@wrongstack/acp 0.298.3 → 0.300.0

package/dist/agent.js

@@ -933,10 +933,16 @@ var ACPProtocolHandler = class {
       }
     };
     let result;
+    const pendingNotifications = [];
+    const emit = (update) => {
+      const p2 = this.sendNotification({ sessionId, update });
+      pendingNotifications.push(p2.catch(() => {
+      }));
+    };
     try {
       result = await this.runTurn(
         { sessionId, prompt: p.prompt, signal: turnSignal.signal },
-        (update) => this.sendNotification({ sessionId, update }),
+        emit,
         api
       );
     } catch (err) {
@@ -945,6 +951,7 @@ var ACPProtocolHandler = class {
       await this.sendError(id, code, message, data);
       return false;
     }
+    await Promise.all(pendingNotifications);
     session.abort.signal.removeEventListener("abort", onCancel);
     session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     await this.persist(session);
@@ -1439,6 +1446,7 @@ var WsBridgeTransport = class {
 };
 
 // src/agent/wrongstack-acp-agent.ts
+import { timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
 import { isIP } from "node:net";
 import { fileURLToPath } from "node:url";
@@ -1506,10 +1514,10 @@ var WrongStackACPServer = class {
     this.httpServer = createServer(async (req, res) => {
       if (authToken) {
         const url = new URL(requestPath(req.url), `http://${host}:${port}`);
-        const queryToken = url.searchParams.get("token");
         const bearerToken = headerValue(req.headers.authorization)?.replace(/^Bearer\s+/i, "");
-        const supplied = queryToken ?? bearerToken ?? "";
-        if (supplied !== authToken) {
+        const queryToken = url.searchParams.get("token");
+        const queryOk = queryToken !== null && isLoopbackPeer(req) && timingSafeTokenEqual(queryToken, authToken);
+        if (!queryOk && !timingSafeTokenEqual(bearerToken ?? "", authToken)) {
           res.writeHead(401, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: { code: -32001, message: "Unauthorized" } }));
           return;
@@ -1623,6 +1631,17 @@ var WrongStackACPServer = class {
 var defaultEchoRunTurn = async (_input, _emit) => {
   return { stopReason: "end_turn" };
 };
+function timingSafeTokenEqual(supplied, expected) {
+  if (!supplied || !expected) return false;
+  const a = Buffer.from(supplied);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+function isLoopbackPeer(req) {
+  const address = req.socket.remoteAddress?.replace(/^::ffff:/i, "");
+  return address !== void 0 && isLoopbackHost(address);
+}
 function headerValue(value) {
   return Array.isArray(value) ? value[0] : value;
 }

package/dist/index.js

@@ -652,10 +652,16 @@ var ACPProtocolHandler = class {
       }
     };
     let result;
+    const pendingNotifications = [];
+    const emit = (update) => {
+      const p2 = this.sendNotification({ sessionId, update });
+      pendingNotifications.push(p2.catch(() => {
+      }));
+    };
     try {
       result = await this.runTurn(
         { sessionId, prompt: p.prompt, signal: turnSignal.signal },
-        (update) => this.sendNotification({ sessionId, update }),
+        emit,
         api
       );
     } catch (err) {
@@ -664,6 +670,7 @@ var ACPProtocolHandler = class {
       await this.sendError(id, code, message, data);
       return false;
     }
+    await Promise.all(pendingNotifications);
     session.abort.signal.removeEventListener("abort", onCancel);
     session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     await this.persist(session);
@@ -1377,6 +1384,7 @@ function toolToPriority(tool) {
 }
 
 // src/agent/wrongstack-acp-agent.ts
+import { timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
 import { isIP } from "node:net";
 import { fileURLToPath } from "node:url";
@@ -1444,10 +1452,10 @@ var WrongStackACPServer = class {
     this.httpServer = createServer(async (req, res) => {
       if (authToken) {
         const url = new URL(requestPath(req.url), `http://${host}:${port}`);
-        const queryToken = url.searchParams.get("token");
         const bearerToken = headerValue(req.headers.authorization)?.replace(/^Bearer\s+/i, "");
-        const supplied = queryToken ?? bearerToken ?? "";
-        if (supplied !== authToken) {
+        const queryToken = url.searchParams.get("token");
+        const queryOk = queryToken !== null && isLoopbackPeer(req) && timingSafeTokenEqual(queryToken, authToken);
+        if (!queryOk && !timingSafeTokenEqual(bearerToken ?? "", authToken)) {
           res.writeHead(401, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: { code: -32001, message: "Unauthorized" } }));
           return;
@@ -1561,6 +1569,17 @@ var WrongStackACPServer = class {
 var defaultEchoRunTurn = async (_input, _emit) => {
   return { stopReason: "end_turn" };
 };
+function timingSafeTokenEqual(supplied, expected) {
+  if (!supplied || !expected) return false;
+  const a = Buffer.from(supplied);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+function isLoopbackPeer(req) {
+  const address = req.socket.remoteAddress?.replace(/^::ffff:/i, "");
+  return address !== void 0 && isLoopbackHost(address);
+}
 function headerValue(value) {
   return Array.isArray(value) ? value[0] : value;
 }

package/dist/wrongstack-acp-agent.js

@@ -1,4 +1,5 @@
 // src/agent/wrongstack-acp-agent.ts
+import { timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
 import { isIP } from "node:net";
 import { fileURLToPath } from "node:url";
@@ -653,10 +654,16 @@ var ACPProtocolHandler = class {
       }
     };
     let result;
+    const pendingNotifications = [];
+    const emit = (update) => {
+      const p2 = this.sendNotification({ sessionId, update });
+      pendingNotifications.push(p2.catch(() => {
+      }));
+    };
     try {
       result = await this.runTurn(
         { sessionId, prompt: p.prompt, signal: turnSignal.signal },
-        (update) => this.sendNotification({ sessionId, update }),
+        emit,
         api
       );
     } catch (err) {
@@ -665,6 +672,7 @@ var ACPProtocolHandler = class {
       await this.sendError(id, code, message, data);
       return false;
     }
+    await Promise.all(pendingNotifications);
     session.abort.signal.removeEventListener("abort", onCancel);
     session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     await this.persist(session);
@@ -1084,10 +1092,10 @@ var WrongStackACPServer = class {
     this.httpServer = createServer(async (req, res) => {
       if (authToken) {
         const url = new URL(requestPath(req.url), `http://${host}:${port}`);
-        const queryToken = url.searchParams.get("token");
         const bearerToken = headerValue(req.headers.authorization)?.replace(/^Bearer\s+/i, "");
-        const supplied = queryToken ?? bearerToken ?? "";
-        if (supplied !== authToken) {
+        const queryToken = url.searchParams.get("token");
+        const queryOk = queryToken !== null && isLoopbackPeer(req) && timingSafeTokenEqual(queryToken, authToken);
+        if (!queryOk && !timingSafeTokenEqual(bearerToken ?? "", authToken)) {
           res.writeHead(401, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: { code: -32001, message: "Unauthorized" } }));
           return;
@@ -1201,6 +1209,17 @@ var WrongStackACPServer = class {
 var defaultEchoRunTurn = async (_input, _emit) => {
   return { stopReason: "end_turn" };
 };
+function timingSafeTokenEqual(supplied, expected) {
+  if (!supplied || !expected) return false;
+  const a = Buffer.from(supplied);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+function isLoopbackPeer(req) {
+  const address = req.socket.remoteAddress?.replace(/^::ffff:/i, "");
+  return address !== void 0 && isLoopbackHost(address);
+}
 function headerValue(value) {
   return Array.isArray(value) ? value[0] : value;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/acp",
-  "version": "0.298.3",
+  "version": "0.300.0",
   "license": "MIT",
   "description": "ACP (Agent Client Protocol) integration for WrongStack — client + agent support",
   "keywords": [
@@ -52,7 +52,7 @@
   ],
   "dependencies": {
     "@agentclientprotocol/sdk": "^1.3.0",
-    "@wrongstack/core": "0.298.3"
+    "@wrongstack/core": "0.300.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",