@zuzuucodes/cli 1.1.0 → 1.2.1

package/web-app/dist/sessions.js

@@ -0,0 +1,334 @@
+import os from "node:os";
+import crypto from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import pty from "@lydell/node-pty";
+import xtermHeadless from "@xterm/headless";
+import addonSerialize from "@xterm/addon-serialize";
+// Both packages are CJS bundles without ESM named exports.
+const { Terminal } = xtermHeadless;
+const { SerializeAddon } = addonSerialize;
+import { ServerOp, FLOW_HIGH_WATER, FLOW_LOW_WATER, } from "./protocol/index.js";
+import { encodeFrame } from "./frames.js";
+import { toRel } from "./safe-path.js";
+import { buildInjection, cleanupInjection } from "./shell-integration/inject.js";
+const execFileAsync = promisify(execFile);
+const SCROLLBACK = 10_000;
+const CWD_POLL_MS = 2_500;
+/** asciicast ring buffer caps */
+const REC_MAX_BYTES = 2 * 1024 * 1024;
+const REC_MAX_EVENTS = 10_000;
+/** Resolve the live working directory of a process, shell-agnostically. */
+async function processCwd(pid) {
+    try {
+        if (process.platform === "linux") {
+            const { stdout } = await execFileAsync("readlink", [`/proc/${pid}/cwd`], { timeout: 1000 });
+            return stdout.trim() || null;
+        }
+        // darwin: -Fn prints "p<pid>" then "n<path>" lines
+        const { stdout } = await execFileAsync("lsof", ["-a", "-p", String(pid), "-d", "cwd", "-Fn"], { timeout: 2000 });
+        const line = stdout.split("\n").find((l) => l.startsWith("n"));
+        return line ? line.slice(1) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Parse an OSC 7 payload `file://host/path` into a decoded absolute path. */
+export function parseOsc7(payload) {
+    const m = /^file:\/\/[^/]*(\/.*)$/.exec(payload);
+    if (!m)
+        return null;
+    try {
+        return decodeURIComponent(m[1]);
+    }
+    catch {
+        return m[1];
+    }
+}
+function pickShell() {
+    if (process.platform === "win32")
+        return process.env.COMSPEC ?? "cmd.exe";
+    return process.env.SHELL ?? (process.platform === "darwin" ? "/bin/zsh" : "/bin/bash");
+}
+/**
+ * A PTY whose lifetime is decoupled from any WebSocket. A headless xterm
+ * mirrors all output so a (re)attaching client gets an accurate replay of
+ * screen + scrollback via the serialize addon, then streams live.
+ *
+ * Flow control: while a client is attached we count PTY output bytes in
+ * flight (sent but not yet acked by the client's `term.write` callbacks).
+ * Above the high-water mark the PTY is paused — backpressure propagates to
+ * the kernel pty buffer, so `yes` / giant `cat` never overruns the browser.
+ */
+export class Session {
+    cwd;
+    root;
+    onUpdate;
+    id = crypto.randomBytes(8).toString("hex");
+    createdAt = Date.now();
+    title;
+    alive = true;
+    /** live working directory of the shell (absolute) */
+    cwdAbs;
+    pty;
+    mirror;
+    serializer = new SerializeAddon();
+    socket = null;
+    inflight = 0;
+    paused = false;
+    exitPayload = null;
+    cwdTimer = null;
+    cwdPolling = false;
+    /** true once OSC 7 has reported cwd — the poll fallback then stops */
+    oscCwd = false;
+    tempDir;
+    // asciicast v2 ring buffer ("o" + "r" only — input is never recorded)
+    castEvents = [];
+    castBytes = 0;
+    castTruncated = false;
+    constructor(cwd, root, cols = 80, rows = 24, onUpdate) {
+        this.cwd = cwd;
+        this.root = root;
+        this.onUpdate = onUpdate;
+        this.cwdAbs = cwd;
+        const shell = pickShell();
+        this.title = shell.split("/").pop() ?? shell;
+        this.mirror = new Terminal({ cols, rows, scrollback: SCROLLBACK, allowProposedApi: true });
+        this.mirror.loadAddon(this.serializer);
+        // OSC 7: the shell reports its real cwd instantly/exactly; this makes
+        // the poll loop a fallback for shells where the hook didn't load.
+        this.mirror.parser.registerOscHandler(7, (payload) => {
+            const dir = parseOsc7(payload);
+            if (dir) {
+                this.oscCwd = true;
+                this.stopCwdPolling();
+                if (dir !== this.cwdAbs) {
+                    this.cwdAbs = dir;
+                    this.send(encodeFrame(ServerOp.Cwd, JSON.stringify(this.cwdPayload())));
+                    this.onUpdate();
+                }
+            }
+            return true;
+        });
+        const injection = process.platform === "win32" ? null : buildInjection(shell);
+        this.tempDir = injection?.tempDir;
+        const args = injection?.args ?? (process.platform === "win32" ? [] : ["-l"]);
+        this.pty = pty.spawn(shell, args, {
+            name: "xterm-256color",
+            cols,
+            rows,
+            cwd,
+            env: {
+                ...process.env,
+                ...injection?.env,
+                TERM: "xterm-256color",
+                COLORTERM: "truecolor",
+                WEBCODE: "1",
+            },
+        });
+        this.pty.onData((data) => {
+            this.mirror.write(data);
+            this.recordEvent("o", data);
+            const proc = this.pty.process;
+            if (proc && proc !== this.title) {
+                this.title = proc;
+                this.send(encodeFrame(ServerOp.Title, JSON.stringify({ title: this.title })));
+                this.onUpdate();
+            }
+            if (this.socket) {
+                const frame = encodeFrame(ServerOp.Output, Buffer.from(data, "utf8"));
+                this.inflight += frame.length - 1;
+                this.send(frame);
+                if (!this.paused && this.inflight > FLOW_HIGH_WATER) {
+                    this.paused = true;
+                    this.pty.pause();
+                }
+            }
+        });
+        this.pty.onExit(({ exitCode, signal }) => {
+            this.alive = false;
+            this.exitPayload = JSON.stringify({ exitCode, signal });
+            this.send(encodeFrame(ServerOp.Exit, this.exitPayload));
+            this.onUpdate();
+        });
+    }
+    /** Single-attachment model: a new client takes over the session. */
+    attach(ws) {
+        if (this.socket && this.socket !== ws) {
+            this.socket.close(4000, "session attached elsewhere");
+        }
+        this.socket = ws;
+        this.resetFlow();
+        const snapshot = this.serializer.serialize({ scrollback: SCROLLBACK });
+        ws.send(encodeFrame(ServerOp.Replay, snapshot));
+        ws.send(encodeFrame(ServerOp.Cwd, JSON.stringify(this.cwdPayload())));
+        if (!this.alive && this.exitPayload) {
+            ws.send(encodeFrame(ServerOp.Exit, this.exitPayload));
+        }
+        this.startCwdPolling();
+    }
+    detach(ws) {
+        if (this.socket === ws) {
+            this.socket = null;
+            this.resetFlow();
+            this.stopCwdPolling();
+        }
+    }
+    // ── cwd tracking ───────────────────────────────────────────────────
+    cwdPayload() {
+        const inside = this.cwdAbs === this.root || this.cwdAbs.startsWith(this.root + "/");
+        return inside
+            ? { cwd: toRel(this.root, this.cwdAbs) }
+            : { cwd: this.cwdAbs, outside: true };
+    }
+    startCwdPolling() {
+        if (this.cwdTimer || !this.alive || this.oscCwd)
+            return;
+        this.cwdTimer = setInterval(() => {
+            if (this.cwdPolling)
+                return;
+            this.cwdPolling = true;
+            void processCwd(this.pty.pid)
+                .then((dir) => {
+                if (dir && dir !== this.cwdAbs) {
+                    this.cwdAbs = dir;
+                    this.send(encodeFrame(ServerOp.Cwd, JSON.stringify(this.cwdPayload())));
+                    this.onUpdate();
+                }
+            })
+                .finally(() => {
+                this.cwdPolling = false;
+            });
+        }, CWD_POLL_MS);
+    }
+    stopCwdPolling() {
+        if (this.cwdTimer) {
+            clearInterval(this.cwdTimer);
+            this.cwdTimer = null;
+        }
+    }
+    // ── asciicast recording ────────────────────────────────────────────
+    recordEvent(code, data) {
+        this.castEvents.push([(Date.now() - this.createdAt) / 1000, code, data]);
+        this.castBytes += data.length;
+        while (this.castEvents.length > REC_MAX_EVENTS ||
+            (this.castBytes > REC_MAX_BYTES && this.castEvents.length > 1)) {
+            const dropped = this.castEvents.shift();
+            this.castBytes -= dropped[2].length;
+            this.castTruncated = true;
+        }
+    }
+    /** Serialize the buffer as asciicast v2 (NDJSON). */
+    recording() {
+        const header = {
+            version: 2,
+            width: this.pty.cols,
+            height: this.pty.rows,
+            timestamp: Math.floor(this.createdAt / 1000),
+            title: `webcode — ${this.title}`,
+            env: { SHELL: process.env.SHELL ?? "", TERM: "xterm-256color" },
+        };
+        const lines = [JSON.stringify(header)];
+        for (const ev of this.castEvents) {
+            lines.push(JSON.stringify([Math.round(ev[0] * 1000) / 1000, ev[1], ev[2]]));
+        }
+        return lines.join("\n") + "\n";
+    }
+    write(data) {
+        if (this.alive)
+            this.pty.write(data);
+    }
+    resize(cols, rows) {
+        if (!Number.isInteger(cols) || !Number.isInteger(rows))
+            return;
+        if (cols < 2 || rows < 1 || cols > 1000 || rows > 1000)
+            return;
+        this.mirror.resize(cols, rows);
+        if (this.alive)
+            this.pty.resize(cols, rows);
+        this.recordEvent("r", `${cols}x${rows}`);
+    }
+    /** Client reports bytes it has finished rendering. */
+    ack(bytes) {
+        if (!Number.isFinite(bytes) || bytes < 0)
+            return;
+        this.inflight = Math.max(0, this.inflight - bytes);
+        if (this.paused && this.inflight < FLOW_LOW_WATER) {
+            this.paused = false;
+            if (this.alive)
+                this.pty.resume();
+        }
+    }
+    /** Nobody is listening: stop counting and let the PTY run free. */
+    resetFlow() {
+        this.inflight = 0;
+        if (this.paused) {
+            this.paused = false;
+            if (this.alive)
+                this.pty.resume();
+        }
+    }
+    send(frame) {
+        if (this.socket && this.socket.readyState === this.socket.OPEN) {
+            this.socket.send(frame);
+        }
+    }
+    kill() {
+        this.stopCwdPolling();
+        this.socket?.close(1000, "session closed");
+        this.socket = null;
+        if (this.alive) {
+            try {
+                this.pty.kill();
+            }
+            catch {
+                // already gone
+            }
+        }
+        this.mirror.dispose();
+        cleanupInjection(this.tempDir);
+    }
+    info() {
+        return {
+            id: this.id,
+            title: this.title,
+            cwd: this.cwdAbs,
+            alive: this.alive,
+            createdAt: this.createdAt,
+        };
+    }
+}
+export class SessionManager {
+    defaultCwd;
+    sessions = new Map();
+    constructor(defaultCwd = os.homedir()) {
+        this.defaultCwd = defaultCwd;
+    }
+    create(cwd, cols, rows) {
+        const session = new Session(cwd ?? this.defaultCwd, this.defaultCwd, cols, rows, () => { });
+        this.sessions.set(session.id, session);
+        return session;
+    }
+    get(id) {
+        return this.sessions.get(id);
+    }
+    list() {
+        return [...this.sessions.values()]
+            .sort((a, b) => a.createdAt - b.createdAt)
+            .map((s) => s.info());
+    }
+    close(id) {
+        const session = this.sessions.get(id);
+        if (!session)
+            return false;
+        session.kill();
+        this.sessions.delete(id);
+        return true;
+    }
+    shutdown() {
+        for (const session of this.sessions.values())
+            session.kill();
+        this.sessions.clear();
+    }
+}

package/web-app/dist/shell-integration/inject.js

@@ -0,0 +1,70 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { fileURLToPath } from "node:url";
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+function readScript(name) {
+    // scripts sit beside this module in src; tsc copies them to dist via the
+    // build step (see package.json), so resolve relative to the compiled file.
+    return fs.readFileSync(path.join(HERE, name), "utf8");
+}
+/**
+ * Build the spawn args + env that load webcode's OSC 133 / OSC 7 shell
+ * integration after the user's own rc. Returns null for shells we don't
+ * integrate (caller spawns as before and falls back to cwd polling).
+ *
+ * Mirrors VS Code's approach: a temp ZDOTDIR for zsh, --rcfile for bash,
+ * a vendor conf.d for fish.
+ */
+export function buildInjection(shell) {
+    const base = path.basename(shell);
+    if (base === "zsh") {
+        const dir = mkTemp();
+        const prevZdotdir = process.env.ZDOTDIR ?? os.homedir();
+        // Each entry point sources the user's original, and .zshrc then adds us.
+        const sourcePrev = (file) => `[ -f "${prevZdotdir}/${file}" ] && WEBCODE_IN_INIT=1 . "${prevZdotdir}/${file}"\n`;
+        write(dir, ".zshenv", sourcePrev(".zshenv"));
+        write(dir, ".zprofile", sourcePrev(".zprofile"));
+        write(dir, ".zlogin", sourcePrev(".zlogin"));
+        write(dir, ".zshrc", sourcePrev(".zshrc") + readScript("webcode.zsh"));
+        return {
+            args: ["-l"],
+            env: { ZDOTDIR: dir, WEBCODE_ZDOTDIR_PREV: prevZdotdir },
+            tempDir: dir,
+        };
+    }
+    if (base === "bash") {
+        const dir = mkTemp();
+        const rc = path.join(dir, "rc.bash");
+        fs.writeFileSync(rc, `[ -f ~/.bashrc ] && . ~/.bashrc\n` + readScript("webcode.bash"), "utf8");
+        // interactive (not login) so --rcfile is honored; the rc sources ~/.bashrc
+        return { args: ["--rcfile", rc, "-i"], env: {}, tempDir: dir };
+    }
+    if (base === "fish") {
+        const dir = mkTemp();
+        const confDir = path.join(dir, "fish", "vendor_conf.d");
+        fs.mkdirSync(confDir, { recursive: true });
+        fs.writeFileSync(path.join(confDir, "webcode.fish"), readScript("webcode.fish"), "utf8");
+        // fish reads conf.d from each XDG_DATA_DIRS/fish entry
+        const prev = process.env.XDG_DATA_DIRS ?? "/usr/local/share:/usr/share";
+        return {
+            args: ["-l"],
+            env: { XDG_DATA_DIRS: `${dir}:${prev}` },
+            tempDir: dir,
+        };
+    }
+    return null;
+}
+function mkTemp() {
+    const dir = path.join(os.tmpdir(), `webcode-si-${crypto.randomBytes(6).toString("hex")}`);
+    fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
+function write(dir, file, content) {
+    fs.writeFileSync(path.join(dir, file), content, "utf8");
+}
+export function cleanupInjection(tempDir) {
+    if (tempDir)
+        fs.rm(tempDir, { recursive: true, force: true }, () => { });
+}

package/web-app/dist/shell-integration/webcode.bash

@@ -0,0 +1,41 @@
+# webcode shell integration (bash) — OSC 133 semantic prompts + OSC 7 cwd.
+# Sourced from a temp --rcfile after the user's ~/.bashrc has loaded.
+# Uses the bash-preexec pattern (DEBUG trap + PROMPT_COMMAND) since bash has
+# no native preexec/precmd hooks.
+if [[ -n "$WEBCODE" && -z "$WEBCODE_SI_LOADED" ]]; then
+  WEBCODE_SI_LOADED=1
+
+  __webcode_osc7() {
+    printf '\033]7;file://%s%s\033\\' "${HOSTNAME:-localhost}" "$PWD"
+  }
+
+  # Fires before drawing each prompt: close previous command (D;exit), emit
+  # cwd (OSC 7) and prompt start (A). $? must be captured first.
+  __webcode_prompt() {
+    local exit=$?
+    printf '\033]133;D;%s\033\\' "$exit"
+    __webcode_osc7
+    printf '\033]133;A\033\\'
+    __webcode_preexec_armed=1
+  }
+
+  # DEBUG trap fires before each command runs → emit output start (C). Armed
+  # once per prompt so it doesn't fire for PROMPT_COMMAND's own subshells.
+  __webcode_preexec_armed=0
+  __webcode_debug() {
+    if [[ "$__webcode_preexec_armed" == 1 && "$BASH_COMMAND" != "__webcode_prompt" ]]; then
+      __webcode_preexec_armed=0
+      printf '\033]133;C\033\\'
+    fi
+  }
+
+  # mark prompt end (B = command start region)
+  PS1="$PS1"'\[\033]133;B\033\\\]'
+
+  case "$PROMPT_COMMAND" in
+    *__webcode_prompt*) ;;
+    "") PROMPT_COMMAND="__webcode_prompt" ;;
+    *) PROMPT_COMMAND="__webcode_prompt;$PROMPT_COMMAND" ;;
+  esac
+  trap '__webcode_debug' DEBUG
+fi

package/web-app/dist/shell-integration/webcode.fish

@@ -0,0 +1,28 @@
+# webcode shell integration (fish) — OSC 133 semantic prompts + OSC 7 cwd.
+# Dropped into a temp vendor_conf.d so fish auto-loads it after user config.
+if test -n "$WEBCODE"; and not set -q WEBCODE_SI_LOADED
+    set -g WEBCODE_SI_LOADED 1
+
+    function __webcode_osc7 --on-variable PWD
+        printf '\033]7;file://%s%s\033\\' (hostname) "$PWD"
+    end
+
+    # prompt start (A) + previous-command done (D;exit)
+    function __webcode_prompt_start --on-event fish_prompt
+        printf '\033]133;D;%s\033\\' $status
+        __webcode_osc7
+        printf '\033]133;A\033\\'
+    end
+
+    # command start (C)
+    function __webcode_preexec --on-event fish_preexec
+        printf '\033]133;C\033\\'
+    end
+
+    # mark prompt end (B) by wrapping fish_prompt
+    functions -q __webcode_orig_fish_prompt; or functions -c fish_prompt __webcode_orig_fish_prompt
+    function fish_prompt
+        __webcode_orig_fish_prompt
+        printf '\033]133;B\033\\'
+    end
+end

package/web-app/dist/shell-integration/webcode.zsh

@@ -0,0 +1,35 @@
+# webcode shell integration (zsh) — emits OSC 133 semantic prompts + OSC 7 cwd.
+# Sourced from a temp ZDOTDIR .zshrc after the user's own rc has loaded.
+# Guarded so it only runs inside webcode and only once.
+if [[ -n "$WEBCODE" && -z "$WEBCODE_SI_LOADED" ]]; then
+  WEBCODE_SI_LOADED=1
+
+  __webcode_osc7() {
+    printf '\033]7;file://%s%s\033\\' "$HOST" "$PWD"
+  }
+
+  # prompt start (A) + previous-command done (D;exit) live in precmd;
+  # command start (C) lives in preexec.
+  __webcode_precmd() {
+    local exit=$?
+    printf '\033]133;D;%s\033\\' "$exit"
+    __webcode_osc7
+    printf '\033]133;A\033\\'
+  }
+
+  __webcode_preexec() {
+    printf '\033]133;C\033\\'
+  }
+
+  # mark the end of the prompt (B = command start region) by appending to PS1
+  PS1="$PS1"$'%{\033]133;B\033\\%}'
+
+  autoload -Uz add-zsh-hook 2>/dev/null
+  if (( $+functions[add-zsh-hook] )); then
+    add-zsh-hook precmd __webcode_precmd
+    add-zsh-hook preexec __webcode_preexec
+  else
+    precmd_functions+=(__webcode_precmd)
+    preexec_functions+=(__webcode_preexec)
+  fi
+fi

package/web-app/dist/workflows.js

@@ -0,0 +1,48 @@
+import fsp from "node:fs/promises";
+import path from "node:path";
+import { resolveSafe } from "./safe-path.js";
+const WORKFLOW_DIR = ".webcode/workflows";
+/** List workflows stored under .webcode/workflows/*.json in the workspace. */
+export async function listWorkflows(root) {
+    let dir;
+    try {
+        dir = await resolveSafe(root, WORKFLOW_DIR);
+    }
+    catch {
+        return [];
+    }
+    let names;
+    try {
+        names = await fsp.readdir(dir);
+    }
+    catch {
+        return []; // dir doesn't exist yet
+    }
+    const workflows = [];
+    for (const name of names) {
+        if (!name.endsWith(".json"))
+            continue;
+        try {
+            const raw = await fsp.readFile(path.join(dir, name), "utf8");
+            const wf = JSON.parse(raw);
+            if (wf.name && wf.command)
+                workflows.push(wf);
+        }
+        catch {
+            // skip malformed
+        }
+    }
+    return workflows.sort((a, b) => a.name.localeCompare(b.name));
+}
+/** Persist a workflow as .webcode/workflows/<slug>.json. */
+export async function saveWorkflow(root, wf) {
+    const slug = wf.name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-|-$/g, "") || "workflow";
+    const rel = `${WORKFLOW_DIR}/${slug}.json`;
+    const abs = await resolveSafe(root, rel);
+    await fsp.mkdir(path.dirname(abs), { recursive: true });
+    await fsp.writeFile(abs, JSON.stringify(wf, null, 2) + "\n", "utf8");
+    return rel;
+}

package/web-app/dist/ws-fs.js

@@ -0,0 +1,69 @@
+import { watch } from "chokidar";
+import { resolveSafe } from "./safe-path.js";
+const DEBOUNCE_MS = 120;
+const MAX_WATCHES = 200;
+/**
+ * The explorer watches only the directories it currently has expanded —
+ * non-recursive, one watcher each — so fd usage stays bounded no matter how
+ * big the workspace is. Events are debounced per directory and the client
+ * just refetches that directory's listing.
+ */
+export function handleFsSocket(ws, root) {
+    const watchers = new Map();
+    const pending = new Map();
+    const notify = (relPath) => {
+        clearTimeout(pending.get(relPath));
+        pending.set(relPath, setTimeout(() => {
+            pending.delete(relPath);
+            if (ws.readyState === ws.OPEN) {
+                const msg = { type: "changed", path: relPath };
+                ws.send(JSON.stringify(msg));
+            }
+        }, DEBOUNCE_MS));
+    };
+    ws.on("message", (raw) => {
+        void (async () => {
+            let msg;
+            try {
+                msg = JSON.parse(raw.toString());
+            }
+            catch {
+                return;
+            }
+            if (msg.type === "watch") {
+                if (watchers.has(msg.path) || watchers.size >= MAX_WATCHES)
+                    return;
+                let abs;
+                try {
+                    abs = await resolveSafe(root, msg.path);
+                }
+                catch {
+                    return;
+                }
+                const watcher = watch(abs, {
+                    depth: 0,
+                    ignoreInitial: true,
+                    followSymlinks: false,
+                });
+                watcher.on("all", () => notify(msg.path));
+                watcher.on("error", () => { });
+                watchers.set(msg.path, watcher);
+            }
+            else if (msg.type === "unwatch") {
+                const watcher = watchers.get(msg.path);
+                if (watcher) {
+                    watchers.delete(msg.path);
+                    void watcher.close();
+                }
+            }
+        })();
+    });
+    ws.on("close", () => {
+        for (const timer of pending.values())
+            clearTimeout(timer);
+        pending.clear();
+        for (const watcher of watchers.values())
+            void watcher.close();
+        watchers.clear();
+    });
+}

package/web-app/dist/ws-term.js

@@ -0,0 +1,42 @@
+import { ClientOp } from "./protocol/index.js";
+import { decodeFrame } from "./frames.js";
+export function handleTermSocket(ws, session) {
+    session.attach(ws);
+    ws.on("message", (raw, isBinary) => {
+        if (!isBinary && !Buffer.isBuffer(raw))
+            return;
+        let frame;
+        try {
+            frame = decodeFrame(Buffer.isBuffer(raw) ? raw : Buffer.from(raw));
+        }
+        catch {
+            return;
+        }
+        switch (frame.op) {
+            case ClientOp.Input:
+                session.write(frame.payload.toString("utf8"));
+                break;
+            case ClientOp.Resize: {
+                try {
+                    const { cols, rows } = JSON.parse(frame.payload.toString("utf8"));
+                    session.resize(cols, rows);
+                }
+                catch {
+                    // ignore malformed resize
+                }
+                break;
+            }
+            case ClientOp.Ack: {
+                try {
+                    const { bytes } = JSON.parse(frame.payload.toString("utf8"));
+                    session.ack(bytes);
+                }
+                catch {
+                    // ignore malformed ack
+                }
+                break;
+            }
+        }
+    });
+    ws.on("close", () => session.detach(ws));
+}