@wrongstack/acp 0.297.0 → 0.298.0

package/dist/wrongstack-acp-agent.js

@@ -4,6 +4,11 @@ import { isIP } from "node:net";
 import { fileURLToPath } from "node:url";
 import { expandIPv6, writeErr as writeErr2 } from "@wrongstack/core/utils";
 
+// src/agent/protocol-handler.ts
+import { randomUUID } from "node:crypto";
+import * as fsp from "node:fs/promises";
+import * as path from "node:path";
+
 // src/types/acp-v1.ts
 var ACP_PROTOCOL_VERSION = 1;
 
@@ -93,12 +98,12 @@ var ACPProtocolHandler = class {
    */
   request(method, params, timeoutMs = 6e4) {
     const id = `srv_${this.nextOutId++}`;
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const timer = setTimeout(() => {
         this.pendingOut.delete(id);
         reject(new Error(`${method} timed out after ${timeoutMs}ms`));
       }, timeoutMs);
-      this.pendingOut.set(id, { resolve, reject, timer });
+      this.pendingOut.set(id, { resolve: resolve2, reject, timer });
       this.transport.send(toWire({ jsonrpc: "2.0", id, method, params })).catch((e) => {
         clearTimeout(timer);
         this.pendingOut.delete(id);
@@ -215,62 +220,68 @@ var ACPProtocolHandler = class {
       this.clientCapabilities = p.clientCapabilities;
     }
     this.initialized = true;
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: {
-        protocolVersion: ACP_PROTOCOL_VERSION,
-        agentCapabilities: {
-          loadSession: true,
-          promptCapabilities: {
-            // We route ACP image blocks into the core agent's multimodal
-            // input (server-agent-turn.promptToAgentInput); whether the
-            // model can see them is the configured provider's concern.
-            image: true,
-            audio: false,
-            embeddedContext: true
-          },
-          mcpCapabilities: {
-            http: false,
-            sse: false
+    await this.transport.send(
+      toWire({
+        jsonrpc: "2.0",
+        id,
+        result: {
+          protocolVersion: ACP_PROTOCOL_VERSION,
+          agentCapabilities: {
+            loadSession: true,
+            promptCapabilities: {
+              // We route ACP image blocks into the core agent's multimodal
+              // input (server-agent-turn.promptToAgentInput); whether the
+              // model can see them is the configured provider's concern.
+              image: true,
+              audio: false,
+              embeddedContext: true
+            },
+            mcpCapabilities: {
+              http: false,
+              sse: false
+            },
+            sessionCapabilities: {
+              close: {},
+              list: {},
+              delete: {},
+              resume: {},
+              fork: {}
+            },
+            auth: {
+              logout: {}
+            }
           },
-          sessionCapabilities: {
-            close: {},
-            list: {},
-            delete: {},
-            resume: {},
-            fork: {}
+          agentInfo: {
+            name: this.agentName,
+            title: "WrongStack",
+            version: WRONGSTACK_VERSION
           },
-          auth: {
-            logout: {}
-          }
-        },
-        agentInfo: {
-          name: this.agentName,
-          title: "WrongStack",
-          version: WRONGSTACK_VERSION
-        },
-        authMethods: WRONGSTACK_AUTH_METHODS,
-        modes: this.modes,
-        configOptions: this.configOptions
-      }
-    }));
+          authMethods: WRONGSTACK_AUTH_METHODS,
+          modes: this.modes,
+          configOptions: this.configOptions
+        }
+      })
+    );
     return false;
   }
   async handleAuthenticate(id, _params) {
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: { outcome: "unauthenticated" }
-    }));
+    await this.transport.send(
+      toWire({
+        jsonrpc: "2.0",
+        id,
+        result: { outcome: "unauthenticated" }
+      })
+    );
     return false;
   }
   async handleLogout(id, _params) {
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: {}
-    }));
+    await this.transport.send(
+      toWire({
+        jsonrpc: "2.0",
+        id,
+        result: {}
+      })
+    );
     return false;
   }
   async handleSessionNew(id, params) {
@@ -279,7 +290,15 @@ var ACPProtocolHandler = class {
       return false;
     }
     const p = params ?? {};
-    const cwd = typeof p.cwd === "string" ? p.cwd : this.defaultCwd;
+    let cwd = this.defaultCwd;
+    if (typeof p.cwd === "string") {
+      const resolved = await this.resolveSessionCwd(p.cwd);
+      if (resolved === null) {
+        await this.sendError(id, -32602, `cwd must be an absolute path to an existing directory`);
+        return false;
+      }
+      cwd = resolved;
+    }
     const sessionId = `sess_${this.allocId()}`;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const state = {
@@ -309,15 +328,17 @@ var ACPProtocolHandler = class {
         }
       });
     }
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: {
-        sessionId,
-        modes: this.modes,
-        configOptions: this.configOptions
-      }
-    }));
+    await this.transport.send(
+      toWire({
+        jsonrpc: "2.0",
+        id,
+        result: {
+          sessionId,
+          modes: this.modes,
+          configOptions: this.configOptions
+        }
+      })
+    );
     return false;
   }
   async handleSessionLoad(id, params) {
@@ -332,9 +353,15 @@ var ACPProtocolHandler = class {
           await this.sendError(id, -32e3, `active session limit reached (${this.maxSessions})`);
           return false;
         }
+        if (loadCwd !== void 0 && await this.resolveSessionCwd(loadCwd) === null) {
+          await this.sendError(id, -32602, `cwd must be an absolute path to an existing directory`);
+          return false;
+        }
+        const candidateCwd = persisted.cwd ?? loadCwd ?? this.defaultCwd;
+        const restoredCwd = await this.resolveSessionCwd(candidateCwd) ?? this.defaultCwd;
         const restored = {
           id: sessionId,
-          cwd: persisted.cwd ?? loadCwd ?? this.defaultCwd,
+          cwd: restoredCwd,
           abort: new AbortController(),
           modeId: persisted.modeId ?? DEFAULT_MODE_ID,
           createdAt: persisted.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
@@ -350,13 +377,15 @@ var ACPProtocolHandler = class {
           sessionId,
           update: { sessionUpdate: "current_mode_update", modeId: restored.modeId }
         });
-        await this.transport.send(toWire({
-          jsonrpc: "2.0",
-          id,
-          result: {
-            initialMode: { currentModeId: restored.modeId, availableModes: this.modes }
-          }
-        }));
+        await this.transport.send(
+          toWire({
+            jsonrpc: "2.0",
+            id,
+            result: {
+              initialMode: { currentModeId: restored.modeId, availableModes: this.modes }
+            }
+          })
+        );
         return false;
       }
     }
@@ -382,16 +411,18 @@ var ACPProtocolHandler = class {
           modeId: existing.modeId
         }
       });
-      await this.transport.send(toWire({
-        jsonrpc: "2.0",
-        id,
-        result: {
-          initialMode: {
-            currentModeId: existing.modeId,
-            availableModes: this.modes
+      await this.transport.send(
+        toWire({
+          jsonrpc: "2.0",
+          id,
+          result: {
+            initialMode: {
+              currentModeId: existing.modeId,
+              availableModes: this.modes
+            }
           }
-        }
-      }));
+        })
+      );
       return false;
     }
     await this.sendError(id, -32e3, `session not found: ${sessionId}`);
@@ -403,16 +434,18 @@ var ACPProtocolHandler = class {
     const existing = sessionId ? this.sessions.get(sessionId) : void 0;
     if (existing) {
       existing.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-      await this.transport.send(toWire({
-        jsonrpc: "2.0",
-        id,
-        result: {
-          initialMode: {
-            currentModeId: existing.modeId,
-            availableModes: this.modes
+      await this.transport.send(
+        toWire({
+          jsonrpc: "2.0",
+          id,
+          result: {
+            initialMode: {
+              currentModeId: existing.modeId,
+              availableModes: this.modes
+            }
           }
-        }
-      }));
+        })
+      );
       return false;
     }
     await this.sendError(id, -32e3, `session not found: ${sessionId}`);
@@ -429,11 +462,13 @@ var ACPProtocolHandler = class {
     session.abort.abort();
     this.sessions.delete(sessionId);
     this.disposeSession(sessionId);
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: {}
-    }));
+    await this.transport.send(
+      toWire({
+        jsonrpc: "2.0",
+        id,
+        result: {}
+      })
+    );
     return false;
   }
   async handleSessionDelete(id, params) {
@@ -444,18 +479,22 @@ var ACPProtocolHandler = class {
       return false;
     }
     if (!this.sessions.has(sessionId)) {
-      await this.transport.send(toWire({ jsonrpc: "2.0", id, result: { configOptions: [...this.configOptions] } }));
+      await this.transport.send(
+        toWire({ jsonrpc: "2.0", id, result: { configOptions: [...this.configOptions] } })
+      );
       return false;
     }
     const session = this.sessions.get(sessionId);
     session.abort.abort();
     this.sessions.delete(sessionId);
     this.disposeSession(sessionId);
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: {}
-    }));
+    await this.transport.send(
+      toWire({
+        jsonrpc: "2.0",
+        id,
+        result: {}
+      })
+    );
     return false;
   }
   async handleSessionFork(id, params) {
@@ -470,11 +509,20 @@ var ACPProtocolHandler = class {
       await this.sendError(id, -32e3, `active session limit reached (${this.maxSessions})`);
       return false;
     }
+    let forkCwd = source.cwd;
+    if (typeof p.cwd === "string") {
+      const resolved = await this.resolveSessionCwd(p.cwd);
+      if (resolved === null) {
+        await this.sendError(id, -32602, `cwd must be an absolute path to an existing directory`);
+        return false;
+      }
+      forkCwd = resolved;
+    }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const sessionId = `sess_${this.allocId()}`;
     const forked = {
       id: sessionId,
-      cwd: typeof p.cwd === "string" ? p.cwd : source.cwd,
+      cwd: forkCwd,
       abort: new AbortController(),
       modeId: source.modeId,
       createdAt: now,
@@ -493,38 +541,48 @@ var ACPProtocolHandler = class {
       sessionId,
       update: { sessionUpdate: "current_mode_update", modeId: forked.modeId }
     });
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: {
-        sessionId,
-        modes: this.modes,
-        configOptions: this.configOptions
-      }
-    }));
+    await this.transport.send(
+      toWire({
+        jsonrpc: "2.0",
+        id,
+        result: {
+          sessionId,
+          modes: this.modes,
+          configOptions: this.configOptions
+        }
+      })
+    );
     return false;
   }
   async handleProvidersList(id, _params) {
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: {
-        providers: [],
-        currentProviderId: null
-      }
-    }));
+    await this.transport.send(
+      toWire({
+        jsonrpc: "2.0",
+        id,
+        result: {
+          providers: [],
+          currentProviderId: null
+        }
+      })
+    );
     return false;
   }
   async handleProvidersSet(id, _params) {
-    await this.sendError(id, -32e3, "provider configuration not available through ACP; use wstack auth");
+    await this.sendError(
+      id,
+      -32e3,
+      "provider configuration not available through ACP; use wstack auth"
+    );
     return false;
   }
   async handleProvidersDisable(id, _params) {
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: {}
-    }));
+    await this.transport.send(
+      toWire({
+        jsonrpc: "2.0",
+        id,
+        result: {}
+      })
+    );
     return false;
   }
   async handleMcpMessage(id, _params) {
@@ -577,7 +635,10 @@ var ACPProtocolHandler = class {
         const terminalId = created?.terminalId;
         if (!terminalId) return { output: "", exitCode: null };
         try {
-          const exit = await this.request("terminal/wait_for_exit", { sessionId, terminalId });
+          const exit = await this.request("terminal/wait_for_exit", {
+            sessionId,
+            terminalId
+          });
           const out = await this.request("terminal/output", { sessionId, terminalId });
           return {
             output: String(out?.output ?? ""),
@@ -607,11 +668,13 @@ var ACPProtocolHandler = class {
     session.abort.signal.removeEventListener("abort", onCancel);
     session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     await this.persist(session);
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: { stopReason: result.stopReason }
-    }));
+    await this.transport.send(
+      toWire({
+        jsonrpc: "2.0",
+        id,
+        result: { stopReason: result.stopReason }
+      })
+    );
     return false;
   }
   async handleSetMode(id, params) {
@@ -652,7 +715,9 @@ var ACPProtocolHandler = class {
         configOptions: [...this.configOptions]
       }
     });
-    await this.transport.send(toWire({ jsonrpc: "2.0", id, result: { configOptions: [...this.configOptions] } }));
+    await this.transport.send(
+      toWire({ jsonrpc: "2.0", id, result: { configOptions: [...this.configOptions] } })
+    );
     return false;
   }
   async handleSessionList(id) {
@@ -665,11 +730,13 @@ var ACPProtocolHandler = class {
       if (s.title !== void 0) out.title = s.title;
       return out;
     });
-    await this.transport.send(toWire({
-      jsonrpc: "2.0",
-      id,
-      result: { sessions }
-    }));
+    await this.transport.send(
+      toWire({
+        jsonrpc: "2.0",
+        id,
+        result: { sessions }
+      })
+    );
     return false;
   }
   // ────────────────────────────────────────────────────────────────────
@@ -715,8 +782,54 @@ var ACPProtocolHandler = class {
     if (data !== void 0) error.data = data;
     await this.transport.send(toWire({ jsonrpc: "2.0", id, error }));
   }
+  /**
+   * Allocate a session id (WS-015).
+   *
+   * This was `this.nextId++`, so ids were `sess_1`, `sess_2`, … — and the
+   * handler has no per-connection ownership: any caller that names a session
+   * id can `session/load`, `session/prompt`, `session/cancel` or
+   * `session/delete` it. Over stdio that is academic (one client per process),
+   * but the agent also serves over HTTP, where a guessable id is the whole
+   * authorization story for any local process or page that reaches the port.
+   *
+   * Random ids do not create ownership — they remove the trivial enumeration
+   * that made its absence exploitable. Real per-connection ownership is the
+   * larger fix and is noted in the WS-015 test file.
+   *
+   * The counter is retained: it keeps ids ordered for debugging and guarantees
+   * uniqueness within a process even in the (impossible) event of a UUID
+   * collision. The random half is what makes the id unguessable.
+   */
+  /**
+   * Resolve a client-supplied `cwd` for a session, or `null` when it is not
+   * usable (WS-015).
+   *
+   * `session/new`, `session/load` and `session/fork` all took `params.cwd`
+   * with a single `typeof === 'string'` check and nothing else. That value is
+   * the working directory the agent then reads, writes and executes in.
+   *
+   * SCOPE, deliberately stated: this does NOT confine the session to a root.
+   * In ACP the client IS the editor and legitimately names its own workspace —
+   * Zed and JetBrains pass the project root — so a fixed boundary here would
+   * break the integration this package exists for. What it enforces is that
+   * the directory is absolute and actually exists as a directory: a relative
+   * or missing `cwd` is a bug or an attack under either reading, and silently
+   * running the agent somewhere other than where the client asked is worse
+   * than refusing. Confinement, if wanted, belongs in an operator-set option
+   * on top of this, not in place of it.
+   */
+  async resolveSessionCwd(requested) {
+    if (!path.isAbsolute(requested)) return null;
+    const resolved = path.resolve(requested);
+    try {
+      const stat2 = await fsp.stat(resolved);
+      return stat2.isDirectory() ? resolved : null;
+    } catch {
+      return null;
+    }
+  }
   allocId() {
-    return this.nextId++;
+    return `${this.nextId++}_${randomUUID().replaceAll("-", "")}`;
   }
 };
 function errorToJsonRpc(err) {
@@ -740,6 +853,7 @@ import { expectDefined, writeErr } from "@wrongstack/core/utils";
 import { treeKill } from "@wrongstack/core/utils/tree-kill";
 var DEFAULT_MAX_FRAME_CHARS = 20 * 1024 * 1024;
 var DEFAULT_MAX_QUEUED_MESSAGES = 1e3;
+var DEFAULT_MAX_QUEUED_CHARS = 32 * 1024 * 1024;
 function positiveLimit(value, fallback) {
   return value !== void 0 && Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
 }
@@ -749,53 +863,82 @@ var StdioTransport = class {
   stderr = process.stderr;
   buffer = "";
   handlers = /* @__PURE__ */ new Set();
+  claimHandlers = /* @__PURE__ */ new Set();
   closed = false;
   resolveRead = null;
   messageQueue = [];
+  queuedChars = 0;
   maxFrameChars;
   maxQueuedMessages;
+  maxQueuedChars;
+  onStdinData = (chunk) => this.onData(chunk);
+  onStdinEnd = () => this.handleClose();
+  onStdinError = (err) => this.failAll(err);
   constructor(opts = {}) {
     this.maxFrameChars = positiveLimit(opts.maxFrameChars, DEFAULT_MAX_FRAME_CHARS);
     this.maxQueuedMessages = positiveLimit(opts.maxQueuedMessages, DEFAULT_MAX_QUEUED_MESSAGES);
+    this.maxQueuedChars = positiveLimit(opts.maxQueuedChars, DEFAULT_MAX_QUEUED_CHARS);
     this.stdin.resume();
     this.stdin.setEncoding("utf8");
-    this.stdin.on("data", (chunk) => this.onData(chunk));
-    this.stdin.on("end", () => this.handleClose());
-    this.stdin.on("error", (err) => this.failAll(err));
+    this.stdin.on("data", this.onStdinData);
+    this.stdin.on("end", this.onStdinEnd);
+    this.stdin.on("error", this.onStdinError);
   }
   sendStartupMarker() {
     this.stdout.write("[wstack-acp]\n", "utf8");
   }
   send(msg) {
     if (this.closed) return Promise.resolve();
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const line = JSON.stringify(msg) + "\n";
-      this.stdout.write(line, "utf8", () => resolve());
+      this.stdout.write(line, "utf8", () => resolve2());
     });
   }
   sendRaw(chunk) {
     this.stdout.write(chunk, "utf8");
   }
   read() {
-    if (this.messageQueue.length > 0)
-      return Promise.resolve(expectDefined(this.messageQueue.shift()));
+    if (this.messageQueue.length > 0) {
+      const queued = expectDefined(this.messageQueue.shift());
+      this.queuedChars = Math.max(0, this.queuedChars - queued.chars);
+      return Promise.resolve(queued.message);
+    }
     if (this.closed) return Promise.resolve(null);
-    return new Promise((resolve) => {
-      this.resolveRead = resolve;
+    return new Promise((resolve2) => {
+      this.resolveRead = resolve2;
     });
   }
   onMessage(handler) {
     this.handlers.add(handler);
     return () => this.handlers.delete(handler);
   }
+  /**
+   * Register a handler that MAY claim a message by returning `true`.
+   * Claimed messages are NOT enqueued for the read() loop — they are
+   * considered fully consumed by the handler. This is how the ACP
+   * server transport prevents the correlation handler (which always
+   * fires on every message but only actually correlates responses)
+   * from starving the read() loop of pipelined requests, notifications,
+   * and any message the handler chose to ignore. See dispatch() for
+   * the gating logic.
+   */
+  onMessageClaim(handler) {
+    this.claimHandlers.add(handler);
+    return () => this.claimHandlers.delete(handler);
+  }
   close() {
     this.closed = true;
+    this.stdin.off("data", this.onStdinData);
+    this.stdin.off("end", this.onStdinEnd);
+    this.stdin.off("error", this.onStdinError);
     this.stdin.pause();
     this.resolveRead?.(null);
     this.resolveRead = null;
     this.buffer = "";
     this.messageQueue.length = 0;
+    this.queuedChars = 0;
     this.handlers.clear();
+    this.claimHandlers.clear();
   }
   onData(chunk) {
     this.buffer += chunk;
@@ -822,29 +965,41 @@ var StdioTransport = class {
         return;
       }
       try {
-        this.dispatch(JSON.parse(raw));
+        this.dispatch(JSON.parse(raw), raw.length);
       } catch (err) {
         this.stderr.write(`[wstack-acp parse error] ${err}
 `, "utf8");
       }
     }
   }
-  dispatch(msg) {
+  dispatch(msg, chars = JSON.stringify(msg).length) {
     if (this.resolveRead) {
-      const resolve = this.resolveRead;
+      const resolve2 = this.resolveRead;
       this.resolveRead = null;
-      resolve(msg);
+      resolve2(msg);
     } else {
-      if (this.messageQueue.length >= this.maxQueuedMessages) {
-        this.stderr.write(
-          `[wstack-acp queue error] pending message queue exceeds ${this.maxQueuedMessages} entries
+      let claimed = false;
+      for (const handler of this.claimHandlers) {
+        try {
+          if (handler(msg)) claimed = true;
+        } catch (err) {
+          this.stderr.write(`[wstack-acp handler error] ${err}
+`, "utf8");
+        }
+      }
+      if (!claimed) {
+        if (this.messageQueue.length >= this.maxQueuedMessages || this.queuedChars + chars > this.maxQueuedChars) {
+          this.stderr.write(
+            `[wstack-acp queue error] pending message queue exceeds ${this.maxQueuedMessages} entries or ${this.maxQueuedChars} characters
 `,
-          "utf8"
-        );
-        this.close();
-        return;
+            "utf8"
+          );
+          this.close();
+          return;
+        }
+        this.messageQueue.push({ message: msg, chars });
+        this.queuedChars += chars;
       }
-      this.messageQueue.push(msg);
     }
     for (const handler of this.handlers) {
       try {
@@ -1023,12 +1178,12 @@ var WrongStackACPServer = class {
         res.end(JSON.stringify({ error: { code: -32603, message: "Internal error" } }));
       }
     });
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       this.httpServer.listen(port, host, () => {
         writeErr2(`[wstack-acp] HTTP server listening on http://${host}:${port}
 `);
         this.running = true;
-        resolve();
+        resolve2();
       });
     });
   }