codeep 3.3.3 → 3.4.1

package/dist/acp/server.js

@@ -4,16 +4,20 @@ import { randomUUID } from 'crypto';
 import { basename as pathBasename } from 'path';
 import { readFile } from 'fs/promises';
 import { fileURLToPath } from 'url';
-import { StdioTransport } from './transport.js';
+import { StdioTransport, AcpRequestError } from './transport.js';
 import { runAgentSession } from './session.js';
 import { loadCustomCommands } from '../utils/customCommands.js';
 import { registerSessionServers, disposeAllSessions as disposeAllMcpSessions } from '../utils/mcpRegistry.js';
-import { loadMcpServerConfigSplit, isWorkspaceMcpTrusted, mergeMcpServers } from '../utils/mcpConfig.js';
+import { selectSessionMcpServers } from '../utils/mcpConfig.js';
 import { handleMcpSamplingRequest } from '../utils/mcpSamplingBridge.js';
-import { executeCommandAsync } from '../utils/shell.js';
+import { executeCommandAsync, validateCommandAsync, commandEnv } from '../utils/shell.js';
+import { checkCommandRateLimit } from '../utils/ratelimit.js';
+import { recordCommand } from '../utils/history.js';
+import { trustBearingWrite } from '../utils/toolExecution.js';
 import { initWorkspace, loadWorkspace, handleCommand } from './commands.js';
+import { beginTurn } from './turns.js';
 import { handleSetMode as handleSetModeExternal, handleSetConfigOption as handleSetConfigOptionExternal, handleSessionList as handleSessionListExternal, handleSessionDelete as handleSessionDeleteExternal, handleListProviders as handleListProvidersExternal, } from './serverHandlers.js';
-import { autoSaveSession, config, getApiKey, getConfiguredProviders } from '../config/index.js';
+import { saveSession, startNewSession, config, getApiKey, getConfiguredProviders } from '../config/index.js';
 import { ApiError } from '../api/index.js';
 import { PROVIDERS } from '../config/providers.js';
 import { getCurrentVersion } from '../utils/update.js';
@@ -65,7 +69,7 @@ const AVAILABLE_COMMANDS = [
     { name: 'insights', description: 'Activity summary over the last N days (default 7)', input: { hint: '[--days N]' } },
     // Project intelligence
     { name: 'scan', description: 'Scan project structure and generate summary' },
-    { name: 'review', description: 'Run code review on project or specific files', input: { hint: '[file…]' } },
+    { name: 'review', description: 'AI review of git changes (--staged), or static analysis (--static / files)', input: { hint: '[--staged | --static | file…]' } },
     { name: 'learn', description: 'Learn coding preferences from project files' },
     { name: 'memory', description: 'Project memory notes — add / list / remove / clear', input: { hint: '<note> | list | remove <n> | clear' } },
     { name: 'profile', description: 'Save / load / delete provider+model presets', input: { hint: 'save | load | delete | list | <name>' } },
@@ -395,9 +399,336 @@ export function resolvePersonalitySelection(personalityId, workspaceRoot) {
     const personality = findPersonality(personalityId, workspaceRoot);
     return personality && isPersonalityAvailable(personality, workspaceRoot) ? personality : null;
 }
-// ─── Server ───────────────────────────────────────────────────────────────────
-export function startAcpServer() {
-    const transport = new StdioTransport();
+/** Per-command budget, the same one a local run gets. */
+export const ACP_COMMAND_TIMEOUT_MS = 120_000;
+/**
+ * Read the exit code from a terminal/wait_for_exit answer. ACP sends
+ * `{ exitCode, signal }`; older clients nest `{ type, code }` under
+ * `exitStatus`. Returns null when the answer carries no exit status.
+ *
+ * Exported for unit testing (see server.command.test.ts).
+ */
+export function exitCodeFromWaitResult(result) {
+    if (!result || typeof result !== 'object')
+        return null;
+    const outer = result;
+    const status = (outer.exitStatus && typeof outer.exitStatus === 'object' ? outer.exitStatus : outer);
+    if (typeof status.exitCode === 'number')
+        return status.exitCode;
+    if (status.type === 'exited' && typeof status.code === 'number')
+        return status.code;
+    // Ended by a signal
+    if (status.type === 'killed' || (typeof status.signal === 'string' && status.signal))
+        return 1;
+    return null;
+}
+/**
+ * `GIT_CONFIG_COUNT` and the `GIT_CONFIG_KEY_<n>` / `GIT_CONFIG_VALUE_<n>`
+ * pairs it counts — the numbered half of what hardenedGitEnv() produces.
+ */
+const GIT_CONFIG_ENV_NAME = /^GIT_CONFIG_(?:COUNT|KEY_\d+|VALUE_\d+)$/;
+/**
+ * The rest of what the terminal has to be given by name — see acpEnvList().
+ *
+ * `GIT_PAGER` and `GIT_TERMINAL_PROMPT` are hardenedGitEnv()'s two
+ * non-numbered outputs. `GIT_CONFIG_GLOBAL` / `GIT_CONFIG_SYSTEM` /
+ * `GIT_CONFIG_NOSYSTEM` are the variables the SCAN itself read the config
+ * through: leaving them behind would let the terminal's git resolve a
+ * different global config than the one Codeep just decided was safe.
+ *
+ * Everything after them is there for a client that REPLACES its environment
+ * with this list rather than extending it, and it is the half the first cut
+ * of this hotfix got wrong: the list was `PATH` and `HOME` — enough for the
+ * hardened `git status` it was written for — while acpEnvList() is applied
+ * to EVERY command handed to terminal/create. Against a replacing client
+ * that cost an ordinary command things that are not secrets and that it had
+ * in the user's own shell: `git push` over SSH had no agent socket to sign
+ * with and fell back to asking for a password on a terminal whose
+ * GIT_TERMINAL_PROMPT is `0`, which fails it outright; a test that sorts
+ * strings or formats a date ran under the C locale instead of the user's; a
+ * build had nowhere but the default /tmp to put its temporaries; anything
+ * behind a corporate proxy could not reach the network at all; and a
+ * toolchain installed under a version manager lost the variable its shim
+ * reads to pick a version.
+ *
+ * It stays an ALLOWLIST rather than becoming "process.env minus the names
+ * that look like credentials", because what made the change necessary is
+ * that `env` is not a private channel (see acpEnvList) and a name-shaped
+ * denylist does not recognise `DATABASE_URL`, a company's own `ACME_CREDS`,
+ * or anything else whose name does not say what it holds. A name gets in
+ * here only when it is known not to hold one.
+ *
+ * The one value below that CAN carry a credential is a proxy URL
+ * (`https_proxy=http://user:pass@proxy`), which is why redactCredentials()
+ * in src/acp/transport.ts has a rule for that exact shape. A command behind
+ * a proxy cannot reach the network without it.
+ */
+const ACP_TERMINAL_ENV_NAMES = new Set([
+    // hardenedGitEnv()'s own, and what the scan read the config through.
+    'GIT_PAGER',
+    'GIT_TERMINAL_PROMPT',
+    'GIT_CONFIG_GLOBAL',
+    'GIT_CONFIG_SYSTEM',
+    'GIT_CONFIG_NOSYSTEM',
+    // Where programs are found, and whose account runs them. No `PWD`: the
+    // terminal's working directory is the `cwd` of the terminal/create, and
+    // this process's would tell a shell script it is somewhere it is not.
+    'PATH',
+    'HOME',
+    'SHELL',
+    'USER',
+    'LOGNAME',
+    // The agent socket `git push` and `git fetch` over SSH sign with.
+    'SSH_AUTH_SOCK',
+    // Where a build puts its temporaries.
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    // The locale a test that sorts strings or formats a date asserts against.
+    'LANG',
+    'LANGUAGE',
+    // What the command may draw with, and what it thinks the time is.
+    'TERM',
+    'COLORTERM',
+    'TERM_PROGRAM',
+    'TZ',
+    // Toolchains under a version manager: the shim is on PATH, but the shim
+    // reads one of these to find the version to run.
+    'ASDF_DIR',
+    'ASDF_DATA_DIR',
+    'NVM_DIR',
+    'NVM_BIN',
+    'PYENV_ROOT',
+    'RBENV_ROOT',
+    'SDKMAN_DIR',
+    'VOLTA_HOME',
+    'PNPM_HOME',
+    'BUN_INSTALL',
+    'VIRTUAL_ENV',
+    'CONDA_PREFIX',
+    'CARGO_HOME',
+    'RUSTUP_HOME',
+    'GOPATH',
+    'GOROOT',
+    'JAVA_HOME',
+]);
+/**
+ * The same allowlist for the two families whose members cannot be listed:
+ * the locale categories (`LC_ALL`, `LC_TIME`, `LC_COLLATE`, …), and the
+ * proxy variables, which every tool spells in whichever case it was written
+ * in — curl and most of Unix read the lowercase ones, Windows-born tools the
+ * uppercase, and a machine behind a proxy usually sets both.
+ */
+const ACP_TERMINAL_ENV_FAMILY = /^(?:LC_[A-Z]+|(?:HTTP|HTTPS|FTP|ALL|NO)_PROXY|(?:http|https|ftp|all|no)_proxy)$/;
+/**
+ * An environment in the shape `terminal/create` takes it: ACP spells it as a
+ * list of `{ name, value }`, not as the map Node keeps in `process.env`.
+ *
+ * An allowlist goes in it — the hardening's own variables and the shell
+ * essentials above — and not the WHOLE of `process.env`, which is what this
+ * used to serialise. `env` is not a private channel: src/acp/transport.ts
+ * mirrors every outbound frame verbatim into ~/.cache/codeep/acp-debug.log
+ * when CODEEP_ACP_DEBUG is set, so every `ANTHROPIC_API_KEY`,
+ * `GITHUB_TOKEN`, `AWS_SECRET_ACCESS_KEY` and session cookie in the user's
+ * shell was written to a plaintext file on disk — and handed to the editor,
+ * which is free to log the protocol traffic itself. None of them makes the
+ * hardening work; the numbered GIT_CONFIG_* pairs do.
+ *
+ * What else the terminal inherits is the CLIENT's decision, not ours: ACP
+ * does not say whether `env` extends the client's environment or replaces it.
+ * A client that extends gives the command the user's shell environment
+ * anyway; a client that replaces gives it only this list — which is why the
+ * list has to cover what an ORDINARY command needs to run at all and not
+ * only what a hardened git spawn does. A terminal that got `GIT_CONFIG_COUNT`
+ * and nothing else would be running without a PATH.
+ *
+ * Unset variables are dropped rather than sent as `value: undefined` — that
+ * is what `process.env` holds for a variable that is not set, and JSON has no
+ * way to carry it.
+ *
+ * `hardened` says whether commandEnv() actually hardened this spawn, which it
+ * does for `git` and for nothing else. It only decides the last entry below:
+ * a command that cannot reach git is left with the environment it would have
+ * had, which is the same line the refusal path draws.
+ */
+function acpEnvList(env, hardened) {
+    const list = Object.entries(env)
+        .filter((entry) => typeof entry[1] === 'string')
+        .filter(([name]) => ACP_TERMINAL_ENV_NAMES.has(name)
+        || ACP_TERMINAL_ENV_FAMILY.test(name)
+        || GIT_CONFIG_ENV_NAME.test(name))
+        .map(([name, value]) => ({ name, value }));
+    // The one thing this list cannot express is a REMOVAL — an absent name is
+    // not a request to unset one — and hardenedGitEnv() removes exactly one
+    // variable, so it is sent EMPTY instead.
+    //
+    // `GIT_CONFIG_PARAMETERS` is read after the numbered `GIT_CONFIG_*` pairs
+    // and beats them: with `GIT_CONFIG_KEY_0=core.fsmonitor` and an empty value
+    // right there, a `GIT_CONFIG_PARAMETERS='core.fsmonitor=<program>'` still
+    // ran the program on `git status` (verified, git 2.54). So against a client
+    // that EXTENDS its own environment rather than replacing it, one variable
+    // the editor happened to inherit switched this whole hardening off. Git
+    // parses an empty value as no parameters at all (verified, same version),
+    // which is the unset this list has no other way to ask for.
+    if (hardened)
+        list.push({ name: 'GIT_CONFIG_PARAMETERS', value: '' });
+    return list;
+}
+/**
+ * Run an execute_command tool call for an ACP session, in the client's
+ * terminal when it offers one, otherwise locally.
+ *
+ * Never throws: the agent loop reports a throw to the model as a failed
+ * command, which hides whether the client terminal already ran it. A
+ * failure comes back as exitCode -1 with the reason instead.
+ *
+ * Exported for unit testing (see server.command.test.ts).
+ */
+export async function executeAcpCommand(command, args, cwd, ctx) {
+    const fail = (stderr, stdout = '') => ({ stdout, stderr, exitCode: -1 });
+    const timeoutMs = ctx.timeoutMs ?? ACP_COMMAND_TIMEOUT_MS;
+    // A cancelled prompt runs nothing more, wherever it would run, and a
+    // command that never ran is neither recorded nor counted.
+    if (ctx.signal.aborted)
+        return fail('Command cancelled');
+    // The same checks and bookkeeping as a local execute_command. They come
+    // before the terminal branch: the client's terminal is another place to
+    // run the command, not a way around the whitelist, the blocked patterns
+    // or the SSRF guard.
+    const validation = await validateCommandAsync(command, args, { cwd, projectRoot: cwd });
+    if (!validation.valid)
+        return fail(validation.reason || 'Command validation failed');
+    const cmdRate = checkCommandRateLimit();
+    if (!cmdRate.allowed)
+        return fail(cmdRate.message || 'Command rate limit exceeded');
+    recordCommand(command, args);
+    // Cancelling the prompt kills a local command too, and reports it as the
+    // client terminal branch does.
+    const runLocally = async () => {
+        const r = await executeCommandAsync(command, args, { cwd, projectRoot: cwd, timeout: timeoutMs, signal: ctx.signal });
+        if (r.cancelled)
+            return fail('Command cancelled', r.stdout ?? '');
+        return { stdout: r.stdout ?? '', stderr: r.stderr ?? '', exitCode: r.exitCode ?? 0 };
+    };
+    // Per ACP spec, only call terminal/* if the client advertised the
+    // capability in initialize. Otherwise execute locally.
+    if (!ctx.clientSupportsTerminal)
+        return runLocally();
+    // The client's terminal is a spawn like any other, and it inherits none of
+    // the hardening executeCommandAsync puts on the local one — so over ACP,
+    // which is how Zed runs Codeep, a `git status` in a hostile repository ran
+    // that repository's `core.fsmonitor` and `filter.<d>.clean` exactly as it
+    // did before this hotfix. The validation above stops the argv forms that
+    // redirect git, but nothing was stopping its config.
+    //
+    // Same helper as the local runner, so there is one answer to "what does a
+    // spawn that may reach git run with" — see commandEnv(). A refusal fails
+    // the command with git's own wording rather than handing it to a terminal
+    // this process cannot harden.
+    //
+    // commandEnv() and NOT shellCommandEnv(): this call site has the argv, and
+    // shellCommandEnv() can only scan the spawn's `cwd`. That made one argument
+    // the whole difference between the two runners — `git -C vendor/lib status`
+    // over ACP got the outer project scanned, so the nested checkout was left
+    // with only the always-on GIT_EXECUTING_CONFIG pairs behind it and its
+    // `filter.<driver>.clean` still ran (proven, git 2.54), while the same
+    // command locally reads `-C` out of the argv and scans where git will
+    // actually run.
+    let env;
+    try {
+        env = commandEnv(command, args, cwd);
+    }
+    catch (error) {
+        return fail(error instanceof Error ? error.message : String(error));
+    }
+    const { transport, sessionId, signal } = ctx;
+    let terminalId;
+    try {
+        const created = await transport.request('terminal/create', {
+            sessionId,
+            command,
+            args,
+            cwd,
+            env: acpEnvList(env, command === 'git'),
+            outputByteLimit: 1_000_000,
+        });
+        if (!created || typeof created.terminalId !== 'string') {
+            return fail('terminal/create returned no terminalId');
+        }
+        terminalId = created.terminalId;
+    }
+    catch (err) {
+        // The client refused to create the terminal, so nothing ran there and
+        // running the command here cannot run it twice. Without an answer that
+        // is unknown, so report the failure instead.
+        if (err instanceof AcpRequestError)
+            return runLocally();
+        return fail(`Client terminal unavailable: ${err.message}`);
+    }
+    const ref = { sessionId, terminalId };
+    // Stop waiting when the prompt is cancelled or the command outlives its
+    // budget. The transport's own timeout does not apply here: the command,
+    // not the client, decides how long wait_for_exit takes.
+    const stopWait = new AbortController();
+    let stopped = null;
+    const stop = (why) => {
+        stopped ??= why;
+        stopWait.abort();
+    };
+    const onAbort = () => stop('cancelled');
+    if (signal.aborted)
+        onAbort();
+    else
+        signal.addEventListener('abort', onAbort, { once: true });
+    const timer = setTimeout(() => stop('timeout'), timeoutMs);
+    try {
+        let exitCode = null;
+        let waitError = '';
+        try {
+            // Spec method is snake_case `terminal/wait_for_exit` and takes
+            // only { sessionId, terminalId } — no timeoutMs.
+            const waitResult = await transport.request('terminal/wait_for_exit', ref, { timeoutMs: 0, signal: stopWait.signal });
+            exitCode = exitCodeFromWaitResult(waitResult);
+            if (exitCode === null)
+                waitError = 'terminal/wait_for_exit returned no exit status';
+        }
+        catch (err) {
+            if (!stopped)
+                waitError = err.message;
+        }
+        if (stopped === 'cancelled') {
+            transport.request('terminal/kill', ref).catch(() => null);
+            return fail('Command cancelled');
+        }
+        if (stopped === 'timeout') {
+            await transport.request('terminal/kill', ref).catch(() => null);
+        }
+        const outputResult = await transport.request('terminal/output', ref).catch(() => null);
+        const output = typeof outputResult?.output === 'string' ? outputResult.output : '';
+        if (stopped === 'timeout')
+            return fail(`Command timed out after ${timeoutMs}ms`, output);
+        if (exitCode === null)
+            return fail(`Client terminal failed: ${waitError}`, output);
+        return { stdout: output, stderr: '', exitCode };
+    }
+    finally {
+        clearTimeout(timer);
+        signal.removeEventListener('abort', onAbort);
+        transport.request('terminal/release', ref).catch(() => null);
+    }
+}
+/**
+ * Save a session's history under its own id. The id travels with the ACP
+ * session (a reopened thread, a second thread in the same editor), so the
+ * global current-session id may name another conversation. Written right
+ * away: the editor may stop the agent at any moment after a turn.
+ */
+function persistSessionHistory(session) {
+    if (!config.get('autoSave') || session.history.length === 0)
+        return;
+    saveSession(session.codeepSessionId, session.history, session.workspaceRoot);
+}
+export function startAcpServer(transport = new StdioTransport()) {
     // ACP sessionId → full AcpSession (includes history + codeep session tracking)
     const sessions = new Map();
     // Shared deps object for the extracted handlers in serverHandlers.ts.
@@ -427,11 +758,13 @@ export function startAcpServer() {
         if (process.listenerCount(sig) === 0)
             process.on(sig, onShutdown);
     }
+    // A handler that throws, or an async one that rejects, is answered with a
+    // JSON-RPC error by the transport — so async handlers return their promise.
     transport.start((msg) => {
         // Notifications have no id — handle separately
         if (!('id' in msg)) {
             handleNotification(msg);
-            return;
+            return undefined;
         }
         const req = msg;
         switch (req.method) {
@@ -451,9 +784,7 @@ export function startAcpServer() {
             case 'session/resume':
                 handleSessionResume(req);
                 break;
-            case 'session/prompt':
-                handleSessionPrompt(req);
-                break;
+            case 'session/prompt': return handleSessionPrompt(req);
             case 'session/set_mode':
                 handleSetMode(req);
                 break;
@@ -475,19 +806,21 @@ export function startAcpServer() {
             case 'session/set_personality':
                 handleSetPersonality(req);
                 break;
-            case 'session/sync_personalities':
-                handleSyncPersonalities(req);
-                break;
+            case 'session/sync_personalities': return handleSyncPersonalities(req);
             default:
                 process.stderr.write(`[codeep-acp] Unknown method: ${req.method}\n`);
                 transport.error(req.id, -32601, `Method not found: ${req.method}`);
         }
+        return undefined;
     });
     // ── Notification handler (no id, no response) ──────────────────────────────
     function handleNotification(msg) {
         if (msg.method === 'session/cancel') {
             const { sessionId } = (msg.params ?? {});
-            sessions.get(sessionId)?.abortController?.abort();
+            const session = sessions.get(sessionId);
+            if (session)
+                for (const controller of session.activePrompts)
+                    controller.abort();
         }
     }
     // ── initialize ──────────────────────────────────────────────────────────────
@@ -581,17 +914,14 @@ export function startAcpServer() {
         // with the repo, so they spawn only for workspaces the user has trusted
         // (same gate the TUI prompts for at startup). ACP-provided servers are
         // the editor's own config and global ~/.codeep entries are the user's —
-        // both spawn unconditionally.
-        const { global: globalServers, workspace: workspaceServers } = loadMcpServerConfigSplit(cwd);
-        const workspaceTrusted = isWorkspaceMcpTrusted(cwd);
-        if (workspaceServers.length > 0 && !workspaceTrusted) {
-            process.stderr.write(`[codeep-acp] MCP (${label}): skipped ${workspaceServers.length} workspace server(s) — untrusted workspace. ` +
+        // both spawn unconditionally. /mcp in commands.ts selects the same way.
+        const { servers: merged, skipped } = selectSessionMcpServers(cwd, { fromClient: acpServers });
+        if (skipped.length > 0) {
+            process.stderr.write(`[codeep-acp] MCP (${label}): skipped ${skipped.length} workspace server(s) — untrusted workspace. ` +
                 `Run /mcp trust (or \`codeep\` in the repo once) to enable.\n`);
         }
-        const fromConfig = workspaceTrusted ? [...globalServers, ...workspaceServers] : globalServers;
-        const merged = mergeMcpServers(fromConfig, acpServers);
-        if (merged.length === 0)
-            return;
+        // Registered even when empty: on a reload that stops the servers the
+        // session no longer has.
         registerSessionServers(acpSessionId, merged, {
             workspaceRoot: cwd,
             // Servers that opted into the `sampling` capability can ask us to
@@ -612,19 +942,48 @@ export function startAcpServer() {
             .catch(err => process.stderr.write(`[codeep-acp] MCP registration crashed (${label}): ${err.message}\n`));
     }
     // ── session/new ─────────────────────────────────────────────────────────────
+    /**
+     * Check the fields a session request cannot do without, answering
+     * -32602 for the first one missing. Without this a missing cwd surfaced
+     * as a raw Node error, and a missing sessionId registered a session
+     * under `undefined`.
+     */
+    function hasSessionParams(msg, needSessionId) {
+        const p = (msg.params ?? {});
+        if (needSessionId && (typeof p.sessionId !== 'string' || !p.sessionId)) {
+            transport.error(msg.id, -32602, 'sessionId is required');
+            return false;
+        }
+        if (typeof p.cwd !== 'string' || !p.cwd) {
+            transport.error(msg.id, -32602, 'cwd is required');
+            return false;
+        }
+        return true;
+    }
     function handleSessionNew(msg) {
+        if (!hasSessionParams(msg, false))
+            return;
         const params = msg.params;
         const acpSessionId = randomUUID();
-        // Spin up MCP servers in the background. Errors surface via /mcp.
-        spawnMcpServersForSession(acpSessionId, params.cwd, params.mcpServers, 'session/new');
-        const { codeepSessionId, history, welcomeText } = initWorkspace(params.cwd, params.fresh);
+        const workspace = initWorkspace(params.cwd, params.fresh);
+        const { history } = workspace;
+        let { codeepSessionId, welcomeText } = workspace;
+        // Two threads bound to one saved conversation would overwrite each
+        // other's file on every turn: a resume of a conversation that another
+        // thread already has open continues under a new name.
+        const inUse = [...sessions.values()].some((s) => s.codeepSessionId === codeepSessionId && s.workspaceRoot === params.cwd);
+        if (inUse) {
+            codeepSessionId = startNewSession();
+            welcomeText += `\n\n_That conversation is open in another thread, so this one continues as \`${codeepSessionId}\`._`;
+        }
         sessions.set(acpSessionId, {
             sessionId: acpSessionId,
             workspaceRoot: params.cwd,
             history,
             codeepSessionId,
             addedFiles: new Map(),
-            abortController: null,
+            clientMcpServers: params.mcpServers,
+            activePrompts: new Set(),
             currentModeId: 'auto',
             titleSent: false,
             hadHistory: history.length > 0,
@@ -638,6 +997,10 @@ export function startAcpServer() {
             modes: AGENT_MODES,
             configOptions: buildConfigOptions(),
         };
+        // Spin up MCP servers in the background. Errors surface via /mcp.
+        // Started only now: if setting up the session throws, the client gets
+        // an error and no session id, so nothing could ever dispose them.
+        spawnMcpServersForSession(acpSessionId, params.cwd, params.mcpServers, 'session/new');
         transport.respond(msg.id, result);
         // Advertise slash commands AFTER a short delay. Zed processes
         // `AvailableCommandsUpdated` events synchronously and silently drops them
@@ -698,6 +1061,8 @@ export function startAcpServer() {
     }
     // ── session/load ────────────────────────────────────────────────────────────
     function handleSessionLoad(msg) {
+        if (!hasSessionParams(msg, true))
+            return;
         const params = msg.params;
         // Try to restore existing Codeep session or fall back to fresh workspace
         const existing = sessions.get(params.sessionId);
@@ -706,17 +1071,24 @@ export function startAcpServer() {
             existing.workspaceRoot = params.cwd;
             // Re-spawn any MCP servers the client passed in (they may have changed
             // since session/new; old ones get disposed by registerSessionServers).
-            spawnMcpServersForSession(params.sessionId, params.cwd, params.mcpServers, 'session/load (warm)');
+            existing.clientMcpServers = params.mcpServers ?? existing.clientMcpServers;
+            spawnMcpServersForSession(params.sessionId, params.cwd, existing.clientMcpServers, 'session/load (warm)');
+            // A load replays the conversation, warm or cold: clients such as the
+            // VS Code extension clear the chat and show what this returns.
             const result = {
+                sessionId: params.sessionId,
+                history: existing.history.filter(m => m.role === 'user' || m.role === 'assistant'),
                 modes: AGENT_MODES,
                 configOptions: buildConfigOptions(),
             };
             transport.respond(msg.id, result);
             return;
         }
-        // Session not in memory — try to load from disk
+        // Session not in memory — try to load from disk. It is registered under
+        // the id the client asked for: ACP clients keep using that id for
+        // prompts and route updates by it.
         const { codeepSessionId, history, welcomeText } = loadWorkspace(params.cwd, params.sessionId);
-        const acpSessionId = randomUUID();
+        const acpSessionId = params.sessionId;
         spawnMcpServersForSession(acpSessionId, params.cwd, params.mcpServers, 'session/load (cold)');
         sessions.set(acpSessionId, {
             sessionId: acpSessionId,
@@ -724,7 +1096,8 @@ export function startAcpServer() {
             history,
             codeepSessionId,
             addedFiles: new Map(),
-            abortController: null,
+            clientMcpServers: params.mcpServers,
+            activePrompts: new Set(),
             titleSent: true,
             hadHistory: history.length > 0,
             currentModeId: 'auto',
@@ -740,10 +1113,10 @@ export function startAcpServer() {
         // session/new — see sendCommandsDelayed comment).
         sendCommandsDelayed(acpSessionId, params.cwd);
         // Send title immediately so Zed "Recent" panel shows something useful
-        sendSessionTitle(params.sessionId, history, pathBasename(params.cwd));
+        sendSessionTitle(acpSessionId, history, pathBasename(params.cwd));
         // Send restored session welcome
         transport.notify('session/update', {
-            sessionId: params.sessionId,
+            sessionId: acpSessionId,
             update: {
                 sessionUpdate: 'agent_message_chunk',
                 content: { type: 'text', text: welcomeText },
@@ -756,13 +1129,16 @@ export function startAcpServer() {
     // (modes + config). No history replay → instant reconnect on UI reload.
     // Falls back to `session/load` semantics if the session isn't in memory yet.
     function handleSessionResume(msg) {
+        if (!hasSessionParams(msg, true))
+            return;
         const params = msg.params;
         const existing = sessions.get(params.sessionId);
         if (existing) {
             existing.workspaceRoot = params.cwd;
             // Resume can carry an updated mcpServers list (e.g. workspace switched
             // config) — re-register so old servers are torn down and new ones spawn.
-            spawnMcpServersForSession(params.sessionId, params.cwd, params.mcpServers, 'session/resume (warm)');
+            existing.clientMcpServers = params.mcpServers ?? existing.clientMcpServers;
+            spawnMcpServersForSession(params.sessionId, params.cwd, existing.clientMcpServers, 'session/resume (warm)');
             const result = {
                 sessionId: params.sessionId,
                 modes: AGENT_MODES,
@@ -775,8 +1151,9 @@ export function startAcpServer() {
         }
         // Session not in memory — load from disk but skip the welcome banner and
         // the history echo (resume contract: client already has history).
+        // Registered under the requested id, as in session/load.
         const { codeepSessionId, history } = loadWorkspace(params.cwd, params.sessionId);
-        const acpSessionId = randomUUID();
+        const acpSessionId = params.sessionId;
         spawnMcpServersForSession(acpSessionId, params.cwd, params.mcpServers, 'session/resume (cold)');
         sessions.set(acpSessionId, {
             sessionId: acpSessionId,
@@ -784,7 +1161,8 @@ export function startAcpServer() {
             history,
             codeepSessionId,
             addedFiles: new Map(),
-            abortController: null,
+            clientMcpServers: params.mcpServers,
+            activePrompts: new Set(),
             titleSent: true,
             hadHistory: history.length > 0,
             currentModeId: 'auto',
@@ -954,7 +1332,7 @@ export function startAcpServer() {
                 });
                 session.history.push({ role: 'user', content: prompt ? `[Image] ${prompt}` : '[Image pasted from clipboard]' });
                 session.history.push({ role: 'assistant', content: description });
-                autoSaveSession(session.history, session.workspaceRoot);
+                persistSessionHistory(session);
             }
             catch (err) {
                 transport.notify('session/update', {
@@ -965,7 +1343,7 @@ export function startAcpServer() {
             return;
         }
         const abortController = new AbortController();
-        session.abortController = abortController;
+        session.activePrompts.add(abortController);
         // Plan tracking: build a live plan from tool calls as the agent works
         // ACP spec: send complete list on every update, client replaces current plan
         const planEntries = new Map();
@@ -978,10 +1356,6 @@ export function startAcpServer() {
                 },
             });
         };
-        // Manual mode gates write/edit for THIS run via a per-call option passed to
-        // runAgentSession (extraDangerousTools, below) — NOT by mutating the global
-        // `agentConfirmWriteFile` config, which leaked the session's mode into the
-        // TUI/other processes and raced on a non-atomic restore.
         const agentResponseChunks = [];
         const sendChunk = (text) => {
             agentResponseChunks.push(text);
@@ -993,6 +1367,141 @@ export function startAcpServer() {
                 },
             });
         };
+        // Ask the user through the client. A person answers this: wait as long
+        // as the dialog is open. Only cancelling the prompt stops the wait. No
+        // answer (error, cancelled prompt, a reply without an outcome) is null,
+        // which callers must treat as a refusal.
+        const askUser = (toolCall, options) => transport.request('session/request_permission', {
+            sessionId: params.sessionId,
+            toolCall,
+            options,
+        }, {
+            timeoutMs: 0,
+            signal: abortController.signal,
+        }).then((reply) => {
+            const outcome = reply?.outcome;
+            return outcome && typeof outcome === 'object' ? reply : null;
+        }, () => null);
+        // How the agent runs for this prompt. Built once so slash commands that
+        // run the agent (/go, custom commands, skill agent steps) run it exactly
+        // like a plain prompt.
+        const manualMode = session.currentModeId === 'manual';
+        // The one permission dialog this session puts in front of the user.
+        const askAboutToolCall = async (toolCall, 
+        // What the agent gate already worked out about this call. Passed rather
+        // than worked out again: trustBearingWrite() stats the path, resolves a
+        // symlinked ancestor and may ask git where this repository keeps its
+        // hooks. `null` is an answer ("writes no such file"); undefined means
+        // the question came from somewhere that has not looked, which is the
+        // only case that pays for the lookup here.
+        known) => {
+            // A write to a file that decides what runs later says so in the
+            // dialog — the editor shows `toolInput`, and "this file controls what
+            // commands git runs" is the part that makes the answer an informed one.
+            const trustBearing = known !== undefined ? known : trustBearingWrite(toolCall, session.workspaceRoot);
+            const result = await askUser({
+                toolCallId: `perm_${randomUUID()}`,
+                toolName: toolCall.tool,
+                toolInput: {
+                    ...formatToolInputForPermission(toolCall.tool, toolCall.parameters),
+                    ...(trustBearing ? { warning: trustBearing.reason } : {}),
+                },
+                status: 'pending',
+                content: [],
+            }, [
+                { optionId: 'allow_once', name: 'Allow once', kind: 'allow_once' },
+                // No "always" for one of those files: the agent answers about this
+                // file only and would not remember the answer anyway.
+                ...(trustBearing ? [] : [{ optionId: 'allow_always', name: 'Allow always', kind: 'allow_always' }]),
+                { optionId: 'reject_once', name: 'Reject once', kind: 'reject_once' },
+                { optionId: 'reject_always', name: 'Reject always', kind: 'reject_always' },
+            ]);
+            // Map ACP outcome back to PermissionOutcome. No answer
+            // (error, cancelled prompt) denies.
+            if (!result || result.outcome.type === 'cancelled')
+                return 'reject_once';
+            return result.outcome.optionId;
+        };
+        // Auto mode's answer to the agent's permission gate: yes to everything
+        // except a write to a file that decides what runs later, which is asked
+        // about in every mode. Without it the agent would have to refuse those
+        // writes outright, having nobody to ask. It travels under its own key on
+        // `agentRun` and never as `onRequestPermission`: a slash command reads
+        // that key being set as "this session asks the user" (see
+        // acp/commands.ts), and auto mode still runs a skill's shell lines
+        // without asking, as it promises.
+        const autoModeAnswer = async (toolCall, known) => {
+            const trustBearing = known !== undefined ? known : trustBearingWrite(toolCall, session.workspaceRoot);
+            // Handed on, so the dialog does not look the same file up a third time.
+            return trustBearing ? askAboutToolCall(toolCall, trustBearing) : 'allow_once';
+        };
+        const agentRun = {
+            // Manual mode gates write_file/edit_file for this run only, per call —
+            // NOT by mutating the global `agentConfirmWriteFile` config, which
+            // leaked the session's mode into the TUI/other processes and raced on
+            // a non-atomic restore.
+            extraDangerousTools: manualMode ? ['write_file', 'edit_file'] : undefined,
+            // Only request permission in Manual mode
+            onRequestPermission: manualMode ? askAboutToolCall : undefined,
+            // …and in auto mode, the answer a command that runs the agent uses in
+            // its place, so /go and a skill's agent step get the same one prompt a
+            // plain prompt gets instead of a refusal.
+            onAutoModePermission: manualMode ? undefined : autoModeAnswer,
+            // A skill's confirm step ("Deploy to production?") — a one-off
+            // question, so no "always" answers.
+            confirm: manualMode
+                ? async (message) => {
+                    const result = await askUser({
+                        toolCallId: `confirm_${randomUUID()}`,
+                        toolName: 'confirm',
+                        toolInput: { question: message },
+                        status: 'pending',
+                        content: [],
+                    }, [
+                        { optionId: 'allow_once', name: 'Yes', kind: 'allow_once' },
+                        { optionId: 'reject_once', name: 'No', kind: 'reject_once' },
+                    ]);
+                    return result?.outcome.type === 'selected' && result.outcome.optionId === 'allow_once';
+                }
+                : undefined,
+            // Per ACP spec, `fs/read_text_file` and `fs/write_text_file` are
+            // CLIENT methods — only safe to call when the client advertised
+            // the capability in `initialize`. Routing through the client
+            // means the editor's dirty buffers + undo history stay correct
+            // (otherwise an in-editor unsaved change would be invisible to
+            // the agent, or worse, silently overwritten).
+            fs: {
+                readTextFile: clientSupportsFsRead
+                    ? async (absolutePath) => {
+                        const result = await transport.request('fs/read_text_file', {
+                            sessionId: params.sessionId,
+                            path: absolutePath,
+                        });
+                        if (!result || typeof result.content !== 'string') {
+                            throw new Error('fs/read_text_file returned no content');
+                        }
+                        return result.content;
+                    }
+                    : undefined,
+                writeTextFile: clientSupportsFsWrite
+                    ? async (absolutePath, content) => {
+                        // Rejects when the client refuses the write, so the tool
+                        // never reports a file it did not write.
+                        await transport.request('fs/write_text_file', {
+                            sessionId: params.sessionId,
+                            path: absolutePath,
+                            content,
+                        });
+                    }
+                    : undefined,
+            },
+            onExecuteCommand: (command, args, cwd) => executeAcpCommand(command, args, cwd, {
+                transport,
+                sessionId: params.sessionId,
+                clientSupportsTerminal,
+                signal: abortController.signal,
+            }),
+        };
         // Try slash commands first.
         // Run the whole prompt lifecycle inside THIS ACP session's token scope so
         // (a) concurrent sessions on one process can't mix usage totals, and
@@ -1002,7 +1511,7 @@ export function startAcpServer() {
         session.tokenRecords ??= createTokenScope();
         runWithTokenScope(session.tokenRecords, () => {
             const tokenReportStart = getRecordCount();
-            return handleCommand(prompt, session, sendChunk, abortController.signal)
+            return handleCommand(prompt, session, sendChunk, abortController.signal, agentRun)
                 .then((cmd) => {
                 if (cmd.handled) {
                     if (cmd.response)
@@ -1022,7 +1531,10 @@ export function startAcpServer() {
                         session.titleSent = true;
                         sendSessionTitle(params.sessionId, [{ role: 'user', content: prompt }]);
                     }
-                    transport.respond(msg.id, { stopReason: 'end_turn' });
+                    session.activePrompts.delete(abortController);
+                    // A command that runs the agent (/go, skills) or the model (/diff,
+                    // /compact) can be cancelled part way; the client must hear so.
+                    transport.respond(msg.id, { stopReason: abortController.signal.aborted ? 'cancelled' : 'end_turn' });
                     return;
                 }
                 // Not a command — run agent loop
@@ -1034,6 +1546,8 @@ export function startAcpServer() {
                     }
                     enrichedPrompt = parts.join('\n') + '\n\n' + prompt;
                 }
+                // Captured now: the user may move to another conversation before this ends.
+                const recordTurn = beginTurn(session);
                 runAgentSession({
                     prompt: enrichedPrompt,
                     workspaceRoot: session.workspaceRoot,
@@ -1095,110 +1609,17 @@ export function startAcpServer() {
                             }
                         }
                     },
-                    // Manual mode gates write_file/edit_file for this run only (per-call,
-                    // no global config mutation).
-                    extraDangerousTools: session.currentModeId === 'manual' ? ['write_file', 'edit_file'] : undefined,
-                    // Only request permission in Manual mode
-                    onRequestPermission: session.currentModeId === 'manual'
-                        ? async (toolCall) => {
-                            const permToolCallId = `perm_${randomUUID()}`;
-                            const result = await transport.request('session/request_permission', {
-                                sessionId: params.sessionId,
-                                toolCall: {
-                                    toolCallId: permToolCallId,
-                                    toolName: toolCall.tool,
-                                    toolInput: formatToolInputForPermission(toolCall.tool, toolCall.parameters),
-                                    status: 'pending',
-                                    content: [],
-                                },
-                                options: [
-                                    { optionId: 'allow_once', name: 'Allow once', kind: 'allow_once' },
-                                    { optionId: 'allow_always', name: 'Allow always', kind: 'allow_always' },
-                                    { optionId: 'reject_once', name: 'Reject once', kind: 'reject_once' },
-                                    { optionId: 'reject_always', name: 'Reject always', kind: 'reject_always' },
-                                ],
-                            });
-                            // Map ACP outcome back to PermissionOutcome
-                            if (!result || result.outcome.type === 'cancelled')
-                                return 'reject_once';
-                            return result.outcome.optionId;
-                        }
-                        : undefined,
-                    // Per ACP spec, `fs/read_text_file` and `fs/write_text_file` are
-                    // CLIENT methods — only safe to call when the client advertised
-                    // the capability in `initialize`. Routing through the client
-                    // means the editor's dirty buffers + undo history stay correct
-                    // (otherwise an in-editor unsaved change would be invisible to
-                    // the agent, or worse, silently overwritten).
-                    fs: {
-                        readTextFile: clientSupportsFsRead
-                            ? async (absolutePath) => {
-                                const result = await transport.request('fs/read_text_file', {
-                                    sessionId: params.sessionId,
-                                    path: absolutePath,
-                                });
-                                if (!result || typeof result.content !== 'string') {
-                                    throw new Error('fs/read_text_file returned no content');
-                                }
-                                return result.content;
-                            }
-                            : undefined,
-                        writeTextFile: clientSupportsFsWrite
-                            ? async (absolutePath, content) => {
-                                await transport.request('fs/write_text_file', {
-                                    sessionId: params.sessionId,
-                                    path: absolutePath,
-                                    content,
-                                });
-                            }
-                            : undefined,
-                    },
-                    onExecuteCommand: async (command, args, cwd) => {
-                        // Per ACP spec, only call terminal/* if the client advertised the
-                        // capability in initialize. Otherwise execute locally.
-                        if (!clientSupportsTerminal) {
-                            const r = await executeCommandAsync(command, args, { cwd, projectRoot: cwd, timeout: 120000 });
-                            return { stdout: r.stdout ?? '', stderr: r.stderr ?? '', exitCode: r.exitCode ?? 0 };
-                        }
-                        try {
-                            const createResult = await transport.request('terminal/create', {
-                                sessionId: params.sessionId,
-                                command,
-                                args,
-                                cwd,
-                                outputByteLimit: 1_000_000,
-                            });
-                            const { terminalId } = createResult;
-                            // Spec method is snake_case `terminal/wait_for_exit` and takes
-                            // only { sessionId, terminalId } — no timeoutMs.
-                            const waitResult = await transport.request('terminal/wait_for_exit', {
-                                sessionId: params.sessionId,
-                                terminalId,
-                            });
-                            const outputResult = await transport.request('terminal/output', {
-                                sessionId: params.sessionId,
-                                terminalId,
-                            });
-                            await transport.request('terminal/release', {
-                                sessionId: params.sessionId,
-                                terminalId,
-                            });
-                            const exitCode = waitResult.exitStatus.type === 'exited' ? waitResult.exitStatus.code : 1;
-                            return { stdout: outputResult.output ?? '', stderr: '', exitCode };
-                        }
-                        catch (err) {
-                            // Client terminal failed — fall back to local execution
-                            const r = await executeCommandAsync(command, args, { cwd, projectRoot: cwd, timeout: 120000 });
-                            return { stdout: r.stdout ?? '', stderr: r.stderr ?? '', exitCode: r.exitCode ?? 0 };
-                        }
-                    },
+                    onRequestPermission: agentRun.onRequestPermission ?? agentRun.onAutoModePermission,
+                    extraDangerousTools: agentRun.extraDangerousTools,
+                    fs: agentRun.fs,
+                    onExecuteCommand: agentRun.onExecuteCommand,
+                    // Earlier turns only: the prompt joins the history once it ran.
+                    chatHistory: [...session.history],
                 }).then(() => {
-                    session.history.push({ role: 'user', content: prompt });
                     const agentResponse = agentResponseChunks.join('');
-                    if (agentResponse) {
-                        session.history.push({ role: 'assistant', content: agentResponse });
-                    }
-                    autoSaveSession(session.history, session.workspaceRoot);
+                    recordTurn(agentResponse
+                        ? [{ role: 'user', content: prompt }, { role: 'assistant', content: agentResponse }]
+                        : [{ role: 'user', content: prompt }]);
                     // Report token usage to dashboard
                     const projectCtx = getProjectContext(session.workspaceRoot);
                     const sharedFields = {
@@ -1241,9 +1662,11 @@ export function startAcpServer() {
                         session.titleSent = true;
                         sendSessionTitle(params.sessionId, [{ role: 'user', content: prompt }]);
                     }
-                    transport.respond(msg.id, { stopReason: 'end_turn' });
+                    transport.respond(msg.id, { stopReason: abortController.signal.aborted ? 'cancelled' : 'end_turn' });
                 }).catch((err) => {
-                    if (err.name === 'AbortError') {
+                    // Once the user cancelled, the answer is "cancelled", whatever the
+                    // run failed with on the way out.
+                    if (err.name === 'AbortError' || abortController.signal.aborted) {
                         // Clear plan UI on the client side when session is cancelled
                         if (planEntries.size > 0) {
                             planEntries.clear();
@@ -1263,13 +1686,17 @@ export function startAcpServer() {
                         transport.error(msg.id, -32000, err.message);
                     }
                 }).finally(() => {
-                    if (session)
-                        session.abortController = null;
+                    session.activePrompts.delete(abortController);
                     planEntries.clear();
                 });
             })
                 .catch((err) => {
-                if (err.message?.includes('API key not configured') || err.message?.includes('API key') || (err instanceof ApiError && err.status === 401)) {
+                // A command that streams (/review, /diff) stops with an AbortError
+                // when cancelled. The client asked for that, so it is not an error.
+                if (err.name === 'AbortError' || abortController.signal.aborted) {
+                    transport.respond(msg.id, { stopReason: 'cancelled' });
+                }
+                else if (err.message?.includes('API key not configured') || err.message?.includes('API key') || (err instanceof ApiError && err.status === 401)) {
                     sendChunk(`❌ No API key configured. Use /login <provider> <key> or set the environment variable (e.g. ZAI_API_KEY, ANTHROPIC_API_KEY).`);
                     transport.respond(msg.id, { stopReason: 'end_turn' });
                 }
@@ -1280,8 +1707,7 @@ export function startAcpServer() {
                 else {
                     transport.error(msg.id, -32000, err.message);
                 }
-                if (session)
-                    session.abortController = null;
+                session.activePrompts.delete(abortController);
             });
         });
     }