@wrongstack/acp 0.309.1 → 0.310.0

package/dist/client.js

@@ -254,37 +254,9 @@ function verbatimOptions(invocation) {
 // src/types/acp-v1.ts
 var ACP_PROTOCOL_VERSION = 1;
 
-// src/client/acp-session-content.ts
-function textContent(text) {
-  return { type: "text", text };
-}
-function imageContent(mimeType, data) {
-  return { type: "image", mimeType, data };
-}
-function audioContent(mimeType, data) {
-  return { type: "audio", mimeType, data };
-}
-function extractText(block) {
-  if (typeof block !== "object" || block === null) return "";
-  const b = block;
-  if (b.type === "text" && typeof b.text === "string") return b.text;
-  if (b.type === "resource" && b.resource && typeof b.resource === "object" && typeof b.resource.text === "string") {
-    return b.resource.text;
-  }
-  return "";
-}
-function isRecord(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function emptyRunResult(stopReason) {
-  return {
-    text: "",
-    stopReason,
-    hasText: false,
-    toolCalls: [],
-    diffs: [],
-    thoughts: ""
-  };
+// src/client/acp-message-routing.ts
+function isBestEffortAckMethod(method) {
+  return method === "mcp/connect" || method === "mcp/message" || method === "mcp/disconnect" || method === "elicitation/create" || method === "elicitation/complete";
 }
 
 // src/client/file-server.ts
@@ -469,622 +441,497 @@ function safeRealpathSync(p) {
   }
 }
 
-// src/client/permission.ts
-function pickAllow(options) {
-  const ranked = [...options].sort((a, b) => {
-    const score = (k) => {
-      if (k === "allow_once") return 0;
-      if (k === "allow_always") return 1;
-      if (k === "reject_once") return 2;
-      return 3;
-    };
-    return score(a.kind) - score(b.kind);
-  });
-  const chosen = ranked[0];
-  if (!chosen || chosen.kind === "reject_once" || chosen.kind === "reject_always") {
-    return { outcome: "cancelled" };
+// src/client/acp-session-callbacks.ts
+var DEFAULT_PERMISSION_TIMEOUT_MS = 6e4;
+async function handleAcpPermissionRequest(msg, permissionPolicy, sender, callbackOptions = {}) {
+  const id = msg.id;
+  if (id === void 0) return;
+  const params = msg.params;
+  const toolCall = params?.toolCall;
+  const permissionOptions = Array.isArray(params?.options) ? params.options : [];
+  if (!toolCall) {
+    await sender.sendErrorResponse(id, -32602, "toolCall is required");
+    return;
   }
-  return { outcome: "selected", optionId: chosen.optionId };
-}
-function pickReject(options) {
-  const reject = options.find(
-    (o) => o.kind === "reject_once" || o.kind === "reject_always"
-  );
-  return reject ? { outcome: "selected", optionId: reject.optionId } : { outcome: "cancelled" };
-}
-var READ_ONLY_KINDS = /* @__PURE__ */ new Set(["read", "search", "fetch", "think"]);
-var defaultPermissionPolicy = async (req) => {
-  if (req.signal.aborted) return { outcome: "cancelled" };
-  return pickAllow(req.options);
-};
-var readOnlyPermissionPolicy = async (req) => {
-  if (req.signal.aborted) return { outcome: "cancelled" };
-  const kind = req.toolCall.kind;
-  if (kind && READ_ONLY_KINDS.has(kind)) {
-    return pickAllow(req.options);
+  try {
+    const outcome = await runPermissionWithDeadline(
+      permissionPolicy,
+      {
+        toolCall,
+        options: permissionOptions
+      },
+      callbackOptions
+    );
+    await sender.sendResult(id, { outcome });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const code = isAbortLikeError(err) ? -32800 : -32603;
+    await sender.sendErrorResponse(id, code, `permission policy failed: ${message}`);
   }
-  return pickReject(req.options);
-};
-function makePermissionPolicy(decide) {
-  return async (req) => {
-    if (req.signal.aborted) return { outcome: "cancelled" };
-    const allow = await decide(req);
-    return allow ? pickAllow(req.options) : pickReject(req.options);
-  };
 }
-
-// src/client/terminal-server.ts
-import { spawn } from "node:child_process";
-import { randomBytes as randomBytes2 } from "node:crypto";
-import { realpathSync as realpathSync2 } from "node:fs";
-import * as path2 from "node:path";
-import { buildChildEnv } from "@wrongstack/core/utils";
-import { treeKill as treeKill2 } from "@wrongstack/core/utils/tree-kill";
-var EMPTY_BUFFER = Buffer.alloc(0);
-var DEBUG_DISPOSE = typeof process !== "undefined" && !!process.env?.WRONGSTACK_DEBUG && process.env.WRONGSTACK_DEBUG !== "0" && process.env.WRONGSTACK_DEBUG !== "false";
-var TerminalServer = class {
-  terminals = /* @__PURE__ */ new Map();
-  /**
-   * Stable per-instance identifier for debug logs. 8 hex chars is enough
-   * to disambiguate concurrent TerminalServers in a trace; not meant to
-   * be cryptographically unique.
-   */
-  instanceId;
-  projectRoot;
-  commandTimeoutMs;
-  outputByteLimit;
-  maxOutputByteLimit;
-  maxTerminals;
-  abortSignal;
-  abortHandler = () => this.dispose();
-  disposed = false;
-  nextId = 1;
-  constructor(opts) {
-    this.projectRoot = path2.resolve(opts.projectRoot);
-    this.commandTimeoutMs = opts.commandTimeoutMs ?? 5 * 6e4;
-    this.outputByteLimit = opts.outputByteLimit ?? 1024 * 1024;
-    this.maxOutputByteLimit = opts.maxOutputByteLimit ?? 16 * 1024 * 1024;
-    this.instanceId = `term_srv_${randomBytes2(4).toString("hex")}`;
-    this.maxTerminals = this.clampFiniteInt(opts.maxTerminals, 32);
-    this.abortSignal = opts.signal;
-    if (opts.signal) {
-      opts.signal.addEventListener("abort", this.abortHandler, { once: true });
-    }
+async function handleAcpFsRequest(msg, fileServer, permissionPolicy, sender, callbackOptions = {}) {
+  const id = msg.id;
+  if (id === void 0) return;
+  const params = msg.params;
+  if (!params?.path) {
+    await sender.sendErrorResponse(id, -32602, "path is required");
+    return;
   }
-  /** Spawn a new terminal. Returns the agent-facing id. */
-  create(params) {
-    if (this.disposed) {
-      throw new Error(
-        "TerminalServer is disposed \u2014 create a new TerminalServer instead of reusing this one"
+  if (msg.method === "fs/write_text_file") {
+    const authorization = await authorizeAcpCallback(
+      permissionPolicy,
+      {
+        toolCallId: `acp-fs-write-${id}`,
+        title: `Write file: ${params.path}`,
+        kind: "edit",
+        rawInput: { path: params.path, sessionId: params.sessionId }
+      },
+      callbackOptions
+    );
+    if (authorization !== "allowed") {
+      const isCancelled = authorization === "cancelled";
+      await sender.sendErrorResponse(
+        id,
+        isCancelled ? -32800 : -32602,
+        isCancelled ? "filesystem write permission request cancelled or timed out" : "filesystem write denied by permission policy"
       );
+      return;
     }
-    if (this.terminals.size >= this.maxTerminals) {
-      throw new Error(
-        `terminal limit reached (${this.maxTerminals}); release an existing terminal before creating another`
-      );
+  }
+  try {
+    if (msg.method === "fs/read_text_file") {
+      const result = await fileServer.readTextFile({
+        sessionId: params.sessionId ?? "",
+        path: params.path
+      });
+      await sender.sendResult(id, result);
+    } else {
+      await fileServer.writeTextFile({
+        sessionId: params.sessionId ?? "",
+        path: params.path,
+        content: params.content ?? ""
+      });
+      await sender.sendResult(id, {});
     }
-    const id = `term_${this.nextId++}`;
-    const cwd = this.resolveCwd(params.cwd);
-    const perCallByteLimit = Math.min(
-      Math.max(1, this.clampFiniteInt(params.outputByteLimit, this.outputByteLimit)),
-      this.maxOutputByteLimit
-    );
-    const proc = spawn(params.command, params.args ?? [], {
-      cwd,
-      env: this.buildEnv(params.env),
-      stdio: ["ignore", "pipe", "pipe"],
-      windowsHide: true
-      // shell: false on purpose. The terminal server is invoked with
-      // the agent's explicit argv; turning on shell-mode would make
-      // the command a single shell-parsed string, which breaks
-      // Windows cmd quoting for the common case of running node with
-      // `-e "<script>"`. If a future feature needs shell features
-      // (pipes, redirects), it should be opt-in per-call, not the
-      // default.
-    });
-    const state = {
-      proc,
-      cwd,
-      command: params.command,
-      args: params.args ?? [],
-      outputChunks: [],
-      outputHead: 0,
-      retainedBytes: 0,
-      truncated: false,
-      exitStatus: void 0,
-      timeoutHandle: null,
-      exitPromise: new Promise((resolve3) => {
-        proc.on("close", (code, signalName) => {
-          if (state.timeoutHandle) {
-            clearTimeout(state.timeoutHandle);
-            state.timeoutHandle = null;
-          }
-          const exitStatus = {
-            exitCode: typeof code === "number" ? code : null,
-            signal: typeof signalName === "string" ? signalName : null
-          };
-          state.exitStatus = exitStatus;
-          resolve3(exitStatus);
-        });
-        proc.on("error", (err) => {
-          if (state.timeoutHandle) {
-            clearTimeout(state.timeoutHandle);
-            state.timeoutHandle = null;
-          }
-          const exitStatus = { exitCode: 127, signal: null };
-          state.exitStatus = exitStatus;
-          let errorOutput = Buffer.from(`[spawn error] ${err.message}
-`, "utf8");
-          if (errorOutput.length > perCallByteLimit) {
-            let start = errorOutput.length - perCallByteLimit;
-            while (start < errorOutput.length && (errorOutput[start] & 192) === 128) start++;
-            errorOutput = errorOutput.subarray(start);
-            state.truncated = true;
-          }
-          state.outputChunks.push(errorOutput);
-          state.retainedBytes = errorOutput.length;
-          resolve3(exitStatus);
-        });
-      })
-    };
-    proc.stdout?.setEncoding("utf8");
-    proc.stderr?.setEncoding("utf8");
-    const onData = (chunk) => {
-      const outputChunk = Buffer.from(chunk, "utf8");
-      state.outputChunks.push(outputChunk);
-      state.retainedBytes += outputChunk.length;
-      if (state.retainedBytes > perCallByteLimit) state.truncated = true;
-      while (state.retainedBytes > perCallByteLimit && state.outputHead < state.outputChunks.length) {
-        const first = state.outputChunks[state.outputHead];
-        const overflow = state.retainedBytes - perCallByteLimit;
-        if (first.length <= overflow) {
-          state.outputChunks[state.outputHead] = EMPTY_BUFFER;
-          state.outputHead++;
-          state.retainedBytes -= first.length;
-          continue;
+  } catch (err) {
+    const code = err instanceof FsError ? -32602 : -32603;
+    const message = err instanceof Error ? err.message : String(err);
+    await sender.sendErrorResponse(id, code, message);
+  }
+}
+async function handleAcpTerminalRequest(msg, terminalServer, permissionPolicy, sender, callbackOptions = {}) {
+  const id = msg.id;
+  if (id === void 0) return;
+  const params = msg.params ?? {};
+  try {
+    switch (msg.method) {
+      case "terminal/create": {
+        const authorization = await authorizeAcpCallback(
+          permissionPolicy,
+          {
+            toolCallId: `acp-terminal-create-${id}`,
+            title: `Run command: ${String(params.command ?? "")} ${(Array.isArray(params.args) ? params.args : []).join(" ")}`.trim(),
+            kind: "execute",
+            rawInput: {
+              command: params.command,
+              args: params.args,
+              cwd: params.cwd,
+              sessionId: params.sessionId
+            }
+          },
+          callbackOptions
+        );
+        if (authorization !== "allowed") {
+          const isCancelled = authorization === "cancelled";
+          await sender.sendErrorResponse(
+            id,
+            isCancelled ? -32800 : -32602,
+            isCancelled ? "terminal create permission request cancelled or timed out" : "terminal create denied by permission policy"
+          );
+          return;
         }
-        let start = overflow;
-        while (start < first.length && (first[start] & 192) === 128) start++;
-        state.outputChunks[state.outputHead] = first.subarray(start);
-        state.retainedBytes -= start;
+        const createOpts = {
+          sessionId: String(params.sessionId ?? ""),
+          command: String(params.command ?? ""),
+          args: Array.isArray(params.args) ? params.args : []
+        };
+        if (Array.isArray(params.env)) {
+          createOpts.env = params.env;
+        }
+        if (typeof params.cwd === "string") {
+          createOpts.cwd = params.cwd;
+        }
+        if (typeof params.outputByteLimit === "number") {
+          createOpts.outputByteLimit = params.outputByteLimit;
+        }
+        const result = terminalServer.create(createOpts);
+        await sender.sendResult(id, result);
+        return;
       }
-      if (state.outputHead >= 256 && state.outputHead * 2 >= state.outputChunks.length) {
-        state.outputChunks = state.outputChunks.slice(state.outputHead);
-        state.outputHead = 0;
+      case "terminal/output": {
+        const terminalId = String(params.terminalId ?? "");
+        const out = terminalServer.output(terminalId);
+        await sender.sendResult(id, out);
+        return;
       }
-    };
-    state.onData = onData;
-    proc.stdout?.on("data", onData);
-    proc.stderr?.on("data", onData);
-    state.timeoutHandle = setTimeout(() => {
-      treeKill2(proc);
-    }, this.commandTimeoutMs);
-    this.terminals.set(id, state);
-    return { terminalId: id };
+      case "terminal/wait_for_exit": {
+        const terminalId = String(params.terminalId ?? "");
+        const exit = await terminalServer.waitForExit(terminalId);
+        await sender.sendResult(id, exit);
+        return;
+      }
+      case "terminal/kill": {
+        const terminalId = String(params.terminalId ?? "");
+        terminalServer.kill(terminalId);
+        await sender.sendResult(id, {});
+        return;
+      }
+      case "terminal/release": {
+        const terminalId = String(params.terminalId ?? "");
+        terminalServer.release(terminalId);
+        await sender.sendResult(id, {});
+        return;
+      }
+      default:
+        await sender.sendErrorResponse(id, -32601, `unknown method: ${msg.method}`);
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    await sender.sendErrorResponse(id, -32603, message);
   }
-  /** Return captured output and (if available) the exit status. */
-  output(terminalId) {
-    const state = this.terminals.get(terminalId);
-    if (!state) throw new Error(`unknown terminal: ${terminalId}`);
-    return {
-      output: Buffer.concat(
-        state.outputChunks.slice(state.outputHead),
-        state.retainedBytes
-      ).toString("utf8"),
-      truncated: state.truncated,
-      ...state.exitStatus ? { exitStatus: state.exitStatus } : {}
-    };
+}
+async function authorizeAcpCallback(permissionPolicy, partial, callbackOptions) {
+  try {
+    const outcome = await runPermissionWithDeadline(
+      permissionPolicy,
+      {
+        toolCall: {
+          sessionUpdate: "tool_call_update",
+          toolCallId: partial.toolCallId,
+          title: partial.title,
+          kind: partial.kind,
+          status: "pending",
+          ...partial.rawInput ? { rawInput: partial.rawInput } : {}
+        },
+        options: [
+          { optionId: "allow", name: "Allow", kind: "allow_once" },
+          { optionId: "reject", name: "Reject", kind: "reject_once" }
+        ]
+      },
+      callbackOptions
+    );
+    return outcome.outcome === "selected" && outcome.optionId !== "reject" && outcome.optionId !== "reject_once" && outcome.optionId !== "reject_always" ? "allowed" : "denied";
+  } catch (err) {
+    return isAbortLikeError(err) ? "cancelled" : "denied";
   }
-  /** Block until the process exits. Resolves with the exit status. */
-  async waitForExit(terminalId) {
-    const state = this.terminals.get(terminalId);
-    if (!state) throw new Error(`unknown terminal: ${terminalId}`);
-    return state.exitPromise;
+}
+async function runPermissionWithDeadline(permissionPolicy, call, callbackOptions) {
+  const timeoutMs = resolvePermissionDeadline(callbackOptions.permissionTimeoutMs);
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  const timer = timeoutMs === null ? null : setTimeout(abort, timeoutMs);
+  let removeAbort;
+  if (callbackOptions.signal) {
+    if (callbackOptions.signal.aborted) {
+      abort();
+    } else {
+      callbackOptions.signal.addEventListener("abort", abort, { once: true });
+      removeAbort = () => callbackOptions.signal?.removeEventListener("abort", abort);
+    }
   }
-  /**
-   * Kill the process but keep the terminal record (agent can still read output).
-   * On POSIX this signals only the direct child; descendants may survive because
-   * terminal processes are not spawned as process-group leaders.
-   */
-  kill(terminalId) {
-    const state = this.terminals.get(terminalId);
-    if (!state) throw new Error(`unknown terminal: ${terminalId}`);
-    treeKill2(state.proc);
+  try {
+    return await Promise.race([
+      permissionPolicy({
+        toolCall: call.toolCall,
+        options: call.options,
+        signal: controller.signal
+      }),
+      rejectOnAbort(controller.signal)
+    ]);
+  } finally {
+    if (timer !== null) clearTimeout(timer);
+    removeAbort?.();
   }
-  /** Kill the process if alive and remove the record. */
-  release(terminalId) {
-    const state = this.terminals.get(terminalId);
-    if (!state) return;
-    if (state.timeoutHandle) {
-      clearTimeout(state.timeoutHandle);
-      state.timeoutHandle = null;
-    }
-    if (state.onData) {
-      state.proc.stdout?.off("data", state.onData);
-      state.proc.stderr?.off("data", state.onData);
-      state.onData = void 0;
+}
+function rejectOnAbort(signal) {
+  return new Promise((_, reject) => {
+    const rejectAbort = () => reject(new Error("permission request cancelled or timed out"));
+    if (signal.aborted) {
+      rejectAbort();
+      return;
     }
-    state.proc.stdout?.destroy?.();
-    state.proc.stderr?.destroy?.();
-    state.outputChunks.length = 0;
-    state.outputHead = 0;
-    state.retainedBytes = 0;
-    treeKill2(state.proc, { force: true });
-    this.terminals.delete(terminalId);
+    signal.addEventListener("abort", rejectAbort, { once: true });
+  });
+}
+function isAbortLikeError(err) {
+  return err instanceof Error && /cancelled|canceled|timed out|aborted/i.test(err.message);
+}
+function resolvePermissionDeadline(value) {
+  if (value === Number.POSITIVE_INFINITY) return null;
+  if (value !== void 0 && Number.isFinite(value) && value > 0) return Math.trunc(value);
+  return DEFAULT_PERMISSION_TIMEOUT_MS;
+}
+
+// src/client/acp-session-content.ts
+function textContent(text) {
+  return { type: "text", text };
+}
+function imageContent(mimeType, data) {
+  return { type: "image", mimeType, data };
+}
+function audioContent(mimeType, data) {
+  return { type: "audio", mimeType, data };
+}
+function extractText(block) {
+  if (typeof block !== "object" || block === null) return "";
+  const b = block;
+  if (b.type === "text" && typeof b.text === "string") return b.text;
+  if (b.type === "resource" && b.resource && typeof b.resource === "object" && typeof b.resource.text === "string") {
+    return b.resource.text;
   }
-  /**
-   * Release all resources held by this server: kill every active terminal
-   * and detach the host `AbortSignal` listener.
-   *
-   * Idempotent — calling it multiple times is safe. Required because the
-   * previously-coded `releaseAll()` was the only path that removed the
-   * abort listener: if the host never called it (unhandled error path,
-   * host crash, GC of the session without explicit close), the listener
-   * pinned `this` (terminals Map, output buffers) for the lifetime of the
-   * signal. With `dispose()` this is no longer leak-prone.
-   *
-   * Also exposed as `[Symbol.dispose]` for `using` blocks in Node ≥ 22.
-   *
-   * RAM-leak audit 2026-08-11, MEDIUM (Finding 2).
-   */
-  dispose() {
-    if (this.disposed) return;
-    if (DEBUG_DISPOSE) {
-      const activeChildren = this.terminals.size;
-      console.debug(
-        JSON.stringify({
-          event: "terminal_server.disposed",
-          instanceId: this.instanceId,
-          activeChildren,
-          hadSignal: this.abortSignal !== void 0,
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        })
-      );
-    }
-    this.disposed = true;
-    this.abortSignal?.removeEventListener("abort", this.abortHandler);
-    for (const id of [...this.terminals.keys()]) {
-      this.release(id);
-    }
-  }
-  /** Alias for `dispose()` — enables `using new TerminalServer(...)`. */
-  [Symbol.dispose]() {
-    this.dispose();
+  return "";
+}
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function emptyRunResult(stopReason) {
+  return {
+    text: "",
+    stopReason,
+    hasText: false,
+    toolCalls: [],
+    diffs: [],
+    thoughts: ""
+  };
+}
+
+// src/client/acp-session-errors.ts
+var ACPSessionError = class extends Error {
+  kind;
+  cause;
+  constructor(kind, message, cause) {
+    super(message);
+    this.name = "ACPSessionError";
+    this.kind = kind;
+    this.cause = cause;
   }
-  /**
-   * Kill all active terminals. Used on session close.
-   *
-   * @deprecated Prefer `dispose()` (or `using { … }` via `Symbol.dispose`).
-   * `releaseAll` is retained as a delegated wrapper for callers that still
-   * reference it; new code should call `dispose()` directly so the
-   * host-signal listener is removed unconditionally.
-   */
-  releaseAll() {
-    this.dispose();
+};
+function isJsonRpcError(v) {
+  return typeof v === "object" && v !== null && typeof v.code === "number" && typeof v.message === "string";
+}
+
+// src/client/acp-session-ops.ts
+function filterMcpServers(agentCapabilities, servers) {
+  if (!servers || servers.length === 0) return [];
+  const mcpCaps = agentCapabilities.mcpCapabilities ?? {};
+  return servers.filter((s) => {
+    if ("type" in s && s.type === "http") return mcpCaps.http === true;
+    if ("type" in s && s.type === "sse") return mcpCaps.sse === true;
+    return true;
+  });
+}
+async function executeLoadSession(ctx, sessionId, mcpServers, cwd) {
+  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
+  if (!ctx.agentCapabilities.loadSession) {
+    throw new ACPSessionError(
+      "unsupported_capability",
+      "agent does not support session/load (loadSession capability not advertised)"
+    );
   }
-  resolveCwd(cwd) {
-    if (!cwd) return this.projectRoot;
-    const resolved = path2.resolve(cwd);
-    const rootWithSep = this.projectRoot.endsWith(path2.sep) ? this.projectRoot : this.projectRoot + path2.sep;
-    if (resolved !== this.projectRoot && !resolved.startsWith(rootWithSep)) {
-      return this.projectRoot;
-    }
-    try {
-      const realRoot = realpathSync2(this.projectRoot);
-      const realCwd = realpathSync2(resolved);
-      const realRootWithSep = realRoot.endsWith(path2.sep) ? realRoot : realRoot + path2.sep;
-      if (realCwd !== realRoot && !realCwd.startsWith(realRootWithSep)) {
-        return realRoot;
-      }
-      return realCwd;
-    } catch {
-      return this.projectRoot;
-    }
+  if (ctx.sessionId) {
+    await ctx.closeSession();
   }
-  buildEnv(agentEnv) {
-    const env = buildChildEnv();
-    if (agentEnv) {
-      for (const { name, value } of agentEnv) {
-        const upper = name.toUpperCase();
-        if (DENIED_AGENT_ENV_KEYS.has(upper)) continue;
-        env[name] = value;
-      }
-    }
-    return env;
+  ctx.resetScratch();
+  const servers = filterMcpServers(ctx.agentCapabilities, mcpServers ?? ctx.opts.mcpServers);
+  const id = ctx.allocId();
+  const result = await ctx.sendRequest(id, "session/load", {
+    sessionId,
+    cwd: cwd ?? ctx.opts.cwd ?? ctx.opts.projectRoot,
+    mcpServers: servers
+  });
+  if (isJsonRpcError(result)) {
+    throw new ACPSessionError("prompt_failed", `session/load failed: ${result.message}`, result);
   }
-  /**
-   * Clamp an agent-supplied numeric to a finite positive safe integer, falling
-   * back to `defaultValue` for undefined/NaN/non-finite values. Prevents
-   * negative, NaN, or Infinity values from disabling output caps or causing
-   * unbounded memory growth.
-   */
-  clampFiniteInt(value, defaultValue) {
-    if (value === void 0 || !Number.isFinite(value) || value < 1) {
-      return defaultValue;
-    }
-    return Math.trunc(value);
+  ctx.setSessionId(sessionId);
+}
+async function executeResumeSession(ctx, sessionId, mcpServers, cwd) {
+  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
+  if (!ctx.agentCapabilities.sessionCapabilities?.resume) {
+    throw new ACPSessionError(
+      "unsupported_capability",
+      "agent does not support session/resume (sessionCapabilities.resume not advertised)"
+    );
   }
-};
-var DENIED_AGENT_ENV_KEYS = /* @__PURE__ */ new Set([
-  "NODE_OPTIONS",
-  "LD_PRELOAD",
-  "LD_LIBRARY_PATH",
-  "DYLD_INSERT_LIBRARIES",
-  "DYLD_LIBRARY_PATH",
-  "DYLD_FALLBACK_LIBRARY_PATH",
-  "PATH",
-  "PYTHONPATH",
-  "PYTHONSTARTUP",
-  "PERL5OPT",
-  "PERLLIB",
-  "RUBYOPT",
-  "RUBYLIB"
-]);
-
-// src/client/trust-boundary-permission.ts
-function pickOption(options, allowed) {
-  const kinds = allowed ? ["allow_once", "allow_always"] : ["reject_once", "reject_always"];
-  for (const kind of kinds) {
-    const option = options.find((candidate) => candidate.kind === kind);
-    if (option) return { outcome: "selected", optionId: option.optionId };
+  if (ctx.sessionId) {
+    await ctx.closeSession();
   }
-  return { outcome: "cancelled" };
-}
-function riskFor(kind) {
-  if (kind === "read" || kind === "search" || kind === "fetch" || kind === "think") return "low";
-  if (kind === "edit" || kind === "move") return "elevated";
-  if (kind === "delete" || kind === "execute") return "high";
-  return "elevated";
-}
-function capabilityFor(request) {
-  const raw = request.toolCall.rawInput;
-  if (typeof raw?.path === "string") {
-    return request.toolCall.kind === "read" || request.toolCall.kind === "search" ? "filesystem.read" : "filesystem.write";
+  const servers = filterMcpServers(ctx.agentCapabilities, mcpServers ?? ctx.opts.mcpServers);
+  const id = ctx.allocId();
+  const result = await ctx.sendRequest(id, "session/resume", {
+    sessionId,
+    cwd: cwd ?? ctx.opts.cwd ?? ctx.opts.projectRoot,
+    mcpServers: servers
+  });
+  if (isJsonRpcError(result)) {
+    throw new ACPSessionError("prompt_failed", `session/resume failed: ${result.message}`, result);
   }
-  if (typeof raw?.command === "string" || request.toolCall.kind === "execute")
-    return "process.spawn";
-  if (request.toolCall.kind === "fetch") return "network.fetch";
-  return `tool.${request.toolCall.kind ?? "unknown"}`;
+  ctx.setSessionId(sessionId);
 }
-function subjectFor(request) {
-  const raw = request.toolCall.rawInput;
-  const title = request.toolCall.title ?? `ACP tool call ${String(request.toolCall.toolCallId)}`;
-  if (typeof raw?.path === "string") {
-    return { kind: "path", id: raw.path, attributes: { toolKind: request.toolCall.kind ?? null } };
+async function executeListSessions(ctx, cursor, cwd) {
+  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
+  if (!ctx.agentCapabilities.sessionCapabilities?.list) {
+    throw new ACPSessionError(
+      "unsupported_capability",
+      "agent does not support session/list (sessionCapabilities.list not advertised)"
+    );
   }
-  if (typeof raw?.command === "string") {
-    return {
-      kind: "command",
-      id: raw.command,
-      attributes: { toolKind: request.toolCall.kind ?? null }
-    };
+  const id = ctx.allocId();
+  const params = {};
+  if (cursor !== void 0) params.cursor = cursor;
+  if (cwd !== void 0) params.cwd = cwd;
+  const result = await ctx.sendRequest(id, "session/list", params);
+  if (isJsonRpcError(result)) {
+    throw new ACPSessionError("prompt_failed", `session/list failed: ${result.message}`, result);
   }
+  const r = result;
   return {
-    kind: "resource",
-    id: title,
-    attributes: { toolKind: request.toolCall.kind ?? null }
+    sessions: r.sessions ?? [],
+    nextCursor: r.nextCursor
   };
 }
-function isAllowed(decision) {
-  return decision.kind === "allow" || decision.kind === "scoped-token";
-}
-function toTrustBoundaryRequest(request, options) {
-  const rawSessionId = request.toolCall.rawInput?.sessionId;
-  const sessionId = typeof rawSessionId === "string" && rawSessionId.length > 0 ? rawSessionId : options.actor?.sessionId;
-  return {
-    version: 1,
-    requestId: String(request.toolCall.toolCallId),
-    actor: {
-      ...options.actor ?? { kind: "agent" },
-      ...sessionId ? { sessionId } : {}
-    },
-    surface: "acp",
-    capability: capabilityFor(request),
-    subject: subjectFor(request),
-    risk: riskFor(request.toolCall.kind),
-    scope: {
-      ...options.scope ?? {},
-      ...sessionId ? { sessionId } : {}
-    },
-    ...options.authContext ? { authContext: options.authContext } : {},
-    metadata: {
-      ...request.toolCall.title ? { title: request.toolCall.title } : {},
-      toolKind: request.toolCall.kind ?? null
-    }
-  };
+async function executeDeleteSession(ctx, sessionId) {
+  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
+  if (!ctx.agentCapabilities.sessionCapabilities?.delete) {
+    throw new ACPSessionError(
+      "unsupported_capability",
+      "agent does not support session/delete (sessionCapabilities.delete not advertised)"
+    );
+  }
+  const id = ctx.allocId();
+  const result = await ctx.sendRequest(id, "session/delete", { sessionId });
+  if (isJsonRpcError(result)) {
+    throw new ACPSessionError("prompt_failed", `session/delete failed: ${result.message}`, result);
+  }
+  if (ctx.sessionId === sessionId) {
+    ctx.setSessionId(null);
+  }
 }
-function makeTrustBoundaryPermissionPolicy(options) {
-  return async (request) => {
-    if (request.signal.aborted) return { outcome: "cancelled" };
-    const decision = await options.boundary.evaluate(toTrustBoundaryRequest(request, options));
-    if (request.signal.aborted) return { outcome: "cancelled" };
-    return pickOption(request.options, isAllowed(decision));
-  };
-}
-
-// src/client/websocket-transport.ts
-var WebSocketClientTransport = class {
-  ws = null;
-  handlers = /* @__PURE__ */ new Set();
-  closed = false;
-  opts;
-  maxBufferedBytes;
-  maxMessageChars;
-  constructor(opts) {
-    this.opts = opts;
-    this.maxBufferedBytes = finitePositiveLimit(opts.maxBufferedBytes, 32 * 1024 * 1024);
-    this.maxMessageChars = finitePositiveLimit(opts.maxMessageChars, 20 * 1024 * 1024);
-  }
-  /** Pending start() promise resolve/reject — settled in stop() to avoid leaking. */
-  pendingStart = null;
-  start() {
-    if (this.closed || this.ws !== null || this.pendingStart !== null) {
-      return Promise.reject(new Error("WebSocket transport has already been started or stopped"));
-    }
-    const WS = globalThis.WebSocket;
-    if (!WS) {
-      return Promise.reject(
-        new Error(
-          "global WebSocket is not available \u2014 Node \u2265 22 is required for the remote ACP transport"
-        )
-      );
-    }
-    const timeoutMs = this.opts.handshakeTimeoutMs ?? 3e4;
-    return new Promise((resolve3, reject) => {
-      const ws = new WS(this.opts.url, this.opts.protocols);
-      this.ws = ws;
-      const timer = setTimeout(() => {
-        const pending = this.pendingStart;
-        if (pending === null) return;
-        this.pendingStart = null;
-        this.closed = true;
-        if (this.ws === ws) this.ws = null;
-        this.handlers.clear();
-        try {
-          ws.close();
-        } catch {
-        }
-        pending.reject(new Error(`WebSocket failed to open within ${timeoutMs}ms`));
-      }, timeoutMs);
-      this.pendingStart = { resolve: resolve3, reject, timer };
-      ws.addEventListener("open", () => {
-        const pending = this.pendingStart;
-        if (pending === null) return;
-        this.pendingStart = null;
-        clearTimeout(pending.timer);
-        pending.resolve();
-      });
-      ws.addEventListener("error", (ev) => {
-        const pending = this.pendingStart;
-        if (pending === null) {
-          this.stop();
-          return;
-        }
-        this.pendingStart = null;
-        this.closed = true;
-        if (this.ws === ws) this.ws = null;
-        this.handlers.clear();
-        clearTimeout(pending.timer);
-        const message = ev && typeof ev === "object" && "message" in ev ? String(ev.message) : "WebSocket error";
-        pending.reject(new Error(message));
-      });
-      ws.addEventListener("close", () => {
-        this.closed = true;
-        if (this.ws === ws) this.ws = null;
-        this.handlers.clear();
-        const pending = this.pendingStart;
-        if (pending !== null) {
-          this.pendingStart = null;
-          clearTimeout(pending.timer);
-          pending.reject(new Error("WebSocket closed before the connection opened"));
-        }
-      });
-      ws.addEventListener("message", (ev) => {
-        this.onData(ev.data);
-      });
-    });
+async function executeForkSession(ctx, sourceSessionId, cwd, mcpServers) {
+  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
+  const servers = filterMcpServers(ctx.agentCapabilities, mcpServers ?? ctx.opts.mcpServers);
+  const id = ctx.allocId();
+  const result = await ctx.sendRequest(id, "session/fork", {
+    sessionId: sourceSessionId,
+    cwd: cwd ?? ctx.opts.cwd ?? ctx.opts.projectRoot,
+    ...servers.length > 0 ? { mcpServers: servers } : {}
+  });
+  if (isJsonRpcError(result)) {
+    throw new ACPSessionError("prompt_failed", `session/fork failed: ${result.message}`, result);
   }
-  send(msg) {
-    if (this.closed || !this.ws) {
-      return Promise.reject(new Error("WebSocket transport is not open"));
-    }
-    try {
-      const serialized = JSON.stringify(msg);
-      const buffered = Number.isFinite(this.ws.bufferedAmount) ? this.ws.bufferedAmount : 0;
-      if (buffered + Buffer.byteLength(serialized, "utf8") > this.maxBufferedBytes) {
-        this.stop();
-        return Promise.reject(new Error("WebSocket transport send buffer limit exceeded"));
-      }
-      this.ws.send(serialized);
-      return Promise.resolve();
-    } catch (err) {
-      return Promise.reject(err instanceof Error ? err : new Error(String(err)));
-    }
+  const newId = result.sessionId;
+  if (typeof newId !== "string" || !newId) {
+    throw new ACPSessionError("protocol_error", "session/fork returned no sessionId", result);
   }
-  onMessage(handler) {
-    this.handlers.add(handler);
-    return () => this.handlers.delete(handler);
+  return newId;
+}
+async function executeSetMode(ctx, sessionId, modeId) {
+  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
+  const id = ctx.allocId();
+  const result = await ctx.sendRequest(id, "session/set_mode", { sessionId, modeId });
+  if (isJsonRpcError(result)) {
+    throw new ACPSessionError(
+      "prompt_failed",
+      `session/set_mode failed: ${result.message}`,
+      result
+    );
   }
-  stop() {
-    this.closed = true;
-    this.handlers.clear();
-    if (this.pendingStart !== null) {
-      const pending = this.pendingStart;
-      this.pendingStart = null;
-      clearTimeout(pending.timer);
-      try {
-        pending.reject(new Error("WebSocket transport stopped while connecting"));
-      } catch {
-      }
-    }
-    if (this.ws) {
-      try {
-        this.ws.close();
-      } catch {
-      }
-      this.ws = null;
-    }
+}
+async function executeSetConfigOption(ctx, sessionId, configId, value) {
+  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
+  const id = ctx.allocId();
+  const result = await ctx.sendRequest(id, "session/set_config_option", {
+    sessionId,
+    configId,
+    value
+  });
+  if (isJsonRpcError(result)) {
+    throw new ACPSessionError(
+      "prompt_failed",
+      `session/set_config_option failed: ${result.message}`,
+      result
+    );
   }
-  onData(data) {
-    const text = typeof data === "string" ? data : data instanceof ArrayBuffer ? Buffer.from(data).toString("utf8") : Buffer.isBuffer(data) ? data.toString("utf8") : String(data);
-    if (text.length > this.maxMessageChars) {
-      this.stop();
-      return;
-    }
-    if (!text.trim()) return;
-    let msg;
-    try {
-      msg = JSON.parse(text);
-    } catch {
-      for (const line of text.split("\n")) {
-        if (!line.trim()) continue;
-        try {
-          this.dispatch(JSON.parse(line));
-        } catch {
-        }
-      }
-      return;
-    }
-    this.dispatch(msg);
+}
+async function executeListProviders(ctx) {
+  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
+  const id = ctx.allocId();
+  const result = await ctx.sendRequest(id, "providers/list", {});
+  if (isJsonRpcError(result)) {
+    throw new ACPSessionError("prompt_failed", `providers/list failed: ${result.message}`, result);
   }
-  dispatch(msg) {
-    for (const handler of [...this.handlers]) {
-      try {
-        handler(msg);
-      } catch {
-      }
-    }
+  const r = result;
+  return { providers: r.providers ?? [], currentProviderId: r.currentProviderId ?? null };
+}
+async function executeSetProvider(ctx, providerId, config) {
+  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
+  const id = ctx.allocId();
+  const result = await ctx.sendRequest(id, "providers/set", { providerId, ...config ?? {} });
+  if (isJsonRpcError(result)) {
+    throw new ACPSessionError("prompt_failed", `providers/set failed: ${result.message}`, result);
   }
-};
-function finitePositiveLimit(value, fallback) {
-  return value !== void 0 && Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
 }
-
-// src/client/acp-session-errors.ts
-var ACPSessionError = class extends Error {
-  kind;
-  cause;
-  constructor(kind, message, cause) {
-    super(message);
-    this.name = "ACPSessionError";
-    this.kind = kind;
-    this.cause = cause;
+async function executeDisableProvider(ctx) {
+  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
+  const id = ctx.allocId();
+  const result = await ctx.sendRequest(id, "providers/disable", {});
+  if (isJsonRpcError(result)) {
+    throw new ACPSessionError(
+      "prompt_failed",
+      `providers/disable failed: ${result.message}`,
+      result
+    );
   }
-};
-function isJsonRpcError(v) {
-  return typeof v === "object" && v !== null && typeof v.code === "number" && typeof v.message === "string";
 }
-
-// src/client/acp-session-updates.ts
-function createSessionScratch() {
-  return { text: "", thoughts: "", toolCalls: /* @__PURE__ */ new Map(), diffs: [] };
+async function executeMcpMessage(ctx, connectionId, message) {
+  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
+  const id = ctx.allocId();
+  const result = await ctx.sendRequest(id, "mcp/message", { connectionId, message });
+  if (isJsonRpcError(result)) {
+    throw new ACPSessionError("prompt_failed", `mcp/message failed: ${result.message}`, result);
+  }
+  return result;
 }
-function handleAcpSessionUpdate(msg, scratch, emitProgress) {
-  const update = msg.params?.update;
-  if (typeof update !== "object" || update === null) return;
-  const u = update;
-  emitProgress({ type: "raw", update: u });
-  switch (u.sessionUpdate) {
+async function executeCreateSession(ctx) {
+  const servers = filterMcpServers(ctx.agentCapabilities, ctx.opts.mcpServers);
+  const id = ctx.allocId();
+  const result = await ctx.sendRequest(id, "session/new", {
+    cwd: ctx.opts.cwd ?? ctx.opts.projectRoot,
+    mcpServers: servers
+  });
+  if (isJsonRpcError(result)) {
+    throw new ACPSessionError(
+      "session_create_failed",
+      `session/new failed: ${result.message}`,
+      result
+    );
+  }
+  const sessionId = result.sessionId;
+  if (typeof sessionId !== "string" || sessionId.length === 0) {
+    throw new ACPSessionError("protocol_error", "session/new returned no sessionId", result);
+  }
+  return sessionId;
+}
+
+// src/client/acp-session-updates.ts
+function createSessionScratch() {
+  return { text: "", thoughts: "", toolCalls: /* @__PURE__ */ new Map(), diffs: [] };
+}
+function handleAcpSessionUpdate(msg, scratch, emitProgress) {
+  const update = msg.params?.update;
+  if (typeof update !== "object" || update === null) return;
+  const u = update;
+  emitProgress({ type: "raw", update: u });
+  switch (u.sessionUpdate) {
     case "agent_message_chunk": {
       const text = extractText(u.content);
       if (text) {
@@ -1166,454 +1013,593 @@ function captureToolCall(u, isNew, scratch, emitProgress) {
   });
 }
 
-// src/client/acp-session-callbacks.ts
-var DEFAULT_PERMISSION_TIMEOUT_MS = 6e4;
-async function handleAcpPermissionRequest(msg, permissionPolicy, sender, callbackOptions = {}) {
-  const id = msg.id;
-  if (id === void 0) return;
-  const params = msg.params;
-  const toolCall = params?.toolCall;
-  const permissionOptions = Array.isArray(params?.options) ? params.options : [];
-  if (!toolCall) {
-    await sender.sendErrorResponse(id, -32602, "toolCall is required");
-    return;
+// src/client/permission.ts
+function pickAllow(options) {
+  const ranked = [...options].sort((a, b) => {
+    const score = (k) => {
+      if (k === "allow_once") return 0;
+      if (k === "allow_always") return 1;
+      if (k === "reject_once") return 2;
+      return 3;
+    };
+    return score(a.kind) - score(b.kind);
+  });
+  const chosen = ranked[0];
+  if (!chosen || chosen.kind === "reject_once" || chosen.kind === "reject_always") {
+    return { outcome: "cancelled" };
   }
-  try {
-    const outcome = await runPermissionWithDeadline(
-      permissionPolicy,
-      {
-        toolCall,
-        options: permissionOptions
-      },
-      callbackOptions
-    );
-    await sender.sendResult(id, { outcome });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    const code = isAbortLikeError(err) ? -32800 : -32603;
-    await sender.sendErrorResponse(id, code, `permission policy failed: ${message}`);
+  return { outcome: "selected", optionId: chosen.optionId };
+}
+function pickReject(options) {
+  const reject = options.find((o) => o.kind === "reject_once" || o.kind === "reject_always");
+  return reject ? { outcome: "selected", optionId: reject.optionId } : { outcome: "cancelled" };
+}
+var READ_ONLY_KINDS = /* @__PURE__ */ new Set(["read", "search", "fetch", "think"]);
+var defaultPermissionPolicy = async (req) => {
+  if (req.signal.aborted) return { outcome: "cancelled" };
+  return pickAllow(req.options);
+};
+var readOnlyPermissionPolicy = async (req) => {
+  if (req.signal.aborted) return { outcome: "cancelled" };
+  const kind = req.toolCall.kind;
+  if (kind && READ_ONLY_KINDS.has(kind)) {
+    return pickAllow(req.options);
   }
+  return pickReject(req.options);
+};
+function makePermissionPolicy(decide) {
+  return async (req) => {
+    if (req.signal.aborted) return { outcome: "cancelled" };
+    const allow = await decide(req);
+    return allow ? pickAllow(req.options) : pickReject(req.options);
+  };
 }
-async function handleAcpFsRequest(msg, fileServer, permissionPolicy, sender, callbackOptions = {}) {
-  const id = msg.id;
-  if (id === void 0) return;
-  const params = msg.params;
-  if (!params?.path) {
-    await sender.sendErrorResponse(id, -32602, "path is required");
-    return;
+
+// src/client/terminal-server.ts
+import { spawn } from "node:child_process";
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { realpathSync as realpathSync2 } from "node:fs";
+import * as path2 from "node:path";
+import { buildChildEnv } from "@wrongstack/core/utils";
+import { treeKill as treeKill2 } from "@wrongstack/core/utils/tree-kill";
+var EMPTY_BUFFER = Buffer.alloc(0);
+var DEBUG_DISPOSE = typeof process !== "undefined" && !!process.env?.WRONGSTACK_DEBUG && process.env.WRONGSTACK_DEBUG !== "0" && process.env.WRONGSTACK_DEBUG !== "false";
+var TerminalServer = class {
+  terminals = /* @__PURE__ */ new Map();
+  /**
+   * Stable per-instance identifier for debug logs. 8 hex chars is enough
+   * to disambiguate concurrent TerminalServers in a trace; not meant to
+   * be cryptographically unique.
+   */
+  instanceId;
+  projectRoot;
+  commandTimeoutMs;
+  outputByteLimit;
+  maxOutputByteLimit;
+  maxTerminals;
+  abortSignal;
+  abortHandler = () => this.dispose();
+  disposed = false;
+  nextId = 1;
+  constructor(opts) {
+    this.projectRoot = path2.resolve(opts.projectRoot);
+    this.commandTimeoutMs = opts.commandTimeoutMs ?? 5 * 6e4;
+    this.outputByteLimit = opts.outputByteLimit ?? 1024 * 1024;
+    this.maxOutputByteLimit = opts.maxOutputByteLimit ?? 16 * 1024 * 1024;
+    this.instanceId = `term_srv_${randomBytes2(4).toString("hex")}`;
+    this.maxTerminals = this.clampFiniteInt(opts.maxTerminals, 32);
+    this.abortSignal = opts.signal;
+    if (opts.signal) {
+      opts.signal.addEventListener("abort", this.abortHandler, { once: true });
+    }
   }
-  if (msg.method === "fs/write_text_file") {
-    const authorization = await authorizeAcpCallback(
-      permissionPolicy,
-      {
-        toolCallId: `acp-fs-write-${id}`,
-        title: `Write file: ${params.path}`,
-        kind: "edit",
-        rawInput: { path: params.path, sessionId: params.sessionId }
-      },
-      callbackOptions
-    );
-    if (authorization !== "allowed") {
-      const isCancelled = authorization === "cancelled";
-      await sender.sendErrorResponse(
-        id,
-        isCancelled ? -32800 : -32602,
-        isCancelled ? "filesystem write permission request cancelled or timed out" : "filesystem write denied by permission policy"
+  /** Spawn a new terminal. Returns the agent-facing id. */
+  create(params) {
+    if (this.disposed) {
+      throw new Error(
+        "TerminalServer is disposed \u2014 create a new TerminalServer instead of reusing this one"
       );
-      return;
     }
-  }
-  try {
-    if (msg.method === "fs/read_text_file") {
-      const result = await fileServer.readTextFile({
-        sessionId: params.sessionId ?? "",
-        path: params.path
-      });
-      await sender.sendResult(id, result);
-    } else {
-      await fileServer.writeTextFile({
-        sessionId: params.sessionId ?? "",
-        path: params.path,
-        content: params.content ?? ""
-      });
-      await sender.sendResult(id, {});
+    if (this.terminals.size >= this.maxTerminals) {
+      throw new Error(
+        `terminal limit reached (${this.maxTerminals}); release an existing terminal before creating another`
+      );
     }
-  } catch (err) {
-    const code = err instanceof FsError ? -32602 : -32603;
-    const message = err instanceof Error ? err.message : String(err);
-    await sender.sendErrorResponse(id, code, message);
-  }
-}
-async function handleAcpTerminalRequest(msg, terminalServer, permissionPolicy, sender, callbackOptions = {}) {
-  const id = msg.id;
-  if (id === void 0) return;
-  const params = msg.params ?? {};
-  try {
-    switch (msg.method) {
-      case "terminal/create": {
-        const authorization = await authorizeAcpCallback(
-          permissionPolicy,
-          {
-            toolCallId: `acp-terminal-create-${id}`,
-            title: `Run command: ${String(params.command ?? "")} ${(Array.isArray(params.args) ? params.args : []).join(" ")}`.trim(),
-            kind: "execute",
-            rawInput: {
-              command: params.command,
-              args: params.args,
-              cwd: params.cwd,
-              sessionId: params.sessionId
-            }
-          },
-          callbackOptions
-        );
-        if (authorization !== "allowed") {
-          const isCancelled = authorization === "cancelled";
-          await sender.sendErrorResponse(
-            id,
-            isCancelled ? -32800 : -32602,
-            isCancelled ? "terminal create permission request cancelled or timed out" : "terminal create denied by permission policy"
-          );
-          return;
-        }
-        const createOpts = {
-          sessionId: String(params.sessionId ?? ""),
-          command: String(params.command ?? ""),
-          args: Array.isArray(params.args) ? params.args : []
-        };
-        if (Array.isArray(params.env)) {
-          createOpts.env = params.env;
-        }
-        if (typeof params.cwd === "string") {
-          createOpts.cwd = params.cwd;
-        }
-        if (typeof params.outputByteLimit === "number") {
-          createOpts.outputByteLimit = params.outputByteLimit;
+    const id = `term_${this.nextId++}`;
+    const cwd = this.resolveCwd(params.cwd);
+    const perCallByteLimit = Math.min(
+      Math.max(1, this.clampFiniteInt(params.outputByteLimit, this.outputByteLimit)),
+      this.maxOutputByteLimit
+    );
+    const proc = spawn(params.command, params.args ?? [], {
+      cwd,
+      env: this.buildEnv(params.env),
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true
+      // shell: false on purpose. The terminal server is invoked with
+      // the agent's explicit argv; turning on shell-mode would make
+      // the command a single shell-parsed string, which breaks
+      // Windows cmd quoting for the common case of running node with
+      // `-e "<script>"`. If a future feature needs shell features
+      // (pipes, redirects), it should be opt-in per-call, not the
+      // default.
+    });
+    const state = {
+      proc,
+      cwd,
+      command: params.command,
+      args: params.args ?? [],
+      outputChunks: [],
+      outputHead: 0,
+      retainedBytes: 0,
+      truncated: false,
+      exitStatus: void 0,
+      timeoutHandle: null,
+      exitPromise: new Promise((resolve3) => {
+        proc.on("close", (code, signalName) => {
+          if (state.timeoutHandle) {
+            clearTimeout(state.timeoutHandle);
+            state.timeoutHandle = null;
+          }
+          const exitStatus = {
+            exitCode: typeof code === "number" ? code : null,
+            signal: typeof signalName === "string" ? signalName : null
+          };
+          state.exitStatus = exitStatus;
+          resolve3(exitStatus);
+        });
+        proc.on("error", (err) => {
+          if (state.timeoutHandle) {
+            clearTimeout(state.timeoutHandle);
+            state.timeoutHandle = null;
+          }
+          const exitStatus = { exitCode: 127, signal: null };
+          state.exitStatus = exitStatus;
+          let errorOutput = Buffer.from(`[spawn error] ${err.message}
+`, "utf8");
+          if (errorOutput.length > perCallByteLimit) {
+            let start = errorOutput.length - perCallByteLimit;
+            while (start < errorOutput.length && (errorOutput[start] & 192) === 128) start++;
+            errorOutput = errorOutput.subarray(start);
+            state.truncated = true;
+          }
+          state.outputChunks.push(errorOutput);
+          state.retainedBytes = errorOutput.length;
+          resolve3(exitStatus);
+        });
+      })
+    };
+    proc.stdout?.setEncoding("utf8");
+    proc.stderr?.setEncoding("utf8");
+    const onData = (chunk) => {
+      const outputChunk = Buffer.from(chunk, "utf8");
+      state.outputChunks.push(outputChunk);
+      state.retainedBytes += outputChunk.length;
+      if (state.retainedBytes > perCallByteLimit) state.truncated = true;
+      while (state.retainedBytes > perCallByteLimit && state.outputHead < state.outputChunks.length) {
+        const first = state.outputChunks[state.outputHead];
+        const overflow = state.retainedBytes - perCallByteLimit;
+        if (first.length <= overflow) {
+          state.outputChunks[state.outputHead] = EMPTY_BUFFER;
+          state.outputHead++;
+          state.retainedBytes -= first.length;
+          continue;
         }
-        const result = terminalServer.create(createOpts);
-        await sender.sendResult(id, result);
-        return;
-      }
-      case "terminal/output": {
-        const terminalId = String(params.terminalId ?? "");
-        const out = terminalServer.output(terminalId);
-        await sender.sendResult(id, out);
-        return;
-      }
-      case "terminal/wait_for_exit": {
-        const terminalId = String(params.terminalId ?? "");
-        const exit = await terminalServer.waitForExit(terminalId);
-        await sender.sendResult(id, exit);
-        return;
-      }
-      case "terminal/kill": {
-        const terminalId = String(params.terminalId ?? "");
-        terminalServer.kill(terminalId);
-        await sender.sendResult(id, {});
-        return;
+        let start = overflow;
+        while (start < first.length && (first[start] & 192) === 128) start++;
+        state.outputChunks[state.outputHead] = first.subarray(start);
+        state.retainedBytes -= start;
       }
-      case "terminal/release": {
-        const terminalId = String(params.terminalId ?? "");
-        terminalServer.release(terminalId);
-        await sender.sendResult(id, {});
-        return;
+      if (state.outputHead >= 256 && state.outputHead * 2 >= state.outputChunks.length) {
+        state.outputChunks = state.outputChunks.slice(state.outputHead);
+        state.outputHead = 0;
       }
-      default:
-        await sender.sendErrorResponse(id, -32601, `unknown method: ${msg.method}`);
+    };
+    state.onData = onData;
+    proc.stdout?.on("data", onData);
+    proc.stderr?.on("data", onData);
+    state.timeoutHandle = setTimeout(() => {
+      treeKill2(proc);
+    }, this.commandTimeoutMs);
+    this.terminals.set(id, state);
+    return { terminalId: id };
+  }
+  /** Return captured output and (if available) the exit status. */
+  output(terminalId) {
+    const state = this.terminals.get(terminalId);
+    if (!state) throw new Error(`unknown terminal: ${terminalId}`);
+    return {
+      output: Buffer.concat(
+        state.outputChunks.slice(state.outputHead),
+        state.retainedBytes
+      ).toString("utf8"),
+      truncated: state.truncated,
+      ...state.exitStatus ? { exitStatus: state.exitStatus } : {}
+    };
+  }
+  /** Block until the process exits. Resolves with the exit status. */
+  async waitForExit(terminalId) {
+    const state = this.terminals.get(terminalId);
+    if (!state) throw new Error(`unknown terminal: ${terminalId}`);
+    return state.exitPromise;
+  }
+  /**
+   * Kill the process but keep the terminal record (agent can still read output).
+   * On POSIX this signals only the direct child; descendants may survive because
+   * terminal processes are not spawned as process-group leaders.
+   */
+  kill(terminalId) {
+    const state = this.terminals.get(terminalId);
+    if (!state) throw new Error(`unknown terminal: ${terminalId}`);
+    treeKill2(state.proc);
+  }
+  /** Kill the process if alive and remove the record. */
+  release(terminalId) {
+    const state = this.terminals.get(terminalId);
+    if (!state) return;
+    if (state.timeoutHandle) {
+      clearTimeout(state.timeoutHandle);
+      state.timeoutHandle = null;
     }
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    await sender.sendErrorResponse(id, -32603, message);
+    if (state.onData) {
+      state.proc.stdout?.off("data", state.onData);
+      state.proc.stderr?.off("data", state.onData);
+      state.onData = void 0;
+    }
+    state.proc.stdout?.destroy?.();
+    state.proc.stderr?.destroy?.();
+    state.outputChunks.length = 0;
+    state.outputHead = 0;
+    state.retainedBytes = 0;
+    treeKill2(state.proc, { force: true });
+    this.terminals.delete(terminalId);
   }
-}
-async function authorizeAcpCallback(permissionPolicy, partial, callbackOptions) {
-  try {
-    const outcome = await runPermissionWithDeadline(
-      permissionPolicy,
-      {
-        toolCall: {
-          sessionUpdate: "tool_call_update",
-          toolCallId: partial.toolCallId,
-          title: partial.title,
-          kind: partial.kind,
-          status: "pending",
-          ...partial.rawInput ? { rawInput: partial.rawInput } : {}
-        },
-        options: [
-          { optionId: "allow", name: "Allow", kind: "allow_once" },
-          { optionId: "reject", name: "Reject", kind: "reject_once" }
-        ]
-      },
-      callbackOptions
-    );
-    return outcome.outcome === "selected" && outcome.optionId !== "reject" && outcome.optionId !== "reject_once" && outcome.optionId !== "reject_always" ? "allowed" : "denied";
-  } catch (err) {
-    return isAbortLikeError(err) ? "cancelled" : "denied";
+  /**
+   * Release all resources held by this server: kill every active terminal
+   * and detach the host `AbortSignal` listener.
+   *
+   * Idempotent — calling it multiple times is safe. Required because the
+   * previously-coded `releaseAll()` was the only path that removed the
+   * abort listener: if the host never called it (unhandled error path,
+   * host crash, GC of the session without explicit close), the listener
+   * pinned `this` (terminals Map, output buffers) for the lifetime of the
+   * signal. With `dispose()` this is no longer leak-prone.
+   *
+   * Also exposed as `[Symbol.dispose]` for `using` blocks in Node ≥ 22.
+   *
+   * RAM-leak audit 2026-08-11, MEDIUM (Finding 2).
+   */
+  dispose() {
+    if (this.disposed) return;
+    if (DEBUG_DISPOSE) {
+      const activeChildren = this.terminals.size;
+      console.debug(
+        JSON.stringify({
+          event: "terminal_server.disposed",
+          instanceId: this.instanceId,
+          activeChildren,
+          hadSignal: this.abortSignal !== void 0,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        })
+      );
+    }
+    this.disposed = true;
+    this.abortSignal?.removeEventListener("abort", this.abortHandler);
+    for (const id of [...this.terminals.keys()]) {
+      this.release(id);
+    }
+  }
+  /** Alias for `dispose()` — enables `using new TerminalServer(...)`. */
+  [Symbol.dispose]() {
+    this.dispose();
+  }
+  /**
+   * Kill all active terminals. Used on session close.
+   *
+   * @deprecated Prefer `dispose()` (or `using { … }` via `Symbol.dispose`).
+   * `releaseAll` is retained as a delegated wrapper for callers that still
+   * reference it; new code should call `dispose()` directly so the
+   * host-signal listener is removed unconditionally.
+   */
+  releaseAll() {
+    this.dispose();
   }
-}
-async function runPermissionWithDeadline(permissionPolicy, call, callbackOptions) {
-  const timeoutMs = resolvePermissionDeadline(callbackOptions.permissionTimeoutMs);
-  const controller = new AbortController();
-  const abort = () => controller.abort();
-  const timer = timeoutMs === null ? null : setTimeout(abort, timeoutMs);
-  let removeAbort;
-  if (callbackOptions.signal) {
-    if (callbackOptions.signal.aborted) {
-      abort();
-    } else {
-      callbackOptions.signal.addEventListener("abort", abort, { once: true });
-      removeAbort = () => callbackOptions.signal?.removeEventListener("abort", abort);
+  resolveCwd(cwd) {
+    if (!cwd) return this.projectRoot;
+    const resolved = path2.resolve(cwd);
+    const rootWithSep = this.projectRoot.endsWith(path2.sep) ? this.projectRoot : this.projectRoot + path2.sep;
+    if (resolved !== this.projectRoot && !resolved.startsWith(rootWithSep)) {
+      return this.projectRoot;
+    }
+    try {
+      const realRoot = realpathSync2(this.projectRoot);
+      const realCwd = realpathSync2(resolved);
+      const realRootWithSep = realRoot.endsWith(path2.sep) ? realRoot : realRoot + path2.sep;
+      if (realCwd !== realRoot && !realCwd.startsWith(realRootWithSep)) {
+        return realRoot;
+      }
+      return realCwd;
+    } catch {
+      return this.projectRoot;
     }
   }
-  try {
-    return await Promise.race([
-      permissionPolicy({
-        toolCall: call.toolCall,
-        options: call.options,
-        signal: controller.signal
-      }),
-      rejectOnAbort(controller.signal)
-    ]);
-  } finally {
-    if (timer !== null) clearTimeout(timer);
-    removeAbort?.();
-  }
-}
-function rejectOnAbort(signal) {
-  return new Promise((_, reject) => {
-    const rejectAbort = () => reject(new Error("permission request cancelled or timed out"));
-    if (signal.aborted) {
-      rejectAbort();
-      return;
+  buildEnv(agentEnv) {
+    const env = buildChildEnv();
+    if (agentEnv) {
+      for (const { name, value } of agentEnv) {
+        const upper = name.toUpperCase();
+        if (DENIED_AGENT_ENV_KEYS.has(upper)) continue;
+        env[name] = value;
+      }
     }
-    signal.addEventListener("abort", rejectAbort, { once: true });
-  });
-}
-function isAbortLikeError(err) {
-  return err instanceof Error && /cancelled|canceled|timed out|aborted/i.test(err.message);
-}
-function resolvePermissionDeadline(value) {
-  if (value === Number.POSITIVE_INFINITY) return null;
-  if (value !== void 0 && Number.isFinite(value) && value > 0) return Math.trunc(value);
-  return DEFAULT_PERMISSION_TIMEOUT_MS;
-}
-
-// src/client/acp-message-routing.ts
-function isBestEffortAckMethod(method) {
-  return method === "mcp/connect" || method === "mcp/message" || method === "mcp/disconnect" || method === "elicitation/create" || method === "elicitation/complete";
-}
-
-// src/client/acp-session-ops.ts
-function filterMcpServers(agentCapabilities, servers) {
-  if (!servers || servers.length === 0) return [];
-  const mcpCaps = agentCapabilities.mcpCapabilities ?? {};
-  return servers.filter((s) => {
-    if ("type" in s && s.type === "http") return mcpCaps.http === true;
-    if ("type" in s && s.type === "sse") return mcpCaps.sse === true;
-    return true;
-  });
-}
-async function executeLoadSession(ctx, sessionId, mcpServers, cwd) {
-  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
-  if (!ctx.agentCapabilities.loadSession) {
-    throw new ACPSessionError(
-      "unsupported_capability",
-      "agent does not support session/load (loadSession capability not advertised)"
-    );
+    return env;
   }
-  if (ctx.sessionId) {
-    await ctx.closeSession();
+  /**
+   * Clamp an agent-supplied numeric to a finite positive safe integer, falling
+   * back to `defaultValue` for undefined/NaN/non-finite values. Prevents
+   * negative, NaN, or Infinity values from disabling output caps or causing
+   * unbounded memory growth.
+   */
+  clampFiniteInt(value, defaultValue) {
+    if (value === void 0 || !Number.isFinite(value) || value < 1) {
+      return defaultValue;
+    }
+    return Math.trunc(value);
   }
-  ctx.resetScratch();
-  const servers = filterMcpServers(ctx.agentCapabilities, mcpServers ?? ctx.opts.mcpServers);
-  const id = ctx.allocId();
-  const result = await ctx.sendRequest(id, "session/load", {
-    sessionId,
-    cwd: cwd ?? ctx.opts.cwd ?? ctx.opts.projectRoot,
-    mcpServers: servers
-  });
-  if (isJsonRpcError(result)) {
-    throw new ACPSessionError("prompt_failed", `session/load failed: ${result.message}`, result);
+};
+var DENIED_AGENT_ENV_KEYS = /* @__PURE__ */ new Set([
+  "NODE_OPTIONS",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "DYLD_INSERT_LIBRARIES",
+  "DYLD_LIBRARY_PATH",
+  "DYLD_FALLBACK_LIBRARY_PATH",
+  "PATH",
+  "PYTHONPATH",
+  "PYTHONSTARTUP",
+  "PERL5OPT",
+  "PERLLIB",
+  "RUBYOPT",
+  "RUBYLIB"
+]);
+
+// src/client/trust-boundary-permission.ts
+function pickOption(options, allowed) {
+  const kinds = allowed ? ["allow_once", "allow_always"] : ["reject_once", "reject_always"];
+  for (const kind of kinds) {
+    const option = options.find((candidate) => candidate.kind === kind);
+    if (option) return { outcome: "selected", optionId: option.optionId };
   }
-  ctx.setSessionId(sessionId);
+  return { outcome: "cancelled" };
 }
-async function executeResumeSession(ctx, sessionId, mcpServers, cwd) {
-  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
-  if (!ctx.agentCapabilities.sessionCapabilities?.resume) {
-    throw new ACPSessionError(
-      "unsupported_capability",
-      "agent does not support session/resume (sessionCapabilities.resume not advertised)"
-    );
-  }
-  if (ctx.sessionId) {
-    await ctx.closeSession();
-  }
-  const servers = filterMcpServers(ctx.agentCapabilities, mcpServers ?? ctx.opts.mcpServers);
-  const id = ctx.allocId();
-  const result = await ctx.sendRequest(id, "session/resume", {
-    sessionId,
-    cwd: cwd ?? ctx.opts.cwd ?? ctx.opts.projectRoot,
-    mcpServers: servers
-  });
-  if (isJsonRpcError(result)) {
-    throw new ACPSessionError(
-      "prompt_failed",
-      `session/resume failed: ${result.message}`,
-      result
-    );
+function riskFor(kind) {
+  if (kind === "read" || kind === "search" || kind === "fetch" || kind === "think") return "low";
+  if (kind === "edit" || kind === "move") return "elevated";
+  if (kind === "delete" || kind === "execute") return "high";
+  return "elevated";
+}
+function capabilityFor(request) {
+  const raw = request.toolCall.rawInput;
+  if (typeof raw?.path === "string") {
+    return request.toolCall.kind === "read" || request.toolCall.kind === "search" ? "filesystem.read" : "filesystem.write";
   }
-  ctx.setSessionId(sessionId);
+  if (typeof raw?.command === "string" || request.toolCall.kind === "execute")
+    return "process.spawn";
+  if (request.toolCall.kind === "fetch") return "network.fetch";
+  return `tool.${request.toolCall.kind ?? "unknown"}`;
 }
-async function executeListSessions(ctx, cursor, cwd) {
-  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
-  if (!ctx.agentCapabilities.sessionCapabilities?.list) {
-    throw new ACPSessionError(
-      "unsupported_capability",
-      "agent does not support session/list (sessionCapabilities.list not advertised)"
-    );
+function subjectFor(request) {
+  const raw = request.toolCall.rawInput;
+  const title = request.toolCall.title ?? `ACP tool call ${String(request.toolCall.toolCallId)}`;
+  if (typeof raw?.path === "string") {
+    return { kind: "path", id: raw.path, attributes: { toolKind: request.toolCall.kind ?? null } };
   }
-  const id = ctx.allocId();
-  const params = {};
-  if (cursor !== void 0) params.cursor = cursor;
-  if (cwd !== void 0) params.cwd = cwd;
-  const result = await ctx.sendRequest(id, "session/list", params);
-  if (isJsonRpcError(result)) {
-    throw new ACPSessionError("prompt_failed", `session/list failed: ${result.message}`, result);
+  if (typeof raw?.command === "string") {
+    return {
+      kind: "command",
+      id: raw.command,
+      attributes: { toolKind: request.toolCall.kind ?? null }
+    };
   }
-  const r = result;
   return {
-    sessions: r.sessions ?? [],
-    nextCursor: r.nextCursor
+    kind: "resource",
+    id: title,
+    attributes: { toolKind: request.toolCall.kind ?? null }
   };
 }
-async function executeDeleteSession(ctx, sessionId) {
-  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
-  if (!ctx.agentCapabilities.sessionCapabilities?.delete) {
-    throw new ACPSessionError(
-      "unsupported_capability",
-      "agent does not support session/delete (sessionCapabilities.delete not advertised)"
-    );
-  }
-  const id = ctx.allocId();
-  const result = await ctx.sendRequest(id, "session/delete", { sessionId });
-  if (isJsonRpcError(result)) {
-    throw new ACPSessionError(
-      "prompt_failed",
-      `session/delete failed: ${result.message}`,
-      result
-    );
-  }
-  if (ctx.sessionId === sessionId) {
-    ctx.setSessionId(null);
-  }
+function isAllowed(decision) {
+  return decision.kind === "allow" || decision.kind === "scoped-token";
 }
-async function executeForkSession(ctx, sourceSessionId, cwd, mcpServers) {
-  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
-  const servers = filterMcpServers(ctx.agentCapabilities, mcpServers ?? ctx.opts.mcpServers);
-  const id = ctx.allocId();
-  const result = await ctx.sendRequest(id, "session/fork", {
-    sessionId: sourceSessionId,
-    cwd: cwd ?? ctx.opts.cwd ?? ctx.opts.projectRoot,
-    ...servers.length > 0 ? { mcpServers: servers } : {}
-  });
-  if (isJsonRpcError(result)) {
-    throw new ACPSessionError("prompt_failed", `session/fork failed: ${result.message}`, result);
-  }
-  const newId = result.sessionId;
-  if (typeof newId !== "string" || !newId) {
-    throw new ACPSessionError("protocol_error", "session/fork returned no sessionId", result);
-  }
-  return newId;
+function toTrustBoundaryRequest(request, options) {
+  const rawSessionId = request.toolCall.rawInput?.sessionId;
+  const sessionId = typeof rawSessionId === "string" && rawSessionId.length > 0 ? rawSessionId : options.actor?.sessionId;
+  return {
+    version: 1,
+    requestId: String(request.toolCall.toolCallId),
+    actor: {
+      ...options.actor ?? { kind: "agent" },
+      ...sessionId ? { sessionId } : {}
+    },
+    surface: "acp",
+    capability: capabilityFor(request),
+    subject: subjectFor(request),
+    risk: riskFor(request.toolCall.kind),
+    scope: {
+      ...options.scope ?? {},
+      ...sessionId ? { sessionId } : {}
+    },
+    ...options.authContext ? { authContext: options.authContext } : {},
+    metadata: {
+      ...request.toolCall.title ? { title: request.toolCall.title } : {},
+      toolKind: request.toolCall.kind ?? null
+    }
+  };
 }
-async function executeSetMode(ctx, sessionId, modeId) {
-  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
-  const id = ctx.allocId();
-  const result = await ctx.sendRequest(id, "session/set_mode", { sessionId, modeId });
-  if (isJsonRpcError(result)) {
-    throw new ACPSessionError(
-      "prompt_failed",
-      `session/set_mode failed: ${result.message}`,
-      result
-    );
-  }
+function makeTrustBoundaryPermissionPolicy(options) {
+  return async (request) => {
+    if (request.signal.aborted) return { outcome: "cancelled" };
+    const decision = await options.boundary.evaluate(toTrustBoundaryRequest(request, options));
+    if (request.signal.aborted) return { outcome: "cancelled" };
+    return pickOption(request.options, isAllowed(decision));
+  };
 }
-async function executeSetConfigOption(ctx, sessionId, configId, value) {
-  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
-  const id = ctx.allocId();
-  const result = await ctx.sendRequest(id, "session/set_config_option", {
-    sessionId,
-    configId,
-    value
-  });
-  if (isJsonRpcError(result)) {
-    throw new ACPSessionError(
-      "prompt_failed",
-      `session/set_config_option failed: ${result.message}`,
-      result
-    );
+
+// src/client/websocket-transport.ts
+var WebSocketClientTransport = class {
+  ws = null;
+  handlers = /* @__PURE__ */ new Set();
+  closed = false;
+  opts;
+  maxBufferedBytes;
+  maxMessageChars;
+  constructor(opts) {
+    this.opts = opts;
+    this.maxBufferedBytes = finitePositiveLimit(opts.maxBufferedBytes, 32 * 1024 * 1024);
+    this.maxMessageChars = finitePositiveLimit(opts.maxMessageChars, 20 * 1024 * 1024);
   }
-}
-async function executeListProviders(ctx) {
-  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
-  const id = ctx.allocId();
-  const result = await ctx.sendRequest(id, "providers/list", {});
-  if (isJsonRpcError(result)) {
-    throw new ACPSessionError(
-      "prompt_failed",
-      `providers/list failed: ${result.message}`,
-      result
-    );
+  /** Pending start() promise resolve/reject — settled in stop() to avoid leaking. */
+  pendingStart = null;
+  start() {
+    if (this.closed || this.ws !== null || this.pendingStart !== null) {
+      return Promise.reject(new Error("WebSocket transport has already been started or stopped"));
+    }
+    const WS = globalThis.WebSocket;
+    if (!WS) {
+      return Promise.reject(
+        new Error(
+          "global WebSocket is not available \u2014 Node \u2265 22 is required for the remote ACP transport"
+        )
+      );
+    }
+    const timeoutMs = this.opts.handshakeTimeoutMs ?? 3e4;
+    return new Promise((resolve3, reject) => {
+      const ws = new WS(this.opts.url, this.opts.protocols);
+      this.ws = ws;
+      const timer = setTimeout(() => {
+        const pending = this.pendingStart;
+        if (pending === null) return;
+        this.pendingStart = null;
+        this.closed = true;
+        if (this.ws === ws) this.ws = null;
+        this.handlers.clear();
+        try {
+          ws.close();
+        } catch {
+        }
+        pending.reject(new Error(`WebSocket failed to open within ${timeoutMs}ms`));
+      }, timeoutMs);
+      this.pendingStart = { resolve: resolve3, reject, timer };
+      ws.addEventListener("open", () => {
+        const pending = this.pendingStart;
+        if (pending === null) return;
+        this.pendingStart = null;
+        clearTimeout(pending.timer);
+        pending.resolve();
+      });
+      ws.addEventListener("error", (ev) => {
+        const pending = this.pendingStart;
+        if (pending === null) {
+          this.stop();
+          return;
+        }
+        this.pendingStart = null;
+        this.closed = true;
+        if (this.ws === ws) this.ws = null;
+        this.handlers.clear();
+        clearTimeout(pending.timer);
+        const message = ev && typeof ev === "object" && "message" in ev ? String(ev.message) : "WebSocket error";
+        pending.reject(new Error(message));
+      });
+      ws.addEventListener("close", () => {
+        this.closed = true;
+        if (this.ws === ws) this.ws = null;
+        this.handlers.clear();
+        const pending = this.pendingStart;
+        if (pending !== null) {
+          this.pendingStart = null;
+          clearTimeout(pending.timer);
+          pending.reject(new Error("WebSocket closed before the connection opened"));
+        }
+      });
+      ws.addEventListener("message", (ev) => {
+        this.onData(ev.data);
+      });
+    });
   }
-  const r = result;
-  return { providers: r.providers ?? [], currentProviderId: r.currentProviderId ?? null };
-}
-async function executeSetProvider(ctx, providerId, config) {
-  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
-  const id = ctx.allocId();
-  const result = await ctx.sendRequest(id, "providers/set", { providerId, ...config ?? {} });
-  if (isJsonRpcError(result)) {
-    throw new ACPSessionError("prompt_failed", `providers/set failed: ${result.message}`, result);
+  send(msg) {
+    if (this.closed || !this.ws) {
+      return Promise.reject(new Error("WebSocket transport is not open"));
+    }
+    try {
+      const serialized = JSON.stringify(msg);
+      const buffered = Number.isFinite(this.ws.bufferedAmount) ? this.ws.bufferedAmount : 0;
+      if (buffered + Buffer.byteLength(serialized, "utf8") > this.maxBufferedBytes) {
+        this.stop();
+        return Promise.reject(new Error("WebSocket transport send buffer limit exceeded"));
+      }
+      this.ws.send(serialized);
+      return Promise.resolve();
+    } catch (err) {
+      return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+    }
   }
-}
-async function executeDisableProvider(ctx) {
-  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
-  const id = ctx.allocId();
-  const result = await ctx.sendRequest(id, "providers/disable", {});
-  if (isJsonRpcError(result)) {
-    throw new ACPSessionError(
-      "prompt_failed",
-      `providers/disable failed: ${result.message}`,
-      result
-    );
+  onMessage(handler) {
+    this.handlers.add(handler);
+    return () => this.handlers.delete(handler);
   }
-}
-async function executeMcpMessage(ctx, connectionId, message) {
-  if (ctx.closed) throw new ACPSessionError("closed", "session is closed");
-  const id = ctx.allocId();
-  const result = await ctx.sendRequest(id, "mcp/message", { connectionId, message });
-  if (isJsonRpcError(result)) {
-    throw new ACPSessionError("prompt_failed", `mcp/message failed: ${result.message}`, result);
+  stop() {
+    this.closed = true;
+    this.handlers.clear();
+    if (this.pendingStart !== null) {
+      const pending = this.pendingStart;
+      this.pendingStart = null;
+      clearTimeout(pending.timer);
+      try {
+        pending.reject(new Error("WebSocket transport stopped while connecting"));
+      } catch {
+      }
+    }
+    if (this.ws) {
+      try {
+        this.ws.close();
+      } catch {
+      }
+      this.ws = null;
+    }
   }
-  return result;
-}
-async function executeCreateSession(ctx) {
-  const servers = filterMcpServers(ctx.agentCapabilities, ctx.opts.mcpServers);
-  const id = ctx.allocId();
-  const result = await ctx.sendRequest(id, "session/new", {
-    cwd: ctx.opts.cwd ?? ctx.opts.projectRoot,
-    mcpServers: servers
-  });
-  if (isJsonRpcError(result)) {
-    throw new ACPSessionError(
-      "session_create_failed",
-      `session/new failed: ${result.message}`,
-      result
-    );
+  onData(data) {
+    const text = typeof data === "string" ? data : data instanceof ArrayBuffer ? Buffer.from(data).toString("utf8") : Buffer.isBuffer(data) ? data.toString("utf8") : String(data);
+    if (text.length > this.maxMessageChars) {
+      this.stop();
+      return;
+    }
+    if (!text.trim()) return;
+    let msg;
+    try {
+      msg = JSON.parse(text);
+    } catch {
+      for (const line of text.split("\n")) {
+        if (!line.trim()) continue;
+        try {
+          this.dispatch(JSON.parse(line));
+        } catch {
+        }
+      }
+      return;
+    }
+    this.dispatch(msg);
   }
-  const sessionId = result.sessionId;
-  if (typeof sessionId !== "string" || sessionId.length === 0) {
-    throw new ACPSessionError("protocol_error", "session/new returned no sessionId", result);
+  dispatch(msg) {
+    for (const handler of [...this.handlers]) {
+      try {
+        handler(msg);
+      } catch {
+      }
+    }
   }
-  return sessionId;
+};
+function finitePositiveLimit(value, fallback) {
+  return value !== void 0 && Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
 }
 
 // src/client/acp-session.ts
@@ -2199,11 +2185,7 @@ async function makeACPSubagentRunnerWithStop(options) {
       options.onProgress?.(event);
     };
     try {
-      const result = await session.prompt(
-        [textContent(task.description)],
-        ctx.signal,
-        onProgress
-      );
+      const result = await session.prompt([textContent(task.description)], ctx.signal, onProgress);
       return {
         result: result.text,
         iterations: 1,