@yitom/agy-acp-map 0.1.16 → 0.1.18

package/README.md

@@ -75,9 +75,10 @@ bunx @yitom/agy-acp-map@latest        # bun users (preferred: no prompt, no shim
 npx -y @yitom/agy-acp-map@latest      # node users
 ```
 
-Requirements are the same as source runs: a logged-in `agy` on `PATH`. The
-optional 95MB single-file `agy-acp-win-x64.exe` is **not** in the npm package —
-grab it from GitHub Releases if you want zero-runtime distribution.
+Requirements are the same as source runs: a logged-in `agy` on `PATH`.
+There is no compiled single-file exe anymore — codex-style `bunx`/`npx`
+is the only distribution (the npm tarball is ~5MB: `dist/bin.js` plus the
+tiny `agy-headless.exe` launcher).
 
 
 ## Launch flags / 启动参数 (v0.1.2)
@@ -95,7 +96,7 @@ Configure on **`session/new`** (preferred) and/or env fallbacks. Stored on the S
 | `--sandbox` | `sandbox: true` | `AGY_ACP_SANDBOX=1` |
 | `--json-schema` | `jsonSchema` (string or object→stringify) | `AGY_ACP_JSON_SCHEMA` (string or path) |
 | `--conversation` | `conversationId` (resume / switch-model flow) | _(from prior turn)_ |
-| `--dangerously-skip-permissions` | `safety: 'autonomous' \| 'autonomous-unsandboxed'` or `skipPermissions: true` | `AGY_ACP_SAFETY=…` / `AGY_ACP_SKIP_PERMISSIONS=1` if safety unset (**default off / safe**) |
+| `--dangerously-skip-permissions` | `safety: 'autonomous' \| 'autonomous-unsandboxed'` or `skipPermissions: true` | `AGY_ACP_SAFETY=…` / `AGY_ACP_SKIP_PERMISSIONS=1` if safety unset (**default: skip on, unsandboxed**) |
 | `--disable-slash-commands` | `disableSlashCommands` (default **true**) | `AGY_ACP_DISABLE_SLASH_COMMANDS=0` to omit |
 | `--print-timeout` | `printTimeout` (e.g. `30m`, `120s`, `0`) | `AGY_ACP_PRINT_TIMEOUT` (default `0`) |
 
@@ -159,7 +160,7 @@ Display-history path: `~/.agy-acp-map/history/`. Override with `AGY_ACP_HISTORY_
 | Env | Default | Meaning |
 |-----|---------|---------|
 | `AGY_ACP_SAFETY` | `safe` | `safe` \| `autonomous` \| `autonomous-unsandboxed` (aliases: `unsandboxed`, `autonomous_unsandboxed`). See Safety modes table. |
-| `AGY_ACP_SKIP_PERMISSIONS` | `0` | If **safety unset**: `1` ≈ treat as `autonomous`; `0` ≈ `safe`. Explicit `AGY_ACP_SAFETY` / `session.safety` wins. |
+| `AGY_ACP_SKIP_PERMISSIONS` | `0` | If **safety unset**: `1` ≈ treat as `autonomous-unsandboxed`; `0` ≈ `safe`. Explicit `AGY_ACP_SAFETY` / `session.safety` wins. |
 | `AGY_ACP_DISABLE_SLASH_COMMANDS` | `1` | When `1` (default), pass `--disable-slash-commands`. Set `0` to omit. |
 | `AGY_ACP_PRINT_TIMEOUT` | `0` | Passed as `--print-timeout` (e.g. `30m`, `120s`, `0` = wait until turn completes). |
 | `AGY_BIN` | `agy` | Override binary |
@@ -167,7 +168,7 @@ Display-history path: `~/.agy-acp-map/history/`. Override with `AGY_ACP_HISTORY_
 | `AGY_ACP_EFFORT` | — | Default `--effort` |
 | `AGY_ACP_MODE` | — | Default `--mode` |
 | `AGY_ACP_AGENT` | — | Default `--agent` |
-| `AGY_ACP_SANDBOX` | — | `1`/`0` → force sandbox on/off for `safe`/`autonomous`. Ignored for `autonomous-unsandboxed` (never sandboxed). |
+| `AGY_ACP_SANDBOX` | — | `1`/`0` → force sandbox on/off for `safe`/`autonomous`/defaulted tier. Ignored only when `autonomous-unsandboxed` was explicitly selected. |
 | `AGY_ACP_JSON_SCHEMA` | — | Schema string or file path for `--json-schema` |
 | `AGY_ACP_KEEP_STAGING` | — | `1` → keep `.agy-acp-staging` files after turn/close (debug) |
 | `AGY_ACP_STORE` / `AGY_ACP_SESSION_STORE` | `~/.agy-acp-map/sessions.json` | Disk session index path (`SESSION_STORE` wins if both set) |
@@ -209,15 +210,15 @@ No interactive ACP permission UI — **launch strategies only** (`resolveSafety`
 
 | Mode / 模式 | Skip permissions / 跳过权限 | Sandbox / 沙箱 |
 |-------------|------------------------------|----------------|
-| **safe** (default) | no — rely on agy `settings.json` allow/deny + soft-deny messages | only if user sets `sandbox: true` / `AGY_ACP_SANDBOX=1` |
+| **safe** | no — rely on agy `settings.json` allow/deny + soft-deny messages | only if user sets `sandbox: true` / `AGY_ACP_SANDBOX=1` |
 | **autonomous** | yes (`--dangerously-skip-permissions`) | **default `--sandbox`** unless user sets `sandbox: false` / `AGY_ACP_SANDBOX=0` |
-| **autonomous-unsandboxed** (aliases: `autonomous_unsandboxed`, `unsandboxed`) | yes (`--dangerously-skip-permissions`) | **never** pass `--sandbox` (explicit dangerous tier; ignores sandbox overrides) |
+| **autonomous-unsandboxed** (default; aliases: `autonomous_unsandboxed`, `unsandboxed`) | yes (`--dangerously-skip-permissions`) | **never** when explicitly selected (ignores sandbox overrides); the defaulted tier honors explicit `sandbox: true` / `AGY_ACP_SANDBOX=1` |
 
 Accept via:
 - `session/new` field `safety`: `'safe' | 'autonomous' | 'autonomous-unsandboxed'`
 - env `AGY_ACP_SAFETY` (same values)
 - idle `session/set_config_option` with `configId: "safety"`
-- Backward compat: `AGY_ACP_SKIP_PERMISSIONS=1` ≈ `autonomous` **if safety unset**; `=0` ≈ `safe`
+- Backward compat: `AGY_ACP_SKIP_PERMISSIONS=1` ≈ `autonomous-unsandboxed` **if safety unset**; `=0` ≈ `safe`
 
 输入：`session/new.safety` / `AGY_ACP_SAFETY` / `set_config_option`；兼容 `AGY_ACP_SKIP_PERMISSIONS`（仅在未设 safety 时生效）。
 
@@ -329,9 +330,7 @@ Engineering feasibility ≠ legal permission. 即便只用官方 CLI I/O，仍
 ## Zed via npm (global install) / Zed 全局安装用法
 
 No Bun / TypeScript needed at runtime — the published package ships compiled
-`dist/` artifacts (`bin.js` for Node, `agy-headless.exe`). The optional
-single-file `agy-acp-win-x64.exe` (no runtime needed) is a GitHub Release
-asset, not part of the npm tarball. A **global** install is recommended so Zed
+`dist/` artifacts (`bin.js` for Node, `agy-headless.exe`). A **global** install is recommended so Zed
 gets a stable absolute path (repo moves would break a local path):
 
 ```powershell

package/dist/bin.js

@@ -10750,14 +10750,15 @@ function normalizePrintTimeout(v) {
   return s === "" ? undefined : s;
 }
 function resolveSafety(session = {}, env = process.env) {
-  let safety = normalizeSafety(session.safety) ?? normalizeSafety(env.AGY_ACP_SAFETY) ?? undefined;
+  const explicitSafety = normalizeSafety(session.safety) ?? normalizeSafety(env.AGY_ACP_SAFETY) ?? undefined;
+  let safety = explicitSafety;
   if (!safety) {
     const envSkip = env.AGY_ACP_SKIP_PERMISSIONS;
     if (envSkip !== undefined && envSkip !== "") {
       const skip = !(envSkip === "0" || envSkip === "false" || envSkip === "no");
-      safety = skip ? "autonomous" : "safe";
+      safety = skip ? "autonomous-unsandboxed" : "safe";
     } else {
-      safety = "autonomous";
+      safety = "autonomous-unsandboxed";
     }
   }
   let skipPermissions = safety === "autonomous" || safety === "autonomous-unsandboxed";
@@ -10765,7 +10766,7 @@ function resolveSafety(session = {}, env = process.env) {
     skipPermissions = Boolean(session.skipPermissions);
   }
   let sandbox;
-  if (safety === "autonomous-unsandboxed") {
+  if (safety === "autonomous-unsandboxed" && explicitSafety === "autonomous-unsandboxed") {
     sandbox = false;
   } else if (session.sandbox !== undefined) {
     sandbox = Boolean(session.sandbox);
@@ -11692,7 +11693,7 @@ function formatSoftDenyMessage(denies) {
       bits.push(`(via ${d.source})`);
     lines.push(bits.join(" "));
   }
-  lines.push("Or set AGY_ACP_SAFETY=safe / AGY_ACP_SKIP_PERMISSIONS=0 to re-enable permission checks (autonomous + sandbox is the bridge default).");
+  lines.push("Or set AGY_ACP_SAFETY=safe / AGY_ACP_SKIP_PERMISSIONS=0 to re-enable permission checks (autonomous-unsandboxed — full permissions, no sandbox — is the bridge default; AGY_ACP_SAFETY=autonomous re-enables sandbox containment).");
   if (denies.some((d) => d.source?.includes("sandbox"))) {
     lines.push("Sandbox note: --sandbox = terminal restrictions, not verified offline. Built-in search may still work; if `curl`/`Invoke-WebRequest` failed, retry once with safety=autonomous-unsandboxed (or sandbox:false) to confirm it is a sandbox network block.");
   }
@@ -12632,7 +12633,7 @@ function mcpServerToAgyAddArgs(s) {
   if (s.kind === "stdio") {
     for (const e of s.env)
       argv.push("--env", `${e.name}=${e.value}`);
-    argv.push(s.name, s.command, ...s.args);
+    argv.push(s.name, "--", s.command, ...s.args);
     return argv;
   }
   for (const h of s.headers)
@@ -12673,6 +12674,21 @@ ${r.stderr}`)}`);
     }
     added.push(s.name);
   }
+  if (added.length) {
+    let listed = "";
+    try {
+      const lr = await runFn(bin, ["mcp", "list"], { timeoutMs });
+      listed = String(lr.stdout ?? "");
+    } catch (err) {
+      throw new RequestError(-32603, `registered MCP server(s) [${added.join(", ")}] but 'mcp list' verification failed: ${err?.message || err}`);
+    }
+    const lines = listed.split(`
+`);
+    const missing = added.filter((n) => !lines.some((ln) => ln.includes(n)));
+    if (missing.length) {
+      throw new RequestError(-32603, `MCP server(s) [${missing.join(", ")}] exited 0 on 'mcp add' but are absent from 'mcp list' ` + `(agy swallows its global --version/--help flags even after '--'; check server args). ` + `List tail: ${tail(listed, 300)}`);
+    }
+  }
   return { added };
 }
 async function removeMcpServers(bin, names, runFn = defaultMcpRunFn, timeoutMs = 30000) {
@@ -12701,7 +12717,7 @@ ${r.stderr}`, 200)}`);
 var AGENT_INFO = {
   name: "agy-acp",
   title: "agy ACP (stream-json)",
-  version: "0.1.16"
+  version: "0.1.18"
 };
 var BRIDGE_CAPABILITIES = {
   prompt: true,

package/dist/index.js

@@ -10421,14 +10421,15 @@ function normalizePrintTimeout(v) {
   return s === "" ? undefined : s;
 }
 function resolveSafety(session = {}, env = process.env) {
-  let safety = normalizeSafety(session.safety) ?? normalizeSafety(env.AGY_ACP_SAFETY) ?? undefined;
+  const explicitSafety = normalizeSafety(session.safety) ?? normalizeSafety(env.AGY_ACP_SAFETY) ?? undefined;
+  let safety = explicitSafety;
   if (!safety) {
     const envSkip = env.AGY_ACP_SKIP_PERMISSIONS;
     if (envSkip !== undefined && envSkip !== "") {
       const skip = !(envSkip === "0" || envSkip === "false" || envSkip === "no");
-      safety = skip ? "autonomous" : "safe";
+      safety = skip ? "autonomous-unsandboxed" : "safe";
     } else {
-      safety = "autonomous";
+      safety = "autonomous-unsandboxed";
     }
   }
   let skipPermissions = safety === "autonomous" || safety === "autonomous-unsandboxed";
@@ -10436,7 +10437,7 @@ function resolveSafety(session = {}, env = process.env) {
     skipPermissions = Boolean(session.skipPermissions);
   }
   let sandbox;
-  if (safety === "autonomous-unsandboxed") {
+  if (safety === "autonomous-unsandboxed" && explicitSafety === "autonomous-unsandboxed") {
     sandbox = false;
   } else if (session.sandbox !== undefined) {
     sandbox = Boolean(session.sandbox);
@@ -11402,7 +11403,7 @@ function formatSoftDenyMessage(denies) {
       bits.push(`(via ${d.source})`);
     lines.push(bits.join(" "));
   }
-  lines.push("Or set AGY_ACP_SAFETY=safe / AGY_ACP_SKIP_PERMISSIONS=0 to re-enable permission checks (autonomous + sandbox is the bridge default).");
+  lines.push("Or set AGY_ACP_SAFETY=safe / AGY_ACP_SKIP_PERMISSIONS=0 to re-enable permission checks (autonomous-unsandboxed — full permissions, no sandbox — is the bridge default; AGY_ACP_SAFETY=autonomous re-enables sandbox containment).");
   if (denies.some((d) => d.source?.includes("sandbox"))) {
     lines.push("Sandbox note: --sandbox = terminal restrictions, not verified offline. Built-in search may still work; if `curl`/`Invoke-WebRequest` failed, retry once with safety=autonomous-unsandboxed (or sandbox:false) to confirm it is a sandbox network block.");
   }
@@ -12419,7 +12420,7 @@ function mcpServerToAgyAddArgs(s) {
   if (s.kind === "stdio") {
     for (const e of s.env)
       argv.push("--env", `${e.name}=${e.value}`);
-    argv.push(s.name, s.command, ...s.args);
+    argv.push(s.name, "--", s.command, ...s.args);
     return argv;
   }
   for (const h of s.headers)
@@ -12460,6 +12461,21 @@ ${r.stderr}`)}`);
     }
     added.push(s.name);
   }
+  if (added.length) {
+    let listed = "";
+    try {
+      const lr = await runFn(bin, ["mcp", "list"], { timeoutMs });
+      listed = String(lr.stdout ?? "");
+    } catch (err) {
+      throw new RequestError(-32603, `registered MCP server(s) [${added.join(", ")}] but 'mcp list' verification failed: ${err?.message || err}`);
+    }
+    const lines = listed.split(`
+`);
+    const missing = added.filter((n) => !lines.some((ln) => ln.includes(n)));
+    if (missing.length) {
+      throw new RequestError(-32603, `MCP server(s) [${missing.join(", ")}] exited 0 on 'mcp add' but are absent from 'mcp list' ` + `(agy swallows its global --version/--help flags even after '--'; check server args). ` + `List tail: ${tail(listed, 300)}`);
+    }
+  }
   return { added };
 }
 async function removeMcpServers(bin, names, runFn = defaultMcpRunFn, timeoutMs = 30000) {
@@ -12488,7 +12504,7 @@ ${r.stderr}`, 200)}`);
 var AGENT_INFO = {
   name: "agy-acp",
   title: "agy ACP (stream-json)",
-  version: "0.1.16"
+  version: "0.1.18"
 };
 var BRIDGE_CAPABILITIES = {
   prompt: true,

package/dist/lib/agy-args.d.ts

@@ -114,14 +114,17 @@ export type SafetyResolveInput = {
  *
  * Tiers:
  *   safe                        — no skip-permissions; sandbox only if explicitly true
- *   autonomous (default)        — skip-permissions; default --sandbox unless sandbox:false
- *   autonomous-unsandboxed      — skip-permissions; NEVER --sandbox
+ *   autonomous                  — skip-permissions; default --sandbox unless sandbox:false
+ *                                 (opt-in containment; explicit safety/autonomous only)
+ *   autonomous-unsandboxed      — skip-permissions; NEVER --sandbox (the default:
+ *                                 full permissions, no terminal restrictions)
  *
  * Inputs:
  *   session.safety / AGY_ACP_SAFETY
- *   AGY_ACP_SKIP_PERMISSIONS=0 ≈ safe if safety unset; otherwise autonomous
+ *   AGY_ACP_SKIP_PERMISSIONS=0 ≈ safe if safety unset; otherwise autonomous-unsandboxed
  *   explicit session.skipPermissions overrides the skip flag only
- *   explicit session.sandbox / AGY_ACP_SANDBOX override sandbox except unsandboxed tier
+ *   explicit session.sandbox / AGY_ACP_SANDBOX override sandbox except when the
+ *   unsandboxed tier was explicitly selected (defaulted tier honors opt-in)
  */
 export declare function resolveSafety(session?: SafetyResolveInput, env?: NodeJS.ProcessEnv): ResolvedSafety;
 /**

package/dist/lib/mcp-servers.d.ts

@@ -53,6 +53,10 @@ export declare function validateMcpServers(input: unknown): NormalizedMcpServer[
  * Build `agy mcp add` argv. agy rejects flags placed after <name>, so all
  * flags come first: mcp add [--env K=V] [--header K:V] [--type t] <name>
  * <commandOrUrl> [args...].
+ * stdio ALWAYS inserts `--` after <name>: agy consumes a global `--version`
+ * (and may misparse other dash-args) even in post-positional slots, which
+ * exits 0 while registering nothing (verified against agy 1.2.8). `--` ends
+ * flag parsing so command/args pass through verbatim.
  */
 export declare function mcpServerToAgyAddArgs(s: NormalizedMcpServer): string[];
 export interface McpRunResult {
@@ -70,6 +74,9 @@ export declare const defaultMcpRunFn: McpRunFn;
  * Register every server via `agy mcp add` (idempotent: add == upsert).
  * Any failure throws RequestError — a client that asked for MCP must never
  * get a silent tools-less session.
+ * Verify-after-add: agy exits 0 while registering NOTHING when argv contains
+ * its global flags (`--version`/`--help` are swallowed even after `--`),
+ * so every add is confirmed via `mcp list`. Absent-after-add throws loud.
  */
 export declare function syncMcpServers(bin: string, servers: NormalizedMcpServer[], runFn?: McpRunFn, timeoutMs?: number): Promise<{
     added: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yitom/agy-acp-map",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "publishConfig": {
     "access": "public"
   },
@@ -28,7 +28,6 @@
     "build": "bun run build:js && bun run build:types && bun run build:headless",
     "build:headless": "bun scripts/build-headless.ts",
     "build:js": "bun build src/sdk-server.ts --target node --outfile dist/bin.js && bun build src/index.ts --target node --outfile dist/index.js",
-    "build:exe": "bun build src/sdk-server.ts --compile --target=bun-windows-x64 --outfile release/agy-acp-win-x64.exe",
     "build:types": "bunx tsc -p tsconfig.build.json",
     "release:patch": "bun scripts/release.ts",
     "release:publish": "bun scripts/release.ts --publish",
@@ -48,8 +47,11 @@
     "smoke:permissions": "bun tests/smoke/smoke-permissions.ts",
     "smoke:image-in": "bun tests/smoke/smoke-image-in.ts",
     "smoke:image-out": "bun tests/smoke/smoke-image-out.ts",
+    "smoke:mcp": "bun tests/smoke/smoke-mcp.ts",
+    "smoke:mcp-resume": "bun tests/smoke/smoke-mcp-resume.ts",
+    "smoke:mcp-e2e": "bun tests/smoke/smoke-mcp-e2e.ts",
     "smoke:robustness": "bun tests/smoke/smoke-robustness.ts",
-    "smoke:all": "bun test src/lib && bun tests/test-agy-args.ts && bun tests/smoke/smoke-basic.ts && bun tests/smoke/smoke-flags.ts && bun tests/smoke/smoke-permissions.ts && bun tests/smoke/smoke-image-in.ts && bun tests/smoke/smoke-image-out.ts && bun tests/smoke/smoke-robustness.ts"
+    "smoke:all": "bun test src/lib && bun tests/test-agy-args.ts && bun tests/smoke/smoke-mcp.ts && bun tests/smoke/smoke-mcp-resume.ts && bun tests/smoke/smoke-basic.ts && bun tests/smoke/smoke-flags.ts && bun tests/smoke/smoke-permissions.ts && bun tests/smoke/smoke-image-in.ts && bun tests/smoke/smoke-image-out.ts && bun tests/smoke/smoke-robustness.ts"
   },
   "keywords": [
     "antigravity",