agent-sh 0.12.0 → 0.12.2

package/README.md

@@ -23,16 +23,22 @@ I still use Claude Code and pi for serious coding work — this doesn't replace
 
 ## Quick Start
 
-Install the latest from GitHub (recommended — development moves faster than npm releases):
+Install from npm:
 
 ```bash
-npm install -g github:guanyilun/agent-sh
+npm install -g agent-sh
 ```
 
-Or the last published npm release:
+Re-run the same command to update. Patch releases ship frequently; `npm update -g agent-sh` works too.
+
+For unreleased changes on `main`, clone and link locally — this avoids `npm install -g github:...`, which builds on your machine and requires a working TypeScript toolchain:
 
 ```bash
-npm install -g agent-sh
+git clone https://github.com/guanyilun/agent-sh.git
+cd agent-sh
+npm install        # installs devDependencies (typescript, etc.)
+npm run build      # produces dist/
+npm link           # exposes `agent-sh` globally
 ```
 
 Pick one of the zero-config paths below — no settings file needed. agent-sh auto-activates a built-in provider when it sees a known key.

package/dist/agent/agent-loop.js

@@ -29,6 +29,16 @@ import { discoverGlobalSkills, discoverProjectSkills } from "./skills.js";
  * the LLM via the API `tools` param (or via load_tool in deferred-
  * lookup mode) — this only trims the always-visible catalog.
  */
+/** Reject on abort; orphaned `p` keeps running but its result is dropped. */
+function raceAbort(p, signal) {
+    if (signal.aborted)
+        return Promise.reject(new Error("cancelled"));
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(new Error("cancelled"));
+        signal.addEventListener("abort", onAbort, { once: true });
+        p.then((v) => { signal.removeEventListener("abort", onAbort); resolve(v); }, (e) => { signal.removeEventListener("abort", onAbort); reject(e); });
+    });
+}
 function summarizeDescription(desc) {
     const firstLine = desc.split("\n", 1)[0];
     const sentenceEnd = firstLine.search(/[.!?](\s|$)/);
@@ -817,12 +827,11 @@ export class AgentLoop {
             this.conversation.addSystemNote(text);
             this.bus.emit("conversation:message-appended", { role: "system", content: text });
         });
+        // Fires on user-abort; extensions advise per tool name for cleanup.
+        h.define("tool:cancel", (_ctx) => { });
         // Wraps each tool call: permission → execute → emit events.
-        // Extensions advise to add safe-mode, logging, metrics, custom policies.
-        // The ctx.onChunk callback is exposed so advisors can wrap it to
-        // intercept/transform streamed tool output (e.g. secret redaction).
         h.define("tool:execute", async (ctx) => {
-            const { name, id, args, tool } = ctx;
+            const { name, id, args, tool, signal } = ctx;
             // Validate required input fields before display/permission/execute.
             // Some models emit wrong arg names (e.g. `file_path` instead of `path`),
             // and downstream helpers assume required strings are present.
@@ -918,16 +927,21 @@ export class AgentLoop {
             const onChunk = (tool.showOutput !== false && !diffShown)
                 ? ctx.onChunk
                 : undefined;
-            const toolCtx = this.compositor
-                ? { ui: createToolUI(this.bus, this.compositor.surface("agent")) }
-                : undefined;
-            // Surface thrown errors as tool results so the agent can self-correct
-            // instead of the throw killing the whole turn.
+            const toolCtx = { signal };
+            if (this.compositor) {
+                toolCtx.ui = createToolUI(this.bus, this.compositor.surface("agent"));
+            }
             let result;
             try {
-                result = await tool.execute(args, onChunk, toolCtx);
+                result = await raceAbort(tool.execute(args, onChunk, toolCtx), signal);
             }
             catch (err) {
+                if (signal.aborted) {
+                    try {
+                        this.handlers.call("tool:cancel", { name, args, reason: "user-aborted" });
+                    }
+                    catch { }
+                }
                 const message = err instanceof Error ? err.message : String(err);
                 result = { content: message, exitCode: 1, isError: true };
             }
@@ -1169,7 +1183,8 @@ export class AgentLoop {
                     this.bus.emit("agent:tool-output-chunk", { chunk });
                 };
                 const result = await this.handlers.call("tool:execute", { name: tc.name, id: tc.id, args, tool, onChunk: defaultOnChunk,
-                    batchIndex, batchTotal: batchTotal > 1 ? batchTotal : undefined });
+                    batchIndex, batchTotal: batchTotal > 1 ? batchTotal : undefined,
+                    signal });
                 // Truncate large outputs to avoid blowing context
                 let content = result.content;
                 const maxBytes = 16_384; // ~4k tokens

package/dist/agent/conversation-state.d.ts

@@ -38,6 +38,7 @@ export declare class ConversationState {
     private nextSeq;
     private lastApiTokenCount;
     private lastApiMessageCount;
+    private pendingNotes;
     constructor(handlers?: HandlerFunctions, instanceId?: string);
     /** Get JSON.stringify of messages, cached until next mutation. */
     private getMessagesJson;
@@ -53,8 +54,18 @@ export declare class ConversationState {
     addToolResult(toolCallId: string, content: string, isError?: boolean): void;
     /** Add tool results as a user message (for inline tool protocol). */
     addToolResultInline(content: string): void;
+    /** Safe from any context: queues if mid-tool-pair, appends otherwise. */
     addSystemNote(text: string): void;
+    private hasOpenToolCalls;
+    private flushPendingNotes;
     getMessages(): ChatCompletionMessageParam[];
+    /**
+     * If a stream was interrupted mid-tool-execution, an assistant message
+     * with tool_calls can land in history without matching tool results.
+     * Strict providers (DeepSeek) 400 on this. Stub each missing result
+     * with a [cancelled] marker so the protocol stays valid.
+     */
+    private stubDanglingToolCalls;
     /**
      * DeepSeek 400s if any assistant in a thinking-mode conversation is
      * missing reasoning_content. Cross-alias here (OpenRouter streams as

package/dist/agent/conversation-state.js

@@ -56,6 +56,10 @@ export class ConversationState {
     nextSeq = 1;
     lastApiTokenCount = null;
     lastApiMessageCount = 0;
+    // Notes queued when addSystemNote fires mid-tool-pair; flushed once
+    // the trailing tool_result lands. Splicing into the gap breaks
+    // reasoning_content pairing and is rejected by strict providers.
+    pendingNotes = [];
     constructor(handlers, instanceId = "0000") {
         this.handlers = handlers ?? null;
         this.instanceId = instanceId;
@@ -100,18 +104,86 @@ export class ConversationState {
         if (isError)
             this.toolErrors.add(toolCallId);
         this.invalidateMessagesCache();
+        this.flushPendingNotes();
     }
     /** Add tool results as a user message (for inline tool protocol). */
     addToolResultInline(content) {
         this.messages.push({ role: "user", content });
         this.invalidateMessagesCache();
+        this.flushPendingNotes();
     }
+    /** Safe from any context: queues if mid-tool-pair, appends otherwise. */
     addSystemNote(text) {
+        if (this.hasOpenToolCalls()) {
+            this.pendingNotes.push(text);
+            return;
+        }
         this.messages.push({ role: "user", content: text });
         this.invalidateMessagesCache();
     }
+    hasOpenToolCalls() {
+        for (let i = this.messages.length - 1; i >= 0; i--) {
+            const msg = this.messages[i];
+            if (msg.role === "tool")
+                continue;
+            if (msg.role !== "assistant")
+                return false;
+            if (!("tool_calls" in msg) || !msg.tool_calls)
+                return false;
+            const answered = new Set();
+            for (let j = i + 1; j < this.messages.length; j++) {
+                const m = this.messages[j];
+                if (m.role !== "tool")
+                    break;
+                answered.add(m.tool_call_id);
+            }
+            return msg.tool_calls.some((tc) => !answered.has(tc.id));
+        }
+        return false;
+    }
+    flushPendingNotes() {
+        if (this.pendingNotes.length === 0)
+            return;
+        if (this.hasOpenToolCalls())
+            return;
+        for (const text of this.pendingNotes) {
+            this.messages.push({ role: "user", content: text });
+        }
+        this.pendingNotes = [];
+        this.invalidateMessagesCache();
+    }
     getMessages() {
-        return this.normalizeReasoningConsistency(this.messages);
+        return this.normalizeReasoningConsistency(this.stubDanglingToolCalls(this.messages));
+    }
+    /**
+     * If a stream was interrupted mid-tool-execution, an assistant message
+     * with tool_calls can land in history without matching tool results.
+     * Strict providers (DeepSeek) 400 on this. Stub each missing result
+     * with a [cancelled] marker so the protocol stays valid.
+     */
+    stubDanglingToolCalls(messages) {
+        const result = [];
+        let i = 0;
+        while (i < messages.length) {
+            const msg = messages[i];
+            result.push(msg);
+            i++;
+            if (msg.role !== "assistant" || !("tool_calls" in msg) || !msg.tool_calls)
+                continue;
+            const seen = new Set();
+            while (i < messages.length && messages[i].role === "tool") {
+                const t = messages[i];
+                seen.add(t.tool_call_id);
+                result.push(t);
+                i++;
+            }
+            for (const tc of msg.tool_calls) {
+                if (!seen.has(tc.id)) {
+                    result.push({ role: "tool", tool_call_id: tc.id, content: "[cancelled]" });
+                }
+            }
+        }
+        return result;
     }
     /**
      * DeepSeek 400s if any assistant in a thinking-mode conversation is
@@ -145,6 +217,7 @@ export class ConversationState {
         this.invalidateMessagesCache();
         this.lastApiTokenCount = null;
         this.lastApiMessageCount = 0;
+        this.flushPendingNotes();
     }
     pruneToolErrors() {
         if (this.toolErrors.size === 0)
@@ -444,6 +517,7 @@ export class ConversationState {
         this.nuclearEntries = [];
         this.nuclearBySeq.clear();
         this.recallArchive.clear();
+        this.pendingNotes = [];
         this.invalidateMessagesCache();
         this.lastApiTokenCount = null;
         this.lastApiMessageCount = 0;

package/dist/agent/tools/bash.js

@@ -1,4 +1,4 @@
-import { executeCommand } from "../../executor.js";
+import { executeCommand, killSession } from "../../executor.js";
 export function createBashTool(opts) {
     return {
         name: "bash",
@@ -33,7 +33,7 @@ export function createBashTool(opts) {
             icon: "▶",
             locations: [],
         }),
-        async execute(args, onChunk) {
+        async execute(args, onChunk, ctx) {
             const command = args.command;
             const timeout = (args.timeout ?? 60) * 1000;
             // Let extensions intercept before execution
@@ -57,7 +57,14 @@ export function createBashTool(opts) {
                 timeout,
                 onOutput: onChunk,
             });
-            await done;
+            const onAbort = () => killSession(session);
+            ctx?.signal?.addEventListener("abort", onAbort, { once: true });
+            try {
+                await done;
+            }
+            finally {
+                ctx?.signal?.removeEventListener("abort", onAbort);
+            }
             const content = session.truncated
                 ? `[output truncated, showing last portion]\n${session.output}`
                 : session.output;

package/dist/agent/types.d.ts

@@ -64,7 +64,9 @@ export interface ToolUI {
 }
 /** Context passed to tool execute() as optional third parameter. */
 export interface ToolExecutionContext {
-    ui: ToolUI;
+    ui?: ToolUI;
+    /** Aborted on Ctrl-C — tools with subprocess work should listen and clean up. */
+    signal?: AbortSignal;
 }
 export interface ToolDefinition {
     name: string;

package/dist/core.d.ts

@@ -33,6 +33,8 @@ export interface AgentShellCore {
     contextManager: ContextManager;
     /** Handler registry for define/advise/call. */
     handlers: HandlerRegistry;
+    /** Unique id for this agent process; used for shell-marker tagging and lineage tracking. */
+    instanceId: string;
     /** Activate the agent backend (call after extensions load). */
     activateBackend(): void;
     /** Convenience: emit agent:submit and await the response. */

package/dist/core.js

@@ -107,6 +107,7 @@ export function createCore(config) {
         bus,
         contextManager,
         handlers,
+        instanceId,
         activateBackend() {
             // Silent — backend info is shown in the startup banner.
             // Runtime switches (config:switch-backend) still emit ui:info.

package/dist/event-bus.js

@@ -6,7 +6,7 @@ import { EventEmitter } from "node:events";
  *   can modify the payload before passing to the next
  */
 export class EventBus {
-    emitter = new EventEmitter();
+    emitter = new EventEmitter().setMaxListeners(0);
     pipeListeners = new Map();
     asyncPipeListeners = new Map();
     /** Subscribe to a fire-and-forget event. */

package/dist/index.js

@@ -218,6 +218,7 @@ async function main() {
         rows,
         shell: config.shell || process.env.SHELL || "/bin/bash",
         cwd: process.cwd(),
+        instanceId: core.instanceId,
         onShowAgentInfo: () => {
             if (agentInfo) {
                 return { info: `${p.dim}${agentInfo.name}${agentInfo.model ? ` (${agentInfo.model})` : ""}${p.reset}` };

package/dist/shell/output-parser.d.ts

@@ -6,11 +6,12 @@ import type { EventBus } from "../event-bus.js";
 export declare class OutputParser {
     private bus;
     private cwd;
+    private ownTag;
     private currentOutputCapture;
     private lastCommand;
     private foregroundBusy;
     private promptReady;
-    constructor(bus: EventBus, initialCwd: string);
+    constructor(bus: EventBus, initialCwd: string, ownTag: string);
     /** Process a chunk of PTY output data. */
     processData(data: string): void;
     /** Called when user presses Enter on a non-empty line. */

package/dist/shell/output-parser.js

@@ -1,4 +1,9 @@
 import { stripAnsi } from "../utils/ansi.js";
+// Self-emitted form: \e]<num>;id=<own>;<body>\a — only this is honored.
+// Anything else (mismatched tag, untagged) is ignored as opaque foreground output.
+const PROMPT_RE = /\x1b\]9999;(?:id=([a-f0-9]+);)?PROMPT\x07/;
+const PREEXEC_RE = /\x1b\]9997;(?:id=([a-f0-9]+);)?([^\x07]*)\x07/;
+const READY_RE = /\x1b\]9998;(?:id=([a-f0-9]+);)?READY\x07/;
 /**
  * Parses PTY output to detect command boundaries, track cwd,
  * and emit shell events. Owns the command lifecycle state.
@@ -6,13 +11,16 @@ import { stripAnsi } from "../utils/ansi.js";
 export class OutputParser {
     bus;
     cwd;
+    ownTag;
     currentOutputCapture = "";
     lastCommand = "";
     foregroundBusy = false;
     promptReady = false;
-    constructor(bus, initialCwd) {
+    constructor(bus, initialCwd, ownTag) {
         this.bus = bus;
         this.cwd = initialCwd;
+        // Strip the "id=" prefix; we compare the value alone.
+        this.ownTag = ownTag.startsWith("id=") ? ownTag.slice(3) : ownTag;
     }
     /** Process a chunk of PTY output data. */
     processData(data) {
@@ -49,24 +57,22 @@ export class OutputParser {
      * completion. Returns data with the OSC stripped out.
      */
     handlePreexec(data) {
-        const marker = "\x1b]9997;";
-        const idx = data.indexOf(marker);
-        if (idx === -1)
+        const match = PREEXEC_RE.exec(data);
+        if (!match)
             return data;
-        const endIdx = data.indexOf("\x07", idx + marker.length);
-        if (endIdx === -1)
-            return data; // incomplete OSC, wait for next chunk
-        const command = data.slice(idx + marker.length, endIdx);
-        // Authoritative command from the shell — override any lineBuffer guess
+        if (match[1] !== this.ownTag) {
+            // Nested instance or untagged foreign emission — strip and ignore.
+            return data.slice(0, match.index) + data.slice(match.index + match[0].length);
+        }
+        const command = match[2];
         this.lastCommand = command;
-        this.currentOutputCapture = ""; // discard echoed text accumulated before preexec
+        this.currentOutputCapture = ""; // discard echo accumulated before preexec
         if (!this.foregroundBusy) {
             this.foregroundBusy = true;
             this.bus.emit("shell:foreground-busy", { busy: true });
         }
         this.bus.emit("shell:command-start", { command, cwd: this.cwd });
-        // Return only data after the OSC — everything before was the echo
-        return data.slice(endIdx + 1);
+        return data.slice(match.index + match[0].length);
     }
     parseOSC7(data) {
         const match = data.match(/\x1b\]7;file:\/\/[^/]*(\/[^\x07\x1b]*)/);
@@ -83,9 +89,15 @@ export class OutputParser {
      * Each time a prompt appears, we finalize the previous command's output.
      */
     parsePromptMarker(data) {
-        const marker = "\x1b]9999;PROMPT\x07";
-        const markerIdx = data.indexOf(marker);
-        if (markerIdx !== -1) {
+        const match = PROMPT_RE.exec(data);
+        if (match) {
+            if (match[1] !== this.ownTag) {
+                // Nested instance or untagged foreign emission — treat as opaque
+                // foreground output, do not finalize our own command.
+                this.currentOutputCapture += data;
+                return;
+            }
+            const markerIdx = match.index;
             // Capture any output that arrived in the same chunk before the marker
             if (markerIdx > 0) {
                 this.currentOutputCapture += data.slice(0, markerIdx);
@@ -125,9 +137,12 @@ export class OutputParser {
      * and the shell is ready for input.
      */
     parsePromptEnd(data) {
-        if (data.includes("\x1b]9998;READY\x07")) {
-            this.promptReady = true;
-        }
+        const match = READY_RE.exec(data);
+        if (!match)
+            return;
+        if (match[1] !== this.ownTag)
+            return;
+        this.promptReady = true;
     }
     removeEchoedCommand(output, command) {
         const lines = output.split("\n");

package/dist/shell/shell.d.ts

@@ -28,6 +28,7 @@ export declare class Shell implements InputContext {
         rows: number;
         shell: string;
         cwd: string;
+        instanceId: string;
     });
     isForegroundBusy(): boolean;
     getCwd(): string;

package/dist/shell/shell.js

@@ -43,8 +43,10 @@ export class Shell {
         }
         const shellBin = (isZsh || isBash) ? opts.shell : "/bin/bash";
         let shellArgs;
+        // Per-instance tag so nested agent-sh hooks don't cross-trigger.
+        const instanceTag = `id=${opts.instanceId}`;
         const osc7Cmd = 'printf "\\e]7;file://%s%s\\a" "$(hostname)" "$PWD"';
-        const promptMarker = 'printf "\\e]9999;PROMPT\\a"';
+        const promptMarker = `printf "\\e]9999;${instanceTag};PROMPT\\a"`;
         const titleCmd = 'printf "\\e]0;⚡ agent-sh: %s\\a" "${PWD/#$HOME/~}"';
         this.isZsh = isZsh;
         const settings = getSettings();
@@ -69,11 +71,11 @@ export class Shell {
                 "# Preexec hook: emit actual command text so agent-sh can track",
                 "# history-recalled and tab-completed commands accurately",
                 "__agent_sh_preexec() {",
-                '  printf "\\e]9997;%s\\a" "$1"',
+                `  printf "\\e]9997;${instanceTag};%s\\a" "$1"`,
                 "}",
                 "preexec_functions+=(__agent_sh_preexec)",
             ];
-            zshrcLines.push("", "# End-of-prompt marker via zle-line-init (fires after prompt is rendered)", "# Chain onto existing widget (p10k uses zle-line-init) rather than clobbering", 'if (( ${+widgets[zle-line-init]} )); then', "  zle -A zle-line-init __agent_sh_orig_line_init", "  __agent_sh_line_init() {", "    zle __agent_sh_orig_line_init", '    printf "\\e]9998;READY\\a"', "  }", "else", "  __agent_sh_line_init() {", '    printf "\\e]9998;READY\\a"', "  }", "fi", "zle -N zle-line-init __agent_sh_line_init", "", "# Hidden widget to trigger prompt redraw from Node.js side", "# Bound to an unused escape sequence that no real key produces", "__agent_sh_redraw() {", "  zle reset-prompt", "}", "zle -N __agent_sh_redraw", "bindkey '\\e[9999~' __agent_sh_redraw");
+            zshrcLines.push("", "# End-of-prompt marker via zle-line-init (fires after prompt is rendered)", "# Chain onto existing widget (p10k uses zle-line-init) rather than clobbering", 'if (( ${+widgets[zle-line-init]} )); then', "  zle -A zle-line-init __agent_sh_orig_line_init", "  __agent_sh_line_init() {", "    zle __agent_sh_orig_line_init", `    printf "\\e]9998;${instanceTag};READY\\a"`, "  }", "else", "  __agent_sh_line_init() {", `    printf "\\e]9998;${instanceTag};READY\\a"`, "  }", "fi", "zle -N zle-line-init __agent_sh_line_init", "", "# Hidden widget to trigger prompt redraw from Node.js side", "# Bound to an unused escape sequence that no real key produces", "__agent_sh_redraw() {", "  zle reset-prompt", "}", "zle -N __agent_sh_redraw", "bindkey '\\e[9999~' __agent_sh_redraw");
             fs.writeFileSync(path.join(this.tmpDir, ".zshrc"), zshrcLines.join("\n") + "\n");
             env.ZDOTDIR = this.tmpDir;
             shellArgs = ["--no-globalrcs"];
@@ -106,12 +108,12 @@ export class Shell {
                 "  __agent_sh_preexec_ran=1",
                 "  local this_cmd",
                 `  this_cmd=$(HISTTIMEFORMAT='' builtin history 1 | command sed 's/^ *[0-9]* *//')`,
-                `  printf '\\e]9997;%s\\a' "$this_cmd"`,
+                `  printf '\\e]9997;${instanceTag};%s\\a' "$this_cmd"`,
                 "}",
                 "trap '__agent_sh_emit_preexec' DEBUG",
                 "",
                 "# End-of-prompt marker: append to PS1 (\\[...\\] marks it zero-width)",
-                'case "$PS1" in *9998*) ;; *) PS1="${PS1}\\[\\e]9998;READY\\a\\]";; esac',
+                `case "$PS1" in *9998*) ;; *) PS1="\${PS1}\\[\\e]9998;${instanceTag};READY\\a\\]";; esac`,
                 "",
                 "# Mirrors the zsh \\e[9999~ reset-prompt widget — used by agent-sh",
                 "# to repaint the prompt in place. All keymaps so `set -o vi` works.",
@@ -155,7 +157,7 @@ export class Shell {
         }
         this.bus = opts.bus;
         this.handlers = opts.handlers;
-        this.outputParser = new OutputParser(opts.bus, opts.cwd);
+        this.outputParser = new OutputParser(opts.bus, opts.cwd, instanceTag);
         // Ensure temp dir cleanup on abnormal exit (SIGKILL won't fire this,
         // but it covers uncaught exceptions and normal process.exit paths)
         if (this.tmpDir) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sh",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "A shell-first terminal where AI is one keystroke away",
   "type": "module",
   "main": "dist/core.js",
@@ -89,7 +89,13 @@
   },
   "files": [
     "dist",
-    "examples"
+    "examples/extensions/*.ts",
+    "examples/extensions/*/package.json",
+    "examples/extensions/*/tsconfig.json",
+    "examples/extensions/*/README.md",
+    "examples/extensions/*/src",
+    "examples/extensions/*/index.ts",
+    "examples/extensions/*/index.js"
   ],
   "scripts": {
     "dev": "tsx src/index.ts",
@@ -121,6 +127,8 @@
     "node": ">=18"
   },
   "dependencies": {
+    "@xterm/addon-serialize": "^0.13.0",
+    "@xterm/headless": "^5.5.0",
     "cli-highlight": "^2.1.11",
     "diff": "^9.0.0",
     "marked": "^17.0.6",

package/examples/extensions/ash-acp-bridge/src/index.ts

@@ -1,574 +0,0 @@
-#!/usr/bin/env node
-/**
- * agent-sh-acp — ACP (Agent Client Protocol) server wrapping agent-sh's
- * headless core. Speaks JSON-RPC 2.0 over stdin/stdout so agent-shell
- * (Emacs) can drive it as a backend.
- *
- * Usage:
- *   agent-sh-acp                     # uses settings from ~/.agent-sh/settings.json
- *   agent-sh-acp --model gpt-4o      # override model
- *
- * In agent-shell (Emacs):
- *   (setq agent-shell-agentsh-acp-command '("agent-sh-acp"))
- */
-import { createCore, type AgentShellCore } from "agent-sh";
-import { loadExtensions } from "agent-sh/extension-loader";
-import { loadBuiltinExtensions } from "agent-sh/extensions";
-import { getSettings } from "agent-sh/settings";
-import type { ContentBlock } from "agent-sh/types";
-
-// ── JSON-RPC types ──────────────────────────────────────────────────
-
-interface JsonRpcRequest {
-  jsonrpc: "2.0";
-  method: string;
-  params?: Record<string, unknown>;
-  id?: number | string;
-}
-
-interface JsonRpcResponse {
-  jsonrpc: "2.0";
-  id: number | string;
-  result?: unknown;
-  error?: { code: number; message: string; data?: unknown };
-}
-
-interface JsonRpcNotification {
-  jsonrpc: "2.0";
-  method: string;
-  params?: Record<string, unknown>;
-}
-
-// ── ACP content block ───────────────────────────────────────────────
-
-interface AcpContentBlock {
-  type: string;
-  text?: string;
-  data?: string;
-  mimeType?: string;
-}
-
-// ── Stdio transport ─────────────────────────────────────────────────
-
-function send(msg: JsonRpcResponse | JsonRpcNotification): void {
-  const line = JSON.stringify(msg) + "\n";
-  process.stdout.write(line);
-}
-
-function sendResult(id: number | string, result: unknown): void {
-  send({ jsonrpc: "2.0", id, result });
-}
-
-function sendError(id: number | string, code: number, message: string, data?: unknown): void {
-  send({ jsonrpc: "2.0", id, error: { code, message, data } });
-}
-
-function sendNotification(method: string, params: Record<string, unknown>): void {
-  send({ jsonrpc: "2.0", method, params });
-}
-
-// ── ACP session/update helpers ──────────────────────────────────────
-
-function sendSessionUpdate(update: Record<string, unknown>): void {
-  sendNotification("session/update", { update });
-}
-
-function sendTextChunk(text: string): void {
-  sendSessionUpdate({
-    sessionUpdate: "agent_message_chunk",
-    content: { type: "text", text },
-  });
-}
-
-function sendThinkingChunk(text: string): void {
-  sendSessionUpdate({
-    sessionUpdate: "agent_thought_chunk",
-    content: { type: "text", text },
-  });
-}
-
-function sendToolCall(
-  toolCallId: string,
-  title: string,
-  kind: string,
-  rawInput?: unknown,
-): void {
-  sendSessionUpdate({
-    sessionUpdate: "tool_call",
-    toolCallId,
-    title,
-    status: "pending",
-    kind,
-    content: [],
-    rawInput,
-  });
-}
-
-function sendToolCallUpdate(
-  toolCallId: string,
-  status: string,
-  content: AcpContentBlock[],
-  kind?: string,
-): void {
-  sendSessionUpdate({
-    sessionUpdate: "tool_call_update",
-    toolCallId,
-    status,
-    content,
-    kind,
-  });
-}
-
-function sendUsageUpdate(
-  inputTokens: number,
-  outputTokens: number,
-): void {
-  sendSessionUpdate({
-    sessionUpdate: "usage_update",
-    inputTokens,
-    outputTokens,
-    cacheCreationInputTokens: 0,
-    cacheReadInputTokens: 0,
-  });
-}
-
-// ── Permission bridge ───────────────────────────────────────────────
-
-let nextPermissionId = 1;
-const pendingPermissions = new Map<
-  number,
-  { resolve: (outcome: string) => void }
->();
-
-function buildPermissionToolCall(
-  title: string,
-  kind: string,
-  metadata: Record<string, unknown>,
-  toolCallId: string,
-): { toolCall: Record<string, unknown> } {
-  const args = (metadata.args ?? {}) as Record<string, unknown>;
-
-  // Map agent-sh permission kinds → ACP tool call shapes
-  if (kind === "file-write") {
-    // File edit/write — send diff content block + rawInput for agent-shell
-    const content: unknown[] = [];
-    const rawInput: Record<string, unknown> = {};
-
-    // Set path for title display
-    const filePath = (args.path as string) ?? "";
-    rawInput.path = filePath;
-    rawInput.file_path = filePath;
-
-    // For edit_file: old_str/new_str so agent-shell can render a diff
-    if (typeof args.old_text === "string") {
-      rawInput.old_str = args.old_text;
-      rawInput.new_str = args.new_text ?? "";
-      content.push({
-        type: "diff",
-        oldText: args.old_text,
-        newText: args.new_text ?? "",
-        path: filePath,
-      });
-    } else if (typeof args.content === "string") {
-      // write_file (new file or full overwrite)
-      rawInput.new_str = args.content;
-      rawInput.old_str = "";
-      content.push({
-        type: "diff",
-        oldText: "",
-        newText: args.content,
-        path: filePath,
-      });
-    }
-
-    if (typeof args.description === "string") {
-      rawInput.description = args.description;
-    }
-
-    return {
-      toolCall: {
-        toolCallId,
-        title,
-        status: "pending",
-        kind: "diff",
-        content,
-        rawInput,
-      },
-    };
-  }
-
-  // Generic tool call (bash, etc.)
-  const rawInput: Record<string, unknown> = {};
-  if (typeof args.command === "string") {
-    rawInput.command = args.command;
-  }
-  if (typeof args.description === "string") {
-    rawInput.description = args.description;
-  }
-
-  return {
-    toolCall: {
-      toolCallId,
-      title,
-      status: "pending",
-      kind: kind === "tool-call" ? "execute" : kind,
-      content: [],
-      rawInput,
-    },
-  };
-}
-
-function requestPermission(
-  title: string,
-  kind: string,
-  metadata: Record<string, unknown>,
-  toolCallId?: string,
-): Promise<string> {
-  const id = nextPermissionId++;
-  const tcId = toolCallId ?? `perm-${id}`;
-  return new Promise((resolve) => {
-    pendingPermissions.set(id, { resolve });
-    const { toolCall } = buildPermissionToolCall(title, kind, metadata, tcId);
-    send({
-      jsonrpc: "2.0",
-      method: "session/request_permission",
-      id,
-      params: {
-        toolCall,
-        options: [
-          { id: "accepted", name: "Accept", description: "Accept this action" },
-          { id: "rejected", name: "Reject", description: "Reject this action" },
-          { id: "always", name: "Always allow", description: "Always allow for this session" },
-        ],
-      },
-    } as any);
-  });
-}
-
-// ── Core setup ──────────────────────────────────────────────────────
-
-function parseArgs(): { model?: string; provider?: string } {
-  const args = process.argv.slice(2);
-  const result: Record<string, string> = {};
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--model" && args[i + 1]) result.model = args[++i];
-    if (args[i] === "--provider" && args[i + 1]) result.provider = args[++i];
-  }
-  return result;
-}
-
-const cliArgs = parseArgs();
-let core: AgentShellCore | null = null;
-let sessionId: string | null = null;
-let sessionCwd: string = process.cwd();
-
-// Track tool output chunks per toolCallId so we can send accumulated content
-const toolOutputBuffers = new Map<string, string>();
-
-// Track the active prompt request id so we can respond when processing is done
-let activePromptRequestId: number | string | null = null;
-
-// Track always-allowed permission kinds
-const alwaysAllowed = new Set<string>();
-
-// Track in-flight async operations so stdin end can wait
-let pendingOp: Promise<void> = Promise.resolve();
-
-// ── Wire agent-sh events → ACP notifications ───────────────────────
-
-function wireEvents(core: AgentShellCore): void {
-  const { bus } = core;
-
-  bus.on("agent:response-chunk", ({ blocks }) => {
-    for (const block of blocks) {
-      if (block.type === "text") {
-        sendTextChunk(block.text);
-      }
-      // code-block blocks are sent as text (agent-shell renders markdown)
-      if (block.type === "code-block") {
-        sendTextChunk("```" + block.language + "\n" + block.code + "\n```");
-      }
-    }
-  });
-
-  bus.on("agent:thinking-chunk", ({ text }) => {
-    sendThinkingChunk(text);
-  });
-
-  bus.on("agent:tool-started", (e) => {
-    const id = e.toolCallId ?? `tool-${Date.now()}`;
-    toolOutputBuffers.set(id, "");
-    sendToolCall(id, e.title, e.kind ?? "tool", e.rawInput);
-  });
-
-  bus.on("agent:tool-output-chunk", ({ chunk }) => {
-    // Accumulate — we don't know toolCallId here, but only one tool runs at a time
-    // in sequential mode. For parallel tools this is best-effort.
-    for (const [id, buf] of toolOutputBuffers) {
-      toolOutputBuffers.set(id, buf + chunk);
-    }
-  });
-
-  bus.on("agent:tool-completed", (e) => {
-    const id = e.toolCallId ?? [...toolOutputBuffers.keys()].pop() ?? "unknown";
-    const output = toolOutputBuffers.get(id) ?? "";
-    toolOutputBuffers.delete(id);
-
-    const status = e.exitCode === 0 || e.exitCode === null ? "completed" : "failed";
-    const content: AcpContentBlock[] = output
-      ? [{ type: "text", text: output }]
-      : [];
-    sendToolCallUpdate(id, status, content, e.kind);
-  });
-
-  bus.on("agent:usage", ({ prompt_tokens, completion_tokens }) => {
-    sendUsageUpdate(prompt_tokens, completion_tokens);
-  });
-
-  bus.on("agent:processing-done", () => {
-    if (activePromptRequestId !== null) {
-      sendResult(activePromptRequestId, { stopReason: "end_turn" });
-      activePromptRequestId = null;
-    }
-  });
-
-  bus.on("agent:error", ({ message }) => {
-    if (activePromptRequestId !== null) {
-      sendError(activePromptRequestId, -32603, message);
-      activePromptRequestId = null;
-    }
-  });
-
-  bus.on("agent:cancelled", () => {
-    if (activePromptRequestId !== null) {
-      sendResult(activePromptRequestId, { stopReason: "cancelled" });
-      activePromptRequestId = null;
-    }
-  });
-
-  // Permission gating — auto-approve all tool calls.
-  // agent-sh's built-in tools handle their own safety; the ACP layer
-  // doesn't add a second permission gate. If you want to bridge
-  // permissions to agent-shell's UI, replace this with the
-  // requestPermission() flow.
-  bus.onPipeAsync("permission:request", async (payload) => {
-    payload.decision = { outcome: "approved" };
-    return payload;
-  });
-}
-
-// ── ACP method handlers ─────────────────────────────────────────────
-
-function getModelsPayload(): Record<string, unknown> | undefined {
-  if (!core) return undefined;
-  const info = core.bus.emitPipe("config:get-models", { models: [], active: null });
-  if (!info.models.length) return undefined;
-  return {
-    currentModelId: info.active ?? info.models[0]?.model,
-    availableModels: info.models.map((m) => ({
-      modelId: m.model,
-      name: m.provider ? `${m.provider}/${m.model}` : m.model,
-      description: m.provider ? `Provider: ${m.provider}` : "",
-    })),
-  };
-}
-
-function handleInitialize(id: number | string): void {
-  sendResult(id, {
-    agentCapabilities: {
-      promptCapabilities: {
-        image: false,
-        embeddedContext: true,
-      },
-      sessionCapabilities: {},
-    },
-    modes: {
-      currentModeId: "default",
-      availableModes: [
-        { id: "default", name: "Default", description: "Standard mode" },
-      ],
-    },
-  });
-}
-
-async function handleSessionNew(id: number | string, params: Record<string, unknown>): Promise<void> {
-  sessionCwd = (params.cwd as string) ?? process.cwd();
-  process.chdir(sessionCwd);
-
-  // Create core lazily on first session
-  if (!core) {
-    core = createCore({
-      model: cliArgs.model,
-      provider: cliArgs.provider,
-    });
-    wireEvents(core);
-
-    const extCtx = core.extensionContext({ quit: () => process.exit(0) });
-    const settings = getSettings();
-
-    // Load built-in extensions first (agent-backend, slash-commands, etc.)
-    // Skip TUI-only extensions that don't apply in headless mode
-    const headlessDisabled = [
-      "tui-renderer",
-      "file-autocomplete",
-      "overlay-agent",
-      ...(settings.disabledBuiltins ?? []),
-    ];
-    await loadBuiltinExtensions(extCtx, headlessDisabled);
-
-    // Load user extensions with a timeout (some may hang in headless mode)
-    const TIMEOUT_MS = 10000;
-    await Promise.race([
-      loadExtensions(extCtx),
-      new Promise<void>((_, reject) =>
-        setTimeout(() => reject(new Error(`Extension loading timeout after ${TIMEOUT_MS}ms`)), TIMEOUT_MS),
-      ),
-    ]).catch((err) => {
-      process.stderr.write(`Warning: ${err instanceof Error ? err.message : err}\n`);
-    });
-
-    // Signal deferred-init listeners (agent-backend) that the provider
-    // registry is complete — they resolve their LLM config on this event.
-    core.bus.emit("core:extensions-loaded", {});
-
-    core.activateBackend();
-  }
-
-  sessionId = `session-${Date.now()}`;
-  const result: Record<string, unknown> = {
-    sessionId,
-    modes: {
-      currentModeId: "default",
-      availableModes: [
-        { id: "default", name: "Default", description: "Standard mode" },
-      ],
-    },
-  };
-  const models = getModelsPayload();
-  if (models) result.models = models;
-  sendResult(id, result);
-}
-
-function handleSessionPrompt(id: number | string, params: Record<string, unknown>): void {
-  if (!core) {
-    sendError(id, -32603, "No active session");
-    return;
-  }
-
-  // Extract text from prompt content blocks
-  const prompt = params.prompt as Array<{ type: string; text?: string; resource?: { text?: string } }>;
-  const parts: string[] = [];
-  for (const block of prompt) {
-    if (block.type === "text" && block.text) {
-      parts.push(block.text);
-    } else if (block.type === "resource" && block.resource?.text) {
-      parts.push(block.resource.text);
-    }
-  }
-
-  const query = parts.join("\n");
-  if (!query) {
-    sendResult(id, { stopReason: "end_turn" });
-    return;
-  }
-
-  // Store the request id — we'll respond when agent:processing-done fires
-  activePromptRequestId = id;
-  core.bus.emit("agent:submit", { query });
-}
-
-function handleSessionSetMode(id: number | string, _params: Record<string, unknown>): void {
-  // Acknowledge — agent-sh doesn't have distinct modes yet
-  sendResult(id, {});
-}
-
-// ── Message dispatcher ──────────────────────────────────────────────
-
-function dispatch(msg: JsonRpcRequest): void {
-  const { method, params, id } = msg;
-
-  // Handle responses to our outgoing requests (permission responses)
-  if (!method && id !== undefined && (msg as any).result !== undefined) {
-    const pending = pendingPermissions.get(id as number);
-    if (pending) {
-      pendingPermissions.delete(id as number);
-      const result = (msg as any).result;
-      const outcome = result?.outcome?.optionId ?? result?.outcome?.outcome ?? "rejected";
-      pending.resolve(outcome);
-    }
-    return;
-  }
-
-  if (!id && !method) return; // ignore malformed
-
-  switch (method) {
-    case "initialize":
-      handleInitialize(id!);
-      break;
-    case "session/new":
-      pendingOp = handleSessionNew(id!, params ?? {}).catch((err) => {
-        sendError(id!, -32603, err instanceof Error ? err.message : String(err));
-      });
-      break;
-    case "session/prompt":
-      handleSessionPrompt(id!, params ?? {});
-      break;
-    case "session/set_mode":
-      handleSessionSetMode(id!, params ?? {});
-      break;
-    case "session/set_model":
-      if (core && params?.modelId) {
-        core.bus.emit("config:switch-model", { model: params.modelId as string });
-      }
-      sendResult(id!, {
-        models: getModelsPayload() ?? {},
-      });
-      break;
-    case "session/cancel":
-      if (core) {
-        core.bus.emit("agent:cancel-request", {});
-      }
-      // Notification — no response needed
-      break;
-    default:
-      if (id !== undefined) {
-        sendError(id, -32601, `Method not found: ${method}`);
-      }
-  }
-}
-
-// ── Stdin line reader ───────────────────────────────────────────────
-
-let buffer = "";
-
-process.stdin.setEncoding("utf-8");
-process.stdin.on("data", (chunk: string) => {
-  buffer += chunk;
-  let newlineIdx: number;
-  while ((newlineIdx = buffer.indexOf("\n")) !== -1) {
-    const line = buffer.slice(0, newlineIdx).trim();
-    buffer = buffer.slice(newlineIdx + 1);
-    if (!line) continue;
-    try {
-      const msg = JSON.parse(line) as JsonRpcRequest;
-      dispatch(msg);
-    } catch {
-      // Skip malformed JSON
-    }
-  }
-});
-
-process.stdin.on("end", async () => {
-  // Wait for any in-flight async operations (e.g. session/new) to settle
-  await pendingOp;
-  core?.kill();
-  process.exit(0);
-});
-
-// Log unhandled rejections to stderr (don't crash, but don't swallow silently)
-process.on("unhandledRejection", (err) => {
-  process.stderr.write(`[ash-acp-bridge] unhandled rejection: ${err instanceof Error ? err.message : err}\n`);
-});
-
-// Redirect stderr from agent-sh internals so it doesn't pollute the protocol
-// (agent-shell reads stdout only; stderr goes to its log)