@wrongstack/acp 0.293.0 → 0.295.1

package/dist/wrongstack-acp-agent.js

@@ -1,16 +1,33 @@
 // src/agent/wrongstack-acp-agent.ts
-import { fileURLToPath } from "node:url";
 import { createServer } from "node:http";
-import { writeErr as writeErr2 } from "@wrongstack/core";
+import { fileURLToPath } from "node:url";
+import { writeErr as writeErr2 } from "@wrongstack/core/utils";
 
 // src/types/acp-v1.ts
 var ACP_PROTOCOL_VERSION = 1;
 
-// src/agent/protocol-handler.ts
+// src/version.ts
+import { createRequire } from "node:module";
+var require2 = createRequire(import.meta.url);
+function readPackageVersion(load = () => require2("../package.json")) {
+  try {
+    const packageJson = load();
+    if (typeof packageJson.version === "string" && packageJson.version.length > 0) {
+      return packageJson.version;
+    }
+  } catch {
+  }
+  return "dev";
+}
+var ACP_PACKAGE_VERSION = readPackageVersion();
+
+// src/agent/protocol-contract.ts
 function toWire(msg) {
   return msg;
 }
-var WRONGSTACK_VERSION = "0.274.1";
+var WRONGSTACK_VERSION = ACP_PACKAGE_VERSION;
+
+// src/agent/protocol-handler.ts
 var WRONGSTACK_AUTH_METHODS = [
   {
     id: "wrongstack-auth",
@@ -21,6 +38,7 @@ var WRONGSTACK_AUTH_METHODS = [
   }
 ];
 var DEFAULT_MODE_ID = "code";
+var DEFAULT_MAX_SESSIONS = 64;
 var DEFAULT_MODES = [
   {
     id: DEFAULT_MODE_ID,
@@ -38,6 +56,8 @@ var ACPProtocolHandler = class {
   agentName;
   replayFor;
   seedFor;
+  disposeFor;
+  maxSessions;
   store;
   initialized = false;
   clientCapabilities = {};
@@ -58,6 +78,8 @@ var ACPProtocolHandler = class {
     this.agentName = opts.agentName ?? "wrongstack";
     this.replayFor = opts.replayFor;
     this.seedFor = opts.seedFor;
+    this.disposeFor = opts.disposeFor;
+    this.maxSessions = Number.isFinite(opts.maxSessions) && opts.maxSessions > 0 ? Math.floor(opts.maxSessions) : DEFAULT_MAX_SESSIONS;
     this.store = opts.store;
     if (typeof this.transport.onMessage === "function") {
       this.transport.onMessage((m) => this.maybeResolvePending(m));
@@ -115,8 +137,9 @@ var ACPProtocolHandler = class {
   }
   /** Abort all active turns and drop session state. */
   close() {
-    for (const [, session] of this.sessions) {
+    for (const [sessionId, session] of this.sessions) {
       session.abort.abort();
+      this.disposeSession(sessionId);
     }
     this.sessions.clear();
     for (const [, p] of this.pendingOut) {
@@ -125,6 +148,12 @@ var ACPProtocolHandler = class {
     }
     this.pendingOut.clear();
   }
+  disposeSession(sessionId) {
+    try {
+      this.disposeFor?.(sessionId);
+    } catch {
+    }
+  }
   // ────────────────────────────────────────────────────────────────────
   // Requests
   // ────────────────────────────────────────────────────────────────────
@@ -244,6 +273,10 @@ var ACPProtocolHandler = class {
     return false;
   }
   async handleSessionNew(id, params) {
+    if (this.sessions.size >= this.maxSessions) {
+      await this.sendError(id, -32e3, `active session limit reached (${this.maxSessions})`);
+      return false;
+    }
     const p = params ?? {};
     const cwd = typeof p.cwd === "string" ? p.cwd : this.defaultCwd;
     const sessionId = `sess_${this.allocId()}`;
@@ -294,6 +327,10 @@ var ACPProtocolHandler = class {
     if (!existing && sessionId && this.store) {
       const persisted = await this.store.load(sessionId);
       if (persisted) {
+        if (this.sessions.size >= this.maxSessions) {
+          await this.sendError(id, -32e3, `active session limit reached (${this.maxSessions})`);
+          return false;
+        }
         const restored = {
           id: sessionId,
           cwd: persisted.cwd ?? loadCwd ?? this.defaultCwd,
@@ -324,7 +361,7 @@ var ACPProtocolHandler = class {
     }
     if (existing) {
       existing.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-      const replay = sessionId ? this.replayFor?.(sessionId) : void 0;
+      const replay = this.replayFor?.(sessionId);
       if (replay) {
         for (const update of replay) {
           await this.sendNotification({ sessionId, update });
@@ -389,7 +426,8 @@ var ACPProtocolHandler = class {
       return false;
     }
     session.abort.abort();
-    if (sessionId) this.sessions.delete(sessionId);
+    this.sessions.delete(sessionId);
+    this.disposeSession(sessionId);
     await this.transport.send(toWire({
       jsonrpc: "2.0",
       id,
@@ -411,6 +449,7 @@ var ACPProtocolHandler = class {
     const session = this.sessions.get(sessionId);
     session.abort.abort();
     this.sessions.delete(sessionId);
+    this.disposeSession(sessionId);
     await this.transport.send(toWire({
       jsonrpc: "2.0",
       id,
@@ -426,6 +465,10 @@ var ACPProtocolHandler = class {
       await this.sendError(id, -32e3, `session not found: ${sourceId}`);
       return false;
     }
+    if (this.sessions.size >= this.maxSessions) {
+      await this.sendError(id, -32e3, `active session limit reached (${this.maxSessions})`);
+      return false;
+    }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const sessionId = `sess_${this.allocId()}`;
     const forked = {
@@ -692,7 +735,13 @@ function errorToJsonRpc(err) {
 }
 
 // src/agent/stdio-transport.ts
-import { expectDefined, writeErr } from "@wrongstack/core";
+import { expectDefined, writeErr } from "@wrongstack/core/utils";
+import { treeKill } from "@wrongstack/core/utils/tree-kill";
+var DEFAULT_MAX_FRAME_CHARS = 20 * 1024 * 1024;
+var DEFAULT_MAX_QUEUED_MESSAGES = 1e3;
+function positiveLimit(value, fallback) {
+  return value !== void 0 && Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
+}
 var StdioTransport = class {
   stdin = process.stdin;
   stdout = process.stdout;
@@ -702,7 +751,11 @@ var StdioTransport = class {
   closed = false;
   resolveRead = null;
   messageQueue = [];
-  constructor() {
+  maxFrameChars;
+  maxQueuedMessages;
+  constructor(opts = {}) {
+    this.maxFrameChars = positiveLimit(opts.maxFrameChars, DEFAULT_MAX_FRAME_CHARS);
+    this.maxQueuedMessages = positiveLimit(opts.maxQueuedMessages, DEFAULT_MAX_QUEUED_MESSAGES);
     this.stdin.resume();
     this.stdin.setEncoding("utf8");
     this.stdin.on("data", (chunk) => this.onData(chunk));
@@ -723,7 +776,8 @@ var StdioTransport = class {
     this.stdout.write(chunk, "utf8");
   }
   read() {
-    if (this.messageQueue.length > 0) return Promise.resolve(expectDefined(this.messageQueue.shift()));
+    if (this.messageQueue.length > 0)
+      return Promise.resolve(expectDefined(this.messageQueue.shift()));
     if (this.closed) return Promise.resolve(null);
     return new Promise((resolve) => {
       this.resolveRead = resolve;
@@ -738,13 +792,34 @@ var StdioTransport = class {
     this.stdin.pause();
     this.resolveRead?.(null);
     this.resolveRead = null;
+    this.buffer = "";
+    this.messageQueue.length = 0;
+    this.handlers.clear();
   }
   onData(chunk) {
     this.buffer += chunk;
     const lines = this.buffer.split("\n");
     this.buffer = lines.pop() ?? "";
+    if (this.buffer.length > this.maxFrameChars) {
+      this.stderr.write(
+        `[wstack-acp frame error] pending frame exceeds ${this.maxFrameChars} characters
+`,
+        "utf8"
+      );
+      this.close();
+      return;
+    }
     for (const raw of lines) {
       if (!raw.trim()) continue;
+      if (raw.length > this.maxFrameChars) {
+        this.stderr.write(
+          `[wstack-acp frame error] frame exceeds ${this.maxFrameChars} characters
+`,
+          "utf8"
+        );
+        this.close();
+        return;
+      }
       try {
         this.dispatch(JSON.parse(raw));
       } catch (err) {
@@ -759,6 +834,15 @@ var StdioTransport = class {
       this.resolveRead = null;
       resolve(msg);
     } else {
+      if (this.messageQueue.length >= this.maxQueuedMessages) {
+        this.stderr.write(
+          `[wstack-acp queue error] pending message queue exceeds ${this.maxQueuedMessages} entries
+`,
+          "utf8"
+        );
+        this.close();
+        return;
+      }
       this.messageQueue.push(msg);
     }
     for (const handler of this.handlers) {
@@ -771,9 +855,7 @@ var StdioTransport = class {
     }
   }
   handleClose() {
-    this.closed = true;
-    this.resolveRead?.(null);
-    this.resolveRead = null;
+    this.close();
   }
   failAll(err) {
     this.stderr.write(`[wstack-acp stdin error] ${err.message}
@@ -801,6 +883,7 @@ var WrongStackACPServer = class {
       agentName: opts.agentName,
       ...opts.replayFor ? { replayFor: opts.replayFor } : {},
       ...opts.seedFor ? { seedFor: opts.seedFor } : {},
+      ...opts.disposeFor ? { disposeFor: opts.disposeFor } : {},
       ...opts.store ? { store: opts.store } : {}
     });
   }
@@ -822,13 +905,17 @@ var WrongStackACPServer = class {
       this.transport.sendStartupMarker();
     }
     this.running = true;
-    while (this.running) {
-      const msg = await this.transport.read();
-      if (!msg) break;
-      const terminal = await this.handler.handleMessage(msg);
-      if (terminal) break;
+    try {
+      while (this.running) {
+        const msg = await this.transport.read();
+        if (!msg) break;
+        const terminal = await this.handler.handleMessage(msg);
+        if (terminal) break;
+      }
+    } finally {
+      this.handler.close();
+      this.transport.close();
     }
-    this.transport.close();
   }
   async startHttp(port) {
     const host = this.options.host ?? "127.0.0.1";
@@ -837,10 +924,9 @@ var WrongStackACPServer = class {
     let httpChain = Promise.resolve();
     this.httpServer = createServer(async (req, res) => {
       if (authToken) {
-        const url = new URL(req.url ?? "/", `http://${host}:${port}`);
+        const url = new URL(requestPath(req.url), `http://${host}:${port}`);
         const queryToken = url.searchParams.get("token");
-        const authHeader = req.headers["authorization"];
-        const bearerToken = Array.isArray(authHeader) ? authHeader[0]?.replace(/^Bearer\s+/i, "") : authHeader?.replace(/^Bearer\s+/i, "");
+        const bearerToken = headerValue(req.headers.authorization)?.replace(/^Bearer\s+/i, "");
         const supplied = queryToken ?? bearerToken ?? "";
         if (supplied !== authToken) {
           res.writeHead(401, { "Content-Type": "application/json" });
@@ -849,7 +935,7 @@ var WrongStackACPServer = class {
         }
       }
       const selfOrigin = `http://${host}:${port}`;
-      const reqOrigin = Array.isArray(req.headers.origin) ? req.headers.origin[0] : req.headers.origin;
+      const reqOrigin = headerValue(req.headers.origin);
       if (reqOrigin && reqOrigin !== selfOrigin) {
         res.writeHead(403);
         res.end(JSON.stringify({ error: "cross-origin request forbidden" }));
@@ -929,6 +1015,8 @@ var WrongStackACPServer = class {
       try {
         await requestPromise;
       } catch {
+        res.writeHead(500, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: { code: -32603, message: "Internal error" } }));
       }
     });
     return new Promise((resolve) => {
@@ -943,6 +1031,7 @@ var WrongStackACPServer = class {
   /** Stop the server. */
   stop() {
     this.running = false;
+    this.handler.close();
     this.transport.close();
     if (this.httpServer) {
       this.httpServer.close();
@@ -953,6 +1042,13 @@ var WrongStackACPServer = class {
 var defaultEchoRunTurn = async (_input, _emit) => {
   return { stopReason: "end_turn" };
 };
+function headerValue(value) {
+  return Array.isArray(value) ? value[0] : value;
+}
+function requestPath(value) {
+  return value ?? "/";
+}
+var wrongStackACPServerCoverage = { defaultEchoRunTurn, headerValue, requestPath };
 async function main() {
   const server = new WrongStackACPServer();
   await server.start();
@@ -966,6 +1062,7 @@ if (isEntrypoint) {
   });
 }
 export {
-  WrongStackACPServer
+  WrongStackACPServer,
+  wrongStackACPServerCoverage
 };
 //# sourceMappingURL=wrongstack-acp-agent.js.map