acp-devtools 0.2.1 → 0.3.0

package/dist/index.js

@@ -9495,9 +9495,22 @@ var init_paths = __esm({
 // ../core/dist/server/queries.js
 import { existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
 import { dirname } from "path";
-function listSessionsSummary(dbPath, limit = 200) {
+function listSessionsSummary(dbPath, limit = 200, filters = {}) {
   if (!existsSync2(dbPath))
     return [];
+  const where = [];
+  const params = [];
+  if (filters.imported === true)
+    where.push("s.imported_at IS NOT NULL");
+  if (filters.imported === false)
+    where.push("s.imported_at IS NULL");
+  if (filters.client) {
+    where.push(`(instr(lower(coalesce(s.client_name, '')), ?)
+              + instr(lower(coalesce(s.client_version, '')), ?)
+              + instr(lower(coalesce(s.client_platform, '')), ?)) > 0`);
+    const needle = filters.client.toLowerCase();
+    params.push(needle, needle, needle);
+  }
   const db = openDatabase(dbPath);
   try {
     return db.prepare(
@@ -9514,21 +9527,16 @@ function listSessionsSummary(dbPath, limit = 200) {
                     s.current_mode, s.current_model,
                     (SELECT COUNT(*) FROM messages WHERE session_id = s.id) AS message_count
                  FROM sessions s
+                 ${where.length > 0 ? `WHERE ${where.join(" AND ")}` : ""}
                  ORDER BY COALESCE(s.imported_at, s.started_at) DESC
                  LIMIT ?`
-    ).all(limit);
+    ).all(...params, limit);
   } finally {
     db.close();
   }
 }
 function findSessionsByClient(dbPath, needle, limit = 200) {
-  const pool = listSessionsSummary(dbPath, FIND_BY_CLIENT_POOL_SIZE);
-  const lower = needle.toLowerCase();
-  const matches = pool.filter((s) => {
-    const candidates = [s.client_name, s.client_version, s.client_platform].filter((v) => typeof v === "string");
-    return candidates.some((c) => c.toLowerCase().includes(lower));
-  });
-  return matches.slice(0, limit);
+  return listSessionsSummary(dbPath, limit, { client: needle });
 }
 function insertImportedSession(dbPath, exp, options = {}) {
   mkdirSync2(dirname(dbPath), { recursive: true });
@@ -9568,13 +9576,11 @@ function deleteSession(dbPath, sessionId) {
     db.close();
   }
 }
-var FIND_BY_CLIENT_POOL_SIZE;
 var init_queries = __esm({
   "../core/dist/server/queries.js"() {
     "use strict";
     init_session();
     init_sqlite();
-    FIND_BY_CLIENT_POOL_SIZE = 500;
   }
 });
 
@@ -9672,10 +9678,36 @@ var init_replay = __esm({
 // ../core/dist/server/http.js
 import { existsSync as existsSync4 } from "fs";
 import { WebSocketServer as WebSocketServer2 } from "ws";
+function stripPort(host) {
+  if (host.startsWith("[")) {
+    const end = host.indexOf("]");
+    return end === -1 ? host : host.slice(1, end);
+  }
+  const colon = host.lastIndexOf(":");
+  if (colon !== -1 && host.indexOf(":") === colon)
+    return host.slice(0, colon);
+  return host;
+}
+function isAllowedHost(hostHeader, allowedHosts = []) {
+  if (allowedHosts.some((h) => WILDCARD_BINDS.has(h)))
+    return true;
+  if (typeof hostHeader !== "string" || hostHeader.length === 0)
+    return false;
+  const host = stripPort(hostHeader.trim()).toLowerCase();
+  if (LOOPBACK_HOSTS.has(host))
+    return true;
+  return allowedHosts.some((h) => stripPort(h).toLowerCase() === host);
+}
 function createApiHandler(options) {
   return (req, res) => {
     const url = req.url ?? "";
-    const path = url.split("?")[0];
+    const path = url.split("?")[0] ?? "";
+    if (path.startsWith("/api/") && !isAllowedHost(req.headers.host, options.allowedHosts)) {
+      res.statusCode = 403;
+      res.setHeader("content-type", "application/json");
+      res.end(JSON.stringify({ error: "forbidden host" }));
+      return true;
+    }
     if (path === "/api/active") {
       handleActive(req, res);
       return true;
@@ -9886,13 +9918,18 @@ function attachReplayUpgrade(httpServer, options) {
     const match = url.match(/^\/replay\/(\d+)/);
     if (!match)
       return;
+    if (!isAllowedHost(req.headers.host, options.allowedHosts)) {
+      socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+      socket.destroy();
+      return;
+    }
     const sessionId = Number(match[1]);
     wss.handleUpgrade(req, socket, head, (ws) => {
       streamReplay(ws, sessionId, options.capturesDbPath);
     });
   });
 }
-var IMPORT_MAX_BYTES;
+var LOOPBACK_HOSTS, WILDCARD_BINDS, IMPORT_MAX_BYTES;
 var init_http = __esm({
   "../core/dist/server/http.js"() {
     "use strict";
@@ -9902,6 +9939,8 @@ var init_http = __esm({
     init_sqlite();
     init_queries();
     init_replay();
+    LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1"]);
+    WILDCARD_BINDS = /* @__PURE__ */ new Set(["0.0.0.0", "::", "*"]);
     IMPORT_MAX_BYTES = 64 * 1024 * 1024;
   }
 });
@@ -10282,7 +10321,11 @@ var init_table = __esm({
 function registerDiffCommand(program) {
   program.command("diff").description(
     'Align two saved sessions and show what changed between them \u2014 added / removed frames and field-level payload differences. Useful for "worked yesterday, broke today" and A/B comparisons of two agents on the same prompt.'
-  ).argument("<a>", "baseline session id (left side)").argument("<b>", "new session id (right side)").option("--db <path>", "captures database", defaultCapturesDbPath()).option("--full", "print unchanged frames too (default collapses equal runs)").option("--json", "machine-readable JSON instead of human-readable text").action((rawA, rawB, opts) => {
+  ).argument("<a>", "baseline session id (left side)").argument("<b>", "new session id (right side)").option("--db <path>", "captures database", defaultCapturesDbPath()).option("--full", "print unchanged frames too (default collapses equal runs)").option("--json", "machine-readable JSON instead of human-readable text").option(
+    "--raw",
+    "skip default redaction of auth headers / proxy tokens (use only when the output stays on YOUR machine)",
+    false
+  ).action((rawA, rawB, opts) => {
     const idA = parseId(rawA);
     const idB = parseId(rawB);
     let db;
@@ -10313,6 +10356,32 @@ function registerDiffCommand(program) {
       process.exit(1);
     }
     db.close();
+    let fieldsRedacted = 0;
+    let messagesAffected = 0;
+    if (!opts.raw) {
+      const redactAll = (msgs) => msgs.map((m) => {
+        const r = redactMessage(m);
+        if (r.count > 0) {
+          messagesAffected += 1;
+          fieldsRedacted += r.count;
+        }
+        return r.redacted;
+      });
+      msgsA = redactAll(msgsA);
+      msgsB = redactAll(msgsB);
+    }
+    const writeRedactionNote = () => {
+      if (opts.raw) {
+        process.stderr.write(
+          "acp-devtools: --raw was set; output may contain auth headers / proxy tokens \u2014 do not share publicly\n"
+        );
+      } else if (fieldsRedacted > 0) {
+        process.stderr.write(
+          `acp-devtools: redacted ${fieldsRedacted} field(s) across ${messagesAffected} message(s) \u2014 re-run with --raw to compare live values
+`
+        );
+      }
+    };
     const diff = buildSessionDiff(msgsA, msgsB);
     const meta = buildMetadataDiff(msgsA, msgsB);
     const perf = buildMethodStatsDiff(msgsA, msgsB);
@@ -10331,12 +10400,14 @@ function registerDiffCommand(program) {
           2
         ) + "\n"
       );
+      writeRedactionNote();
       return;
     }
     const st = createStyler(colorEnabled(process.stdout));
     process.stdout.write(
       renderDiff(infoA, infoB, msgsA.length, msgsB.length, diff, meta, perf, Boolean(opts.full), st)
     );
+    writeRedactionNote();
   });
 }
 function heading(st, label) {
@@ -10782,7 +10853,7 @@ var CLI_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    CLI_VERSION = "0.2.1";
+    CLI_VERSION = "0.3.0";
   }
 });
 
@@ -11201,18 +11272,17 @@ function registerListCommand(program) {
 `);
       process.exit(2);
     }
-    let rows = listSessionsSummary(opts.db, limit);
-    if (opts.imported) rows = rows.filter((r) => r.imported_at !== null);
-    if (opts.saved) rows = rows.filter((r) => r.imported_at === null);
-    if (opts.client) {
-      const needle = opts.client.toLowerCase();
-      rows = rows.filter((r) => {
-        const fields = [r.client_name, r.client_version, r.client_platform].filter(
-          (v) => typeof v === "string"
-        );
-        return fields.some((f) => f.toLowerCase().includes(needle));
-      });
+    if (opts.imported && opts.saved) {
+      process.stderr.write(
+        "acp-devtools: --imported and --saved are mutually exclusive\n"
+      );
+      process.exit(2);
     }
+    const filters = {};
+    if (opts.imported) filters.imported = true;
+    if (opts.saved) filters.imported = false;
+    if (opts.client) filters.client = opts.client;
+    const rows = listSessionsSummary(opts.db, limit, filters);
     if (opts.json) {
       process.stdout.write(JSON.stringify(rows, null, 2) + "\n");
       return;
@@ -11980,7 +12050,7 @@ import { readFileSync as readFileSync3 } from "fs";
 import { basename as basename2 } from "path";
 function loadPlaybackScript(opts) {
   if (opts.script && opts.session !== void 0) {
-    throw new Error("--script and --session are mutually exclusive");
+    throw new PlaybackUsageError("--script and --session are mutually exclusive");
   }
   if (opts.script) {
     let text;
@@ -11999,7 +12069,7 @@ function loadPlaybackScript(opts) {
     if (opts.session !== void 0) {
       const id = Number(opts.session);
       if (!Number.isInteger(id) || id <= 0) {
-        throw new Error(`invalid --session "${opts.session}"`);
+        throw new PlaybackUsageError(`invalid --session "${opts.session}"`);
       }
       session = Session.load(db, id);
     } else {
@@ -12019,10 +12089,17 @@ function loadPlaybackScript(opts) {
     db.close();
   }
 }
+var PlaybackUsageError;
 var init_playback_source = __esm({
   "src/commands/playback-source.ts"() {
     "use strict";
     init_dist();
+    PlaybackUsageError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "PlaybackUsageError";
+      }
+    };
   }
 });
 
@@ -12052,7 +12129,7 @@ function registerMockAgentCommand(program) {
       const msg = err instanceof Error ? err.message : String(err);
       process.stderr.write(`acp-devtools: ${msg}
 `);
-      process.exit(1);
+      process.exit(err instanceof PlaybackUsageError ? 2 : 1);
     }
     const engine = new PlaybackEngine(loaded.messages, "agent");
     process.stderr.write(
@@ -12112,11 +12189,18 @@ function registerMockAgentCommand(program) {
       }
     };
     let pendingTimer = null;
+    let stdinEnded = false;
     const emit = (line) => {
       process.stdout.write(line + "\n");
       log("\u2190", line);
       capture(line, "agent-to-editor");
     };
+    const finishIfDrained = () => {
+      if (stdinEnded && !pendingTimer) {
+        closeSession();
+        process.exit(0);
+      }
+    };
     const drain = () => {
       if (pendingTimer) return;
       while (true) {
@@ -12135,9 +12219,7 @@ function registerMockAgentCommand(program) {
           emit(step.line);
           continue;
         }
-        if (step.kind === "done") {
-          return;
-        }
+        finishIfDrained();
         return;
       }
     };
@@ -12157,9 +12239,8 @@ function registerMockAgentCommand(program) {
       }
     });
     process.stdin.on("end", () => {
+      stdinEnded = true;
       drain();
-      closeSession();
-      process.exit(0);
     });
     drain();
   });
@@ -12198,7 +12279,7 @@ function registerMockEditorCommand(program) {
       const msg = err instanceof Error ? err.message : String(err);
       process.stderr.write(`acp-devtools: ${msg}
 `);
-      process.exit(1);
+      process.exit(err instanceof PlaybackUsageError ? 2 : 1);
     }
     const engine = new PlaybackEngine(loaded.messages, "editor");
     process.stderr.write(
@@ -12396,7 +12477,7 @@ function registerProxyCommand(program) {
     } else {
       process.stderr.write(
         `acp-devtools: no agent specified.
-  Pass an agent command (\`acp-devtools proxy npx -y @zed-industries/claude-code-acp\`)
+  Pass an agent command (\`acp-devtools proxy npx -y @agentclientprotocol/claude-agent-acp\`)
   or use --agent <name> with one of: ${knownAgentList}.
 `
       );
@@ -12850,7 +12931,11 @@ var init_search = __esm({
 function registerSessionInfoCommand(program) {
   program.command("session-info").description(
     "Print derived client/agent metadata for a saved session \u2014 the terminal equivalent of the inspector's session info panel."
-  ).argument("<id>", "session id (see `acp-devtools list`)").option("--db <path>", "captures database", defaultCapturesDbPath()).option("--json", "machine-readable JSON instead of human-readable text").action((rawId, opts) => {
+  ).argument("<id>", "session id (see `acp-devtools list`)").option("--db <path>", "captures database", defaultCapturesDbPath()).option("--json", "machine-readable JSON instead of human-readable text").option(
+    "--raw",
+    "skip default redaction of auth headers / proxy tokens (use only when the output stays on YOUR machine)",
+    false
+  ).action((rawId, opts) => {
     const id = Number(rawId);
     if (!Number.isInteger(id) || id <= 0) {
       process.stderr.write(`acp-devtools: invalid id "${rawId}"
@@ -12880,8 +12965,30 @@ function registerSessionInfoCommand(program) {
     }
     const messages = [];
     for (const m of session.messages()) messages.push(m);
-    const meta = extractSessionMetadata(messages);
     db.close();
+    let fieldsRedacted = 0;
+    let messagesAffected = 0;
+    const display = opts.raw ? messages : messages.map((m) => {
+      const r = redactMessage(m);
+      if (r.count > 0) {
+        messagesAffected += 1;
+        fieldsRedacted += r.count;
+      }
+      return r.redacted;
+    });
+    const meta = extractSessionMetadata(display);
+    const writeRedactionNote = () => {
+      if (opts.raw) {
+        process.stderr.write(
+          "acp-devtools: --raw was set; output may contain auth headers / proxy tokens \u2014 do not share publicly\n"
+        );
+      } else if (fieldsRedacted > 0) {
+        process.stderr.write(
+          `acp-devtools: redacted ${fieldsRedacted} field(s) across ${messagesAffected} message(s) \u2014 re-run with --raw to print them
+`
+        );
+      }
+    };
     if (opts.json) {
       process.stdout.write(
         JSON.stringify(
@@ -12901,9 +13008,11 @@ function registerSessionInfoCommand(program) {
           2
         ) + "\n"
       );
+      writeRedactionNote();
       return;
     }
     renderText(session, meta, messages.length);
+    writeRedactionNote();
   });
 }
 function renderText(session, meta, msgCount) {
@@ -12913,12 +13022,10 @@ function renderText(session, meta, msgCount) {
 `);
   w.write(s.dim("\u2500".repeat(48)) + "\n");
   const clientLabel = meta.client.title ?? meta.client.name ?? session.info.clientName ?? "\u2014";
-  const clientVer = meta.client.version ? ` v${meta.client.version}` : "";
   const clientPlatform = meta.client.platform ? ` (${meta.client.platform})` : "";
-  w.write(pad(s, "Client", `${clientLabel}${clientVer}${clientPlatform}`));
+  w.write(pad(s, "Client", `${withVersion(clientLabel, meta.client.version)}${clientPlatform}`));
   const agentLabel = meta.agent.name ?? shortAgent(session.info.agentCommand) ?? "\u2014";
-  const agentVer = meta.agent.version ? ` v${meta.agent.version}` : "";
-  w.write(pad(s, "Agent", `${agentLabel}${agentVer}`));
+  w.write(pad(s, "Agent", withVersion(agentLabel, meta.agent.version)));
   w.write(pad(s, "Protocol", meta.protocolVersion !== null ? `ACP v${meta.protocolVersion}` : "\u2014"));
   w.write(
     pad(
@@ -12966,6 +13073,10 @@ ${heading2(s, "JETBRAINS EXTENSIONS")}
     );
   }
 }
+function withVersion(label, version) {
+  if (!version || label.includes(version)) return label;
+  return `${label} v${version}`;
+}
 function heading2(s, label) {
   return s.bold(s.yellow(label));
 }
@@ -13368,15 +13479,17 @@ function registerUiCommand(program) {
       process.exit(1);
     }
     const capturesDbPath = opts.capturesDb ?? defaultCapturesDbPath();
+    const allowedHosts = [opts.host];
     const apiHandler = createApiHandler({
       capturesDbPath,
-      binaryPath: process.argv[1] ?? null
+      binaryPath: process.argv[1] ?? null,
+      allowedHosts
     });
     const server = createServer((req, res) => {
       if (apiHandler(req, res)) return;
       serveStatic(req, res, rootDir);
     });
-    attachReplayUpgrade(server, { capturesDbPath });
+    attachReplayUpgrade(server, { capturesDbPath, allowedHosts });
     await new Promise((resolveListen, rejectListen) => {
       server.once("error", rejectListen);
       server.listen(port, opts.host, () => {
@@ -13768,7 +13881,7 @@ var init_help = __esm({
     };
     ROOT_EXAMPLES = [
       "# Capture a Claude Code session (Zed adapter)",
-      "acp-devtools proxy npx -y @zed-industries/claude-code-acp",
+      "acp-devtools proxy npx -y @agentclientprotocol/claude-agent-acp",
       "",
       "# Browse captured sessions in the web inspector",
       "acp-devtools ui",
@@ -13783,7 +13896,7 @@ var init_help = __esm({
     EXAMPLES = {
       proxy: [
         "# Wrap the Zed Claude Code adapter and capture every frame",
-        "acp-devtools proxy npx -y @zed-industries/claude-code-acp",
+        "acp-devtools proxy npx -y @agentclientprotocol/claude-agent-acp",
         "",
         "# Capture headless, into a specific database",
         "acp-devtools proxy --no-ws --save-to /tmp/run.db node ./my-agent.js"
@@ -14013,7 +14126,7 @@ function expandArgv(rawArgs, defaultAgent, isAgentShortcut2) {
   if (isAgentShortcut2(first)) {
     return ["proxy", "--agent", first, ...rawArgs.slice(1)];
   }
-  return ["proxy", ...rawArgs];
+  return rawArgs;
 }
 function reportFatal(err, prefix = "acp-devtools") {
   if (isNativeBindingError(err)) {
@@ -14056,4 +14169,7 @@ async function main() {
   }
 }
 main();
+export {
+  expandArgv
+};
 //# sourceMappingURL=index.js.map