@wrongstack/acp 1.0.3 → 1.0.5

package/dist/index.js

@@ -49,6 +49,64 @@ var DEFAULT_MODES = [
     description: "Default agent mode for code-generation tasks."
   }
 ];
+function parseMcpServers(raw, onSkipped) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const entry of raw) {
+    if (typeof entry !== "object" || entry === null) {
+      onSkipped?.("entry is not an object");
+      continue;
+    }
+    const e = entry;
+    const name = typeof e.name === "string" ? e.name.trim() : "";
+    if (name === "") {
+      onSkipped?.("entry has no name");
+      continue;
+    }
+    const type = typeof e.type === "string" ? e.type : "stdio";
+    if (type === "http" || type === "sse") {
+      if (typeof e.url !== "string" || e.url === "") {
+        onSkipped?.(`"${name}": ${type} server has no url`);
+        continue;
+      }
+      const headers = parseNameValuePairs(e.headers);
+      const url = e.url;
+      out.push(
+        type === "http" ? { type: "http", name, url, ...headers ? { headers } : {} } : { type: "sse", name, url, ...headers ? { headers } : {} }
+      );
+      continue;
+    }
+    if (type !== "stdio") {
+      onSkipped?.(`"${name}": unknown transport "${type}"`);
+      continue;
+    }
+    if (typeof e.command !== "string" || e.command === "") {
+      onSkipped?.(`"${name}": stdio server has no command`);
+      continue;
+    }
+    const args = Array.isArray(e.args) ? e.args.filter((a) => typeof a === "string") : void 0;
+    const env = parseNameValuePairs(e.env);
+    out.push({
+      name,
+      command: e.command,
+      ...args && args.length > 0 ? { args } : {},
+      ...env ? { env } : {}
+    });
+  }
+  return out;
+}
+function parseNameValuePairs(raw) {
+  if (!Array.isArray(raw)) return void 0;
+  const out = [];
+  for (const pair of raw) {
+    if (typeof pair !== "object" || pair === null) continue;
+    const p = pair;
+    if (typeof p.name === "string" && p.name !== "" && typeof p.value === "string") {
+      out.push({ name: p.name, value: p.value });
+    }
+  }
+  return out.length > 0 ? out : void 0;
+}
 async function resolveSessionCwd(requested) {
   if (!path.isAbsolute(requested)) return null;
   const resolved = path.resolve(requested);
@@ -131,9 +189,16 @@ function buildInitializeResult(agentName, modes, configOptions) {
         audio: false,
         embeddedContext: true
       },
+      // All three ACP transports are supported. stdio is mandatory per spec
+      // and cannot be declined; http and sse are declared here because the
+      // agent now actually connects them (see `parseMcpServers` above and the
+      // per-session MCP registry in `buildAcpServerAgentFactory`). Before that
+      // wiring existed the array was destructured and thrown away at every
+      // entry point, so a client got a successful `session/new` and no tools —
+      // flip these back to false if that connection path is ever removed.
       mcpCapabilities: {
-        http: false,
-        sse: false
+        http: true,
+        sse: true
       },
       sessionCapabilities: {
         close: {},
@@ -173,6 +238,8 @@ async function handleSessionNewOp(ctx, id, params) {
     }
     cwd = resolved;
   }
+  const skipped = [];
+  const mcpServers = parseMcpServers(p.mcpServers, (reason) => skipped.push(reason));
   const sessionId = `sess_${ctx.allocId()}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const state = {
@@ -181,7 +248,8 @@ async function handleSessionNewOp(ctx, id, params) {
     abort: new AbortController(),
     modeId: DEFAULT_MODE_ID,
     createdAt: now,
-    updatedAt: now
+    updatedAt: now,
+    ...mcpServers.length > 0 ? { mcpServers } : {}
   };
   ctx.sessions.set(sessionId, state);
   ctx.onSessionNew(state);
@@ -202,6 +270,7 @@ async function handleSessionNewOp(ctx, id, params) {
       }
     });
   }
+  await reportSkippedMcpServers(ctx, sessionId, skipped);
   await ctx.sendResult(id, {
     sessionId,
     modes: ctx.modes,
@@ -213,6 +282,8 @@ async function handleSessionLoadOp(ctx, id, params) {
   const p = params ?? {};
   const sessionId = typeof p.sessionId === "string" ? p.sessionId : null;
   const loadCwd = typeof p.cwd === "string" ? p.cwd : void 0;
+  const loadSkipped = [];
+  const loadMcpServers = parseMcpServers(p.mcpServers, (reason) => loadSkipped.push(reason));
   const existing = sessionId ? ctx.sessions.get(sessionId) : void 0;
   if (!existing && sessionId && ctx.store) {
     const persisted = await ctx.store.load(sessionId);
@@ -234,7 +305,8 @@ async function handleSessionLoadOp(ctx, id, params) {
         modeId: persisted.modeId ?? DEFAULT_MODE_ID,
         createdAt: persisted.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
         updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        ...persisted.title !== void 0 ? { title: persisted.title } : {}
+        ...persisted.title !== void 0 ? { title: persisted.title } : {},
+        ...loadMcpServers.length > 0 ? { mcpServers: loadMcpServers } : {}
       };
       ctx.sessions.set(sessionId, restored);
       ctx.seedFor?.(sessionId, persisted.history ?? []);
@@ -245,6 +317,7 @@ async function handleSessionLoadOp(ctx, id, params) {
         sessionId,
         update: { sessionUpdate: "current_mode_update", modeId: restored.modeId }
       });
+      await reportSkippedMcpServers(ctx, sessionId, loadSkipped);
       await ctx.sendResult(id, {
         initialMode: { currentModeId: restored.modeId, availableModes: ctx.modes }
       });
@@ -253,6 +326,9 @@ async function handleSessionLoadOp(ctx, id, params) {
   }
   if (existing) {
     existing.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    if (loadMcpServers.length > 0) {
+      existing.mcpServers = loadMcpServers;
+    }
     const replay = ctx.replayFor?.(sessionId);
     if (replay) {
       for (const update of replay) {
@@ -273,6 +349,7 @@ async function handleSessionLoadOp(ctx, id, params) {
         modeId: existing.modeId
       }
     });
+    await reportSkippedMcpServers(ctx, sessionId, loadSkipped);
     await ctx.sendResult(id, {
       initialMode: {
         currentModeId: existing.modeId,
@@ -305,6 +382,9 @@ async function handleSessionForkOp(ctx, id, params) {
     }
     forkCwd = resolved;
   }
+  const forkSkipped = [];
+  const forkRequested = parseMcpServers(p.mcpServers, (reason) => forkSkipped.push(reason));
+  const forkMcpServers = forkRequested.length > 0 ? forkRequested : source.mcpServers;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const sessionId = `sess_${ctx.allocId()}`;
   const forked = {
@@ -314,7 +394,8 @@ async function handleSessionForkOp(ctx, id, params) {
     modeId: source.modeId,
     createdAt: now,
     updatedAt: now,
-    ...source.title !== void 0 ? { title: source.title } : {}
+    ...source.title !== void 0 ? { title: source.title } : {},
+    ...forkMcpServers && forkMcpServers.length > 0 ? { mcpServers: forkMcpServers } : {}
   };
   const history = (ctx.replayFor?.(sourceId) ?? []).map((update) => ({
     sessionUpdate: update.sessionUpdate,
@@ -328,6 +409,7 @@ async function handleSessionForkOp(ctx, id, params) {
     sessionId,
     update: { sessionUpdate: "current_mode_update", modeId: forked.modeId }
   });
+  await reportSkippedMcpServers(ctx, sessionId, forkSkipped);
   await ctx.sendResult(id, {
     sessionId,
     modes: ctx.modes,
@@ -367,7 +449,13 @@ async function handleSessionPromptOp(ctx, id, params) {
   };
   try {
     result = await ctx.runTurn(
-      { sessionId, prompt: p.prompt, signal: turnSignal.signal },
+      {
+        sessionId,
+        prompt: p.prompt,
+        signal: turnSignal.signal,
+        cwd: session.cwd,
+        ...session.mcpServers ? { mcpServers: session.mcpServers } : {}
+      },
       emit,
       api
     );
@@ -425,6 +513,22 @@ async function handleSetConfigOptionOp(ctx, id, params) {
   await ctx.sendResult(id, { configOptions: [...ctx.configOptions] });
   return false;
 }
+async function reportSkippedMcpServers(ctx, sessionId, skipped) {
+  if (skipped.length === 0) return;
+  try {
+    await ctx.sendNotification({
+      sessionId,
+      update: {
+        sessionUpdate: "agent_message_chunk",
+        content: {
+          type: "text",
+          text: `Ignored ${skipped.length} malformed mcpServers entr${skipped.length === 1 ? "y" : "ies"}: ${skipped.join("; ")}`
+        }
+      }
+    });
+  } catch {
+  }
+}
 
 // src/agent/protocol-handler.ts
 var ACPProtocolHandler = class {
@@ -623,7 +727,7 @@ var ACPProtocolHandler = class {
     return false;
   }
   async handleAuthenticate(id, _params) {
-    await this.sendResult(id, { outcome: "unauthenticated" });
+    await this.sendResult(id, {});
     return false;
   }
   async handleLogout(id, _params) {
@@ -636,6 +740,10 @@ var ACPProtocolHandler = class {
     const existing = sessionId ? this.sessions.get(sessionId) : void 0;
     if (existing) {
       existing.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const resumeServers = parseMcpServers(p.mcpServers);
+      if (resumeServers.length > 0) {
+        existing.mcpServers = resumeServers;
+      }
       await this.sendResult(id, {
         initialMode: {
           currentModeId: existing.modeId,
@@ -1293,11 +1401,11 @@ function toolToPriority(tool) {
 }
 
 // src/agent/wrongstack-acp-agent.ts
-import { timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
 import { isIP } from "node:net";
 import { fileURLToPath } from "node:url";
 import { expandIPv6, writeErr as writeErr2 } from "@wrongstack/core/utils";
+import { timingSafeTokenEqual } from "@wrongstack/primitives";
 var LISTEN_RETRY_LIMIT = 5;
 var LISTEN_RETRY_BASE_MS = 25;
 var WrongStackACPServer = class {
@@ -1531,13 +1639,6 @@ var WrongStackACPServer = class {
 var defaultEchoRunTurn = async (_input, _emit) => {
   return { stopReason: "end_turn" };
 };
-function timingSafeTokenEqual(supplied, expected) {
-  if (!supplied || !expected) return false;
-  const a = Buffer.from(supplied);
-  const b = Buffer.from(expected);
-  if (a.length !== b.length) return false;
-  return timingSafeEqual(a, b);
-}
 function isLoopbackPeer(req) {
   const address = req.socket.remoteAddress?.replace(/^::ffff:/i, "");
   return address !== void 0 && isLoopbackHost(address);
@@ -2045,6 +2146,20 @@ var ACPSessionError = class extends Error {
 function isJsonRpcError(v) {
   return typeof v === "object" && v !== null && typeof v.code === "number" && typeof v.message === "string";
 }
+function isAuthRequiredError(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (/auth(_|-)?required|authentication required/i.test(message)) return true;
+  const cause = err instanceof ACPSessionError ? err.cause : err && typeof err === "object" && "cause" in err ? err.cause : err;
+  if (!cause || typeof cause !== "object") return false;
+  const data = cause.data;
+  if (data === "auth_required" || data === "AUTH_REQUIRED") return true;
+  if (data && typeof data === "object") {
+    const d = data;
+    if (d.authRequired === true) return true;
+    if (d.code === "auth_required" || d.code === "AUTH_REQUIRED") return true;
+  }
+  return false;
+}
 
 // src/client/acp-session-ops.ts
 function filterMcpServers(agentCapabilities, servers) {
@@ -3089,7 +3204,7 @@ var ACPSession = class _ACPSession {
         fs: { readTextFile: true, writeTextFile: true },
         terminal: true
       },
-      clientInfo: { name: "wrongstack", title: "WrongStack", version: "0.287.0" }
+      clientInfo: { name: "wrongstack", title: "WrongStack", version: ACP_PACKAGE_VERSION }
     });
     if (isJsonRpcError(result)) {
       throw new ACPSessionError("init_failed", `initialize failed: ${result.message}`, result);
@@ -3121,12 +3236,13 @@ var ACPSession = class _ACPSession {
     if (this.state === "closed") {
       throw new ACPSessionError("closed", "session is closed");
     }
-    if (this.state !== "ready") {
+    if (this.state !== "ready" && this.state !== "authenticated") {
       throw new ACPSessionError(
         "protocol_error",
         `authenticate called in state=${this.state} (expected 'ready')`
       );
     }
+    if (this.state === "authenticated") return;
     if (!this.authMethods.some((m) => m.id === methodId)) {
       throw new ACPSessionError(
         "auth_failed",
@@ -3229,7 +3345,7 @@ var ACPSession = class _ACPSession {
       return emptyRunResult("cancelled");
     }
     if (!this.sessionId) {
-      this.sessionId = await executeCreateSession(this.opContext());
+      this.sessionId = await this.createSessionWithAuth();
     }
     if (signal.aborted) {
       return emptyRunResult("cancelled");
@@ -3365,6 +3481,54 @@ var ACPSession = class _ACPSession {
       });
     });
   }
+  /**
+   * `session/new`, then one authenticate+retry if the agent demands login.
+   * Logged-in CLIs succeed on the first call even when they advertise
+   * `authMethods`; we do not pop OAuth on every spawn.
+   */
+  async createSessionWithAuth() {
+    try {
+      return await executeCreateSession(this.opContext());
+    } catch (err) {
+      if (this.state === "authenticated" || !isAuthRequiredError(err)) {
+        throw err instanceof ACPSessionError ? err : new ACPSessionError(
+          "session_create_failed",
+          err instanceof Error ? err.message : String(err),
+          err
+        );
+      }
+      await this.ensureAuthenticated();
+      return executeCreateSession(this.opContext());
+    }
+  }
+  /**
+   * Pick a non-terminal auth method and run `authenticate`. Terminal-only
+   * agents need an out-of-band login CLI (registry AUTHENTICATION.md) —
+   * we refuse rather than hang a TUI inside the JSON-RPC child.
+   */
+  async ensureAuthenticated() {
+    if (this.state === "authenticated") return;
+    if (this.authMethods.length === 0) {
+      throw new ACPSessionError(
+        "auth_failed",
+        "This agent requires authentication before a session can start, but advertised no authMethods. Log into the CLI, then retry."
+      );
+    }
+    const inProcess = this.authMethods.find(
+      (m) => m.type === void 0 || m.type === "agent" || m.type === "oauth" || m.type === "http"
+    );
+    if (inProcess) {
+      await this.authenticate(inProcess.id);
+      return;
+    }
+    const terminal = this.authMethods.find((m) => m.type === "terminal");
+    const setupArgs = terminal?.args?.length ? terminal.args.join(" ") : void 0;
+    const setup = setupArgs !== void 0 ? `${this.opts.command} ${setupArgs}` : `${this.opts.command}${this.opts.args?.length ? ` ${this.opts.args.join(" ")}` : ""}`;
+    throw new ACPSessionError(
+      "auth_failed",
+      `This agent requires a terminal login before ACP can start. Run \`${setup}\` (or the CLI's /login), then retry.`
+    );
+  }
   sendResult(id, result) {
     return this.transport.send({ jsonrpc: "2.0", id, result });
   }
@@ -3393,7 +3557,11 @@ var ACPSession = class _ACPSession {
       clearTimeout(pending.timeoutHandle);
       this.pending.delete(msg.id);
       if (msg.error !== void 0) {
-        pending.reject(new Error(msg.error.message ?? "unknown JSON-RPC error"));
+        const method = pending.method;
+        const kind = method === "session/new" ? "session_create_failed" : method === "authenticate" ? "auth_failed" : "protocol_error";
+        pending.reject(
+          new ACPSessionError(kind, msg.error.message ?? "unknown JSON-RPC error", msg.error)
+        );
       } else {
         pending.resolve(msg.result);
       }
@@ -3833,7 +4001,7 @@ var AGENTS_CATALOG = [
     id: "cline",
     displayName: "Cline",
     vendor: "community",
-    probe: { command: "npx", args: ["--version"] },
+    probe: { command: "cline", args: ["--version"] },
     // Registry id `cline`: the `cline` npm package speaks ACP behind `--acp`.
     acp: {
       command: "npx",
@@ -3876,7 +4044,8 @@ var AGENTS_CATALOG = [
       fs: true
     },
     integration: "experimental",
-    // Canonical repo URL — the org renamed; All-Hands-AI/OpenHands 301-redirects here.
+    // Not in the official agentclientprotocol/registry (2026-09). Keep as a
+    // local-PATH fallback; probe/spawn may hang if the binary has no ACP entry.
     docs: "https://github.com/OpenHands/OpenHands"
   },
   // ── Vendor CLIs (native binaries) ───────────────────────────────────
@@ -3909,6 +4078,7 @@ var AGENTS_CATALOG = [
       fs: true
     },
     integration: "experimental",
+    // Not in the official agentclientprotocol/registry (2026-09).
     docs: "https://kiro.dev"
   },
   {
@@ -3931,8 +4101,9 @@ var AGENTS_CATALOG = [
     id: "mistral-vibe",
     displayName: "Mistral Vibe",
     vendor: "community",
-    probe: { command: "vibe", args: ["--version"] },
-    acp: { command: "vibe", args: [] },
+    probe: { command: "vibe-acp", args: ["--version"] },
+    // Official registry ships a dedicated `vibe-acp` binary, not bare `vibe`.
+    acp: { command: "vibe-acp", args: [] },
     supports: {
       loadSession: false,
       promptImages: false,
@@ -4054,6 +4225,10 @@ async function makeACPSubagentRunnerWithStop(options) {
       } catch {
       }
       options.onProgress?.(event);
+      try {
+        options.publishLive?.(ctx, task, event);
+      } catch {
+      }
     };
     try {
       const result = await session.prompt([textContent(task.description)], ctx.signal, onProgress);
@@ -4140,10 +4315,13 @@ var REGISTRY_ID_ALIASES = {
   "gemini-cli": "gemini",
   "codex-cli": "codex-acp",
   copilot: "github-copilot-cli",
-  // Kimi's live registry id is `kimi` — same as our catalog id, so the
-  // alias is identity. Listed explicitly so `resolveAcpAgentCommand`
-  // finds the live entry when the registry is synced.
-  kimi: "kimi"
+  kimi: "kimi",
+  cline: "cline",
+  goose: "goose",
+  opencode: "opencode",
+  cursor: "cursor",
+  "qwen-code": "qwen-code",
+  "mistral-vibe": "mistral-vibe"
 };
 function resolveAcpAgentCommand(id, overrides, live) {
   const ov = overrides?.[id];
@@ -4566,20 +4744,20 @@ async function runEnsemble(opts) {
   const detectedById = new Map(detected.map((a) => [a.id, a]));
   const runnable = [];
   for (const id of requested) {
+    const cmd = resolveCmd(id);
     const det = detectedById.get(id);
-    if (!det?.installed) {
+    const pkgLauncher = cmd?.command === "npx" || cmd?.command === "uvx";
+    if (det && !det.installed && !pkgLauncher) {
       setResult(results, id, {
         status: "skipped",
-        reason: det?.reason ?? "not in catalog"
+        reason: det.reason ?? "binary not found"
       });
       continue;
     }
-    const cmd = resolveCmd(id);
     if (!cmd) {
       setResult(results, id, {
-        status: "failed",
-        error: { kind: "unknown_agent", message: `Unknown ACP agent: ${id}` },
-        durationMs: 0
+        status: "skipped",
+        reason: det?.reason ?? "not in catalog"
       });
       continue;
     }
@@ -4715,9 +4893,17 @@ function mapRegistryEntry(entry, platformKey = currentPlatformKey()) {
   const dist = entry.distribution;
   let acp = null;
   if (dist?.npx?.package) {
-    acp = { command: "npx", args: ["-y", dist.npx.package, ...dist.npx.args ?? []] };
+    acp = {
+      command: "npx",
+      args: ["-y", dist.npx.package, ...dist.npx.args ?? []],
+      ...dist.npx.env ? { env: dist.npx.env } : {}
+    };
   } else if (dist?.uvx?.package) {
-    acp = { command: "uvx", args: [dist.uvx.package, ...dist.uvx.args ?? []] };
+    acp = {
+      command: "uvx",
+      args: [dist.uvx.package, ...dist.uvx.args ?? []],
+      ...dist.uvx.env ? { env: dist.uvx.env } : {}
+    };
   } else if (dist?.binary) {
     const target = dist.binary[platformKey];
     if (target?.cmd) {

package/dist/integration/acp-subagent-runner.d.ts

@@ -11,8 +11,8 @@
  * Connected to the Director / MultiAgentCoordinator via the
  * `SubagentRunner` interface (same shape as `AgentSubagentRunner`).
  */
-import type { SubagentRunner } from '@wrongstack/core/types';
-import { type ACPProgressHandler, ACPSession } from '../client/acp-session.js';
+import type { SubagentRunContext, SubagentRunner, TaskSpec } from '@wrongstack/core/types';
+import { type ACPProgressEvent, type ACPProgressHandler, ACPSession } from '../client/acp-session.js';
 import type { PermissionPolicy } from '../client/permission.js';
 import type { McpServer } from '../types/acp-v1.js';
 export interface ACPSubagentRunnerOptions {
@@ -40,6 +40,12 @@ export interface ACPSubagentRunnerOptions {
      * stream, instead of waiting for the buffered final result.
      */
     onProgress?: ACPProgressHandler | undefined;
+    /**
+     * Host live-view hook. Called with the run context so a fleet/TUI/WebUI
+     * publisher can attribute tool calls and text to the right subagent.
+     * Invoked in addition to `onProgress`.
+     */
+    publishLive?: ((ctx: SubagentRunContext, task: TaskSpec, event: ACPProgressEvent) => void) | undefined;
     /**
      * Permission policy for the external agent's `session/request_permission`
      * calls. Defaults to the session's own default. Inject the host's

package/dist/registry/acp-registry-fetch.d.ts

@@ -39,10 +39,12 @@ export interface RegistryAgentEntry {
         npx?: {
             package: string;
             args?: string[];
+            env?: Record<string, string>;
         };
         uvx?: {
             package: string;
             args?: string[];
+            env?: Record<string, string>;
         };
         binary?: Record<string, {
             archive?: string;

package/dist/types/acp-v1.d.ts

@@ -95,7 +95,15 @@ export interface AuthMethod {
     id: string;
     name: string;
     description?: string | undefined;
-    type?: 'agent' | 'oauth' | 'http' | undefined;
+    /**
+     * Registry agents advertise `agent` (OAuth in-process) or `terminal`
+     * (separate login CLI). `oauth`/`http` are spec aliases; `env_var` is
+     * used by some agents but is not a registry-supported setup path.
+     */
+    type?: 'agent' | 'oauth' | 'http' | 'terminal' | 'env_var' | undefined;
+    /** Extra argv for `type: 'terminal'` setup (replaces the ACP entry args). */
+    args?: string[] | undefined;
+    env?: Record<string, string> | undefined;
 }
 export interface AuthenticateRequest {
     methodId: string;