId) {
-      await this.sendError(id, -32e3, `session not found: ${sessionId}`);
-      return false;
-    }
-    if (!this.sessions.has(sessionId)) {
-      await this.transport.send(toWire({ jsonrpc: "2.0", id, result: { configOptions: [...this.configOptions] } }));
-      return false;
-    }
-    const session = this.sessions.get(sessionId);
-    session.abort.abort();
-    this.sessions.delete(sessionId);
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: {}
-    }));
-    return false;
-  }
-  async handleSessionFork(id, params) {
-    const p = params ?? {};
-    const sourceId = typeof p.sessionId === "string" ? p.sessionId : null;
-    const source = sourceId ? this.sessions.get(sourceId) : void 0;
-    if (!sourceId || !source) {
-      await this.sendError(id, -32e3, `session not found: ${sourceId}`);
-      return false;
-    }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const sessionId = `sess_${this.allocId()}`;
-    const forked = {
-      id: sessionId,
-      cwd: typeof p.cwd === "string" ? p.cwd : source.cwd,
-      abort: new AbortController(),
-      modeId: source.modeId,
-      createdAt: now,
-      updatedAt: now,
-      ...source.title !== void 0 ? { title: source.title } : {}
-    };
-    const history = (this.replayFor?.(sourceId) ?? []).map((update) => ({
-      sessionUpdate: update.sessionUpdate,
-      content: structuredClone(update.content)
-    }));
-    this.sessions.set(sessionId, forked);
-    this.seedFor?.(sessionId, history);
-    this.onSessionNew(forked);
-    await this.persist(forked, history);
-    await this.sendNotification({
-      sessionId,
-      update: { sessionUpdate: "current_mode_update", modeId: forked.modeId }
-    });
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: {
-        sessionId,
-        modes: this.modes,
-        configOptions: this.configOptions
-      }
-    }));
-    return false;
-  }
-  async handleProvidersList(id, _params) {
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: {
-        providers: [],
-        currentProviderId: null
-      }
-    }));
-    return false;
-  }
-  async handleProvidersSet(id, _params) {
-    await this.sendError(id, -32e3, "provider configuration not available through ACP; use wstack auth");
-    return false;
-  }
-  async handleProvidersDisable(id, _params) {
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: {}
-    }));
-    return false;
-  }
-  async handleMcpMessage(id, _params) {
-    await this.sendError(id, -32e3, "MCP message routing not available through ACP");
-    return false;
-  }
-  async handleSessionPrompt(id, params) {
+  async handleMcpMessage(id, _params) {
+    await this.sendError(id, -32e3, "MCP message routing not available through ACP");
+    return false;
+  }
+  async handleSessionPrompt(id, params) {
     const p = params ?? {};
     const sessionId = typeof p.sessionId === "string" ? p.sessionId : null;
     if (!sessionId || !this.sessions.has(sessionId)) {
@@ -1078,259 +736,276 @@ function errorToJsonRpc(err) {
   return { code: -32603, message };
 }
 
-// src/agent/wrongstack-acp-agent.ts
-import { fileURLToPath } from "node:url";
-import { createServer } from "node:http";
-import { writeErr as writeErr2 } from "@wrongstack/core";
-var WrongStackACPServer = class {
-  transport;
-  handler;
-  options;
-  /** HTTP server when transport mode is HTTP. */
-  httpServer = null;
-  running = false;
-  constructor(opts = {}) {
-    this.options = opts;
-    this.transport = new StdioTransport();
-    const runTurn = opts.runTurn ?? defaultEchoRunTurn;
-    this.handler = new ACPProtocolHandler({
-      transport: this.transport,
-      defaultCwd: opts.defaultCwd ?? process.cwd(),
-      runTurn,
-      agentName: opts.agentName,
-      ...opts.replayFor ? { replayFor: opts.replayFor } : {},
-      ...opts.seedFor ? { seedFor: opts.seedFor } : {},
-      ...opts.store ? { store: opts.store } : {}
-    });
-  }
-  /**
-   * Start the server. Mode depends on `options.transport`:
-   * - 'stdio' (default): reads JSON-RPC from stdin, writes to stdout.
-   * - number: listens as HTTP on the given port.
-   */
-  async start() {
-    const transportMode = this.options.transport;
-    if (typeof transportMode === "number") {
-      await this.startHttp(transportMode);
-    } else {
-      await this.startStdio();
-    }
-  }
-  async startStdio() {
-    if (this.options.legacyStartupMarker) {
-      this.transport.sendStartupMarker();
-    }
-    this.running = true;
-    while (this.running) {
-      const msg = await this.transport.read();
-      if (!msg) break;
-      const terminal = await this.handler.handleMessage(msg);
-      if (terminal) break;
+// src/agent/stdio-transport.ts
+import { expectDefined, writeErr } from "@wrongstack/core/utils";
+
+// src/win32-cmd.ts
+var WIN32_CMD_META = /[&|<>"\r\n\0]/;
+function buildWin32CmdShimInvocation(command, args = []) {
+  assertSafeWin32CmdArgs([command, ...args]);
+  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
+  return {
+    command: process.env["COMSPEC"] ?? "cmd.exe",
+    args: ["/d", "/c", line],
+    windowsVerbatimArguments: true
+  };
+}
+function assertSafeWin32CmdArgs(args) {
+  for (const arg of args) {
+    if (typeof arg === "string" && WIN32_CMD_META.test(arg)) {
+      throw new Error(
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+      );
     }
-    this.transport.close();
   }
-  async startHttp(port) {
-    const host = this.options.host ?? "127.0.0.1";
-    const handler = this.handler;
-    const authToken = this.options.authToken;
-    let httpChain = Promise.resolve();
-    this.httpServer = createServer(async (req, res) => {
-      if (authToken) {
-        const url = new URL(req.url ?? "/", `http://${host}:${port}`);
-        const queryToken = url.searchParams.get("token");
-        const authHeader = req.headers["authorization"];
-        const bearerToken = Array.isArray(authHeader) ? authHeader[0]?.replace(/^Bearer\s+/i, "") : authHeader?.replace(/^Bearer\s+/i, "");
-        const supplied = queryToken ?? bearerToken ?? "";
-        if (supplied !== authToken) {
-          res.writeHead(401, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ error: { code: -32001, message: "Unauthorized" } }));
-          return;
-        }
-      }
-      const selfOrigin = `http://${host}:${port}`;
-      const reqOrigin = Array.isArray(req.headers.origin) ? req.headers.origin[0] : req.headers.origin;
-      if (reqOrigin && reqOrigin !== selfOrigin) {
-        res.writeHead(403);
-        res.end(JSON.stringify({ error: "cross-origin request forbidden" }));
-        return;
-      }
-      if (reqOrigin) res.setHeader("Access-Control-Allow-Origin", reqOrigin);
-      res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
-      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id, Authorization");
-      if (req.method === "OPTIONS") {
-        res.writeHead(204);
-        res.end();
-        return;
-      }
-      if (req.method !== "POST") {
-        res.writeHead(405);
-        res.end(JSON.stringify({ error: "method not allowed" }));
-        return;
-      }
-      const MAX_HTTP_BODY = 10 * 1024 * 1024;
-      let body = "";
-      let bodyBytes = 0;
-      let tooLarge = false;
-      for await (const chunk of req) {
-        bodyBytes += chunk.length;
-        if (bodyBytes > MAX_HTTP_BODY) {
-          tooLarge = true;
-          break;
-        }
-        body += chunk;
-      }
-      if (tooLarge) {
-        res.writeHead(413, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: { code: -32700, message: "Request body too large" } }));
+}
+function quoteWin32CmdArg(arg) {
+  return `"${arg}"`;
+}
+
+// src/agent/stdio-transport.ts
+var DEFAULT_MAX_FRAME_CHARS = 20 * 1024 * 1024;
+var DEFAULT_MAX_QUEUED_MESSAGES = 1e3;
+function positiveLimit(value, fallback) {
+  return Number.isFinite(value) && (value ?? 0) > 0 ? Math.floor(value) : fallback;
+}
+var StdioTransport = class {
+  stdin = process.stdin;
+  stdout = process.stdout;
+  stderr = process.stderr;
+  buffer = "";
+  handlers = /* @__PURE__ */ new Set();
+  closed = false;
+  resolveRead = null;
+  messageQueue = [];
+  maxFrameChars;
+  maxQueuedMessages;
+  constructor(opts = {}) {
+    this.maxFrameChars = positiveLimit(opts.maxFrameChars, DEFAULT_MAX_FRAME_CHARS);
+    this.maxQueuedMessages = positiveLimit(
+      opts.maxQueuedMessages,
+      DEFAULT_MAX_QUEUED_MESSAGES
+    );
+    this.stdin.resume();
+    this.stdin.setEncoding("utf8");
+    this.stdin.on("data", (chunk) => this.onData(chunk));
+    this.stdin.on("end", () => this.handleClose());
+    this.stdin.on("error", (err) => this.failAll(err));
+  }
+  sendStartupMarker() {
+    this.stdout.write("[wstack-acp]\n", "utf8");
+  }
+  send(msg) {
+    if (this.closed) return Promise.resolve();
+    return new Promise((resolve3) => {
+      const line = JSON.stringify(msg) + "\n";
+      this.stdout.write(line, "utf8", () => resolve3());
+    });
+  }
+  sendRaw(chunk) {
+    this.stdout.write(chunk, "utf8");
+  }
+  read() {
+    if (this.messageQueue.length > 0) return Promise.resolve(expectDefined(this.messageQueue.shift()));
+    if (this.closed) return Promise.resolve(null);
+    return new Promise((resolve3) => {
+      this.resolveRead = resolve3;
+    });
+  }
+  onMessage(handler) {
+    this.handlers.add(handler);
+    return () => this.handlers.delete(handler);
+  }
+  close() {
+    this.closed = true;
+    this.stdin.pause();
+    this.resolveRead?.(null);
+    this.resolveRead = null;
+    this.buffer = "";
+    this.messageQueue.length = 0;
+    this.handlers.clear();
+  }
+  onData(chunk) {
+    this.buffer += chunk;
+    const lines = this.buffer.split("\n");
+    this.buffer = lines.pop() ?? "";
+    if (this.buffer.length > this.maxFrameChars) {
+      this.stderr.write(
+        `[wstack-acp frame error] pending frame exceeds ${this.maxFrameChars} characters
+`,
+        "utf8"
+      );
+      this.close();
+      return;
+    }
+    for (const raw of lines) {
+      if (!raw.trim()) continue;
+      if (raw.length > this.maxFrameChars) {
+        this.stderr.write(
+          `[wstack-acp frame error] frame exceeds ${this.maxFrameChars} characters
+`,
+          "utf8"
+        );
+        this.close();
         return;
       }
-      let msg;
       try {
-        msg = JSON.parse(body);
-      } catch {
-        res.writeHead(400);
-        res.end(JSON.stringify({ error: { code: -32700, message: "Parse error" } }));
-        return;
+        this.dispatch(JSON.parse(raw));
+      } catch (err) {
+        this.stderr.write(`[wstack-acp parse error] ${err}
+`, "utf8");
       }
-      const isNotification = typeof msg === "object" && msg !== null && msg.id === void 0 && typeof msg.method === "string";
-      if (isNotification) {
-        try {
-          await handler.handleMessage(msg);
-        } catch {
-        }
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ notifications: [] }));
+    }
+  }
+  dispatch(msg) {
+    if (this.resolveRead) {
+      const resolve3 = this.resolveRead;
+      this.resolveRead = null;
+      resolve3(msg);
+    } else {
+      if (this.messageQueue.length >= this.maxQueuedMessages) {
+        this.stderr.write(
+          `[wstack-acp queue error] pending message queue exceeds ${this.maxQueuedMessages} entries
+`,
+          "utf8"
+        );
+        this.close();
         return;
       }
-      const requestPromise = httpChain.then(async () => {
-        const notifications = [];
-        let response = null;
-        const originalSend = this.transport.send.bind(this.transport);
-        this.transport.send = async (m) => {
-          if (m.id !== void 0 && (m.result !== void 0 || m.error !== void 0)) {
-            response = m;
-          } else if (m.method === "session/update") {
-            notifications.push(m.params);
-          } else {
-            notifications.push(m);
-          }
-        };
-        try {
-          await handler.handleMessage(msg);
-        } finally {
-          this.transport.send = originalSend;
-        }
-        res.writeHead(200, { "Content-Type": "application/json" });
-        const responseBody = response !== null ? { ...response, notifications } : { notifications };
-        res.end(JSON.stringify(responseBody));
-      });
-      httpChain = requestPromise.catch(() => void 0);
+      this.messageQueue.push(msg);
+    }
+    for (const handler of this.handlers) {
       try {
-        await requestPromise;
-      } catch {
+        handler(msg);
+      } catch (err) {
+        this.stderr.write(`[wstack-acp handler error] ${err}
+`, "utf8");
       }
-    });
-    return new Promise((resolve3) => {
-      this.httpServer.listen(port, host, () => {
-        writeErr2(`[wstack-acp] HTTP server listening on http://${host}:${port}
-`);
-        this.running = true;
-        resolve3();
-      });
-    });
-  }
-  /** Stop the server. */
-  stop() {
-    this.running = false;
-    this.transport.close();
-    if (this.httpServer) {
-      this.httpServer.close();
-      this.httpServer = null;
     }
   }
+  handleClose() {
+    this.close();
+  }
+  failAll(err) {
+    this.stderr.write(`[wstack-acp stdin error] ${err.message}
+`, "utf8");
+    this.close();
+  }
 };
-var defaultEchoRunTurn = async (_input, _emit) => {
-  return { stopReason: "end_turn" };
-};
-async function main() {
-  const server = new WrongStackACPServer();
-  await server.start();
-}
-var isEntrypoint = process.argv[1] !== void 0 && fileURLToPath(import.meta.url) === process.argv[1];
-if (isEntrypoint) {
-  main().catch((err) => {
-    writeErr2(`[wstack-acp fatal] ${err}
-`);
-    process.exit(1);
-  });
-}
-
-// src/client/websocket-transport.ts
-var WebSocketClientTransport = class {
-  ws = null;
+var ClientTransport = class {
+  child = null;
+  buffer = "";
   handlers = /* @__PURE__ */ new Set();
   closed = false;
+  resolveRead = null;
+  messageQueue = [];
   opts;
-  constructor(opts) {
-    this.opts = opts;
+  maxFrameChars;
+  maxQueuedMessages;
+  constructor(options) {
+    this.opts = {
+      handshakeTimeoutMs: 3e4,
+      ...options
+    };
+    this.maxFrameChars = positiveLimit(options.maxFrameChars, DEFAULT_MAX_FRAME_CHARS);
+    this.maxQueuedMessages = positiveLimit(
+      options.maxQueuedMessages,
+      DEFAULT_MAX_QUEUED_MESSAGES
+    );
   }
-  start() {
-    const WS = globalThis.WebSocket;
-    if (!WS) {
-      return Promise.reject(
-        new Error(
-          "global WebSocket is not available \u2014 Node \u2265 22 is required for the remote ACP transport"
-        )
-      );
-    }
-    const timeoutMs = this.opts.handshakeTimeoutMs ?? 3e4;
+  async start() {
+    if (this.child) return;
+    const [{ spawn: spawn3 }, { buildChildEnv: buildChildEnv2 }, os] = await Promise.all([
+      import("node:child_process"),
+      import("@wrongstack/core/utils"),
+      import("node:os")
+    ]);
     return new Promise((resolve3, reject) => {
+      const timeout = setTimeout(() => {
+        reject(
+          new Error(`ACP child process failed to start within ${this.opts.handshakeTimeoutMs}ms`)
+        );
+      }, this.opts.handshakeTimeoutMs);
+      const isPkgLauncher = this.opts.command === "npx" || this.opts.command === "uvx";
+      const spawnCwd = isPkgLauncher ? os.homedir() : this.opts.cwd;
+      try {
+        const childArgs = this.opts.args ?? [];
+        const shim = process.platform === "win32" ? buildWin32CmdShimInvocation(this.opts.command, childArgs) : null;
+        this.child = spawn3(shim?.command ?? this.opts.command, shim?.args ?? childArgs, {
+          env: { ...buildChildEnv2(), ...this.opts.env },
+          cwd: spawnCwd,
+          stdio: ["pipe", "pipe", "pipe"],
+          windowsHide: true,
+          ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
+        });
+      } catch (err) {
+        clearTimeout(timeout);
+        reject(err);
+        return;
+      }
+      const child = this.child;
+      child.stdout.setEncoding("utf8");
       let settled = false;
-      const ws = new WS(this.opts.url, this.opts.protocols);
-      this.ws = ws;
-      const timer = setTimeout(() => {
-        if (settled) return;
-        settled = true;
-        try {
-          ws.close();
-        } catch {
-        }
-        reject(new Error(`WebSocket failed to open within ${timeoutMs}ms`));
-      }, timeoutMs);
-      ws.addEventListener("open", () => {
-        if (settled) return;
-        settled = true;
-        clearTimeout(timer);
-        resolve3();
-      });
-      ws.addEventListener("error", (ev) => {
+      const onSpawnFailure = (err) => {
         if (settled) {
           this.closed = true;
           return;
         }
         settled = true;
-        clearTimeout(timer);
-        const message = ev && typeof ev === "object" && "message" in ev ? String(ev.message) : "WebSocket error";
-        reject(new Error(message));
-      });
-      ws.addEventListener("close", () => {
-        this.closed = true;
-      });
-      ws.addEventListener("message", (ev) => {
-        this.onData(ev.data);
-      });
+        clearTimeout(timeout);
+        reject(err);
+      };
+      child.on("error", onSpawnFailure);
+      child.stdout.on("error", onSpawnFailure);
+      if (this.opts.skipHandshakeMarker) {
+        child.stdout.on("data", (c) => this.onChildData(c));
+        child.stderr.on("data", (c) => this.onChildError(c));
+        child.on("close", (code) => this.onChildClose(code));
+        child.once("spawn", () => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timeout);
+          resolve3();
+        });
+        return;
+      }
+      const onReady = () => {
+        if (settled) return;
+        settled = true;
+        child.stdout.on("data", (c) => this.onChildData(c));
+        child.stderr.on("data", (c) => this.onChildError(c));
+        child.on("close", (code) => this.onChildClose(code));
+        clearTimeout(timeout);
+        resolve3();
+      };
+      const waitForMarker = (chunk) => {
+        this.buffer += chunk;
+        const idx = this.buffer.indexOf("[wstack-acp]\n");
+        if (idx !== -1) {
+          this.buffer = this.buffer.slice(idx + "[wstack-acp]\n".length);
+          child.stdout.removeListener("data", waitForMarker);
+          onReady();
+        }
+      };
+      child.stdout.on("data", waitForMarker);
     });
   }
   send(msg) {
-    if (this.closed || !this.ws) {
-      return Promise.reject(new Error("WebSocket transport is not open"));
-    }
-    try {
-      this.ws.send(JSON.stringify(msg));
-      return Promise.resolve();
-    } catch (err) {
-      return Promise.reject(err instanceof Error ? err : new Error(String(err)));
-    }
+    if (!this.child) return Promise.reject(new Error("ClientTransport not started"));
+    return new Promise((resolve3, reject) => {
+      const line = JSON.stringify(msg) + "\n";
+      this.child?.stdin.write(line, "utf8", (err) => {
+        if (err) reject(err);
+        else resolve3();
+      });
+    });
+  }
+  read() {
+    if (this.messageQueue.length > 0) return Promise.resolve(expectDefined(this.messageQueue.shift()));
+    if (this.closed) return Promise.resolve(null);
+    return new Promise((resolve3) => {
+      this.resolveRead = resolve3;
+    });
   }
   onMessage(handler) {
     this.handlers.add(handler);
@@ -1338,34 +1013,73 @@ var WebSocketClientTransport = class {
   }
   stop() {
     this.closed = true;
-    if (this.ws) {
+    this.resolveRead?.(null);
+    this.resolveRead = null;
+    this.buffer = "";
+    this.messageQueue.length = 0;
+    this.handlers.clear();
+    const child = this.child;
+    if (!child) return;
+    try {
+      child.kill();
+    } catch {
+    }
+    this.child = null;
+  }
+  onChildData(chunk) {
+    this.buffer += chunk;
+    const lines = this.buffer.split("\n");
+    this.buffer = lines.pop() ?? "";
+    if (this.buffer.length > this.maxFrameChars) {
+      writeErr(`[acp-child pending frame exceeds ${this.maxFrameChars} characters]
+`);
+      this.stop();
+      return;
+    }
+    for (const raw of lines) {
+      if (!raw.trim()) continue;
+      if (raw.length > this.maxFrameChars) {
+        writeErr(`[acp-child frame exceeds ${this.maxFrameChars} characters]
+`);
+        this.stop();
+        return;
+      }
       try {
-        this.ws.close();
+        this.dispatch(JSON.parse(raw));
       } catch {
       }
-      this.ws = null;
     }
   }
-  onData(data) {
-    const text = typeof data === "string" ? data : data instanceof ArrayBuffer ? Buffer.from(data).toString("utf8") : Buffer.isBuffer(data) ? data.toString("utf8") : String(data);
-    if (!text.trim()) return;
-    let msg;
-    try {
-      msg = JSON.parse(text);
-    } catch {
-      for (const line of text.split("\n")) {
-        if (!line.trim()) continue;
-        try {
-          this.dispatch(JSON.parse(line));
-        } catch {
-        }
-      }
-      return;
+  onChildError(chunk) {
+    writeErr(`[acp-child stderr] ${chunk}`);
+  }
+  onChildClose(code) {
+    this.closed = true;
+    this.resolveRead?.(null);
+    this.resolveRead = null;
+    this.buffer = "";
+    this.messageQueue.length = 0;
+    this.handlers.clear();
+    if (code !== 0 && code !== null) {
+      writeErr(`[acp-child exited with code ${code}]
+`);
     }
-    this.dispatch(msg);
   }
   dispatch(msg) {
-    for (const handler of [...this.handlers]) {
+    if (this.resolveRead) {
+      const resolve3 = this.resolveRead;
+      this.resolveRead = null;
+      resolve3(msg);
+    } else if (this.handlers.size === 0) {
+      if (this.messageQueue.length >= this.maxQueuedMessages) {
+        writeErr(`[acp-child message queue exceeds ${this.maxQueuedMessages} entries]
+`);
+        this.stop();
+        return;
+      }
+      this.messageQueue.push(msg);
+    }
+    for (const handler of this.handlers) {
       try {
         handler(msg);
       } catch {
@@ -1374,495 +1088,978 @@ var WebSocketClientTransport = class {
   }
 };
 
-// src/client/tool-translator.ts
-import { expectDefined as expectDefined2 } from "@wrongstack/core";
-var DEFAULT_OPTIONS = {
-  asyncTools: true,
-  pollIntervalMs: 500,
-  totalTimeoutMs: 12e4
-};
-var ToolTranslator = class {
-  opts;
-  pending = /* @__PURE__ */ new Map();
-  constructor(opts = {}) {
-    this.opts = { ...DEFAULT_OPTIONS, ...opts };
+// src/agent/tools-registry.ts
+var ACPToolsRegistry = class {
+  tools = /* @__PURE__ */ new Map();
+  owner;
+  constructor(owner = "wrongstack") {
+    this.owner = owner;
   }
   /**
-   * Start listening to a transport for tool responses and cancellations.
-   * Call this once after constructing the translator and before sending tasks.
+   * Register one or more tools.
+   * Throws on duplicate name unless force=true.
    */
-  attachToTransport(transport) {
-    transport.onMessage((msg) => {
-      if (msg.method === "tools/call" && msg.id !== void 0) {
-        const pending = this.pending.get(msg.id);
-        if (pending) {
-          clearTimeout(pending.timeout);
-          this.pending.delete(expectDefined2(msg.id));
-          pending.resolve(msg);
-        }
-      }
-      if (msg.method === "cancel" && msg.id !== void 0) {
-        const pending = this.pending.get(msg.id);
-        if (pending) {
-          clearTimeout(pending.timeout);
-          this.pending.delete(expectDefined2(msg.id));
-          pending.reject(new Error("Call cancelled by client"));
-        }
-      }
-    });
+  register(tools) {
+    for (const tool of tools) {
+      this.tools.set(tool.name, tool);
+    }
   }
   /**
-   * Send a tool call over the transport and wait for a response.
-   * If asyncTools is true, polls for progress and resolves when the final
-   * response arrives.
+   * Replace the current tool set.
    */
-  async callTool(transport, name, args, callId = crypto.randomUUID()) {
-    await transport.send({
-      jsonrpc: "2.0",
-      method: "tools/call",
-      id: callId,
-      params: { name, arguments: args }
-    });
-    return new Promise((resolve3, reject) => {
-      const timeout = setTimeout(() => {
-        this.pending.delete(callId);
-        reject(new Error(`Tool call ${name} timed out after ${this.opts.totalTimeoutMs}ms`));
-      }, this.opts.totalTimeoutMs);
-      this.pending.set(callId, { resolve: resolve3, reject, timeout });
-    });
+  setTools(tools) {
+    this.tools.clear();
+    for (const tool of tools) this.tools.set(tool.name, tool);
   }
-  cancelAll() {
-    for (const [, p] of this.pending) {
-      clearTimeout(p.timeout);
-    }
-    this.pending.clear();
+  get(name) {
+    return this.tools.get(name);
   }
-};
-
-// src/client/file-server.ts
-import { randomBytes } from "node:crypto";
-import { realpathSync } from "node:fs";
-import * as fsp from "node:fs/promises";
-import * as path from "node:path";
-var DEFAULT_MAX_READ_BYTES = 5 * 1024 * 1024;
-var DEFAULT_MAX_WRITE_BYTES = 5 * 1024 * 1024;
-var FsError = class extends Error {
-  code;
-  path;
-  constructor(code, path4, message) {
-    super(message);
-    this.name = "FsError";
-    this.code = code;
-    this.path = path4;
+  has(name) {
+    return this.tools.has(name);
   }
-};
-var FileServer = class {
-  root;
-  realRoot;
-  timeoutMs;
-  maxReadBytes;
-  maxWriteBytes;
-  constructor(opts) {
-    this.root = path.resolve(opts.projectRoot);
-    this.realRoot = safeRealpathSync(this.root);
-    this.timeoutMs = opts.timeoutMs ?? 3e4;
-    this.maxReadBytes = opts.maxReadBytes ?? DEFAULT_MAX_READ_BYTES;
-    this.maxWriteBytes = opts.maxWriteBytes ?? DEFAULT_MAX_WRITE_BYTES;
+  list() {
+    return Array.from(this.tools.values());
   }
-  /** Read a text file. Returns the content as a string. */
-  async readTextFile(params) {
-    const safe = await this.resolveInside(params.path);
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-    try {
-      const stat2 = await fsp.stat(safe).catch((err) => {
-        throw mapFsError(err, safe);
-      });
-      if (stat2.size > this.maxReadBytes) {
-        throw new FsError(
-          "TOO_LARGE",
-          safe,
-          `file is ${stat2.size} bytes, max read is ${this.maxReadBytes} bytes`
-        );
-      }
-      const content = await fsp.readFile(safe, {
-        encoding: "utf8",
-        signal: controller.signal
-      });
-      return { content };
-    } catch (err) {
-      if (err instanceof FsError) throw err;
-      if (controller.signal.aborted) {
-        throw new FsError("TIMEOUT", safe, `readTextFile timed out after ${this.timeoutMs}ms`);
-      }
-      throw mapFsError(err, safe);
-    } finally {
-      clearTimeout(timer);
-    }
+  /** Build the ACP tools/list payload from registered tools. */
+  buildToolList() {
+    return {
+      tools: Array.from(this.tools.values()).map(
+        (t) => toACPToolDefinition(t, this.owner)
+      )
+    };
   }
-  /** Write a text file. Atomic via write-then-rename. */
-  async writeTextFile(params) {
-    const byteLength = Buffer.byteLength(params.content, "utf8");
-    if (byteLength > this.maxWriteBytes) {
-      throw new FsError(
-        "TOO_LARGE",
-        params.path,
-        `content is ${byteLength} bytes, max write is ${this.maxWriteBytes} bytes`
-      );
-    }
-    const safe = await this.resolveInside(params.path);
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-    const tmp = `${safe}.${randomBytes(6).toString("hex")}.tmp`;
+  /**
+   * Execute a tool by name and return ACP-formatted result.
+   * Returns null if the tool is not found.
+   */
+  async execute(name, args, ctx, signal) {
+    const tool = this.tools.get(name);
+    if (!tool) return null;
     try {
-      await fsp.writeFile(tmp, params.content, {
-        encoding: "utf8",
-        signal: controller.signal
+      const result = await tool.execute(args, ctx, {
+        signal
       });
-      await this.assertRealInside(tmp);
-      await this.assertRealInside(path.dirname(safe));
-      await fsp.rename(tmp, safe);
+      return toACPToolResult(result);
     } catch (err) {
-      if (err instanceof FsError) {
-        await fsp.unlink(tmp).catch(() => void 0);
-        throw err;
-      }
-      try {
-        await fsp.unlink(tmp);
-      } catch {
-      }
-      if (controller.signal.aborted) {
-        throw new FsError("TIMEOUT", safe, `writeTextFile timed out after ${this.timeoutMs}ms`);
-      }
-      throw mapFsError(err, safe);
-    } finally {
-      clearTimeout(timer);
+      const msg = err instanceof Error ? err.message : String(err);
+      return { content: [{ type: "text", text: msg }], isError: true };
     }
   }
-  /**
-   * Resolve a path and verify it is inside the project root by realpath.
-   * Rejects with `FsError` if the textual path, the resolved path, or the
-   * real (symlink-resolved) path escapes the project root.
-   *
-   * For files that don't exist yet (e.g. a write to a new file), the
-   * nearest existing ancestor directory is realpath-checked instead.
-   */
-  async resolveInside(p) {
-    if (typeof p !== "string" || p.length === 0) {
-      throw new FsError("INVALID_PATH", p, "path is empty or not a string");
-    }
-    if (!path.isAbsolute(p)) {
-      throw new FsError("INVALID_PATH", p, "path must be absolute (ACP requirement)");
-    }
-    const resolved = path.resolve(p);
-    const rootWithSep = this.root.endsWith(path.sep) ? this.root : this.root + path.sep;
-    if (resolved !== this.root && !resolved.startsWith(rootWithSep)) {
-      throw new FsError("OUTSIDE_ROOT", resolved, "path is outside the project root");
+};
+function toACPToolDefinition(tool, _owner) {
+  return {
+    name: tool.name,
+    description: tool.description,
+    inputSchema: toACPInputSchema(tool.inputSchema),
+    annotations: {
+      title: tool.name,
+      description: tool.usageHint ?? tool.description,
+      priority: toolToPriority(tool),
+      alwaysAccept: tool.permission === "auto"
     }
-    await this.assertRealInside(resolved);
-    return resolved;
+  };
+}
+function toACPInputSchema(src) {
+  if (!src || typeof src !== "object") {
+    return {};
   }
-  /**
-   * Resolve `resolvedPath` through `fs.realpath` and verify the result is
-   * inside `realRoot`. For non-existent paths (new files), walk up to the
-   * nearest existing ancestor and check that instead.
-   */
-  async assertRealInside(resolvedPath) {
-    let probe = resolvedPath;
-    for (; ; ) {
-      let real;
-      try {
-        real = await fsp.realpath(probe);
-      } catch (err) {
-        const code = err.code;
-        if (code === "ENOENT") {
-          const parent = path.dirname(probe);
-          if (parent === probe) return;
-          probe = parent;
-          continue;
-        }
-        throw mapFsError(err, resolvedPath);
-      }
-      if (real === this.realRoot || real.startsWith(this.realRoot + path.sep)) return;
-      throw new FsError(
-        "OUTSIDE_ROOT",
-        resolvedPath,
-        "path resolves through a symlink outside the project root"
-      );
+  const s = src;
+  const out = {};
+  if (typeof s.type === "string") out.type = s.type;
+  if (Array.isArray(s.enum)) out.enum = s.enum;
+  if (typeof s.description === "string") out.description = s.description;
+  if ("default" in s) out.default = s.default;
+  if (typeof s.minimum === "number") out.minimum = s.minimum;
+  if (typeof s.maximum === "number") out.maximum = s.maximum;
+  if (s.items) out.items = toACPInputSchema(s.items);
+  if (s.properties && typeof s.properties === "object") {
+    const props = {};
+    for (const [k, v] of Object.entries(s.properties)) {
+      props[k] = toACPInputSchema(v);
     }
+    out.properties = props;
+    if (Array.isArray(s.required)) out.required = s.required;
   }
-};
-function mapFsError(err, p) {
-  const code = err?.code;
-  if (code === "ENOENT") return new FsError("ENOENT", p, `no such file: ${p}`);
-  if (code === "EACCES" || code === "EPERM") {
-    return new FsError("EACCES", p, `permission denied: ${p}`);
-  }
-  const msg = err instanceof Error ? err.message : String(err);
-  return new FsError("INVALID_PATH", p, msg);
+  return out;
 }
-function safeRealpathSync(p) {
-  try {
-    return realpathSync(p);
-  } catch {
-    return p;
+function toACPToolResult(result) {
+  const blocks = [];
+  if (result === void 0 || result === null) {
+    return { content: [{ type: "text", text: "ok" }] };
   }
-}
-
-// src/client/permission.ts
-function pickAllow(options) {
-  const ranked = [...options].sort((a, b) => {
-    const score = (k) => {
-      if (k === "allow_once") return 0;
-      if (k === "allow_always") return 1;
-      if (k === "reject_once") return 2;
-      return 3;
-    };
-    return score(a.kind) - score(b.kind);
-  });
-  const chosen = ranked[0];
-  if (!chosen || chosen.kind === "reject_once" || chosen.kind === "reject_always") {
-    return { outcome: "cancelled" };
+  if (typeof result === "string") {
+    blocks.push({ type: "text", text: result });
+  } else if (typeof result === "object") {
+    blocks.push({ type: "text", text: JSON.stringify(result, null, 2) });
+  } else {
+    blocks.push({ type: "text", text: String(result) });
   }
-  return { outcome: "selected", optionId: chosen.optionId };
+  return { content: blocks };
 }
-function pickReject(options) {
-  const reject = options.find(
-    (o) => o.kind === "reject_once" || o.kind === "reject_always"
-  );
-  return reject ? { outcome: "selected", optionId: reject.optionId } : { outcome: "cancelled" };
-}
-var READ_ONLY_KINDS = /* @__PURE__ */ new Set(["read", "search", "fetch", "think"]);
-var defaultPermissionPolicy = async (req) => {
-  if (req.signal.aborted) return { outcome: "cancelled" };
-  return pickAllow(req.options);
-};
-var readOnlyPermissionPolicy = async (req) => {
-  if (req.signal.aborted) return { outcome: "cancelled" };
-  const kind = req.toolCall.kind;
-  if (kind && READ_ONLY_KINDS.has(kind)) {
-    return pickAllow(req.options);
-  }
-  return pickReject(req.options);
-};
-function makePermissionPolicy(decide) {
-  return async (req) => {
-    if (req.signal.aborted) return { outcome: "cancelled" };
-    const allow = await decide(req);
-    return allow ? pickAllow(req.options) : pickReject(req.options);
-  };
+function toolToPriority(tool) {
+  if (tool.riskTier === "destructive") return "high";
+  if (tool.riskTier === "standard" || tool.permission === "confirm") return "medium";
+  return "low";
 }
 
-// src/client/terminal-server.ts
-import { spawn } from "node:child_process";
-import { realpathSync as realpathSync2 } from "node:fs";
-import * as path2 from "node:path";
-import { buildChildEnv } from "@wrongstack/core/utils";
-var TerminalServer = class {
-  terminals = /* @__PURE__ */ new Map();
-  projectRoot;
-  commandTimeoutMs;
-  outputByteLimit;
-  maxOutputByteLimit;
-  nextId = 1;
-  constructor(opts) {
-    this.projectRoot = path2.resolve(opts.projectRoot);
-    this.commandTimeoutMs = opts.commandTimeoutMs ?? 5 * 6e4;
-    this.outputByteLimit = opts.outputByteLimit ?? 1024 * 1024;
-    this.maxOutputByteLimit = opts.maxOutputByteLimit ?? 16 * 1024 * 1024;
-    if (opts.signal) {
-      opts.signal.addEventListener("abort", () => this.releaseAll());
-    }
-  }
-  /** Spawn a new terminal. Returns the agent-facing id. */
-  create(params) {
-    const id = `term_${this.nextId++}`;
-    const cwd = this.resolveCwd(params.cwd);
-    const proc = spawn(params.command, params.args ?? [], {
-      cwd,
-      env: this.buildEnv(params.env),
-      stdio: ["ignore", "pipe", "pipe"],
-      windowsHide: true
-      // shell: false on purpose. The terminal server is invoked with
-      // the agent's explicit argv; turning on shell-mode would make
-      // the command a single shell-parsed string, which breaks
-      // Windows cmd quoting for the common case of running node with
-      // `-e "<script>"`. If a future feature needs shell features
-      // (pipes, redirects), it should be opt-in per-call, not the
-      // default.
+// src/agent/wrongstack-acp-agent.ts
+import { fileURLToPath } from "node:url";
+import { createServer } from "node:http";
+import { writeErr as writeErr2 } from "@wrongstack/core/utils";
+var WrongStackACPServer = class {
+  transport;
+  handler;
+  options;
+  /** HTTP server when transport mode is HTTP. */
+  httpServer = null;
+  running = false;
+  constructor(opts = {}) {
+    this.options = opts;
+    this.transport = new StdioTransport();
+    const runTurn = opts.runTurn ?? defaultEchoRunTurn;
+    this.handler = new ACPProtocolHandler({
+      transport: this.transport,
+      defaultCwd: opts.defaultCwd ?? process.cwd(),
+      runTurn,
+      agentName: opts.agentName,
+      ...opts.replayFor ? { replayFor: opts.replayFor } : {},
+      ...opts.seedFor ? { seedFor: opts.seedFor } : {},
+      ...opts.disposeFor ? { disposeFor: opts.disposeFor } : {},
+      ...opts.store ? { store: opts.store } : {}
     });
-    const state = {
-      proc,
-      cwd,
-      command: params.command,
-      args: params.args ?? [],
-      output: "",
-      retainedBytes: 0,
-      truncated: false,
-      exitStatus: void 0,
-      timeoutHandle: null,
-      exitPromise: new Promise((resolve3) => {
-        proc.on("close", (code, signalName) => {
-          if (state.timeoutHandle) {
-            clearTimeout(state.timeoutHandle);
-            state.timeoutHandle = null;
-          }
-          const exitStatus = {
-            exitCode: typeof code === "number" ? code : null,
-            signal: typeof signalName === "string" ? signalName : null
-          };
-          state.exitStatus = exitStatus;
-          resolve3(exitStatus);
-        });
-        proc.on("error", (err) => {
-          if (state.timeoutHandle) {
-            clearTimeout(state.timeoutHandle);
-            state.timeoutHandle = null;
-          }
-          const exitStatus = { exitCode: 127, signal: null };
-          state.exitStatus = exitStatus;
-          state.output += `[spawn error] ${err.message}
-`;
-          state.retainedBytes = Buffer.byteLength(state.output, "utf8");
-          resolve3(exitStatus);
-        });
-      })
-    };
-    const perCallByteLimit = Math.min(
-      Math.max(1, this.clampFiniteInt(params.outputByteLimit, this.outputByteLimit)),
-      this.maxOutputByteLimit
-    );
-    proc.stdout?.setEncoding("utf8");
-    proc.stderr?.setEncoding("utf8");
-    const onData = (chunk) => {
-      state.output += chunk;
-      state.retainedBytes = Buffer.byteLength(state.output, "utf8");
-      while (state.retainedBytes > perCallByteLimit) {
-        const trimmed = state.output.slice(1);
-        state.output = trimmed;
-        const newBytes = Buffer.byteLength(state.output, "utf8");
-        if (newBytes >= state.retainedBytes) {
-          break;
-        }
-        state.retainedBytes = newBytes;
-        state.truncated = true;
-      }
-    };
-    proc.stdout?.on("data", onData);
-    proc.stderr?.on("data", onData);
-    state.timeoutHandle = setTimeout(() => {
-      try {
-        proc.kill("SIGTERM");
-      } catch {
-      }
-    }, this.commandTimeoutMs);
-    this.terminals.set(id, state);
-    return { terminalId: id };
   }
-  /** Return captured output and (if available) the exit status. */
-  output(terminalId) {
-    const state = this.terminals.get(terminalId);
-    if (!state) throw new Error(`unknown terminal: ${terminalId}`);
-    return {
-      output: state.output,
-      truncated: state.truncated,
-      ...state.exitStatus ? { exitStatus: state.exitStatus } : {}
-    };
-  }
-  /** Block until the process exits. Resolves with the exit status. */
-  async waitForExit(terminalId) {
-    const state = this.terminals.get(terminalId);
-    if (!state) throw new Error(`unknown terminal: ${terminalId}`);
-    return state.exitPromise;
-  }
-  /** Kill the process but keep the terminal record (agent can still read output). */
-  kill(terminalId) {
-    const state = this.terminals.get(terminalId);
-    if (!state) throw new Error(`unknown terminal: ${terminalId}`);
-    try {
-      state.proc.kill("SIGTERM");
-    } catch {
-    }
-  }
-  /** Kill the process if alive and remove the record. */
-  release(terminalId) {
-    const state = this.terminals.get(terminalId);
-    if (!state) return;
-    if (state.timeoutHandle) {
-      clearTimeout(state.timeoutHandle);
-      state.timeoutHandle = null;
-    }
-    try {
-      state.proc.kill("SIGKILL");
-    } catch {
-    }
-    this.terminals.delete(terminalId);
-  }
-  /** Kill all active terminals. Used on session close. */
-  releaseAll() {
-    for (const id of [...this.terminals.keys()]) {
-      this.release(id);
+  /**
+   * Start the server. Mode depends on `options.transport`:
+   * - 'stdio' (default): reads JSON-RPC from stdin, writes to stdout.
+   * - number: listens as HTTP on the given port.
+   */
+  async start() {
+    const transportMode = this.options.transport;
+    if (typeof transportMode === "number") {
+      await this.startHttp(transportMode);
+    } else {
+      await this.startStdio();
     }
   }
-  resolveCwd(cwd) {
-    if (!cwd) return this.projectRoot;
-    const resolved = path2.resolve(cwd);
-    const rootWithSep = this.projectRoot.endsWith(path2.sep) ? this.projectRoot : this.projectRoot + path2.sep;
-    if (resolved !== this.projectRoot && !resolved.startsWith(rootWithSep)) {
-      return this.projectRoot;
+  async startStdio() {
+    if (this.options.legacyStartupMarker) {
+      this.transport.sendStartupMarker();
     }
+    this.running = true;
     try {
-      const realRoot = realpathSync2(this.projectRoot);
-      const realCwd = realpathSync2(resolved);
-      const realRootWithSep = realRoot.endsWith(path2.sep) ? realRoot : realRoot + path2.sep;
-      if (realCwd !== realRoot && !realCwd.startsWith(realRootWithSep)) {
-        return realRoot;
+      while (this.running) {
+        const msg = await this.transport.read();
+        if (!msg) break;
+        const terminal = await this.handler.handleMessage(msg);
+        if (terminal) break;
       }
-      return realCwd;
-    } catch {
-      return this.projectRoot;
+    } finally {
+      this.handler.close();
+      this.transport.close();
     }
   }
-  buildEnv(agentEnv) {
-    const env = buildChildEnv();
-    if (agentEnv) {
-      for (const { name, value } of agentEnv) {
-        const upper = name.toUpperCase();
-        if (DENIED_AGENT_ENV_KEYS.has(upper)) continue;
-        env[name] = value;
+  async startHttp(port) {
+    const host = this.options.host ?? "127.0.0.1";
+    const handler = this.handler;
+    const authToken = this.options.authToken;
+    let httpChain = Promise.resolve();
+    this.httpServer = createServer(async (req, res) => {
+      if (authToken) {
+        const url = new URL(req.url ?? "/", `http://${host}:${port}`);
+        const queryToken = url.searchParams.get("token");
+        const authHeader = req.headers["authorization"];
+        const bearerToken = Array.isArray(authHeader) ? authHeader[0]?.replace(/^Bearer\s+/i, "") : authHeader?.replace(/^Bearer\s+/i, "");
+        const supplied = queryToken ?? bearerToken ?? "";
+        if (supplied !== authToken) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: { code: -32001, message: "Unauthorized" } }));
+          return;
+        }
       }
-    }
-    return env;
-  }
-  /**
-   * Clamp an agent-supplied numeric to a finite positive safe integer, falling
-   * back to `defaultValue` for undefined/NaN/non-finite values. Prevents
-   * negative, NaN, or Infinity values from disabling output caps or causing
-   * unbounded memory growth.
-   */
-  clampFiniteInt(value, defaultValue) {
-    if (value === void 0 || !Number.isFinite(value) || value < 1) {
-      return defaultValue;
-    }
-    return Math.trunc(value);
-  }
-};
-var DENIED_AGENT_ENV_KEYS = /* @__PURE__ */ new Set([
-  "NODE_OPTIONS",
-  "LD_PRELOAD",
-  "LD_LIBRARY_PATH",
-  "DYLD_INSERT_LIBRARIES",
-  "DYLD_LIBRARY_PATH",
-  "DYLD_FALLBACK_LIBRARY_PATH",
-  "PATH",
-  "PYTHONPATH",
-  "PYTHONSTARTUP",
-  "PERL5OPT",
-  "PERLLIB",
-  "RUBYOPT",
-  "RUBYLIB"
-]);
-
+      const selfOrigin = `http://${host}:${port}`;
+      const reqOrigin = Array.isArray(req.headers.origin) ? req.headers.origin[0] : req.headers.origin;
+      if (reqOrigin && reqOrigin !== selfOrigin) {
+        res.writeHead(403);
+        res.end(JSON.stringify({ error: "cross-origin request forbidden" }));
+        return;
+      }
+      if (reqOrigin) res.setHeader("Access-Control-Allow-Origin", reqOrigin);
+      res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
+      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id, Authorization");
+      if (req.method === "OPTIONS") {
+        res.writeHead(204);
+        res.end();
+        return;
+      }
+      if (req.method !== "POST") {
+        res.writeHead(405);
+        res.end(JSON.stringify({ error: "method not allowed" }));
+        return;
+      }
+      const MAX_HTTP_BODY = 10 * 1024 * 1024;
+      let body = "";
+      let bodyBytes = 0;
+      let tooLarge = false;
+      for await (const chunk of req) {
+        bodyBytes += chunk.length;
+        if (bodyBytes > MAX_HTTP_BODY) {
+          tooLarge = true;
+          break;
+        }
+        body += chunk;
+      }
+      if (tooLarge) {
+        res.writeHead(413, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: { code: -32700, message: "Request body too large" } }));
+        return;
+      }
+      let msg;
+      try {
+        msg = JSON.parse(body);
+      } catch {
+        res.writeHead(400);
+        res.end(JSON.stringify({ error: { code: -32700, message: "Parse error" } }));
+        return;
+      }
+      const isNotification = typeof msg === "object" && msg !== null && msg.id === void 0 && typeof msg.method === "string";
+      if (isNotification) {
+        try {
+          await handler.handleMessage(msg);
+        } catch {
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ notifications: [] }));
+        return;
+      }
+      const requestPromise = httpChain.then(async () => {
+        const notifications = [];
+        let response = null;
+        const originalSend = this.transport.send.bind(this.transport);
+        this.transport.send = async (m) => {
+          if (m.id !== void 0 && (m.result !== void 0 || m.error !== void 0)) {
+            response = m;
+          } else if (m.method === "session/update") {
+            notifications.push(m.params);
+          } else {
+            notifications.push(m);
+          }
+        };
+        try {
+          await handler.handleMessage(msg);
+        } finally {
+          this.transport.send = originalSend;
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        const responseBody = response !== null ? { ...response, notifications } : { notifications };
+        res.end(JSON.stringify(responseBody));
+      });
+      httpChain = requestPromise.catch(() => void 0);
+      try {
+        await requestPromise;
+      } catch {
+      }
+    });
+    return new Promise((resolve3) => {
+      this.httpServer.listen(port, host, () => {
+        writeErr2(`[wstack-acp] HTTP server listening on http://${host}:${port}
+`);
+        this.running = true;
+        resolve3();
+      });
+    });
+  }
+  /** Stop the server. */
+  stop() {
+    this.running = false;
+    this.handler.close();
+    this.transport.close();
+    if (this.httpServer) {
+      this.httpServer.close();
+      this.httpServer = null;
+    }
+  }
+};
+var defaultEchoRunTurn = async (_input, _emit) => {
+  return { stopReason: "end_turn" };
+};
+async function main() {
+  const server = new WrongStackACPServer();
+  await server.start();
+}
+var isEntrypoint = process.argv[1] !== void 0 && fileURLToPath(import.meta.url) === process.argv[1];
+if (isEntrypoint) {
+  main().catch((err) => {
+    writeErr2(`[wstack-acp fatal] ${err}
+`);
+    process.exit(1);
+  });
+}
+
+// src/client/file-server.ts
+import { randomBytes } from "node:crypto";
+import { realpathSync } from "node:fs";
+import * as fsp from "node:fs/promises";
+import * as path from "node:path";
+var DEFAULT_MAX_READ_BYTES = 5 * 1024 * 1024;
+var DEFAULT_MAX_WRITE_BYTES = 5 * 1024 * 1024;
+var FsError = class extends Error {
+  code;
+  path;
+  constructor(code, path4, message) {
+    super(message);
+    this.name = "FsError";
+    this.code = code;
+    this.path = path4;
+  }
+};
+var FileServer = class {
+  root;
+  realRoot;
+  timeoutMs;
+  maxReadBytes;
+  maxWriteBytes;
+  constructor(opts) {
+    this.root = path.resolve(opts.projectRoot);
+    this.realRoot = safeRealpathSync(this.root);
+    this.timeoutMs = opts.timeoutMs ?? 3e4;
+    this.maxReadBytes = opts.maxReadBytes ?? DEFAULT_MAX_READ_BYTES;
+    this.maxWriteBytes = opts.maxWriteBytes ?? DEFAULT_MAX_WRITE_BYTES;
+  }
+  /** Read a text file. Returns the content as a string. */
+  async readTextFile(params) {
+    const safe = await this.resolveInside(params.path);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    try {
+      const stat2 = await fsp.stat(safe).catch((err) => {
+        throw mapFsError(err, safe);
+      });
+      if (stat2.size > this.maxReadBytes) {
+        throw new FsError(
+          "TOO_LARGE",
+          safe,
+          `file is ${stat2.size} bytes, max read is ${this.maxReadBytes} bytes`
+        );
+      }
+      const content = await fsp.readFile(safe, {
+        encoding: "utf8",
+        signal: controller.signal
+      });
+      return { content };
+    } catch (err) {
+      if (err instanceof FsError) throw err;
+      if (controller.signal.aborted) {
+        throw new FsError("TIMEOUT", safe, `readTextFile timed out after ${this.timeoutMs}ms`);
+      }
+      throw mapFsError(err, safe);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  /** Write a text file. Atomic via write-then-rename. */
+  async writeTextFile(params) {
+    const byteLength = Buffer.byteLength(params.content, "utf8");
+    if (byteLength > this.maxWriteBytes) {
+      throw new FsError(
+        "TOO_LARGE",
+        params.path,
+        `content is ${byteLength} bytes, max write is ${this.maxWriteBytes} bytes`
+      );
+    }
+    const safe = await this.resolveInside(params.path);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    const tmp = `${safe}.${randomBytes(6).toString("hex")}.tmp`;
+    try {
+      await fsp.writeFile(tmp, params.content, {
+        encoding: "utf8",
+        signal: controller.signal
+      });
+      await this.assertRealInside(tmp);
+      await this.assertRealInside(path.dirname(safe));
+      await fsp.rename(tmp, safe);
+    } catch (err) {
+      if (err instanceof FsError) {
+        await fsp.unlink(tmp).catch(() => void 0);
+        throw err;
+      }
+      try {
+        await fsp.unlink(tmp);
+      } catch {
+      }
+      if (controller.signal.aborted) {
+        throw new FsError("TIMEOUT", safe, `writeTextFile timed out after ${this.timeoutMs}ms`);
+      }
+      throw mapFsError(err, safe);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  /**
+   * Resolve a path and verify it is inside the project root by realpath.
+   * Rejects with `FsError` if the textual path, the resolved path, or the
+   * real (symlink-resolved) path escapes the project root.
+   *
+   * For files that don't exist yet (e.g. a write to a new file), the
+   * nearest existing ancestor directory is realpath-checked instead.
+   */
+  async resolveInside(p) {
+    if (typeof p !== "string" || p.length === 0) {
+      throw new FsError("INVALID_PATH", p, "path is empty or not a string");
+    }
+    if (!path.isAbsolute(p)) {
+      throw new FsError("INVALID_PATH", p, "path must be absolute (ACP requirement)");
+    }
+    const resolved = path.resolve(p);
+    const rootWithSep = this.root.endsWith(path.sep) ? this.root : this.root + path.sep;
+    if (resolved !== this.root && !resolved.startsWith(rootWithSep)) {
+      throw new FsError("OUTSIDE_ROOT", resolved, "path is outside the project root");
+    }
+    await this.assertRealInside(resolved);
+    return resolved;
+  }
+  /**
+   * Resolve `resolvedPath` through `fs.realpath` and verify the result is
+   * inside `realRoot`. For non-existent paths (new files), walk up to the
+   * nearest existing ancestor and check that instead.
+   */
+  async assertRealInside(resolvedPath) {
+    let probe = resolvedPath;
+    for (; ; ) {
+      let real;
+      try {
+        real = await fsp.realpath(probe);
+      } catch (err) {
+        const code = err.code;
+        if (code === "ENOENT") {
+          const parent = path.dirname(probe);
+          if (parent === probe) return;
+          probe = parent;
+          continue;
+        }
+        throw mapFsError(err, resolvedPath);
+      }
+      if (real === this.realRoot || real.startsWith(this.realRoot + path.sep)) return;
+      throw new FsError(
+        "OUTSIDE_ROOT",
+        resolvedPath,
+        "path resolves through a symlink outside the project root"
+      );
+    }
+  }
+};
+function mapFsError(err, p) {
+  const code = err?.code;
+  if (code === "ENOENT") return new FsError("ENOENT", p, `no such file: ${p}`);
+  if (code === "EACCES" || code === "EPERM") {
+    return new FsError("EACCES", p, `permission denied: ${p}`);
+  }
+  const msg = err instanceof Error ? err.message : String(err);
+  return new FsError("INVALID_PATH", p, msg);
+}
+function safeRealpathSync(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+}
+
+// src/client/permission.ts
+function pickAllow(options) {
+  const ranked = [...options].sort((a, b) => {
+    const score = (k) => {
+      if (k === "allow_once") return 0;
+      if (k === "allow_always") return 1;
+      if (k === "reject_once") return 2;
+      return 3;
+    };
+    return score(a.kind) - score(b.kind);
+  });
+  const chosen = ranked[0];
+  if (!chosen || chosen.kind === "reject_once" || chosen.kind === "reject_always") {
+    return { outcome: "cancelled" };
+  }
+  return { outcome: "selected", optionId: chosen.optionId };
+}
+function pickReject(options) {
+  const reject = options.find(
+    (o) => o.kind === "reject_once" || o.kind === "reject_always"
+  );
+  return reject ? { outcome: "selected", optionId: reject.optionId } : { outcome: "cancelled" };
+}
+var READ_ONLY_KINDS = /* @__PURE__ */ new Set(["read", "search", "fetch", "think"]);
+var defaultPermissionPolicy = async (req) => {
+  if (req.signal.aborted) return { outcome: "cancelled" };
+  return pickAllow(req.options);
+};
+var readOnlyPermissionPolicy = async (req) => {
+  if (req.signal.aborted) return { outcome: "cancelled" };
+  const kind = req.toolCall.kind;
+  if (kind && READ_ONLY_KINDS.has(kind)) {
+    return pickAllow(req.options);
+  }
+  return pickReject(req.options);
+};
+function makePermissionPolicy(decide) {
+  return async (req) => {
+    if (req.signal.aborted) return { outcome: "cancelled" };
+    const allow = await decide(req);
+    return allow ? pickAllow(req.options) : pickReject(req.options);
+  };
+}
+
+// src/client/terminal-server.ts
+import { spawn } from "node:child_process";
+import { realpathSync as realpathSync2 } from "node:fs";
+import * as path2 from "node:path";
+import { buildChildEnv } from "@wrongstack/core/utils";
+var EMPTY_BUFFER = Buffer.alloc(0);
+var TerminalServer = class {
+  terminals = /* @__PURE__ */ new Map();
+  projectRoot;
+  commandTimeoutMs;
+  outputByteLimit;
+  maxOutputByteLimit;
+  maxTerminals;
+  abortSignal;
+  abortHandler = () => this.releaseAll();
+  nextId = 1;
+  constructor(opts) {
+    this.projectRoot = path2.resolve(opts.projectRoot);
+    this.commandTimeoutMs = opts.commandTimeoutMs ?? 5 * 6e4;
+    this.outputByteLimit = opts.outputByteLimit ?? 1024 * 1024;
+    this.maxOutputByteLimit = opts.maxOutputByteLimit ?? 16 * 1024 * 1024;
+    this.maxTerminals = this.clampFiniteInt(opts.maxTerminals, 32);
+    if (this.maxTerminals < 1) throw new RangeError("maxTerminals must be at least 1");
+    this.abortSignal = opts.signal;
+    if (opts.signal) {
+      opts.signal.addEventListener("abort", this.abortHandler, { once: true });
+    }
+  }
+  /** Spawn a new terminal. Returns the agent-facing id. */
+  create(params) {
+    if (this.terminals.size >= this.maxTerminals) {
+      throw new Error(
+        `terminal limit reached (${this.maxTerminals}); release an existing terminal before creating another`
+      );
+    }
+    const id = `term_${this.nextId++}`;
+    const cwd = this.resolveCwd(params.cwd);
+    const perCallByteLimit = Math.min(
+      Math.max(1, this.clampFiniteInt(params.outputByteLimit, this.outputByteLimit)),
+      this.maxOutputByteLimit
+    );
+    const proc = spawn(params.command, params.args ?? [], {
+      cwd,
+      env: this.buildEnv(params.env),
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true
+      // shell: false on purpose. The terminal server is invoked with
+      // the agent's explicit argv; turning on shell-mode would make
+      // the command a single shell-parsed string, which breaks
+      // Windows cmd quoting for the common case of running node with
+      // `-e "<script>"`. If a future feature needs shell features
+      // (pipes, redirects), it should be opt-in per-call, not the
+      // default.
+    });
+    const state = {
+      proc,
+      cwd,
+      command: params.command,
+      args: params.args ?? [],
+      outputChunks: [],
+      outputHead: 0,
+      retainedBytes: 0,
+      truncated: false,
+      exitStatus: void 0,
+      timeoutHandle: null,
+      exitPromise: new Promise((resolve3) => {
+        proc.on("close", (code, signalName) => {
+          if (state.timeoutHandle) {
+            clearTimeout(state.timeoutHandle);
+            state.timeoutHandle = null;
+          }
+          const exitStatus = {
+            exitCode: typeof code === "number" ? code : null,
+            signal: typeof signalName === "string" ? signalName : null
+          };
+          state.exitStatus = exitStatus;
+          resolve3(exitStatus);
+        });
+        proc.on("error", (err) => {
+          if (state.timeoutHandle) {
+            clearTimeout(state.timeoutHandle);
+            state.timeoutHandle = null;
+          }
+          const exitStatus = { exitCode: 127, signal: null };
+          state.exitStatus = exitStatus;
+          let errorOutput = Buffer.from(`[spawn error] ${err.message}
+`, "utf8");
+          if (errorOutput.length > perCallByteLimit) {
+            let start = errorOutput.length - perCallByteLimit;
+            while (start < errorOutput.length && (errorOutput[start] & 192) === 128) start++;
+            errorOutput = errorOutput.subarray(start);
+            state.truncated = true;
+          }
+          state.outputChunks.push(errorOutput);
+          state.retainedBytes = errorOutput.length;
+          resolve3(exitStatus);
+        });
+      })
+    };
+    proc.stdout?.setEncoding("utf8");
+    proc.stderr?.setEncoding("utf8");
+    const onData = (chunk) => {
+      const outputChunk = Buffer.from(chunk, "utf8");
+      state.outputChunks.push(outputChunk);
+      state.retainedBytes += outputChunk.length;
+      if (state.retainedBytes > perCallByteLimit) state.truncated = true;
+      while (state.retainedBytes > perCallByteLimit && state.outputHead < state.outputChunks.length) {
+        const first = state.outputChunks[state.outputHead];
+        const overflow = state.retainedBytes - perCallByteLimit;
+        if (first.length <= overflow) {
+          state.outputChunks[state.outputHead] = EMPTY_BUFFER;
+          state.outputHead++;
+          state.retainedBytes -= first.length;
+          continue;
+        }
+        let start = overflow;
+        while (start < first.length && (first[start] & 192) === 128) start++;
+        state.outputChunks[state.outputHead] = first.subarray(start);
+        state.retainedBytes -= start;
+      }
+      if (state.outputHead >= 256 && state.outputHead * 2 >= state.outputChunks.length) {
+        state.outputChunks = state.outputChunks.slice(state.outputHead);
+        state.outputHead = 0;
+      }
+    };
+    proc.stdout?.on("data", onData);
+    proc.stderr?.on("data", onData);
+    state.timeoutHandle = setTimeout(() => {
+      try {
+        proc.kill("SIGTERM");
+      } catch {
+      }
+    }, this.commandTimeoutMs);
+    this.terminals.set(id, state);
+    return { terminalId: id };
+  }
+  /** Return captured output and (if available) the exit status. */
+  output(terminalId) {
+    const state = this.terminals.get(terminalId);
+    if (!state) throw new Error(`unknown terminal: ${terminalId}`);
+    return {
+      output: Buffer.concat(
+        state.outputChunks.slice(state.outputHead),
+        state.retainedBytes
+      ).toString("utf8"),
+      truncated: state.truncated,
+      ...state.exitStatus ? { exitStatus: state.exitStatus } : {}
+    };
+  }
+  /** Block until the process exits. Resolves with the exit status. */
+  async waitForExit(terminalId) {
+    const state = this.terminals.get(terminalId);
+    if (!state) throw new Error(`unknown terminal: ${terminalId}`);
+    return state.exitPromise;
+  }
+  /** Kill the process but keep the terminal record (agent can still read output). */
+  kill(terminalId) {
+    const state = this.terminals.get(terminalId);
+    if (!state) throw new Error(`unknown terminal: ${terminalId}`);
+    try {
+      state.proc.kill("SIGTERM");
+    } catch {
+    }
+  }
+  /** Kill the process if alive and remove the record. */
+  release(terminalId) {
+    const state = this.terminals.get(terminalId);
+    if (!state) return;
+    if (state.timeoutHandle) {
+      clearTimeout(state.timeoutHandle);
+      state.timeoutHandle = null;
+    }
+    try {
+      state.proc.kill("SIGKILL");
+    } catch {
+    }
+    this.terminals.delete(terminalId);
+  }
+  /** Kill all active terminals. Used on session close. */
+  releaseAll() {
+    this.abortSignal?.removeEventListener("abort", this.abortHandler);
+    for (const id of [...this.terminals.keys()]) {
+      this.release(id);
+    }
+  }
+  resolveCwd(cwd) {
+    if (!cwd) return this.projectRoot;
+    const resolved = path2.resolve(cwd);
+    const rootWithSep = this.projectRoot.endsWith(path2.sep) ? this.projectRoot : this.projectRoot + path2.sep;
+    if (resolved !== this.projectRoot && !resolved.startsWith(rootWithSep)) {
+      return this.projectRoot;
+    }
+    try {
+      const realRoot = realpathSync2(this.projectRoot);
+      const realCwd = realpathSync2(resolved);
+      const realRootWithSep = realRoot.endsWith(path2.sep) ? realRoot : realRoot + path2.sep;
+      if (realCwd !== realRoot && !realCwd.startsWith(realRootWithSep)) {
+        return realRoot;
+      }
+      return realCwd;
+    } catch {
+      return this.projectRoot;
+    }
+  }
+  buildEnv(agentEnv) {
+    const env = buildChildEnv();
+    if (agentEnv) {
+      for (const { name, value } of agentEnv) {
+        const upper = name.toUpperCase();
+        if (DENIED_AGENT_ENV_KEYS.has(upper)) continue;
+        env[name] = value;
+      }
+    }
+    return env;
+  }
+  /**
+   * Clamp an agent-supplied numeric to a finite positive safe integer, falling
+   * back to `defaultValue` for undefined/NaN/non-finite values. Prevents
+   * negative, NaN, or Infinity values from disabling output caps or causing
+   * unbounded memory growth.
+   */
+  clampFiniteInt(value, defaultValue) {
+    if (value === void 0 || !Number.isFinite(value) || value < 1) {
+      return defaultValue;
+    }
+    return Math.trunc(value);
+  }
+};
+var DENIED_AGENT_ENV_KEYS = /* @__PURE__ */ new Set([
+  "NODE_OPTIONS",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "DYLD_INSERT_LIBRARIES",
+  "DYLD_LIBRARY_PATH",
+  "DYLD_FALLBACK_LIBRARY_PATH",
+  "PATH",
+  "PYTHONPATH",
+  "PYTHONSTARTUP",
+  "PERL5OPT",
+  "PERLLIB",
+  "RUBYOPT",
+  "RUBYLIB"
+]);
+
+// src/client/trust-boundary-permission.ts
+function pickOption(options, allowed) {
+  const kinds = allowed ? ["allow_once", "allow_always"] : ["reject_once", "reject_always"];
+  for (const kind of kinds) {
+    const option = options.find((candidate) => candidate.kind === kind);
+    if (option) return { outcome: "selected", optionId: option.optionId };
+  }
+  return { outcome: "cancelled" };
+}
+function riskFor(kind) {
+  if (kind === "read" || kind === "search" || kind === "fetch" || kind === "think") return "low";
+  if (kind === "edit" || kind === "move") return "elevated";
+  if (kind === "delete" || kind === "execute") return "high";
+  return "elevated";
+}
+function capabilityFor(request) {
+  const raw = request.toolCall.rawInput;
+  if (typeof raw?.path === "string") {
+    return request.toolCall.kind === "read" || request.toolCall.kind === "search" ? "filesystem.read" : "filesystem.write";
+  }
+  if (typeof raw?.command === "string" || request.toolCall.kind === "execute")
+    return "process.spawn";
+  if (request.toolCall.kind === "fetch") return "network.fetch";
+  return `tool.${request.toolCall.kind ?? "unknown"}`;
+}
+function subjectFor(request) {
+  const raw = request.toolCall.rawInput;
+  const title = request.toolCall.title ?? `ACP tool call ${String(request.toolCall.toolCallId)}`;
+  if (typeof raw?.path === "string") {
+    return { kind: "path", id: raw.path, attributes: { toolKind: request.toolCall.kind ?? null } };
+  }
+  if (typeof raw?.command === "string") {
+    return {
+      kind: "command",
+      id: raw.command,
+      attributes: { toolKind: request.toolCall.kind ?? null }
+    };
+  }
+  return {
+    kind: "resource",
+    id: title,
+    attributes: { toolKind: request.toolCall.kind ?? null }
+  };
+}
+function isAllowed(decision) {
+  return decision.kind === "allow" || decision.kind === "scoped-token";
+}
+function toTrustBoundaryRequest(request, options) {
+  const rawSessionId = request.toolCall.rawInput?.sessionId;
+  const sessionId = typeof rawSessionId === "string" && rawSessionId.length > 0 ? rawSessionId : options.actor?.sessionId;
+  return {
+    version: 1,
+    requestId: String(request.toolCall.toolCallId),
+    actor: {
+      ...options.actor ?? { kind: "agent" },
+      ...sessionId ? { sessionId } : {}
+    },
+    surface: "acp",
+    capability: capabilityFor(request),
+    subject: subjectFor(request),
+    risk: riskFor(request.toolCall.kind),
+    scope: {
+      ...options.scope ?? {},
+      ...sessionId ? { sessionId } : {}
+    },
+    ...options.authContext ? { authContext: options.authContext } : {},
+    metadata: {
+      ...request.toolCall.title ? { title: request.toolCall.title } : {},
+      toolKind: request.toolCall.kind ?? null
+    }
+  };
+}
+function makeTrustBoundaryPermissionPolicy(options) {
+  return async (request) => {
+    if (request.signal.aborted) return { outcome: "cancelled" };
+    const decision = await options.boundary.evaluate(toTrustBoundaryRequest(request, options));
+    if (request.signal.aborted) return { outcome: "cancelled" };
+    return pickOption(request.options, isAllowed(decision));
+  };
+}
+
+// src/client/websocket-transport.ts
+var WebSocketClientTransport = class {
+  ws = null;
+  handlers = /* @__PURE__ */ new Set();
+  closed = false;
+  opts;
+  maxBufferedBytes;
+  maxMessageChars;
+  constructor(opts) {
+    this.opts = opts;
+    this.maxBufferedBytes = finitePositiveLimit(opts.maxBufferedBytes, 32 * 1024 * 1024);
+    this.maxMessageChars = finitePositiveLimit(opts.maxMessageChars, 20 * 1024 * 1024);
+  }
+  start() {
+    const WS = globalThis.WebSocket;
+    if (!WS) {
+      return Promise.reject(
+        new Error(
+          "global WebSocket is not available \u2014 Node \u2265 22 is required for the remote ACP transport"
+        )
+      );
+    }
+    const timeoutMs = this.opts.handshakeTimeoutMs ?? 3e4;
+    return new Promise((resolve3, reject) => {
+      let settled = false;
+      const ws = new WS(this.opts.url, this.opts.protocols);
+      this.ws = ws;
+      const timer = setTimeout(() => {
+        if (settled) return;
+        settled = true;
+        try {
+          ws.close();
+        } catch {
+        }
+        reject(new Error(`WebSocket failed to open within ${timeoutMs}ms`));
+      }, timeoutMs);
+      ws.addEventListener("open", () => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        resolve3();
+      });
+      ws.addEventListener("error", (ev) => {
+        if (settled) {
+          this.closed = true;
+          return;
+        }
+        settled = true;
+        clearTimeout(timer);
+        const message = ev && typeof ev === "object" && "message" in ev ? String(ev.message) : "WebSocket error";
+        reject(new Error(message));
+      });
+      ws.addEventListener("close", () => {
+        this.closed = true;
+      });
+      ws.addEventListener("message", (ev) => {
+        this.onData(ev.data);
+      });
+    });
+  }
+  send(msg) {
+    if (this.closed || !this.ws) {
+      return Promise.reject(new Error("WebSocket transport is not open"));
+    }
+    try {
+      const serialized = JSON.stringify(msg);
+      const buffered = Number.isFinite(this.ws.bufferedAmount) ? this.ws.bufferedAmount ?? 0 : 0;
+      if (buffered + Buffer.byteLength(serialized, "utf8") > this.maxBufferedBytes) {
+        this.stop();
+        return Promise.reject(new Error("WebSocket transport send buffer limit exceeded"));
+      }
+      this.ws.send(serialized);
+      return Promise.resolve();
+    } catch (err) {
+      return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+    }
+  }
+  onMessage(handler) {
+    this.handlers.add(handler);
+    return () => this.handlers.delete(handler);
+  }
+  stop() {
+    this.closed = true;
+    if (this.ws) {
+      try {
+        this.ws.close();
+      } catch {
+      }
+      this.ws = null;
+    }
+  }
+  onData(data) {
+    const text = typeof data === "string" ? data : data instanceof ArrayBuffer ? Buffer.from(data).toString("utf8") : Buffer.isBuffer(data) ? data.toString("utf8") : String(data);
+    if (text.length > this.maxMessageChars) {
+      this.stop();
+      return;
+    }
+    if (!text.trim()) return;
+    let msg;
+    try {
+      msg = JSON.parse(text);
+    } catch {
+      for (const line of text.split("\n")) {
+        if (!line.trim()) continue;
+        try {
+          this.dispatch(JSON.parse(line));
+        } catch {
+        }
+      }
+      return;
+    }
+    this.dispatch(msg);
+  }
+  dispatch(msg) {
+    for (const handler of [...this.handlers]) {
+      try {
+        handler(msg);
+      } catch {
+      }
+    }
+  }
+};
+function finitePositiveLimit(value, fallback) {
+  return Number.isFinite(value) && (value ?? 0) > 0 ? Math.floor(value) : fallback;
+}
+
 // src/client/acp-session.ts
 var ACPSessionError = class extends Error {
   kind;
@@ -1884,6 +2081,7 @@ var ACPSession = class _ACPSession {
   permissionPolicy;
   timeoutMs;
   opts;
+  transportOff = null;
   state = "init";
   sessionId = null;
   /** Pending outbound requests (initialize, session/new, session/prompt, etc). */
@@ -1915,8 +2113,19 @@ var ACPSession = class _ACPSession {
     if (opts.terminalOutputByteLimit !== void 0) {
       termOpts.outputByteLimit = opts.terminalOutputByteLimit;
     }
+    if (opts.terminalMaxCount !== void 0) {
+      termOpts.maxTerminals = opts.terminalMaxCount;
+    }
     this.terminalServer = new TerminalServer(termOpts);
-    this.permissionPolicy = opts.permissionPolicy ?? defaultPermissionPolicy;
+    if (opts.permissionPolicy && opts.trustBoundary) {
+      throw new TypeError("permissionPolicy and trustBoundary are mutually exclusive");
+    }
+    this.permissionPolicy = opts.trustBoundary ? makeTrustBoundaryPermissionPolicy({
+      boundary: opts.trustBoundary,
+      ...opts.trustActor ? { actor: opts.trustActor } : {},
+      scope: opts.trustScope ?? { cwd: opts.projectRoot },
+      ...opts.trustAuthContext ? { authContext: opts.trustAuthContext } : {}
+    }) : opts.permissionPolicy ?? readOnlyPermissionPolicy;
   }
   // ──────────────────────────────────────────────────────────────────────
   // Public accessors
@@ -1990,10 +2199,12 @@ var ACPSession = class _ACPSession {
       throw new ACPSessionError("spawn_failed", `${spawnErrLabel}: ${msg}`, err);
     }
     const session = new _ACPSession(opts, transport);
-    transport.onMessage((msg) => session.handleMessage(msg));
+    session.transportOff = transport.onMessage((msg) => session.handleMessage(msg));
     try {
       await session.initialize();
     } catch (err) {
+      session.transportOff?.();
+      session.transportOff = null;
       try {
         transport.stop();
       } catch {
@@ -2157,7 +2368,11 @@ var ACPSession = class _ACPSession {
       mcpServers: servers
     });
     if (isJsonRpcError(result)) {
-      throw new ACPSessionError("prompt_failed", `session/resume failed: ${result.message}`, result);
+      throw new ACPSessionError(
+        "prompt_failed",
+        `session/resume failed: ${result.message}`,
+        result
+      );
     }
     this.sessionId = sessionId;
   }
@@ -2208,7 +2423,11 @@ var ACPSession = class _ACPSession {
     const id = this.allocId();
     const result = await this.sendRequest(id, "session/delete", { sessionId });
     if (isJsonRpcError(result)) {
-      throw new ACPSessionError("prompt_failed", `session/delete failed: ${result.message}`, result);
+      throw new ACPSessionError(
+        "prompt_failed",
+        `session/delete failed: ${result.message}`,
+        result
+      );
     }
     if (this.sessionId === sessionId) {
       this.sessionId = null;
@@ -2243,7 +2462,11 @@ var ACPSession = class _ACPSession {
     const id = this.allocId();
     const result = await this.sendRequest(id, "session/set_mode", { sessionId, modeId });
     if (isJsonRpcError(result)) {
-      throw new ACPSessionError("prompt_failed", `session/set_mode failed: ${result.message}`, result);
+      throw new ACPSessionError(
+        "prompt_failed",
+        `session/set_mode failed: ${result.message}`,
+        result
+      );
     }
   }
   /**
@@ -2258,7 +2481,11 @@ var ACPSession = class _ACPSession {
       value
     });
     if (isJsonRpcError(result)) {
-      throw new ACPSessionError("prompt_failed", `session/set_config_option failed: ${result.message}`, result);
+      throw new ACPSessionError(
+        "prompt_failed",
+        `session/set_config_option failed: ${result.message}`,
+        result
+      );
     }
   }
   /**
@@ -2269,7 +2496,11 @@ var ACPSession = class _ACPSession {
     const id = this.allocId();
     const result = await this.sendRequest(id, "providers/list", {});
     if (isJsonRpcError(result)) {
-      throw new ACPSessionError("prompt_failed", `providers/list failed: ${result.message}`, result);
+      throw new ACPSessionError(
+        "prompt_failed",
+        `providers/list failed: ${result.message}`,
+        result
+      );
     }
     const r = result;
     return { providers: r.providers ?? [], currentProviderId: r.currentProviderId ?? null };
@@ -2305,7 +2536,11 @@ var ACPSession = class _ACPSession {
     const id = this.allocId();
     const result = await this.sendRequest(id, "providers/disable", {});
     if (isJsonRpcError(result)) {
-      throw new ACPSessionError("prompt_failed", `providers/disable failed: ${result.message}`, result);
+      throw new ACPSessionError(
+        "prompt_failed",
+        `providers/disable failed: ${result.message}`,
+        result
+      );
     }
   }
   // ──────────────────────────────────────────────────────────────────────
@@ -2412,11 +2647,7 @@ var ACPSession = class _ACPSession {
     }
     const sessionId = result.sessionId;
     if (typeof sessionId !== "string" || sessionId.length === 0) {
-      throw new ACPSessionError(
-        "protocol_error",
-        "session/new returned no sessionId",
-        result
-      );
+      throw new ACPSessionError("protocol_error", "session/new returned no sessionId", result);
     }
     this.sessionId = sessionId;
   }
@@ -2459,6 +2690,8 @@ var ACPSession = class _ACPSession {
       p.reject(new ACPSessionError("closed", "session was closed"));
     }
     this.pending.clear();
+    this.transportOff?.();
+    this.transportOff = null;
     try {
       this.transport.stop();
     } catch {
@@ -2494,10 +2727,7 @@ var ACPSession = class _ACPSession {
       const handle = setTimeout(() => {
         this.pending.delete(id);
         reject(
-          new ACPSessionError(
-            "protocol_error",
-            `${method} timed out after ${effectiveTimeout}ms`
-          )
+          new ACPSessionError("protocol_error", `${method} timed out after ${effectiveTimeout}ms`)
         );
       }, effectiveTimeout);
       this.pending.set(id, {
@@ -2606,297 +2836,580 @@ var ACPSession = class _ACPSession {
           this.scratch.text += text;
           this.emitProgress({ type: "message", text });
         }
-        return;
-      }
-      case "thought_chunk": {
-        const text = extractText(u.content);
-        if (text) {
-          this.scratch.thoughts += text;
-          this.emitProgress({ type: "thought", text });
+        return;
+      }
+      case "thought_chunk": {
+        const text = extractText(u.content);
+        if (text) {
+          this.scratch.thoughts += text;
+          this.emitProgress({ type: "thought", text });
+        }
+        return;
+      }
+      case "tool_call":
+      case "tool_call_update": {
+        this.captureToolCall(u, u.sessionUpdate === "tool_call");
+        return;
+      }
+      case "plan":
+        if (Array.isArray(u.entries)) {
+          this.scratch.plan = u.entries;
+          this.emitProgress({ type: "plan", entries: u.entries });
+        }
+        return;
+      case "usage_update":
+        if (typeof u.used === "number" && typeof u.size === "number") {
+          const usage = {
+            used: u.used,
+            size: u.size,
+            ...typeof u.cost === "object" && u.cost !== null ? { cost: u.cost } : {}
+          };
+          this.scratch.usage = usage;
+          this.emitProgress({ type: "usage", usage });
+        }
+        return;
+      case "available_commands_update":
+      case "current_mode_update":
+      case "config_option_update":
+      case "session_info_update":
+      case "user_message_chunk":
+      case "next_edit_suggestions":
+      case "elicitation":
+        return;
+      default:
+        return;
+    }
+  }
+  /**
+   * Fold a `tool_call` / `tool_call_update` notification into the scratch
+   * tool-call map (deduped by toolCallId), extract any `diff` content into
+   * the diffs list, and emit live progress.
+   */
+  captureToolCall(u, isNew) {
+    const toolCallId = typeof u.toolCallId === "string" ? u.toolCallId : "";
+    if (!toolCallId) return;
+    const prev = this.scratch.toolCalls.get(toolCallId);
+    const record = {
+      toolCallId,
+      title: typeof u.title === "string" ? u.title : prev?.title ?? toolCallId,
+      kind: typeof u.kind === "string" ? u.kind : prev?.kind,
+      status: typeof u.status === "string" ? u.status : prev?.status ?? (isNew ? "pending" : "in_progress"),
+      rawInput: isRecord(u.rawInput) ? u.rawInput : prev?.rawInput,
+      rawOutput: isRecord(u.rawOutput) ? u.rawOutput : prev?.rawOutput
+    };
+    this.scratch.toolCalls.set(toolCallId, record);
+    if (Array.isArray(u.content)) {
+      for (const c of u.content) {
+        if (c && typeof c === "object" && c.type === "diff") {
+          const diff = {
+            path: c.path,
+            oldText: c.oldText,
+            newText: c.newText
+          };
+          this.scratch.diffs.push(diff);
+          this.emitProgress({ type: "diff", diff });
+        }
+      }
+    }
+    this.emitProgress({
+      type: isNew ? "tool_call" : "tool_call_update",
+      toolCall: record
+    });
+  }
+  emitProgress(event) {
+    if (!this.progressHandler) return;
+    try {
+      this.progressHandler(event);
+    } catch {
+    }
+  }
+  /** Live progress handler installed for the duration of a `prompt()` turn. */
+  progressHandler = null;
+  // Per-prompt scratch state
+  scratch = { text: "", thoughts: "", toolCalls: /* @__PURE__ */ new Map(), diffs: [] };
+  resetScratch() {
+    this.scratch = { text: "", thoughts: "", toolCalls: /* @__PURE__ */ new Map(), diffs: [] };
+  }
+  async handlePermissionRequest(msg) {
+    const id = msg.id;
+    if (id === void 0) return;
+    const params = msg.params;
+    const toolCall = params?.toolCall;
+    const options = Array.isArray(params?.options) ? params.options : [];
+    if (!toolCall) {
+      await this.sendErrorResponse(id, -32602, "toolCall is required");
+      return;
+    }
+    const policyAbort = new AbortController();
+    try {
+      const outcome = await this.permissionPolicy({
+        toolCall,
+        options,
+        signal: policyAbort.signal
+      });
+      await this.sendResult(id, { outcome });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      await this.sendErrorResponse(id, -32603, `permission policy failed: ${message}`);
+    }
+  }
+  /**
+   * Enforce authorization at privileged callback sinks (fs/write,
+   * terminal/create). Unlike `handlePermissionRequest` which responds to
+   * agent-initiated `session/request_permission` messages, this method is
+   * called by the handler BEFORE dispatching to FileServer/TerminalServer,
+   * closing the gap where the agent simply skips the voluntary permission
+   * request and sends the privileged callback directly.
+   *
+   * Uses the session's permission policy. The default
+   * (`readOnlyPermissionPolicy`) auto-approves only side-effect-free tool
+   * calls (read/search/fetch/think) and rejects everything else — this is
+   * the safe-by-default posture. For trusted local agents (CLI `acp spawn`,
+   * Director fan-out), inject `defaultPermissionPolicy` to grant
+   * write/execute access.
+   *
+   * Returns true if the callback is authorized, false if denied.
+   */
+  async authorizeCallback(partial) {
+    try {
+      const outcome = await this.permissionPolicy({
+        toolCall: {
+          sessionUpdate: "tool_call_update",
+          toolCallId: partial.toolCallId,
+          title: partial.title,
+          kind: partial.kind,
+          status: "pending",
+          ...partial.rawInput ? { rawInput: partial.rawInput } : {}
+        },
+        options: [
+          { optionId: "allow", name: "Allow", kind: "allow_once" },
+          { optionId: "reject", name: "Reject", kind: "reject_once" }
+        ],
+        signal: new AbortController().signal
+      });
+      return outcome.outcome === "selected" && outcome.optionId !== "reject" && outcome.optionId !== "reject_once" && outcome.optionId !== "reject_always";
+    } catch {
+      return false;
+    }
+  }
+  async handleFsRequest(msg) {
+    const id = msg.id;
+    if (id === void 0) return;
+    const params = msg.params;
+    if (!params?.path) {
+      await this.sendErrorResponse(id, -32602, "path is required");
+      return;
+    }
+    if (msg.method === "fs/write_text_file") {
+      const allowed = await this.authorizeCallback({
+        toolCallId: `acp-fs-write-${id}`,
+        title: `Write file: ${params.path}`,
+        kind: "edit",
+        rawInput: { path: params.path, sessionId: params.sessionId }
+      });
+      if (!allowed) {
+        await this.sendErrorResponse(id, -32602, "filesystem write denied by permission policy");
+        return;
+      }
+    }
+    try {
+      if (msg.method === "fs/read_text_file") {
+        const result = await this.fileServer.readTextFile({
+          sessionId: params.sessionId ?? "",
+          path: params.path
+        });
+        await this.sendResult(id, result);
+      } else {
+        await this.fileServer.writeTextFile({
+          sessionId: params.sessionId ?? "",
+          path: params.path,
+          content: params.content ?? ""
+        });
+        await this.sendResult(id, {});
+      }
+    } catch (err) {
+      const code = err instanceof FsError ? -32602 : -32603;
+      const message = err instanceof Error ? err.message : String(err);
+      await this.sendErrorResponse(id, code, message);
+    }
+  }
+  async handleTerminalRequest(msg) {
+    const id = msg.id;
+    if (id === void 0) return;
+    const params = msg.params ?? {};
+    try {
+      switch (msg.method) {
+        case "terminal/create": {
+          const allowed = await this.authorizeCallback({
+            toolCallId: `acp-terminal-create-${id}`,
+            title: `Run command: ${String(params.command ?? "")} ${(Array.isArray(params.args) ? params.args : []).join(" ")}`.trim(),
+            kind: "execute",
+            rawInput: {
+              command: params.command,
+              args: params.args,
+              cwd: params.cwd,
+              sessionId: params.sessionId
+            }
+          });
+          if (!allowed) {
+            await this.sendErrorResponse(id, -32602, "terminal create denied by permission policy");
+            return;
+          }
+          const createOpts = {
+            sessionId: String(params.sessionId ?? ""),
+            command: String(params.command ?? ""),
+            args: Array.isArray(params.args) ? params.args : []
+          };
+          if (Array.isArray(params.env)) {
+            createOpts.env = params.env;
+          }
+          if (typeof params.cwd === "string") {
+            createOpts.cwd = params.cwd;
+          }
+          if (typeof params.outputByteLimit === "number") {
+            createOpts.outputByteLimit = params.outputByteLimit;
+          }
+          const result = this.terminalServer.create(createOpts);
+          await this.sendResult(id, result);
+          return;
+        }
+        case "terminal/output": {
+          const terminalId = String(params.terminalId ?? "");
+          const out = this.terminalServer.output(terminalId);
+          await this.sendResult(id, out);
+          return;
         }
-        return;
-      }
-      case "tool_call":
-      case "tool_call_update": {
-        this.captureToolCall(u, u.sessionUpdate === "tool_call");
-        return;
-      }
-      case "plan":
-        if (Array.isArray(u.entries)) {
-          this.scratch.plan = u.entries;
-          this.emitProgress({ type: "plan", entries: u.entries });
+        case "terminal/wait_for_exit": {
+          const terminalId = String(params.terminalId ?? "");
+          const exit = await this.terminalServer.waitForExit(terminalId);
+          await this.sendResult(id, exit);
+          return;
         }
-        return;
-      case "usage_update":
-        if (typeof u.used === "number" && typeof u.size === "number") {
-          const usage = {
-            used: u.used,
-            size: u.size,
-            ...typeof u.cost === "object" && u.cost !== null ? { cost: u.cost } : {}
-          };
-          this.scratch.usage = usage;
-          this.emitProgress({ type: "usage", usage });
+        case "terminal/kill": {
+          const terminalId = String(params.terminalId ?? "");
+          this.terminalServer.kill(terminalId);
+          await this.sendResult(id, {});
+          return;
         }
-        return;
-      case "available_commands_update":
-      case "current_mode_update":
-      case "config_option_update":
-      case "session_info_update":
-      case "user_message_chunk":
-      case "next_edit_suggestions":
-      case "elicitation":
-        return;
-      default:
-        return;
+        case "terminal/release": {
+          const terminalId = String(params.terminalId ?? "");
+          this.terminalServer.release(terminalId);
+          await this.sendResult(id, {});
+          return;
+        }
+        default:
+          await this.sendErrorResponse(id, -32601, `unknown method: ${msg.method}`);
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      await this.sendErrorResponse(id, -32603, message);
     }
   }
+};
+function textContent(text) {
+  return { type: "text", text };
+}
+function imageContent(mimeType, data) {
+  return { type: "image", mimeType, data };
+}
+function audioContent(mimeType, data) {
+  return { type: "audio", mimeType, data };
+}
+function extractText(block) {
+  if (typeof block !== "object" || block === null) return "";
+  const b = block;
+  if (b.type === "text" && typeof b.text === "string") return b.text;
+  if (b.type === "resource" && b.resource && typeof b.resource === "object" && typeof b.resource.text === "string") {
+    return b.resource.text;
+  }
+  return "";
+}
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function emptyRunResult(stopReason) {
+  return {
+    text: "",
+    stopReason,
+    hasText: false,
+    toolCalls: [],
+    diffs: [],
+    thoughts: ""
+  };
+}
+
+// src/client/tool-translator.ts
+import { expectDefined as expectDefined2 } from "@wrongstack/core/utils";
+var DEFAULT_OPTIONS = {
+  asyncTools: true,
+  pollIntervalMs: 500,
+  totalTimeoutMs: 12e4
+};
+var ToolTranslator = class {
+  opts;
+  pending = /* @__PURE__ */ new Map();
+  constructor(opts = {}) {
+    this.opts = { ...DEFAULT_OPTIONS, ...opts };
+  }
   /**
-   * Fold a `tool_call` / `tool_call_update` notification into the scratch
-   * tool-call map (deduped by toolCallId), extract any `diff` content into
-   * the diffs list, and emit live progress.
+   * Start listening to a transport for tool responses and cancellations.
+   * Call this once after constructing the translator and before sending tasks.
    */
-  captureToolCall(u, isNew) {
-    const toolCallId = typeof u.toolCallId === "string" ? u.toolCallId : "";
-    if (!toolCallId) return;
-    const prev = this.scratch.toolCalls.get(toolCallId);
-    const record = {
-      toolCallId,
-      title: typeof u.title === "string" ? u.title : prev?.title ?? toolCallId,
-      kind: typeof u.kind === "string" ? u.kind : prev?.kind,
-      status: typeof u.status === "string" ? u.status : prev?.status ?? (isNew ? "pending" : "in_progress"),
-      rawInput: isRecord(u.rawInput) ? u.rawInput : prev?.rawInput,
-      rawOutput: isRecord(u.rawOutput) ? u.rawOutput : prev?.rawOutput
-    };
-    this.scratch.toolCalls.set(toolCallId, record);
-    if (Array.isArray(u.content)) {
-      for (const c of u.content) {
-        if (c && typeof c === "object" && c.type === "diff") {
-          const diff = {
-            path: c.path,
-            oldText: c.oldText,
-            newText: c.newText
-          };
-          this.scratch.diffs.push(diff);
-          this.emitProgress({ type: "diff", diff });
+  attachToTransport(transport) {
+    transport.onMessage((msg) => {
+      if (msg.method === "tools/call" && msg.id !== void 0) {
+        const pending = this.pending.get(msg.id);
+        if (pending) {
+          clearTimeout(pending.timeout);
+          this.pending.delete(expectDefined2(msg.id));
+          pending.resolve(msg);
+        }
+      }
+      if (msg.method === "cancel" && msg.id !== void 0) {
+        const pending = this.pending.get(msg.id);
+        if (pending) {
+          clearTimeout(pending.timeout);
+          this.pending.delete(expectDefined2(msg.id));
+          pending.reject(new Error("Call cancelled by client"));
         }
       }
+    });
+  }
+  /**
+   * Send a tool call over the transport and wait for a response.
+   * If asyncTools is true, polls for progress and resolves when the final
+   * response arrives.
+   */
+  async callTool(transport, name, args, callId = crypto.randomUUID()) {
+    await transport.send({
+      jsonrpc: "2.0",
+      method: "tools/call",
+      id: callId,
+      params: { name, arguments: args }
+    });
+    return new Promise((resolve3, reject) => {
+      const timeout = setTimeout(() => {
+        this.pending.delete(callId);
+        reject(new Error(`Tool call ${name} timed out after ${this.opts.totalTimeoutMs}ms`));
+      }, this.opts.totalTimeoutMs);
+      this.pending.set(callId, { resolve: resolve3, reject, timeout });
+    });
+  }
+  cancelAll() {
+    for (const [, p] of this.pending) {
+      clearTimeout(p.timeout);
     }
-    this.emitProgress({
-      type: isNew ? "tool_call" : "tool_call_update",
-      toolCall: record
+    this.pending.clear();
+  }
+};
+
+// src/integration/acp-bench.ts
+import * as fsp2 from "node:fs/promises";
+import * as path3 from "node:path";
+function firstLine(s) {
+  const line = s.split("\n").map((l) => l.trim()).find((l) => l.length > 0) ?? "";
+  return line.length > 120 ? `${line.slice(0, 117)}\u2026` : line;
+}
+function randomMarker() {
+  return `ACP_OK_${Math.random().toString(36).slice(2, 8).toUpperCase()}`;
+}
+async function benchOne(agentId, cmd, opts) {
+  const checks = [];
+  const startedAt = opts.now();
+  let session = null;
+  const signal = opts.signal ?? new AbortController().signal;
+  const hsStart = opts.now();
+  try {
+    session = await ACPSession.start({
+      command: cmd.command,
+      ...cmd.args !== void 0 ? { args: [...cmd.args] } : {},
+      ...cmd.env !== void 0 ? { env: cmd.env } : {},
+      projectRoot: opts.projectRoot,
+      timeoutMs: opts.timeoutMs
+    });
+  } catch (err) {
+    const reason2 = err instanceof Error ? err.message : String(err);
+    checks.push({ name: "handshake", ok: false, detail: reason2 });
+    return {
+      agentId,
+      status: "fail",
+      checks,
+      reason: reason2,
+      handshakeMs: opts.now() - hsStart,
+      durationMs: opts.now() - startedAt
+    };
+  }
+  const handshakeMs = opts.now() - hsStart;
+  const agentInfo = session.getAgentInfo() ?? void 0;
+  checks.push({
+    name: "handshake",
+    ok: true,
+    detail: agentInfo ? `${agentInfo.name} ${agentInfo.version}` : void 0
+  });
+  let promptMs;
+  let sample;
+  let reason;
+  try {
+    const pStart = opts.now();
+    const res = await session.prompt(
+      [textContent(`Reply with exactly this token and nothing else: ${opts.marker}`)],
+      signal
+    );
+    promptMs = opts.now() - pStart;
+    sample = res.text ? firstLine(res.text) : void 0;
+    const promptOk = res.hasText && res.stopReason !== "refusal";
+    checks.push({
+      name: "prompt",
+      ok: promptOk,
+      detail: `stopReason=${res.stopReason}${res.hasText ? "" : ", no text"}`
     });
-  }
-  emitProgress(event) {
-    if (!this.progressHandler) return;
-    try {
-      this.progressHandler(event);
-    } catch {
-    }
-  }
-  /** Live progress handler installed for the duration of a `prompt()` turn. */
-  progressHandler = null;
-  // Per-prompt scratch state
-  scratch = { text: "", thoughts: "", toolCalls: /* @__PURE__ */ new Map(), diffs: [] };
-  resetScratch() {
-    this.scratch = { text: "", thoughts: "", toolCalls: /* @__PURE__ */ new Map(), diffs: [] };
-  }
-  async handlePermissionRequest(msg) {
-    const id = msg.id;
-    if (id === void 0) return;
-    const params = msg.params;
-    const toolCall = params?.toolCall;
-    const options = Array.isArray(params?.options) ? params.options : [];
-    if (!toolCall) {
-      await this.sendErrorResponse(id, -32602, "toolCall is required");
-      return;
-    }
-    const policyAbort = new AbortController();
-    try {
-      const outcome = await this.permissionPolicy({
-        toolCall,
-        options,
-        signal: policyAbort.signal
-      });
-      await this.sendResult(id, { outcome });
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      await this.sendErrorResponse(id, -32603, `permission policy failed: ${message}`);
+    const markerOk = res.text.includes(opts.marker);
+    checks.push({
+      name: "marker",
+      ok: markerOk,
+      detail: markerOk ? void 0 : "reply did not contain the token"
+    });
+    if (opts.checkFs) {
+      const fileToken = `FILE_${opts.marker}`;
+      const fileName = `acp-bench-${opts.marker}.txt`;
+      const filePath = path3.join(opts.projectRoot, fileName);
+      let fsOk = false;
+      let fsDetail;
+      try {
+        await fsp2.writeFile(filePath, fileToken, "utf8");
+        const fsRes = await session.prompt(
+          [
+            textContent(
+              `Read the file "${fileName}" in the current directory and reply with its exact contents.`
+            )
+          ],
+          signal
+        );
+        fsOk = fsRes.text.includes(fileToken);
+        if (!fsOk) fsDetail = "agent did not return the file contents (may not have used a read tool)";
+      } catch (err) {
+        fsDetail = err instanceof Error ? err.message : String(err);
+      } finally {
+        await fsp2.rm(filePath, { force: true }).catch(() => {
+        });
+      }
+      checks.push({ name: "fs", ok: fsOk, detail: fsDetail });
     }
-  }
-  /**
-   * Enforce authorization at privileged callback sinks (fs/write,
-   * terminal/create). Unlike `handlePermissionRequest` which responds to
-   * agent-initiated `session/request_permission` messages, this method is
-   * called by the handler BEFORE dispatching to FileServer/TerminalServer,
-   * closing the gap where the agent simply skips the voluntary permission
-   * request and sends the privileged callback directly.
-   *
-   * Uses the session's permission policy. The default policy
-   * (`defaultPermissionPolicy`) auto-approves everything — this is correct
-   * for trusted local agents (CLI `acp spawn`, Director fan-out). For
-   * untrusted/remote agents, the host should inject
-   * `readOnlyPermissionPolicy` or an interactive policy.
-   *
-   * Returns true if the callback is authorized, false if denied.
-   */
-  async authorizeCallback(partial) {
+  } catch (err) {
+    reason = err instanceof Error ? err.message : String(err);
+    checks.push({ name: "prompt", ok: false, detail: reason });
+  } finally {
     try {
-      const outcome = await this.permissionPolicy({
-        toolCall: {
-          sessionUpdate: "tool_call_update",
-          toolCallId: partial.toolCallId,
-          title: partial.title,
-          kind: partial.kind,
-          status: "pending"
-        },
-        options: [
-          { optionId: "allow", name: "Allow", kind: "allow_once" },
-          { optionId: "reject", name: "Reject", kind: "reject_once" }
-        ],
-        signal: new AbortController().signal
-      });
-      return outcome.outcome === "selected" && outcome.optionId !== "reject" && outcome.optionId !== "reject_once" && outcome.optionId !== "reject_always";
+      await session.close();
     } catch {
-      return false;
     }
   }
-  async handleFsRequest(msg) {
-    const id = msg.id;
-    if (id === void 0) return;
-    const params = msg.params;
-    if (!params?.path) {
-      await this.sendErrorResponse(id, -32602, "path is required");
-      return;
-    }
-    if (msg.method === "fs/write_text_file") {
-      const allowed = await this.authorizeCallback({
-        toolCallId: `acp-fs-write-${id}`,
-        title: `Write file: ${params.path}`,
-        kind: "edit"
-      });
-      if (!allowed) {
-        await this.sendErrorResponse(id, -32602, "filesystem write denied by permission policy");
-        return;
-      }
-    }
-    try {
-      if (msg.method === "fs/read_text_file") {
-        const result = await this.fileServer.readTextFile({
-          sessionId: params.sessionId ?? "",
-          path: params.path
-        });
-        await this.sendResult(id, result);
-      } else {
-        await this.fileServer.writeTextFile({
-          sessionId: params.sessionId ?? "",
-          path: params.path,
-          content: params.content ?? ""
-        });
-        await this.sendResult(id, {});
-      }
-    } catch (err) {
-      const code = err instanceof FsError ? -32602 : -32603;
-      const message = err instanceof Error ? err.message : String(err);
-      await this.sendErrorResponse(id, code, message);
+  const required = checks.filter((c) => c.name !== "fs" || opts.checkFs);
+  const allReq = required.every((c) => c.ok);
+  const handshakeOk = checks.find((c) => c.name === "handshake")?.ok === true;
+  const status = allReq ? "pass" : handshakeOk ? "partial" : "fail";
+  return {
+    agentId,
+    status,
+    checks,
+    ...agentInfo ? { agentInfo } : {},
+    handshakeMs,
+    ...promptMs !== void 0 ? { promptMs } : {},
+    ...sample ? { sample } : {},
+    ...reason ? { reason } : {},
+    durationMs: opts.now() - startedAt
+  };
+}
+async function runAcpBench(opts) {
+  const now = opts.now ?? Date.now;
+  const projectRoot = opts.projectRoot ?? process.cwd();
+  const timeoutMs = opts.timeoutMs ?? 6e4;
+  const checkFs = opts.checkFs ?? false;
+  const marker = opts.marker ?? randomMarker();
+  const concurrency = Math.max(1, opts.concurrency ?? 2);
+  const seen = /* @__PURE__ */ new Set();
+  const ids = [];
+  for (const raw of opts.agentIds) {
+    const id = raw.trim();
+    if (id && !seen.has(id)) {
+      seen.add(id);
+      ids.push(id);
     }
   }
-  async handleTerminalRequest(msg) {
-    const id = msg.id;
-    if (id === void 0) return;
-    const params = msg.params ?? {};
-    try {
-      switch (msg.method) {
-        case "terminal/create": {
-          const allowed = await this.authorizeCallback({
-            toolCallId: `acp-terminal-create-${id}`,
-            title: `Run command: ${String(params.command ?? "")} ${(Array.isArray(params.args) ? params.args : []).join(" ")}`.trim(),
-            kind: "execute"
-          });
-          if (!allowed) {
-            await this.sendErrorResponse(id, -32602, "terminal create denied by permission policy");
-            return;
-          }
-          const createOpts = {
-            sessionId: String(params.sessionId ?? ""),
-            command: String(params.command ?? ""),
-            args: Array.isArray(params.args) ? params.args : []
-          };
-          if (Array.isArray(params.env)) {
-            createOpts.env = params.env;
-          }
-          if (typeof params.cwd === "string") {
-            createOpts.cwd = params.cwd;
-          }
-          if (typeof params.outputByteLimit === "number") {
-            createOpts.outputByteLimit = params.outputByteLimit;
-          }
-          const result = this.terminalServer.create(createOpts);
-          await this.sendResult(id, result);
-          return;
-        }
-        case "terminal/output": {
-          const terminalId = String(params.terminalId ?? "");
-          const out = this.terminalServer.output(terminalId);
-          await this.sendResult(id, out);
-          return;
-        }
-        case "terminal/wait_for_exit": {
-          const terminalId = String(params.terminalId ?? "");
-          const exit = await this.terminalServer.waitForExit(terminalId);
-          await this.sendResult(id, exit);
-          return;
-        }
-        case "terminal/kill": {
-          const terminalId = String(params.terminalId ?? "");
-          this.terminalServer.kill(terminalId);
-          await this.sendResult(id, {});
-          return;
-        }
-        case "terminal/release": {
-          const terminalId = String(params.terminalId ?? "");
-          this.terminalServer.release(terminalId);
-          await this.sendResult(id, {});
-          return;
+  const results = ids.map((agentId) => ({
+    agentId,
+    status: "skipped",
+    checks: [],
+    durationMs: 0,
+    reason: "unknown agent"
+  }));
+  const startMs = now();
+  const runnable = [];
+  ids.forEach((id, index) => {
+    const cmd = opts.resolveCmd(id);
+    if (cmd) runnable.push({ id, cmd, index });
+  });
+  let next = 0;
+  const workers = [];
+  const workerCount = Math.min(concurrency, runnable.length);
+  for (let w = 0; w < workerCount; w++) {
+    workers.push(
+      (async () => {
+        while (true) {
+          const current = next++;
+          if (current >= runnable.length) return;
+          const { id, cmd, index } = runnable[current];
+          if (opts.signal?.aborted) {
+            results[index] = {
+              agentId: id,
+              status: "skipped",
+              checks: [],
+              durationMs: 0,
+              reason: "aborted"
+            };
+            continue;
+          }
+          opts.onProgress?.(id, "start");
+          const r = await benchOne(id, cmd, {
+            projectRoot,
+            timeoutMs,
+            checkFs,
+            marker,
+            now,
+            ...opts.signal ? { signal: opts.signal } : {}
+          });
+          results[index] = r;
+          opts.onProgress?.(id, "done", r);
         }
-        default:
-          await this.sendErrorResponse(id, -32601, `unknown method: ${msg.method}`);
-      }
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      await this.sendErrorResponse(id, -32603, message);
-    }
+      })()
+    );
   }
-};
-function textContent(text) {
-  return { type: "text", text };
-}
-function imageContent(mimeType, data) {
-  return { type: "image", mimeType, data };
-}
-function audioContent(mimeType, data) {
-  return { type: "audio", mimeType, data };
+  await Promise.all(workers);
+  const summary = { pass: 0, partial: 0, fail: 0, skipped: 0 };
+  for (const r of results) summary[r.status]++;
+  return { results, summary, totalDurationMs: now() - startMs };
 }
-function extractText(block) {
-  if (typeof block !== "object" || block === null) return "";
-  const b = block;
-  if (b.type === "text" && typeof b.text === "string") return b.text;
-  if (b.type === "resource" && b.resource && typeof b.resource === "object" && typeof b.resource.text === "string") {
-    return b.resource.text;
+function renderAcpBenchText(result) {
+  const icon = (s) => s === "pass" ? "\u2713" : s === "partial" ? "\u25D0" : s === "skipped" ? "\u2013" : "\u2717";
+  const lines = ["ACP client bench:", ""];
+  if (result.results.length === 0) {
+    lines.push("No agents to bench.");
+    return lines.join("\n");
   }
-  return "";
-}
-function isRecord(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function emptyRunResult(stopReason) {
-  return {
-    text: "",
-    stopReason,
-    hasText: false,
-    toolCalls: [],
-    diffs: [],
-    thoughts: ""
-  };
+  for (const r of result.results) {
+    const checks = r.checks.map((c) => `${c.ok ? "\u2713" : "\u2717"}${c.name}`).join(" ");
+    const timing = r.handshakeMs !== void 0 ? `  hs=${r.handshakeMs}ms${r.promptMs !== void 0 ? ` prompt=${r.promptMs}ms` : ""}` : "";
+    lines.push(`  ${icon(r.status)} ${r.agentId.padEnd(16)} ${r.status.toUpperCase().padEnd(7)} ${checks}${timing}`);
+    if (r.agentInfo) lines.push(`      agent: ${r.agentInfo.name} ${r.agentInfo.version}`);
+    if (r.sample) lines.push(`      reply: ${r.sample}`);
+    if (r.reason) lines.push(`      reason: ${r.reason}`);
+  }
+  const { pass, partial, fail, skipped } = result.summary;
+  lines.push("");
+  lines.push(
+    `Bench summary: ${pass} pass, ${partial} partial, ${fail} fail, ${skipped} skipped. (${result.totalDurationMs}ms total)`
+  );
+  return lines.join("\n");
 }
 
 // src/registry/agents.catalog.ts
@@ -3135,50 +3648,6 @@ function findAgentDescriptor(id) {
   return AGENTS_CATALOG.find((a) => a.id === id);
 }
 
-// src/integration/run-one-acp-task.ts
-import { SubagentBudget } from "@wrongstack/core/coordination";
-async function runOneAcpTask(opts) {
-  const role = opts.role ?? "acp";
-  const timeoutMs = opts.timeoutMs ?? 5 * 6e4;
-  const { runner, stop } = await makeACPSubagentRunnerWithStop({
-    command: opts.command,
-    ...opts.args !== void 0 ? { args: opts.args } : {},
-    ...opts.env !== void 0 ? { env: opts.env } : {},
-    ...opts.cwd !== void 0 ? { cwd: opts.cwd } : {},
-    ...opts.projectRoot !== void 0 ? { projectRoot: opts.projectRoot } : {},
-    role,
-    timeoutMs,
-    ...opts.onProgress !== void 0 ? { onProgress: opts.onProgress } : {},
-    ...opts.permissionPolicy !== void 0 ? { permissionPolicy: opts.permissionPolicy } : {}
-  });
-  try {
-    const budget = new SubagentBudget({
-      timeoutMs,
-      maxIterations: 2e3,
-      maxToolCalls: 5e3
-    });
-    budget.start();
-    const ctx = {
-      subagentId: role,
-      config: { id: role, name: role, role, provider: "acp", prompt: "" },
-      budget,
-      signal: opts.signal ?? new AbortController().signal,
-      bridge: null
-    };
-    const result = await runner({ id: `acp-${role}`, description: opts.task }, ctx);
-    return {
-      result: result.result == null ? "" : String(result.result),
-      iterations: result.iterations,
-      toolCalls: result.toolCalls
-    };
-  } finally {
-    try {
-      await stop();
-    } catch {
-    }
-  }
-}
-
 // src/integration/acp-subagent-runner.ts
 var ACP_AGENT_COMMANDS = {
   cline: {
@@ -3646,93 +4115,8 @@ var EnsembleRegistry = class {
   }
 };
 
-// src/registry/acp-registry-fetch.ts
-var ACP_REGISTRY_URL = "https://cdn.agentclientprotocol.com/registry/v1/latest/registry.json";
-function currentPlatformKey() {
-  const os = process.platform === "win32" ? "windows" : process.platform === "darwin" ? "darwin" : "linux";
-  const arch = process.arch === "arm64" ? "aarch64" : process.arch === "x64" ? "x86_64" : process.arch;
-  return `${os}-${arch}`;
-}
-function basename(cmd) {
-  const cleaned = cmd.replace(/^\.\//, "").replace(/\\/g, "/");
-  const parts = cleaned.split("/");
-  return parts[parts.length - 1] || cleaned;
-}
-function mapRegistryEntry(entry, platformKey = currentPlatformKey()) {
-  if (!entry || typeof entry.id !== "string" || entry.id.length === 0) return null;
-  const dist = entry.distribution;
-  let acp = null;
-  if (dist?.npx?.package) {
-    acp = { command: "npx", args: ["-y", dist.npx.package, ...dist.npx.args ?? []] };
-  } else if (dist?.uvx?.package) {
-    acp = { command: "uvx", args: [dist.uvx.package, ...dist.uvx.args ?? []] };
-  } else if (dist?.binary) {
-    const target = dist.binary[platformKey];
-    if (target?.cmd) {
-      acp = {
-        command: basename(target.cmd),
-        args: [...target.args ?? []],
-        ...target.env ? { env: target.env } : {}
-      };
-    }
-  }
-  if (!acp) return null;
-  const probeCmd = acp.command === "npx" ? "npx" : acp.command === "uvx" ? "uvx" : acp.command;
-  return {
-    id: entry.id,
-    displayName: entry.name ?? entry.id,
-    vendor: inferVendor(entry),
-    probe: { command: probeCmd, args: ["--version"] },
-    acp,
-    supports: { loadSession: true, promptImages: true, terminal: true, fs: true },
-    integration: "native",
-    docs: entry.repository ?? entry.website ?? ""
-  };
-}
-function inferVendor(entry) {
-  const hay = `${entry.id} ${entry.name ?? ""} ${(entry.authors ?? []).join(" ")}`.toLowerCase();
-  if (hay.includes("anthropic") || hay.includes("claude")) return "anthropic";
-  if (hay.includes("google") || hay.includes("gemini")) return "google";
-  if (hay.includes("openai") || hay.includes("codex")) return "openai";
-  if (hay.includes("github") || hay.includes("copilot")) return "github";
-  if (hay.includes("moonshot") || hay.includes("kimi")) return "moonshot";
-  return "community";
-}
-async function fetchAcpRegistry(opts = {}) {
-  const url = opts.url ?? ACP_REGISTRY_URL;
-  const timeoutMs = opts.timeoutMs ?? 15e3;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const onParentAbort = () => controller.abort();
-  if (opts.signal) {
-    if (opts.signal.aborted) controller.abort();
-    else opts.signal.addEventListener("abort", onParentAbort, { once: true });
-  }
-  try {
-    const res = await fetch(url, { signal: controller.signal });
-    if (!res.ok) {
-      throw new Error(`ACP registry fetch failed: HTTP ${res.status}`);
-    }
-    const body = await res.json();
-    const rawAgents = Array.isArray(body) ? body : Array.isArray(body?.agents) ? body.agents : null;
-    if (!rawAgents) {
-      throw new Error("ACP registry response had no agents array");
-    }
-    const platformKey = opts.platformKey ?? currentPlatformKey();
-    const agents = [];
-    for (const raw of rawAgents) {
-      const mapped = mapRegistryEntry(raw, platformKey);
-      if (mapped) agents.push(mapped);
-    }
-    return { fetchedAt: opts.now ?? (/* @__PURE__ */ new Date()).toISOString(), agents };
-  } finally {
-    clearTimeout(timer);
-    opts.signal?.removeEventListener("abort", onParentAbort);
-  }
-}
-
 // src/integration/ensemble-runner.ts
-import { SubagentBudget as SubagentBudget2 } from "@wrongstack/core/coordination";
+import { SubagentBudget } from "@wrongstack/core/coordination";
 var DEFAULT_MAX_CONCURRENCY = 4;
 async function mapBound(items, worker, limit) {
   const results = new Array(items.length);
@@ -3768,10 +4152,13 @@ async function runOne(agentId, cmd, task, timeoutMs, signal, onProgress) {
     const { runner, stop } = await makeACPSubagentRunnerWithStop({
       ...cmd,
       timeoutMs,
+      // CLI /acp parallel and Director fan-out are trusted local agents — grant write/execute access.
+      // The session default is read-only for untrusted agents (acp-session.ts:221).
+      permissionPolicy: defaultPermissionPolicy,
       ...onProgress ? { onProgress: (event) => onProgress(agentId, event) } : {}
     });
     try {
-      const budget = new SubagentBudget2({
+      const budget = new SubagentBudget({
         timeoutMs,
         maxIterations: 2e3,
         maxToolCalls: 5e3
@@ -3948,213 +4335,133 @@ Ensemble summary: ${succeeded} succeeded, ${failed} failed, ${cancelled} cancell
   return lines.join("\n");
 }
 
-// src/integration/acp-bench.ts
-import * as fsp2 from "node:fs/promises";
-import * as path3 from "node:path";
-function firstLine(s) {
-  const line = s.split("\n").map((l) => l.trim()).find((l) => l.length > 0) ?? "";
-  return line.length > 120 ? `${line.slice(0, 117)}\u2026` : line;
-}
-function randomMarker() {
-  return `ACP_OK_${Math.random().toString(36).slice(2, 8).toUpperCase()}`;
-}
-async function benchOne(agentId, cmd, opts) {
-  const checks = [];
-  const startedAt = opts.now();
-  let session = null;
-  const signal = opts.signal ?? new AbortController().signal;
-  const hsStart = opts.now();
-  try {
-    session = await ACPSession.start({
-      command: cmd.command,
-      ...cmd.args !== void 0 ? { args: [...cmd.args] } : {},
-      ...cmd.env !== void 0 ? { env: cmd.env } : {},
-      projectRoot: opts.projectRoot,
-      timeoutMs: opts.timeoutMs
-    });
-  } catch (err) {
-    const reason2 = err instanceof Error ? err.message : String(err);
-    checks.push({ name: "handshake", ok: false, detail: reason2 });
-    return {
-      agentId,
-      status: "fail",
-      checks,
-      reason: reason2,
-      handshakeMs: opts.now() - hsStart,
-      durationMs: opts.now() - startedAt
-    };
-  }
-  const handshakeMs = opts.now() - hsStart;
-  const agentInfo = session.getAgentInfo() ?? void 0;
-  checks.push({
-    name: "handshake",
-    ok: true,
-    detail: agentInfo ? `${agentInfo.name} ${agentInfo.version}` : void 0
+// src/integration/run-one-acp-task.ts
+import { SubagentBudget as SubagentBudget2 } from "@wrongstack/core/coordination";
+async function runOneAcpTask(opts) {
+  const role = opts.role ?? "acp";
+  const timeoutMs = opts.timeoutMs ?? 5 * 6e4;
+  const { runner, stop } = await makeACPSubagentRunnerWithStop({
+    command: opts.command,
+    ...opts.args !== void 0 ? { args: opts.args } : {},
+    ...opts.env !== void 0 ? { env: opts.env } : {},
+    ...opts.cwd !== void 0 ? { cwd: opts.cwd } : {},
+    ...opts.projectRoot !== void 0 ? { projectRoot: opts.projectRoot } : {},
+    role,
+    timeoutMs,
+    ...opts.onProgress !== void 0 ? { onProgress: opts.onProgress } : {},
+    ...opts.permissionPolicy !== void 0 ? { permissionPolicy: opts.permissionPolicy } : {}
   });
-  let promptMs;
-  let sample;
-  let reason;
   try {
-    const pStart = opts.now();
-    const res = await session.prompt(
-      [textContent(`Reply with exactly this token and nothing else: ${opts.marker}`)],
-      signal
-    );
-    promptMs = opts.now() - pStart;
-    sample = res.text ? firstLine(res.text) : void 0;
-    const promptOk = res.hasText && res.stopReason !== "refusal";
-    checks.push({
-      name: "prompt",
-      ok: promptOk,
-      detail: `stopReason=${res.stopReason}${res.hasText ? "" : ", no text"}`
-    });
-    const markerOk = res.text.includes(opts.marker);
-    checks.push({
-      name: "marker",
-      ok: markerOk,
-      detail: markerOk ? void 0 : "reply did not contain the token"
+    const budget = new SubagentBudget2({
+      timeoutMs,
+      maxIterations: 2e3,
+      maxToolCalls: 5e3
     });
-    if (opts.checkFs) {
-      const fileToken = `FILE_${opts.marker}`;
-      const fileName = `acp-bench-${opts.marker}.txt`;
-      const filePath = path3.join(opts.projectRoot, fileName);
-      let fsOk = false;
-      let fsDetail;
-      try {
-        await fsp2.writeFile(filePath, fileToken, "utf8");
-        const fsRes = await session.prompt(
-          [
-            textContent(
-              `Read the file "${fileName}" in the current directory and reply with its exact contents.`
-            )
-          ],
-          signal
-        );
-        fsOk = fsRes.text.includes(fileToken);
-        if (!fsOk) fsDetail = "agent did not return the file contents (may not have used a read tool)";
-      } catch (err) {
-        fsDetail = err instanceof Error ? err.message : String(err);
-      } finally {
-        await fsp2.rm(filePath, { force: true }).catch(() => {
-        });
-      }
-      checks.push({ name: "fs", ok: fsOk, detail: fsDetail });
-    }
-  } catch (err) {
-    reason = err instanceof Error ? err.message : String(err);
-    checks.push({ name: "prompt", ok: false, detail: reason });
+    budget.start();
+    const ctx = {
+      subagentId: role,
+      config: { id: role, name: role, role, provider: "acp", prompt: "" },
+      budget,
+      signal: opts.signal ?? new AbortController().signal,
+      bridge: null
+    };
+    const result = await runner({ id: `acp-${role}`, description: opts.task }, ctx);
+    return {
+      result: result.result == null ? "" : String(result.result),
+      iterations: result.iterations,
+      toolCalls: result.toolCalls
+    };
   } finally {
     try {
-      await session.close();
+      await stop();
     } catch {
     }
   }
-  const required = checks.filter((c) => c.name !== "fs" || opts.checkFs);
-  const allReq = required.every((c) => c.ok);
-  const handshakeOk = checks.find((c) => c.name === "handshake")?.ok === true;
-  const status = allReq ? "pass" : handshakeOk ? "partial" : "fail";
-  return {
-    agentId,
-    status,
-    checks,
-    ...agentInfo ? { agentInfo } : {},
-    handshakeMs,
-    ...promptMs !== void 0 ? { promptMs } : {},
-    ...sample ? { sample } : {},
-    ...reason ? { reason } : {},
-    durationMs: opts.now() - startedAt
-  };
 }
-async function runAcpBench(opts) {
-  const now = opts.now ?? Date.now;
-  const projectRoot = opts.projectRoot ?? process.cwd();
-  const timeoutMs = opts.timeoutMs ?? 6e4;
-  const checkFs = opts.checkFs ?? false;
-  const marker = opts.marker ?? randomMarker();
-  const concurrency = Math.max(1, opts.concurrency ?? 2);
-  const seen = /* @__PURE__ */ new Set();
-  const ids = [];
-  for (const raw of opts.agentIds) {
-    const id = raw.trim();
-    if (id && !seen.has(id)) {
-      seen.add(id);
-      ids.push(id);
+
+// src/registry/acp-registry-fetch.ts
+var ACP_REGISTRY_URL = "https://cdn.agentclientprotocol.com/registry/v1/latest/registry.json";
+function currentPlatformKey() {
+  const os = process.platform === "win32" ? "windows" : process.platform === "darwin" ? "darwin" : "linux";
+  const arch = process.arch === "arm64" ? "aarch64" : process.arch === "x64" ? "x86_64" : process.arch;
+  return `${os}-${arch}`;
+}
+function basename(cmd) {
+  const cleaned = cmd.replace(/^\.\//, "").replace(/\\/g, "/");
+  const parts = cleaned.split("/");
+  return parts[parts.length - 1] || cleaned;
+}
+function mapRegistryEntry(entry, platformKey = currentPlatformKey()) {
+  if (!entry || typeof entry.id !== "string" || entry.id.length === 0) return null;
+  const dist = entry.distribution;
+  let acp = null;
+  if (dist?.npx?.package) {
+    acp = { command: "npx", args: ["-y", dist.npx.package, ...dist.npx.args ?? []] };
+  } else if (dist?.uvx?.package) {
+    acp = { command: "uvx", args: [dist.uvx.package, ...dist.uvx.args ?? []] };
+  } else if (dist?.binary) {
+    const target = dist.binary[platformKey];
+    if (target?.cmd) {
+      acp = {
+        command: basename(target.cmd),
+        args: [...target.args ?? []],
+        ...target.env ? { env: target.env } : {}
+      };
     }
   }
-  const results = ids.map((agentId) => ({
-    agentId,
-    status: "skipped",
-    checks: [],
-    durationMs: 0,
-    reason: "unknown agent"
-  }));
-  const startMs = now();
-  const runnable = [];
-  ids.forEach((id, index) => {
-    const cmd = opts.resolveCmd(id);
-    if (cmd) runnable.push({ id, cmd, index });
-  });
-  let next = 0;
-  const workers = [];
-  const workerCount = Math.min(concurrency, runnable.length);
-  for (let w = 0; w < workerCount; w++) {
-    workers.push(
-      (async () => {
-        while (true) {
-          const current = next++;
-          if (current >= runnable.length) return;
-          const { id, cmd, index } = runnable[current];
-          if (opts.signal?.aborted) {
-            results[index] = {
-              agentId: id,
-              status: "skipped",
-              checks: [],
-              durationMs: 0,
-              reason: "aborted"
-            };
-            continue;
-          }
-          opts.onProgress?.(id, "start");
-          const r = await benchOne(id, cmd, {
-            projectRoot,
-            timeoutMs,
-            checkFs,
-            marker,
-            now,
-            ...opts.signal ? { signal: opts.signal } : {}
-          });
-          results[index] = r;
-          opts.onProgress?.(id, "done", r);
-        }
-      })()
-    );
-  }
-  await Promise.all(workers);
-  const summary = { pass: 0, partial: 0, fail: 0, skipped: 0 };
-  for (const r of results) summary[r.status]++;
-  return { results, summary, totalDurationMs: now() - startMs };
+  if (!acp) return null;
+  const probeCmd = acp.command === "npx" ? "npx" : acp.command === "uvx" ? "uvx" : acp.command;
+  return {
+    id: entry.id,
+    displayName: entry.name ?? entry.id,
+    vendor: inferVendor(entry),
+    probe: { command: probeCmd, args: ["--version"] },
+    acp,
+    supports: { loadSession: true, promptImages: true, terminal: true, fs: true },
+    integration: "native",
+    docs: entry.repository ?? entry.website ?? ""
+  };
 }
-function renderAcpBenchText(result) {
-  const icon = (s) => s === "pass" ? "\u2713" : s === "partial" ? "\u25D0" : s === "skipped" ? "\u2013" : "\u2717";
-  const lines = ["ACP client bench:", ""];
-  if (result.results.length === 0) {
-    lines.push("No agents to bench.");
-    return lines.join("\n");
+function inferVendor(entry) {
+  const hay = `${entry.id} ${entry.name ?? ""} ${(entry.authors ?? []).join(" ")}`.toLowerCase();
+  if (hay.includes("anthropic") || hay.includes("claude")) return "anthropic";
+  if (hay.includes("google") || hay.includes("gemini")) return "google";
+  if (hay.includes("openai") || hay.includes("codex")) return "openai";
+  if (hay.includes("github") || hay.includes("copilot")) return "github";
+  if (hay.includes("moonshot") || hay.includes("kimi")) return "moonshot";
+  return "community";
+}
+async function fetchAcpRegistry(opts = {}) {
+  const url = opts.url ?? ACP_REGISTRY_URL;
+  const timeoutMs = opts.timeoutMs ?? 15e3;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const onParentAbort = () => controller.abort();
+  if (opts.signal) {
+    if (opts.signal.aborted) controller.abort();
+    else opts.signal.addEventListener("abort", onParentAbort, { once: true });
   }
-  for (const r of result.results) {
-    const checks = r.checks.map((c) => `${c.ok ? "\u2713" : "\u2717"}${c.name}`).join(" ");
-    const timing = r.handshakeMs !== void 0 ? `  hs=${r.handshakeMs}ms${r.promptMs !== void 0 ? ` prompt=${r.promptMs}ms` : ""}` : "";
-    lines.push(`  ${icon(r.status)} ${r.agentId.padEnd(16)} ${r.status.toUpperCase().padEnd(7)} ${checks}${timing}`);
-    if (r.agentInfo) lines.push(`      agent: ${r.agentInfo.name} ${r.agentInfo.version}`);
-    if (r.sample) lines.push(`      reply: ${r.sample}`);
-    if (r.reason) lines.push(`      reason: ${r.reason}`);
+  try {
+    const res = await fetch(url, { signal: controller.signal });
+    if (!res.ok) {
+      throw new Error(`ACP registry fetch failed: HTTP ${res.status}`);
+    }
+    const body = await res.json();
+    const rawAgents = Array.isArray(body) ? body : Array.isArray(body?.agents) ? body.agents : null;
+    if (!rawAgents) {
+      throw new Error("ACP registry response had no agents array");
+    }
+    const platformKey = opts.platformKey ?? currentPlatformKey();
+    const agents = [];
+    for (const raw of rawAgents) {
+      const mapped = mapRegistryEntry(raw, platformKey);
+      if (mapped) agents.push(mapped);
+    }
+    return { fetchedAt: opts.now ?? (/* @__PURE__ */ new Date()).toISOString(), agents };
+  } finally {
+    clearTimeout(timer);
+    opts.signal?.removeEventListener("abort", onParentAbort);
   }
-  const { pass, partial, fail, skipped } = result.summary;
-  lines.push("");
-  lines.push(
-    `Bench summary: ${pass} pass, ${partial} partial, ${fail} fail, ${skipped} skipped. (${result.totalDurationMs}ms total)`
-  );
-  return lines.join("\n");
 }
 export {
   ACPProtocolHandler,
@@ -4162,6 +4469,8 @@ export {
   ACPSessionError,
   ACPToolsRegistry,
   ACP_AGENT_COMMANDS,
+  ACP_PACKAGE_VERSION,
+  ACP_PROTOCOL_VERSION,
   ACP_REGISTRY_URL,
   AGENTS_CATALOG,
   ClientTransport,
@@ -4174,6 +4483,7 @@ export {
   ToolTranslator,
   WebSocketClientTransport,
   WrongStackACPServer,
+  assertNeverSessionUpdate,
   audioContent,
   defaultEnsembleCmdResolver,
   defaultPermissionPolicy,
@@ -4183,6 +4493,7 @@ export {
   makeACPSubagentRunner,
   makeACPSubagentRunnerWithStop,
   makePermissionPolicy,
+  makeTrustBoundaryPermissionPolicy,
   mapRegistryEntry,
   probeAcpAgent,
   probeAcpAgents,
@@ -4193,6 +4504,7 @@ export {
   runAcpBench,
   runEnsemble,
   runOneAcpTask,
-  textContent
+  textContent,
+  toTrustBoundaryRequest
 };
 //# sourceMappingURL=index.js.map