@wrongstack/acp 1.0.35 → 1.0.37

package/dist/agent.js

@@ -1086,6 +1086,7 @@ ${b.resource.text}` : `[embedded resource: ${b.resource.uri}]`
 function extractText(result) {
   if (typeof result !== "object" || result === null) return "";
   const r = result;
+  if (typeof r.finalText === "string") return r.finalText;
   if (typeof r.text === "string") return r.text;
   if (Array.isArray(r.content)) {
     const parts = [];
@@ -1103,6 +1104,7 @@ function pickStopReason(result, signal) {
   if (signal.aborted) return "cancelled";
   if (typeof result !== "object" || result === null) return "end_turn";
   const r = result;
+  if (r.status === "max_iterations") return "max_turn_requests";
   if (r.error) {
     return "end_turn";
   }
@@ -1461,7 +1463,7 @@ function replayEntryBytes(entry) {
 // src/agent/session-store.ts
 import * as fsp2 from "node:fs/promises";
 import * as path2 from "node:path";
-import { isSafePathSegment, resolveContainedPath } from "@wrongstack/core/utils";
+import { isSafePathSegment, resolveContainedPath, withFileLock } from "@wrongstack/core/utils";
 var RESERVED_SESSION_IDS = /* @__PURE__ */ new Set(["index"]);
 var ACPSessionStore = class {
   dir;
@@ -1635,7 +1637,8 @@ var ACPSessionStore = class {
    */
   withIndexLock(fn) {
     const prev = this.indexChain;
-    const next = prev.then(fn, fn);
+    const locked = () => withFileLock(this.indexPath(), fn);
+    const next = prev.then(locked, locked);
     const settled = next.then(
       () => void 0,
       () => void 0
@@ -1855,7 +1858,11 @@ var StdioTransport = class {
         return;
       }
       try {
-        this.dispatch(JSON.parse(raw), raw.length);
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== "object") {
+          throw new Error("frame is not a JSON-RPC object");
+        }
+        this.dispatch(parsed, raw.length);
       } catch (err) {
         this.stderr.write(`[wstack-acp parse error] ${err}
 `, "utf8");

package/dist/client.js

@@ -1158,7 +1158,9 @@ function isAbortLikeError(err) {
 }
 function resolvePermissionDeadline(value) {
   if (value === Number.POSITIVE_INFINITY) return null;
-  if (value !== void 0 && Number.isFinite(value) && value > 0) return Math.trunc(value);
+  if (value !== void 0 && Number.isFinite(value) && value > 0) {
+    return Math.min(Math.trunc(value), 2147483647);
+  }
   return DEFAULT_PERMISSION_TIMEOUT_MS;
 }
 
@@ -1585,7 +1587,8 @@ function win32BatchTarget(command) {
   if (/\.(?:cmd|bat)$/i.test(command)) return command;
   if (/[\\/]/.test(command) || path2.extname(command)) return void 0;
   const exts = (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD").toLowerCase().split(";");
-  for (const dir of (process.env["PATH"] ?? "").split(path2.delimiter)) {
+  for (const rawDir of (process.env["PATH"] ?? "").split(path2.delimiter)) {
+    const dir = rawDir.trim().replace(/^"|"$/g, "");
     if (!dir) continue;
     for (const ext of exts) {
       if (!ext) continue;
@@ -1849,15 +1852,13 @@ var TerminalServer = class {
   resolveCwd(cwd) {
     if (!cwd) return this.projectRoot;
     const resolved = path2.resolve(cwd);
-    const rootWithSep = this.projectRoot.endsWith(path2.sep) ? this.projectRoot : this.projectRoot + path2.sep;
-    if (resolved !== this.projectRoot && !resolved.startsWith(rootWithSep)) {
+    if (!isInsideRoot(resolved, this.projectRoot)) {
       return this.projectRoot;
     }
     try {
       const realRoot = realpathSync2(this.projectRoot);
       const realCwd = realpathSync2(resolved);
-      const realRootWithSep = realRoot.endsWith(path2.sep) ? realRoot : realRoot + path2.sep;
-      if (realCwd !== realRoot && !realCwd.startsWith(realRootWithSep)) {
+      if (!isInsideRoot(realCwd, realRoot)) {
         return realRoot;
       }
       return realCwd;
@@ -1889,6 +1890,12 @@ var TerminalServer = class {
     return Math.trunc(value);
   }
 };
+function isInsideRoot(child, root) {
+  const fold = (p) => process.platform === "win32" ? p.toLowerCase() : p;
+  const c = fold(child);
+  const r = fold(root);
+  return c === r || c.startsWith(r.endsWith(path2.sep) ? r : r + path2.sep);
+}
 var DENIED_AGENT_ENV_KEYS = /* @__PURE__ */ new Set([
   "NODE_OPTIONS",
   "LD_PRELOAD",
@@ -2152,6 +2159,7 @@ var WebSocketClientTransport = class {
   }
   dispatch(msg) {
     for (const handler of [...this.handlers]) {
+      if (this.closed) break;
       try {
         handler(msg);
       } catch {

package/dist/index.js

@@ -1135,7 +1135,11 @@ var StdioTransport = class {
         return;
       }
       try {
-        this.dispatch(JSON.parse(raw), raw.length);
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== "object") {
+          throw new Error("frame is not a JSON-RPC object");
+        }
+        this.dispatch(parsed, raw.length);
       } catch (err) {
         this.stderr.write(`[wstack-acp parse error] ${err}
 `, "utf8");
@@ -2705,7 +2709,9 @@ function isAbortLikeError(err) {
 }
 function resolvePermissionDeadline(value) {
   if (value === Number.POSITIVE_INFINITY) return null;
-  if (value !== void 0 && Number.isFinite(value) && value > 0) return Math.trunc(value);
+  if (value !== void 0 && Number.isFinite(value) && value > 0) {
+    return Math.min(Math.trunc(value), 2147483647);
+  }
   return DEFAULT_PERMISSION_TIMEOUT_MS;
 }
 
@@ -3132,7 +3138,8 @@ function win32BatchTarget(command) {
   if (/\.(?:cmd|bat)$/i.test(command)) return command;
   if (/[\\/]/.test(command) || path3.extname(command)) return void 0;
   const exts = (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD").toLowerCase().split(";");
-  for (const dir of (process.env["PATH"] ?? "").split(path3.delimiter)) {
+  for (const rawDir of (process.env["PATH"] ?? "").split(path3.delimiter)) {
+    const dir = rawDir.trim().replace(/^"|"$/g, "");
     if (!dir) continue;
     for (const ext of exts) {
       if (!ext) continue;
@@ -3396,15 +3403,13 @@ var TerminalServer = class {
   resolveCwd(cwd) {
     if (!cwd) return this.projectRoot;
     const resolved = path3.resolve(cwd);
-    const rootWithSep = this.projectRoot.endsWith(path3.sep) ? this.projectRoot : this.projectRoot + path3.sep;
-    if (resolved !== this.projectRoot && !resolved.startsWith(rootWithSep)) {
+    if (!isInsideRoot(resolved, this.projectRoot)) {
       return this.projectRoot;
     }
     try {
       const realRoot = realpathSync2(this.projectRoot);
       const realCwd = realpathSync2(resolved);
-      const realRootWithSep = realRoot.endsWith(path3.sep) ? realRoot : realRoot + path3.sep;
-      if (realCwd !== realRoot && !realCwd.startsWith(realRootWithSep)) {
+      if (!isInsideRoot(realCwd, realRoot)) {
         return realRoot;
       }
       return realCwd;
@@ -3436,6 +3441,12 @@ var TerminalServer = class {
     return Math.trunc(value);
   }
 };
+function isInsideRoot(child, root) {
+  const fold = (p) => process.platform === "win32" ? p.toLowerCase() : p;
+  const c = fold(child);
+  const r = fold(root);
+  return c === r || c.startsWith(r.endsWith(path3.sep) ? r : r + path3.sep);
+}
 var DENIED_AGENT_ENV_KEYS = /* @__PURE__ */ new Set([
   "NODE_OPTIONS",
   "LD_PRELOAD",
@@ -3699,6 +3710,7 @@ var WebSocketClientTransport = class {
   }
   dispatch(msg) {
     for (const handler of [...this.handlers]) {
+      if (this.closed) break;
       try {
         handler(msg);
       } catch {

package/dist/wrongstack-acp-agent.js

@@ -1132,7 +1132,11 @@ var StdioTransport = class {
         return;
       }
       try {
-        this.dispatch(JSON.parse(raw), raw.length);
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== "object") {
+          throw new Error("frame is not a JSON-RPC object");
+        }
+        this.dispatch(parsed, raw.length);
       } catch (err) {
         this.stderr.write(`[wstack-acp parse error] ${err}
 `, "utf8");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/acp",
-  "version": "1.0.35",
+  "version": "1.0.37",
   "license": "MIT",
   "description": "ACP (Agent Client Protocol) integration for WrongStack — client + agent support",
   "keywords": [
@@ -50,10 +50,18 @@
     "dist",
     "!dist/**/*.map"
   ],
+  "scripts": {
+    "build": "bun ../../scripts/build-package.mjs",
+    "typecheck": "bun ../../scripts/bun-typecheck.mjs --noEmit",
+    "typecheck:tests": "bun ../../scripts/bun-typecheck.mjs --noEmit -p tsconfig.test.json",
+    "clean": "bun -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "test": "bun --bun run vitest run",
+    "smoke": "bun run build && bun ../../scripts/acp-smoke-test.mts"
+  },
   "dependencies": {
     "@agentclientprotocol/sdk": "^1.4.0",
-    "@wrongstack/core": "1.0.35",
-    "@wrongstack/primitives": "1.0.35"
+    "@wrongstack/core": "1.0.37",
+    "@wrongstack/primitives": "1.0.37"
   },
   "devDependencies": {
     "@types/node": "^26.5.1",
@@ -62,13 +70,5 @@
   },
   "publishConfig": {
     "access": "public"
-  },
-  "scripts": {
-    "build": "node ../../scripts/build-package.mjs",
-    "typecheck": "tsc --noEmit",
-    "typecheck:tests": "tsc --noEmit -p tsconfig.test.json",
-    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
-    "test": "vitest run",
-    "smoke": "pnpm build && node --experimental-strip-types ../../scripts/acp-smoke-test.mts"
   }
-}
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 ECOSTACK TECHNOLOGY OÜ
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.