ds-harness-remote 0.4.12 → 0.4.14

package/dist/index.js

@@ -4059,6 +4059,15 @@ var MAX_DEVICE_NAME_LENGTH = 128;
 var MAX_DEVICE_PLATFORM_LENGTH = 64;
 var MAX_DEVICE_VERSION_LENGTH = 64;
 var MAX_AUTH_TOKEN_LENGTH = 8 * 1024;
+var HOST_REGISTRATION_CODE_TTL_MS = 10 * 6e4;
+var MAX_ACTIVE_TRANSFERS_PER_DIRECTION = 2;
+var TRANSFER_IDLE_MS = 2 * 6e4;
+var MAX_RPC_TEXT_INPUT_BYTES = 64 * 1024;
+var MAX_FILEVIEWER_RANGE_BYTES = 512 * 1024;
+var MIN_REPLAY_WINDOW_MS = 15 * 6e4;
+var MAX_ALPHA_STREAMS_PER_CONNECTION = 16;
+var MAX_ACP_PROMPT_BYTES = 64 * 1024;
+var MAX_ACP_UPDATE_BYTES = 512 * 1024;
 var SECURE_FRAGMENT_MAGIC = new Uint8Array([68, 83, 72, 70]);
 var SECURE_FRAGMENT_VERSION = 1;
 var SECURE_FRAGMENT_HEADER_BYTES = 17;
@@ -4114,7 +4123,60 @@ var rpcMethods = [
   "codex.app.transfer.chunk",
   "codex.app.transfer.commit",
   "codex.app.transfer.read",
-  "codex.app.transfer.close"
+  "codex.app.transfer.close",
+  "acp.initialize",
+  "acp.session.new",
+  "acp.session.load",
+  "acp.session.prompt",
+  "acp.session.respond_permission",
+  "acp.session.cancel",
+  "acp.session.set_mode"
+];
+var errorCodes = [
+  // Protocol / Version
+  "INVALID_MESSAGE",
+  "UNSUPPORTED_VERSION",
+  "CAPABILITY_NOT_SUPPORTED",
+  "METHOD_NOT_FOUND",
+  "METHOD_NOT_ALLOWED",
+  "REQUEST_CONFLICT",
+  "FRAME_TOO_LARGE",
+  "RATE_LIMITED",
+  // Auth / Device
+  "AUTH_REQUIRED",
+  "AUTH_INVALID",
+  "ACCOUNT_AUTH_REQUIRED",
+  "TOKEN_EXPIRED",
+  "DEVICE_NOT_FOUND",
+  "DEVICE_REVOKED",
+  "DEVICE_OWNERSHIP_REQUIRED",
+  "MEMBERSHIP_REQUIRED",
+  "PEER_IDENTITY_MISMATCH",
+  "HOST_REGISTRATION_CODE_NOT_FOUND",
+  "HOST_REGISTRATION_CODE_EXPIRED",
+  "HOST_REGISTRATION_CODE_CONSUMED",
+  // Connection / Transport
+  "HOST_OFFLINE",
+  "CONNECTION_NOT_FOUND",
+  "CONNECTION_FAILED",
+  "CONNECTION_REPLACED",
+  "P2P_FAILED",
+  "TURN_UNAVAILABLE",
+  "RELAY_UNAVAILABLE",
+  "SLOW_CONSUMER",
+  "SECURE_CHANNEL_FAILED",
+  // Harness
+  "HARNESS_UNAVAILABLE",
+  "HARNESS_VERSION_INCOMPATIBLE",
+  "RESPONSE_TOO_LARGE",
+  "SESSION_NOT_FOUND",
+  "SESSION_NOT_READY",
+  "AGENT_BUSY",
+  "PERMISSION_DENIED",
+  "PERMISSION_NOT_PENDING",
+  "RPC_TIMEOUT",
+  "FULL_RESYNC_REQUIRED",
+  "INTERNAL_ERROR"
 ];
 var selectedTransports = ["lan", "p2p", "turn", "relay"];
 function normalizeSdpMLineIndex(value) {
@@ -4140,6 +4202,7 @@ function acceptNegotiatedCapabilities(offered, negotiated) {
 var rpcMethodSchema = external_exports.enum(rpcMethods);
 var messageTypeSchema = external_exports.enum(messageTypes);
 var controlFrameTypeSchema = external_exports.enum(controlFrameTypes);
+var errorCodeSchema = external_exports.enum(errorCodes);
 var uniqueStrings = (values) => new Set(values).size === values.length;
 var uniqueNumbers = (values) => new Set(values).size === values.length;
 var utf8Length = (value) => new TextEncoder().encode(value).byteLength;
@@ -4181,6 +4244,10 @@ var hostRegistrationCodeRequestSchema = external_exports.object({
   code: external_exports.string().regex(/^[A-Z0-9]{4}-[A-Z0-9]{4}$/u),
   device: hostDeviceDescriptorSchema
 }).strict();
+var registerOwnedRoleRequestSchema = external_exports.object({
+  v: external_exports.literal(PROTOCOL_VERSION),
+  device: accountDeviceDescriptorSchema
+}).strict();
 var deviceRefreshRequestSchema = external_exports.object({
   deviceId: deviceIdSchema,
   refreshToken: authTokenSchema
@@ -13958,6 +14025,120 @@ async function waitForResponder(inner, noise) {
 
 // src/control-route.ts
 var CONTROL_RPC_PREFIX = "/ds-harness-remote";
+var ENDPOINT_SEGMENT_PATTERN = /^[A-Za-z0-9_$.-]+$/;
+var INVALID_REQUEST_RPC_ID = "invalid-request";
+function registerControlRoute(connection, handler, webServer) {
+  if (webServer !== void 0 && connection.requestRejection !== void 0) {
+    const dispose = webServer.register({
+      kind: "prefix",
+      path: CONTROL_RPC_PREFIX,
+      handler: (req, res) => handleControlRequest(connection, handler, req, res)
+    });
+    return async () => {
+      await dispose();
+    };
+  }
+  return connection.rpc.handle(CONTROL_RPC_PREFIX, handler, {
+    authority: "loopback"
+  });
+}
+async function handleControlRequest(connection, handler, req, res) {
+  const rejection = connection.requestRejection?.(req);
+  if (rejection !== void 0) {
+    res.writeHead(rejection);
+    res.end(rejection === 401 ? "unauthorized" : "forbidden");
+    return;
+  }
+  const endpoint = endpointFromPath(CONTROL_RPC_PREFIX, new URL(req.url ?? "/", "http://dsh.internal").pathname);
+  if (req.method !== "POST" || endpoint === void 0) {
+    writeText(res, 404, "not found");
+    return;
+  }
+  if (contentType(req.headers) !== "application/json") {
+    writeText(res, 415, "content type must be application/json");
+    return;
+  }
+  let body;
+  try {
+    body = await readJsonBody(req);
+  } catch {
+    writeText(res, 400, "body is not JSON");
+    return;
+  }
+  const message = clientRequest(body);
+  if (message === void 0) {
+    writeJson(res, 200, errorResponse(rpcId(body), {
+      code: "gateway/bad-request",
+      message: "invalid client-request message",
+      details: { issues: [] }
+    }));
+    return;
+  }
+  if (message.method !== endpoint) {
+    writeJson(res, 200, errorResponse(message.rpcId, {
+      code: "gateway/bad-request",
+      message: `method ${JSON.stringify(message.method)} does not match endpoint ${JSON.stringify(endpoint)}`,
+      details: { issues: [] }
+    }));
+    return;
+  }
+  try {
+    const result = await handler(endpoint, message.payload, requestSignal(req));
+    writeJson(res, 200, fullResponse(message.rpcId, result));
+  } catch (error) {
+    writeText(res, 500, `handler failure: ${String(error)}`);
+  }
+}
+function endpointFromPath(channel, pathname) {
+  if (!pathname.startsWith(`${channel}/`)) return void 0;
+  const endpoint = pathname.slice(channel.length + 1);
+  if (endpoint.split("/").some((segment) => segment === "" || segment === "." || segment === ".." || !ENDPOINT_SEGMENT_PATTERN.test(segment))) {
+    return void 0;
+  }
+  return endpoint;
+}
+function contentType(headers) {
+  const raw = headers["content-type"];
+  const value = Array.isArray(raw) ? raw[0] : raw;
+  return value?.split(";", 1)[0]?.trim().toLowerCase();
+}
+async function readJsonBody(req) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function requestSignal(req) {
+  const abort = new AbortController();
+  req.on("close", () => {
+    if (!req.complete) abort.abort();
+  });
+  return abort.signal;
+}
+function clientRequest(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+  const record6 = value;
+  if (record6.type !== "client-request" || typeof record6.rpcId !== "string" || typeof record6.method !== "string") return void 0;
+  return { type: "client-request", rpcId: record6.rpcId, method: record6.method, payload: record6.payload };
+}
+function rpcId(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return INVALID_REQUEST_RPC_ID;
+  const record6 = value;
+  return typeof record6.rpcId === "string" ? record6.rpcId : INVALID_REQUEST_RPC_ID;
+}
+function errorResponse(rpcId2, error) {
+  return fullResponse(rpcId2, { ok: false, error });
+}
+function fullResponse(rpcId2, result) {
+  return { type: "server-response", rpcId: rpcId2, result };
+}
+function writeJson(res, status2, body) {
+  res.writeHead(status2, { "content-type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function writeText(res, status2, body) {
+  res.writeHead(status2);
+  res.end(body);
+}
 
 // src/ids.ts
 import { randomBytes as randomBytes6 } from "node:crypto";
@@ -14310,11 +14491,168 @@ function base64ToBytes2(value) {
   return bytes;
 }
 
+// src/session-format-compat.ts
+function normalizeLegacySessionGatewayValue(endpoint, value) {
+  if (endpoint === "session/page") return normalizePage(value);
+  if (endpoint === "session/follow") return normalizeFollowFrame(value);
+  return value;
+}
+function normalizeFollowFrame(value) {
+  if (!isRecord3(value)) return value;
+  if (value.type === "snapshot") {
+    return {
+      ...value,
+      header: normalizeHeader(value.header),
+      records: normalizeRecords(value.records),
+      ...value.assistantStream === void 0 ? { assistantStream: { revision: 0 } } : {}
+    };
+  }
+  return normalizeEntry(value);
+}
+function normalizePage(value) {
+  if (!isRecord3(value)) return value;
+  return { ...value, records: normalizeRecords(value.records) };
+}
+function normalizeRecords(value) {
+  if (!Array.isArray(value)) return value;
+  const records = [];
+  let previousSeq;
+  for (const record6 of value) {
+    if (!isEventEntry(record6)) continue;
+    const seq = entrySeq(record6);
+    if (previousSeq !== void 0 && seq !== void 0 && seq > previousSeq + 1) {
+      for (let fillerSeq = previousSeq + 1; fillerSeq < seq; fillerSeq += 1) {
+        records.push(createLegacyGapRecord(fillerSeq, record6));
+      }
+    }
+    records.push(normalizeEntry(record6));
+    if (seq !== void 0) previousSeq = seq;
+  }
+  return records;
+}
+function normalizeEntry(value) {
+  if (!isEventEntry(value)) return value;
+  return { ...value, event: normalizeEvent(value.event) };
+}
+function entrySeq(value) {
+  if (!isEventEntry(value)) return void 0;
+  return isEventSeq(value.event.seq) ? value.event.seq : void 0;
+}
+function createLegacyGapRecord(seq, nextRecord) {
+  return {
+    type: "event",
+    event: {
+      type: "legacy/session-gap",
+      seq,
+      time: eventTime(nextRecord),
+      ignorable: true,
+      data: {}
+    }
+  };
+}
+function eventTime(value) {
+  if (!isEventEntry(value)) return 0;
+  return typeof value.event.time === "number" && Number.isSafeInteger(value.event.time) ? value.event.time : 0;
+}
+function isEventEntry(value) {
+  return isRecord3(value) && value.type === "event" && isRecord3(value.event);
+}
+function normalizeHeader(value) {
+  if (!isRecord3(value)) return value;
+  const next = {
+    ...value,
+    version: 3,
+    ...value.delegationDepth === void 0 ? { delegationDepth: 0 } : {}
+  };
+  return next.agentPreset === "code" ? { ...next, agentPreset: "ptc" } : next;
+}
+function normalizeEvent(value) {
+  if (!isRecord3(value)) return value;
+  let next = value;
+  const type = normalizeEventType(value.type);
+  if (type !== value.type) next = { ...next, type };
+  if (type === "assistant/message" && Object.hasOwn(next, "sourceEventSeqs")) {
+    const { sourceEventSeqs: _sourceEventSeqs, ...rest } = next;
+    next = rest;
+  }
+  const data = normalizeEventData(type, next.data);
+  if (data !== next.data) next = { ...next, data };
+  const surfaceOp = normalizeSurfaceOp(next.surfaceOp);
+  if (surfaceOp !== next.surfaceOp) next = { ...next, surfaceOp };
+  return next;
+}
+function normalizeEventType(value) {
+  if (value === "tool/code-dispatch-start") return "tool/ptc-dispatch-start";
+  if (value === "tool/code-dispatch") return "tool/ptc-dispatch";
+  return value;
+}
+function normalizeEventData(type, value) {
+  if (!isRecord3(value)) return value;
+  if (type === "request/header") return normalizeRequestHeaderData(value);
+  if (type === "agent-preset/selected" && value.agentPreset === "code") return { ...value, agentPreset: "ptc" };
+  if (type === "user/message") return normalizeMessage(value);
+  if (type === "agent/inbox/spliced" && Array.isArray(value.inserted)) {
+    return { ...value, inserted: value.inserted.map((item) => normalizeMessage(item)) };
+  }
+  if (type === "session/title-llm-request" && Array.isArray(value.messages)) {
+    return { ...value, messages: value.messages.map((item) => normalizeMessage(item)) };
+  }
+  return value;
+}
+function normalizeRequestHeaderData(value) {
+  if (!isRecord3(value.header)) return value;
+  const header = normalizeRequestHeader(value.header);
+  return header === value.header ? value : { ...value, header };
+}
+function normalizeRequestHeader(value) {
+  let changed = false;
+  const next = {};
+  for (const [key, field] of Object.entries(value)) {
+    if (key === "system") {
+      changed = true;
+      continue;
+    }
+    if (key === "tools" && Array.isArray(field) && field.length === 0) {
+      changed = true;
+      continue;
+    }
+    if (key === "adapterDefaults" && isRecord3(field) && Object.keys(field).length === 0) {
+      changed = true;
+      continue;
+    }
+    next[key] = field;
+  }
+  return changed ? next : value;
+}
+function normalizeMessage(value) {
+  if (!isRecord3(value) || !isRecord3(value.source)) return value;
+  if (value.source.kind !== "plugin" || value.source.plugin !== "tools-code-mode") return value;
+  return { ...value, source: { ...value.source, plugin: "tools-ptc" } };
+}
+function normalizeSurfaceOp(value) {
+  if (!isRecord3(value) || value.op !== "replace") return value;
+  const { start, end, ...rest } = value;
+  if (start === void 0 && end === void 0) return value;
+  return {
+    ...rest,
+    op: "replace",
+    ...start === void 0 ? {} : { startSeq: start },
+    ...end === void 0 ? {} : { endSeq: end }
+  };
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isEventSeq(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0);
+}
+
 // src/remote-typert-gateway.ts
 var DIRECT_REMOTE_CALL_BYTES2 = 2 * 1024 * 1024;
 var RemoteTypertGateway2 = class {
-  constructor(client) {
+  constructor(client, compatibility) {
     this.client = client;
+    this.compatibility = compatibility;
   }
   async invoke(request) {
     const result = await this.dispatch(
@@ -14339,7 +14677,11 @@ var RemoteTypertGateway2 = class {
         response = await this.callTransferred(encoded, signal);
       }
     }
-    return parseRpcResult(response);
+    const result = parseRpcResult(response);
+    if (result.ok && this.compatibility === "legacy-to-v3") {
+      return { ...result, value: normalizeLegacySessionGatewayValue(endpoint, result.value) };
+    }
+    return result;
   }
   async open(endpoint, payload, signal) {
     const streamId = uuidV7();
@@ -14358,11 +14700,13 @@ var RemoteTypertGateway2 = class {
       unsubscribeClose();
       throw error;
     }
-    return this.iterate(streamId, queue, unsubscribe, unsubscribeClose, signal, onAbort);
+    return this.iterate(streamId, endpoint, queue, unsubscribe, unsubscribeClose, signal, onAbort);
   }
-  async *iterate(streamId, queue, unsubscribe, unsubscribeClose, signal, onAbort) {
+  async *iterate(streamId, endpoint, queue, unsubscribe, unsubscribeClose, signal, onAbort) {
     try {
-      yield* queue;
+      for await (const value of queue) {
+        yield this.compatibility === "legacy-to-v3" ? normalizeLegacySessionGatewayValue(endpoint, value) : value;
+      }
     } finally {
       signal.removeEventListener("abort", onAbort);
       unsubscribe();
@@ -14482,16 +14826,16 @@ function routeStreamEvent2(event, streamId, queue) {
     queue.fail(remoteFailure({
       code: typeof failure2?.code === "string" ? failure2.code : "internal",
       message: typeof failure2?.message === "string" ? failure2.message : "The remote Harness stream failed.",
-      details: isRecord3(failure2?.details) ? failure2.details : {}
+      details: isRecord4(failure2?.details) ? failure2.details : {}
     }));
   } else {
     queue.close();
   }
 }
 function parseRpcResult(value) {
-  if (!isRecord3(value)) throw new Error("The remote Host returned an invalid Gateway result.");
+  if (!isRecord4(value)) throw new Error("The remote Host returned an invalid Gateway result.");
   if (value.ok === true) return Object.hasOwn(value, "value") ? { ok: true, value: value.value } : { ok: true };
-  if (value.ok !== false || !isRecord3(value.error) || typeof value.error.code !== "string" || typeof value.error.message !== "string" || !isRecord3(value.error.details)) {
+  if (value.ok !== false || !isRecord4(value.error) || typeof value.error.code !== "string" || typeof value.error.message !== "string" || !isRecord4(value.error.details)) {
     throw new Error("The remote Host returned an invalid Gateway failure.");
   }
   return {
@@ -14525,7 +14869,7 @@ function base64ToBytes3(value) {
   if (bytesToBase643(bytes) !== value) throw new Error("The remote Host returned non-canonical Harness Remote transfer data.");
   return bytes;
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasErrorCode(error, code) {
@@ -15446,7 +15790,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       this.broadcastRcHost({ type: "host/session-status", sessionId, running: args[1] });
     } else if (event === "api-session/removed" && sessionId !== void 0) {
       this.broadcastRcHost({ type: "host/session-removed", sessionId });
-    } else if (event === "api-session/added" && isRecord4(args[0])) {
+    } else if (event === "api-session/added" && isRecord5(args[0])) {
       const summary = args[0];
       this.broadcastRcHost({
         type: "host/session-added",
@@ -15831,7 +16175,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
   }
   createApiProxy() {
     const call = (endpoint) => async (request, signal) => {
-      const payload = endpoint === "session.prompt" && isRecord4(request.payload) ? { ...request.payload, requestId: String(request.rpcId) } : request.payload;
+      const payload = endpoint === "session.prompt" && isRecord5(request.payload) ? { ...request.payload, requestId: String(request.rpcId) } : request.payload;
       const result = await this.dispatch(rcEndpoint(endpoint), { args: { request: payload } }, signal ?? new AbortController().signal);
       return {
         rpcId: request.rpcId,
@@ -15915,8 +16259,8 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       queue.close();
     }
   }
-  broadcastRcMux(payload, rpcId = `codex-mux:${Date.now()}:${Math.random()}`) {
-    for (const queue of this.rcMuxStreams) queue.push({ rpcId, payload });
+  broadcastRcMux(payload, rpcId2 = `codex-mux:${Date.now()}:${Math.random()}`) {
+    for (const queue of this.rcMuxStreams) queue.push({ rpcId: rpcId2, payload });
   }
   broadcastRcHost(payload) {
     const frame = { rpcId: `codex-host:${Date.now()}:${Math.random()}`, payload };
@@ -16356,7 +16700,7 @@ function collectImageBlocks(value, output = []) {
     for (const item of value) collectImageBlocks(item, output);
     return output;
   }
-  if (!isRecord4(value)) return output;
+  if (!isRecord5(value)) return output;
   if (value.type === "image") output.push(value);
   for (const [key, child] of Object.entries(value)) {
     if (key === "attachment") continue;
@@ -16686,7 +17030,7 @@ function codexPromptInput(content) {
   if (content.length === 0 || content.length > MAX_CODEX_PROMPT_PARTS) return void 0;
   const input2 = [];
   for (const value of content) {
-    if (!isRecord4(value)) return void 0;
+    if (!isRecord5(value)) return void 0;
     if (value.type === "text") {
       if (typeof value.text !== "string" || value.text.length === 0 || value.text.length > MAX_CODEX_PROMPT_TEXT) return void 0;
       input2.push({ type: "text", text: value.text });
@@ -16939,12 +17283,12 @@ function errorCode(error) {
   return "code" in error && typeof error.code === "string" ? error.code : void 0;
 }
 function errorDetails(error) {
-  return "details" in error && isRecord4(error.details) ? error.details : {};
+  return "details" in error && isRecord5(error.details) ? error.details : {};
 }
 function record2(value) {
-  return isRecord4(value) ? value : {};
+  return isRecord5(value) ? value : {};
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function array(value) {
@@ -17087,7 +17431,8 @@ var Config = s.object({
   codex: s.object({
     enabled: s.boolean(),
     binary: s.string()
-  })
+  }),
+  acp: s.object({ enabled: s.boolean(), backends: s.array(s.object({ id: s.string(), enabled: s.boolean(), command: s.string(), args: s.array(s.string()), cwd: s.string() })) })
 });
 var reconnectSchema = external_exports.union([
   external_exports.boolean(),
@@ -17108,7 +17453,8 @@ var configSchema = external_exports.object({
   codex: external_exports.object({
     enabled: external_exports.boolean().optional(),
     binary: external_exports.string().trim().min(1).max(4096).optional()
-  }).strict().optional()
+  }).strict().optional(),
+  acp: external_exports.object({ enabled: external_exports.boolean().optional(), backends: external_exports.array(external_exports.object({ id: external_exports.string().trim().regex(/^[a-z0-9][a-z0-9._-]{0,31}$/i), enabled: external_exports.boolean().optional(), command: external_exports.string().trim().min(1).max(4096).optional(), args: external_exports.array(external_exports.string().max(4096)).max(32).optional(), cwd: external_exports.string().max(4096).optional() }).strict()).max(12).optional(), backend: external_exports.string().trim().regex(/^[a-z0-9][a-z0-9._-]{0,31}$/i).optional(), command: external_exports.string().trim().min(1).max(4096).optional(), args: external_exports.array(external_exports.string().max(4096)).max(32).optional(), cwd: external_exports.string().max(4096).optional() }).strict().optional()
 }).strict();
 function resolveConfig(input2 = {}, env = process.env) {
   const parsed = configSchema.parse(input2);
@@ -17136,7 +17482,12 @@ function resolveConfig(input2 = {}, env = process.env) {
     codex: {
       enabled: parsed.codex?.enabled ?? true,
       binary: parsed.codex?.binary ?? "codex"
-    }
+    },
+    acp: { enabled: parsed.acp?.enabled ?? true, backends: [.../* @__PURE__ */ new Set(["codex", "cursor", "kimi", ...parsed.acp?.backends?.map((item) => item.id) ?? []])].map((id2) => {
+      const d = parsed.acp?.backends?.find((x) => x.id === id2);
+      const legacy = parsed.acp?.backend === id2 ? parsed.acp : void 0;
+      return { id: id2, enabled: d?.enabled ?? legacy?.enabled ?? true, command: d?.command ?? legacy?.command ?? { codex: "codex", cursor: "agent", kimi: "kimi" }[id2] ?? id2, args: d?.args ?? legacy?.args ?? ["acp"], ...d?.cwd ?? legacy?.cwd ? { cwd: d?.cwd ?? legacy?.cwd } : {} };
+    }) }
   };
 }
 function normalizeServerUrl(value) {
@@ -17158,7 +17509,7 @@ function normalizeServerUrl(value) {
 }
 
 // src/version.ts
-var PLUGIN_VERSION = "0.4.12";
+var PLUGIN_VERSION = "0.4.14";
 
 // src/server-api.ts
 var TERMINAL_CONTROL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f]/u;
@@ -17677,7 +18028,7 @@ var TypertGatewaySwitch = class {
     if (normalized !== void 0) return normalized;
     const source = error instanceof Error ? error : new Error("The Harness Gateway rejected the request.");
     const code = "code" in source && typeof source.code === "string" ? source.code : "internal";
-    const details = "details" in source && isRecord5(source.details) ? source.details : {};
+    const details = "details" in source && isRecord6(source.details) ? source.details : {};
     return { code, message: source.message, details };
   }
 };
@@ -17686,7 +18037,7 @@ function requestFromCarrier(endpoint, payload, signal) {
   if (segments.length !== 2 || segments.some((segment) => segment.length === 0)) {
     throw new Error("The Harness Gateway endpoint is invalid.");
   }
-  if (!isRecord5(payload) || !isRecord5(payload.args)) {
+  if (!isRecord6(payload) || !isRecord6(payload.args)) {
     throw new Error("The Harness Gateway payload is invalid.");
   }
   return { namespace: segments[0], method: segments[1], args: payload.args, signal };
@@ -17701,7 +18052,7 @@ function isLocalOnlyEndpoint(endpoint) {
 function isRemoteCommandMethod(method) {
   return REMOTE_COMMAND_METHODS.includes(method);
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -18805,10 +19156,8 @@ var ClientModeRuntime = class {
       fingerprint: this.identity.fingerprint
     });
   }
-  registerControl(connection) {
-    return connection.rpc.handle(CONTROL_RPC_PREFIX, (endpoint, payload, signal) => this.handleControl(endpoint, payload, signal), {
-      authority: "loopback"
-    });
+  registerControl(connection, webServer) {
+    return registerControlRoute(connection, (endpoint, payload, signal) => this.handleControl(endpoint, payload, signal), webServer);
   }
   status() {
     const targetStatus = this.gatewaySwitch.supportsCarrier() ? this.gatewaySwitch.status() : this.proxySwitch?.status() ?? this.gatewaySwitch.status();
@@ -18989,9 +19338,9 @@ var ClientModeRuntime = class {
   async openRemoteWorkspace(targetDeviceId, path, signal) {
     if (path.trim() === "") throw new ClientModeError("INVALID_MESSAGE", "A remote working directory is required.");
     const remote = await this.ensureConnected(targetDeviceId, signal);
-    this.assertRemoteCompatible(remote);
+    const transport = this.selectHarnessRemoteTransport(remote);
     let workspace;
-    if (remote.features.remoteGateway) {
+    if (transport === "remoteGateway") {
       workspace = await new RemoteTypertGateway2(remote.client).invoke({
         namespace: "workspace",
         method: "create",
@@ -19007,7 +19356,7 @@ var ClientModeRuntime = class {
       workspace = unwrapNativeResult(response);
     }
     await this.closeCodexVirtual();
-    this.selectRemoteTarget(remote);
+    this.selectRemoteTarget(remote, transport);
     const workspaceId = workspaceRecordId(workspace.workspace);
     this.pendingWorkspaceSelection = { targetDeviceId: remote.target.deviceId, workspaceId };
     this.logger.info("Remote workspace opened", { targetDeviceId: shortId(remote.target.deviceId) });
@@ -19027,7 +19376,7 @@ var ClientModeRuntime = class {
     if (!remote.features.codex) {
       throw new ClientModeError("FEATURE_NOT_SUPPORTED", "The selected Host does not provide CodeX workspaces.");
     }
-    this.assertRemoteCompatible(remote);
+    this.assertLocalHarnessCarrierAvailable();
     const virtual = CodexVirtualHarness.remote(remote.client, {
       deviceId: remote.target.deviceId,
       name: remote.target.name
@@ -19060,7 +19409,7 @@ var ClientModeRuntime = class {
     if (!remote.features.codex) {
       throw new ClientModeError("FEATURE_NOT_SUPPORTED", "The selected Host does not provide CodeX workspaces.");
     }
-    this.assertRemoteCompatible(remote);
+    this.assertLocalHarnessCarrierAvailable();
     const result = record3(await new CodexRemoteClient(remote.client).request("project/create", {
       name: remoteWorkspaceTitle(trimmedPath),
       roots: [{ path: trimmedPath }],
@@ -19148,10 +19497,10 @@ var ClientModeRuntime = class {
       }
     }
     stream.unsubscribe = remote.client.onEvent((event) => {
-      if (event.event === "codex.app.frame" && isRecord6(event.data) && event.data.streamId === value.streamId) {
+      if (event.event === "codex.app.frame" && isRecord7(event.data) && event.data.streamId === value.streamId) {
         this.appendCodexFrame(stream, event.data);
       }
-      if (event.event === "codex.app.stream.closed" && isRecord6(event.data) && event.data.streamId === value.streamId) {
+      if (event.event === "codex.app.stream.closed" && isRecord7(event.data) && event.data.streamId === value.streamId) {
         stream.closed = typeof event.data.reason === "string" ? event.data.reason : "closed";
         stream.wake();
       }
@@ -19178,7 +19527,7 @@ var ClientModeRuntime = class {
     stream.wake();
   };
   appendCodexFrame(stream, data) {
-    if (!isRecord6(data) || !isRecord6(data.frame) || typeof data.frame.method !== "string") return;
+    if (!isRecord7(data) || !isRecord7(data.frame) || typeof data.frame.method !== "string") return;
     if (stream.frames.length >= 256) {
       stream.closed = "overflow";
     } else {
@@ -19235,18 +19584,25 @@ var ClientModeRuntime = class {
       await stream.close();
     }));
   }
-  selectRemoteTarget(remote) {
+  selectRemoteTarget(remote, transport = this.selectHarnessRemoteTransport(remote)) {
     const target = { deviceId: remote.target.deviceId, name: remote.target.name };
-    if (this.gatewaySwitch.supportsCarrier()) {
-      this.gatewaySwitch.selectRemote(new RemoteTypertGateway2(remote.client), void 0, target);
+    if (transport === "remoteGateway") {
+      this.gatewaySwitch.selectRemote(this.remoteTypertGateway(remote), void 0, target);
       return;
     }
-    this.proxySwitch.selectRemote(new RemoteHarnessApiProxy(remote.client).api, target);
+    this.proxySwitch?.selectRemote(new RemoteHarnessApiProxy(remote.client).api, target);
     this.gatewaySwitch.selectRemote((request) => invokeRemoteCommand(remote.client, request), {
       execute: true,
       list: remote.features.commandList
     }, target);
   }
+  remoteTypertGateway(remote) {
+    const localSessionGeneration = harnessSessionGeneration(this.host?.localHarnessVersion?.());
+    return new RemoteTypertGateway2(
+      remote.client,
+      localSessionGeneration === "v3" && remote.features.sessionFormat !== 3 ? "legacy-to-v3" : void 0
+    );
+  }
   selectCodexTarget(virtual, remote) {
     const target = { deviceId: remote.target.deviceId, name: remote.target.name };
     if (this.gatewaySwitch.supportsCarrier()) {
@@ -19262,20 +19618,29 @@ var ClientModeRuntime = class {
     await virtual?.close();
   }
   assertRemoteCompatible(remote) {
+    this.selectHarnessRemoteTransport(remote);
+  }
+  selectHarnessRemoteTransport(remote) {
     const localRemoteGateway = this.gatewaySwitch.supportsCarrier();
+    const localSessionGeneration = harnessSessionGeneration(this.host?.localHarnessVersion?.());
     if (localRemoteGateway && remote.features.remoteGateway) {
-      const localSessionGeneration = harnessSessionGeneration(this.host?.localHarnessVersion?.());
-      const remoteSessionGeneration = remote.features.sessionFormat === 3 ? "v3" : "legacy";
-      if (localSessionGeneration === remoteSessionGeneration) return;
+      if (localSessionGeneration === "v3" || remote.features.sessionFormat !== 3) return "remoteGateway";
       throw new ClientModeError(
         "HARNESS_VERSION_INCOMPATIBLE",
-        `The local and remote Harness Session formats differ (${localSessionGeneration} vs ${remoteSessionGeneration}).`
+        "The selected Host uses Harness Session V3, but this Client uses the legacy Typert Remote session format."
       );
     }
-    if (!localRemoteGateway && this.proxySwitch !== void 0 && remote.features.apiProxy) return;
+    if (this.proxySwitch !== void 0 && remote.features.apiProxy) return "apiProxy";
+    throw new ClientModeError(
+      "HARNESS_VERSION_INCOMPATIBLE",
+      localRemoteGateway ? "The selected Host does not provide a compatible Harness Typert Remote Gateway transport." : "The selected Host does not provide the legacy Harness ApiProxy transport."
+    );
+  }
+  assertLocalHarnessCarrierAvailable() {
+    if (this.gatewaySwitch.supportsCarrier() || this.proxySwitch !== void 0) return;
     throw new ClientModeError(
       "HARNESS_VERSION_INCOMPATIBLE",
-      localRemoteGateway ? "The selected Host does not provide the Harness v0.1.2 Typert Remote Gateway transport." : "The selected Host does not provide the legacy Harness ApiProxy transport."
+      "This Client does not provide a compatible Harness carrier for the selected remote workspace."
     );
   }
   async connect(targetDeviceId, signal) {
@@ -19654,20 +20019,20 @@ function record3(value) {
   }
   return value;
 }
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function ok2(value) {
   return { ok: true, value };
 }
 async function invokeRemoteCommand(client, request) {
-  const rpcId = uuidV7();
+  const rpcId2 = uuidV7();
   const response = await client.rpc("harness.api.call", {
     method: `${request.namespace}.${request.method}`,
-    rpcId,
+    rpcId: rpcId2,
     payload: request.args
   }, request.signal);
-  if (response.rpcId !== rpcId) {
+  if (response.rpcId !== rpcId2) {
     throw new ClientModeError("INVALID_MESSAGE", "The remote Host returned an invalid command response.");
   }
   return unwrapNativeResult(response);
@@ -19679,11 +20044,11 @@ async function readRemoteWorkspaceBaseline(gateway, signal) {
   const iterator = source[Symbol.asyncIterator]();
   try {
     const first = await iterator.next();
-    if (first.done || !isRecord6(first.value) || first.value.type !== "baseline" || !isRecord6(first.value.value) || !Array.isArray(first.value.value.items)) {
+    if (first.done || !isRecord7(first.value) || first.value.type !== "baseline" || !isRecord7(first.value.value) || !Array.isArray(first.value.value.items)) {
       throw new ClientModeError("INVALID_MESSAGE", "The remote Host returned an invalid Workspace baseline.");
     }
     return first.value.value.items.map((item) => {
-      if (!isRecord6(item) || typeof item.workspaceId !== "string" || typeof item.path !== "string" || typeof item.title !== "string") {
+      if (!isRecord7(item) || typeof item.workspaceId !== "string" || typeof item.path !== "string" || typeof item.title !== "string") {
         throw new ClientModeError("INVALID_MESSAGE", "The remote Host returned an invalid Workspace row.");
       }
       return { workspaceId: item.workspaceId, path: item.path, title: item.title };
@@ -19748,19 +20113,20 @@ async function probeRemoteHostFeatures(client, clientVersion) {
     if (error instanceof Error && "code" in error && error.code === "METHOD_NOT_FOUND") return fallback;
     throw error;
   }
-  if (!isRecord6(value) || !Array.isArray(value.capabilities) || value.capabilities.some((capability) => typeof capability !== "string")) {
+  if (!isRecord7(value) || !Array.isArray(value.capabilities) || value.capabilities.some((capability) => typeof capability !== "string")) {
     throw new ClientModeError("INVALID_MESSAGE", "The remote Host returned invalid transport capabilities.");
   }
   const capabilities = new Set(value.capabilities);
   const apiProxy = capabilities.has("harness.api.v1");
   const remoteV1 = capabilities.has("harness.remote.v1");
   const remoteV3 = capabilities.has("harness.remote.v3");
+  const codex = capabilities.has("codex.appserver.v1");
   if (remoteV1 && remoteV3) {
     throw new ClientModeError("INVALID_MESSAGE", "The remote Host advertised conflicting Harness Session formats.");
   }
   const sessionFormat = remoteV3 ? 3 : void 0;
   const remoteGateway = remoteV3 || remoteV1;
-  if (!apiProxy && !remoteGateway) {
+  if (!apiProxy && !remoteGateway && !codex) {
     throw new ClientModeError("FEATURE_NOT_SUPPORTED", "The remote Host exposes no supported Harness transport.");
   }
   return {
@@ -19769,7 +20135,7 @@ async function probeRemoteHostFeatures(client, clientVersion) {
     apiProxy,
     remoteGateway,
     ...sessionFormat === void 0 ? {} : { sessionFormat },
-    codex: capabilities.has("codex.appserver.v1")
+    codex
   };
 }
 async function waitForCodexFrames(stream, signal) {
@@ -19832,6 +20198,7 @@ function iceServersForAttempt(attempt, iceServers) {
 
 // src/control-runtime.ts
 import { hostname as hostname2 } from "node:os";
+import { execFileSync } from "node:child_process";
 
 // src/identity-store.ts
 import { createHash } from "node:crypto";
@@ -20086,10 +20453,8 @@ var PluginControlRuntime = class {
     this.client = client;
     this.host = host;
   }
-  register(connection) {
-    return connection.rpc.handle(CONTROL_RPC_PREFIX, (endpoint, payload, signal) => this.handle(endpoint, payload, signal), {
-      authority: "loopback"
-    });
+  register(connection, webServer) {
+    return registerControlRoute(connection, (endpoint, payload, signal) => this.handle(endpoint, payload, signal), webServer);
   }
   async handle(endpoint, payload, signal) {
     try {
@@ -20098,6 +20463,9 @@ var PluginControlRuntime = class {
       if (endpoint === "settings.server.set") return ok3(await this.setServer(payload));
       if (endpoint === "settings.role.set") return ok3(await this.setRole(payload));
       if (endpoint === "settings.codex.set") return ok3(await this.setCodex(payload));
+      if (endpoint === "settings.acp.set") return ok3(await this.setAcp(payload));
+      if (endpoint === "settings.acp.add") return ok3(await this.addAcp(payload));
+      if (endpoint === "settings.acp.remove") return ok3(await this.removeAcp(payload));
       if (endpoint === "settings.logout") return ok3(await this.logout());
       if (endpoint === "host.reconnect") {
         if (this.host === void 0) throw new ClientModeError("METHOD_NOT_ALLOWED", "This plugin is not running as a Host.");
@@ -20209,6 +20577,37 @@ var PluginControlRuntime = class {
     await this.settings.replace(editableConfig(next));
     return this.settingsView();
   }
+  async setAcp(payload) {
+    if (this.settings === void 0) throw new ClientModeError("SETTINGS_UNAVAILABLE", "DSH user settings are unavailable in this profile.");
+    const value = record4(payload);
+    if (typeof value.backend !== "string" || typeof value.enabled !== "boolean") throw new ClientModeError("INVALID_MESSAGE", "ACP backend and enabled are required.");
+    const current = resolveConfig(this.settings.get());
+    const backends = current.acp?.backends.map((item) => item.id === value.backend ? { ...item, enabled: value.enabled } : item) ?? [];
+    await this.settings.replace({ ...editableConfig(current), acp: { enabled: current.acp?.enabled ?? true, backends } });
+    return this.settingsView();
+  }
+  async addAcp(payload) {
+    if (this.settings === void 0) throw new ClientModeError("SETTINGS_UNAVAILABLE", "DSH user settings are unavailable in this profile.");
+    const value = record4(payload);
+    if (typeof value.id !== "string" || typeof value.command !== "string" || !Array.isArray(value.args) || !value.args.every((item) => typeof item === "string")) {
+      throw new ClientModeError("INVALID_MESSAGE", "ACP name, command, and arguments are required.");
+    }
+    const current = resolveConfig(this.settings.get());
+    if (current.acp?.backends.some((item) => item.id === value.id)) throw new ClientModeError("INVALID_MESSAGE", "ACP backend already exists.");
+    const backends = [...current.acp?.backends ?? [], { id: value.id, command: value.command, args: value.args, enabled: false }];
+    const next = resolveConfig({ ...editableConfig(current), acp: { enabled: current.acp?.enabled ?? true, backends } });
+    await this.settings.replace(editableConfig(next));
+    return this.settingsView();
+  }
+  async removeAcp(payload) {
+    if (this.settings === void 0) throw new ClientModeError("SETTINGS_UNAVAILABLE", "DSH user settings are unavailable in this profile.");
+    const id2 = record4(payload).id;
+    if (typeof id2 !== "string" || ["codex", "cursor", "kimi"].includes(id2)) throw new ClientModeError("INVALID_MESSAGE", "Only custom ACP backends can be removed.");
+    const current = resolveConfig(this.settings.get());
+    const backends = (current.acp?.backends ?? []).filter((item) => item.id !== id2);
+    await this.settings.replace(editableConfig({ ...current, acp: { enabled: current.acp?.enabled ?? true, backends } }));
+    return this.settingsView();
+  }
   async authorizeOwnedRole(serverUrl, sourceRole, targetRole) {
     const sourceDirectory = serverStorageDirectory(this.identityDirectory, serverUrl, sourceRole);
     const sourceIdentity = await new IdentityStore({ directory: sourceDirectory }).loadOrCreate(hostname2());
@@ -20249,6 +20648,7 @@ var PluginControlRuntime = class {
       writable: this.settings !== void 0,
       applies: "restart",
       associations,
+      acpAvailability: Object.fromEntries((config.acp?.backends ?? []).map((item) => [item.id, commandAvailable(item.command ?? "")])),
       ...association === void 0 ? {} : { association }
     };
   }
@@ -20285,6 +20685,14 @@ var PluginControlRuntime = class {
     };
   }
 };
+function commandAvailable(command) {
+  try {
+    execFileSync(process.platform === "win32" ? "where" : "which", [command], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
 function editableConfig(config) {
   return {
     enabled: config.enabled,
@@ -20300,14 +20708,15 @@ function editableConfig(config) {
     codex: {
       enabled: config.codex.enabled,
       binary: config.codex.binary
-    }
+    },
+    ...config.acp === void 0 ? {} : { acp: { enabled: config.acp.enabled, backends: config.acp.backends } }
   };
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function record4(value) {
-  if (!isRecord7(value)) throw new ClientModeError("INVALID_MESSAGE", "The control request payload is invalid.");
+  if (!isRecord8(value)) throw new ClientModeError("INVALID_MESSAGE", "The control request payload is invalid.");
   return value;
 }
 function ok3(value) {
@@ -20431,7 +20840,21 @@ var ConnectionController = class {
     return this.active.size;
   }
   peerDeviceIds() {
-    return [...new Set([...this.active.values()].map((connection) => connection.channel.peerDeviceId))];
+    return this.connectedPeers().map((peer) => peer.deviceId);
+  }
+  connectedPeers() {
+    const peers = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const connection of this.active.values()) {
+      const deviceId = connection.channel.peerDeviceId;
+      if (seen.has(deviceId)) continue;
+      seen.add(deviceId);
+      peers.push({
+        deviceId,
+        ...connection.channel.mode === void 0 ? {} : { mode: connection.channel.mode }
+      });
+    }
+    return peers;
   }
   peerDeviceId() {
     const peers = this.peerDeviceIds();
@@ -20576,7 +20999,14 @@ var apiMethods = /* @__PURE__ */ new Set([
   "codex.app.transfer.chunk",
   "codex.app.transfer.commit",
   "codex.app.transfer.read",
-  "codex.app.transfer.close"
+  "codex.app.transfer.close",
+  "acp.initialize",
+  "acp.session.new",
+  "acp.session.load",
+  "acp.session.prompt",
+  "acp.session.respond_permission",
+  "acp.session.cancel",
+  "acp.session.set_mode"
 ]);
 var HOST_CAPABILITIES = [
   "harness.api.v1",
@@ -20585,10 +21015,11 @@ var HOST_CAPABILITIES = [
   "harness.remote.transfer.v1",
   "fileviewer.read.v1",
   "codex.appserver.v1",
-  "codex.appserver.transfer.v1"
+  "codex.appserver.transfer.v1",
+  "agent.acp.v1"
 ];
 var RpcRouter = class {
-  constructor(harnessApi, maxPending = 128, logger, fileViewer, harnessRemote, capabilities = () => HOST_CAPABILITIES, codex) {
+  constructor(harnessApi, maxPending = 128, logger, fileViewer, harnessRemote, capabilities = () => HOST_CAPABILITIES, codex, acp) {
     this.harnessApi = harnessApi;
     this.maxPending = maxPending;
     this.logger = logger;
@@ -20596,6 +21027,7 @@ var RpcRouter = class {
     this.harnessRemote = harnessRemote;
     this.capabilities = capabilities;
     this.codex = codex;
+    this.acp = acp;
   }
   active = 0;
   async closePeerStreams() {
@@ -20628,7 +21060,7 @@ var RpcRouter = class {
       });
       return createRpcResponse(request.id, result);
     } catch (error) {
-      const response = errorResponse(request.id, error);
+      const response = errorResponse2(request.id, error);
       this.logger?.warn("host rpc failed", {
         method: request.payload.method,
         durationMs: Math.round(performance.now() - startedAt),
@@ -20704,6 +21136,20 @@ var RpcRouter = class {
         return this.requireCodex().readTransfer(params);
       case "codex.app.transfer.close":
         return this.requireCodex().closeTransfer(params);
+      case "acp.initialize":
+        return this.requireAcp().initialize(params);
+      case "acp.session.new":
+        return this.requireAcp().sessionNew(params);
+      case "acp.session.load":
+        return this.requireAcp().sessionLoad(params);
+      case "acp.session.prompt":
+        return this.requireAcp().prompt(params, async () => void 0);
+      case "acp.session.respond_permission":
+        return this.requireAcp().respondPermission(params);
+      case "acp.session.cancel":
+        return this.requireAcp().cancel(params);
+      case "acp.session.set_mode":
+        return this.requireAcp().setMode(params);
       default:
         throw new RpcError("METHOD_NOT_FOUND", "The requested method does not exist.");
     }
@@ -20720,6 +21166,10 @@ var RpcRouter = class {
     }
     return this.harnessRemote;
   }
+  requireAcp() {
+    if (!this.acp) throw new RpcError("CAPABILITY_NOT_SUPPORTED", "ACP is not configured on this Host.");
+    return this.acp;
+  }
   requireCodex() {
     if (this.codex === void 0) {
       throw new RpcError("FEATURE_NOT_SUPPORTED", "Codex Remote is disabled or unavailable on this Host.");
@@ -20727,7 +21177,7 @@ var RpcRouter = class {
     return this.codex;
   }
 };
-function errorResponse(requestId, error) {
+function errorResponse2(requestId, error) {
   const code = safeErrorCode(error);
   if (error instanceof RpcError) return createRpcError(requestId, code, error.message, error.details, error.retryable);
   return createRpcError(
@@ -21806,11 +22256,22 @@ var transferCloseSchema = external_exports.object({ transferId: transferIdSchema
 var commandExecuteSchema = external_exports.object({
   agentId: external_exports.string().min(1).max(128),
   line: external_exports.string().min(1).max(2048),
-  // The official Harness command endpoint requires the `images` wire field.
-  // Remote command execution keeps attachments out of scope, so only an empty
-  // list is accepted and legacy clients that omit it are normalized below.
-  images: external_exports.array(external_exports.never()).length(0).optional()
-}).strict();
+  // dsh-commands <= 0.1.2 calls this field `images`; dsh-commands 0.1.5
+  // renamed it to `submittedAttachments` and expanded its element type to
+  // include staged file receipts. Remote command execution keeps attachments
+  // out of scope, so either compatibility field is restricted to an empty
+  // list. The dispatcher below chooses the matching Host descriptor.
+  images: external_exports.array(external_exports.never()).length(0).optional(),
+  submittedAttachments: external_exports.array(external_exports.never()).length(0).optional()
+}).strict().superRefine((value, context) => {
+  if (value.images !== void 0 && value.submittedAttachments !== void 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Use either images or submittedAttachments, not both.",
+      path: ["submittedAttachments"]
+    });
+  }
+});
 var commandListSchema = external_exports.object({
   agentId: external_exports.string().min(1).max(128)
 }).strict();
@@ -21920,8 +22381,8 @@ var HARNESS_API_ALLOWLIST = [
   "credentials.unset"
 ];
 var NATIVE_CALL_TIMEOUT_MS = 3e4;
-var MAX_ACTIVE_API_TRANSFERS = 2;
-var API_TRANSFER_IDLE_MS = 2 * 6e4;
+var MAX_ACTIVE_API_TRANSFERS = MAX_ACTIVE_TRANSFERS_PER_DIRECTION;
+var API_TRANSFER_IDLE_MS = TRANSFER_IDLE_MS;
 var INLINE_TRANSFER_RESPONSE_BYTES = 2 * 1024 * 1024;
 var SESSION_HISTORY_PAGE_SIZES = [50, 30, 20, 12, 6, 3, 1];
 var HarnessApiBridge = class {
@@ -21931,7 +22392,7 @@ var HarnessApiBridge = class {
     this.maxStreams = maxStreams;
     this.logger = logger;
     this.harnessVersion = harnessVersion;
-    this.methods = createMethodMap(api, typertGateway);
+    this.methods = createMethodMap(api, typertGateway, harnessVersion);
     this.mux = api.events.mux.bind(api.events);
     this.host = api.events.host.bind(api.events);
     this.answer = api.respond.bind(api);
@@ -21998,9 +22459,9 @@ var HarnessApiBridge = class {
     const value = await listRemoteDirectory(payload.path, signal);
     return { rpcId: params.rpcId, result: { ok: true, value } };
   }
-  describeFallback(rpcId) {
+  describeFallback(rpcId2) {
     return {
-      rpcId,
+      rpcId: rpcId2,
       result: {
         ok: true,
         value: {
@@ -22218,8 +22679,8 @@ var HarnessApiBridge = class {
     }
   }
   deleteRespondable(value) {
-    for (const [rpcId, correlation] of this.respondable) {
-      if (correlation === value) this.respondable.delete(rpcId);
+    for (const [rpcId2, correlation] of this.respondable) {
+      if (correlation === value) this.respondable.delete(rpcId2);
     }
   }
 };
@@ -22252,7 +22713,7 @@ function normalizeHostDescribe(response, harnessVersion, canListDirectory) {
     }
   };
 }
-function createMethodMap(api, typertGateway) {
+function createMethodMap(api, typertGateway, harnessVersion) {
   const domains = api;
   const methods = /* @__PURE__ */ new Map();
   for (const method of HARNESS_API_ALLOWLIST) {
@@ -22262,7 +22723,17 @@ function createMethodMap(api, typertGateway) {
       const implementation2 = async (request, signal) => {
         if (commandMethod === "execute") {
           const payload = commandExecuteSchema.parse(request.payload);
-          const args2 = { ...payload, images: payload.images ?? [] };
+          const legacyArgs = {
+            agentId: payload.agentId,
+            line: payload.line,
+            images: payload.images ?? []
+          };
+          const currentArgs = {
+            agentId: payload.agentId,
+            line: payload.line,
+            submittedAttachments: payload.submittedAttachments ?? []
+          };
+          const args2 = harnessSessionGeneration(harnessVersion) === "v3" ? currentArgs : legacyArgs;
           const value2 = await typertGateway.invoke({
             namespace,
             method: "execute",
@@ -22406,9 +22877,9 @@ function sanitizeModelDiscoveryResponse(response, settingsNs) {
   if (typeof result === "object" && result !== null && "ok" in result && result.ok === true) return response;
   return modelDiscoveryFailure(response.rpcId, settingsNs);
 }
-function modelDiscoveryFailure(rpcId, settingsNs) {
+function modelDiscoveryFailure(rpcId2, settingsNs) {
   return {
-    rpcId,
+    rpcId: rpcId2,
     result: {
       ok: false,
       error: {
@@ -22468,15 +22939,15 @@ function frameSessionId(frame) {
   const payload = frame.payload;
   return typeof payload.sessionId === "string" && payload.sessionId.length > 0 ? payload.sessionId : void 0;
 }
-function callSessionHistory(callWithTimeout, payload, rpcId) {
+function callSessionHistory(callWithTimeout, payload, rpcId2) {
   const fallbackPageSizes = sessionHistoryFallbackPageSizes(payloadMaxMessages(payload));
-  return callHistoryWithRetry(callWithTimeout, payload, rpcId, fallbackPageSizes);
+  return callHistoryWithRetry(callWithTimeout, payload, rpcId2, fallbackPageSizes);
 }
-async function callHistoryWithRetry(callWithTimeout, payload, rpcId, pageSizes) {
+async function callHistoryWithRetry(callWithTimeout, payload, rpcId2, pageSizes) {
   for (const maxMessages of pageSizes) {
     const requestPayload = historyRequestPayload(payload, maxMessages);
     const response = await callWithTimeout(requestPayload);
-    const request = createRpcResponse(rpcId, response.result);
+    const request = createRpcResponse(rpcId2, response.result);
     if (encodeMessage(request).byteLength <= MAX_SECURE_MESSAGE_BYTES) return response;
     if (maxMessages === pageSizes[pageSizes.length - 1]) {
       throw new RpcError(
@@ -22564,6 +23035,24 @@ var streamOpenSchema2 = external_exports.object({
   payload: external_exports.unknown()
 }).strict();
 var streamCloseSchema2 = external_exports.object({ streamId: external_exports.string().min(1).max(128) }).strict();
+var commandExecuteArgsSchema = external_exports.object({
+  agentId: external_exports.string().min(1).max(128),
+  line: external_exports.string().min(1).max(2048),
+  // dsh-commands <= 0.1.2 calls this field `images`; dsh-commands 0.1.5
+  // renamed it to `submittedAttachments`. Only empty arrays are exposed by
+  // the Remote bridge; command attachments are deliberately out of scope.
+  images: external_exports.array(external_exports.never()).length(0).optional(),
+  submittedAttachments: external_exports.array(external_exports.never()).length(0).optional()
+}).strict().superRefine((value, context) => {
+  if (value.images !== void 0 && value.submittedAttachments !== void 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Use either images or submittedAttachments, not both.",
+      path: ["submittedAttachments"]
+    });
+  }
+});
+var commandExecutePayloadSchema = external_exports.object({ args: commandExecuteArgsSchema }).strict();
 var transferOpenSchema2 = external_exports.object({
   transferId: external_exports.string().uuid(),
   totalBytes: external_exports.number().int().positive().max(MAX_HARNESS_API_TRANSFER_BYTES),
@@ -22582,9 +23071,8 @@ var transferReadSchema2 = external_exports.object({
 var directoryListSchema2 = external_exports.object({
   path: external_exports.string().min(1).max(4096).optional()
 }).strict();
-var MAX_ACTIVE_STREAMS = 16;
-var MAX_ACTIVE_TRANSFERS = 2;
-var TRANSFER_IDLE_MS = 2 * 6e4;
+var MAX_ACTIVE_STREAMS = MAX_ALPHA_STREAMS_PER_CONNECTION;
+var MAX_ACTIVE_TRANSFERS = MAX_ACTIVE_TRANSFERS_PER_DIRECTION;
 var INLINE_TRANSFER_RESPONSE_BYTES2 = 2 * 1024 * 1024;
 var HARNESS_REMOTE_ALLOWLIST = [
   "$events",
@@ -22646,10 +23134,11 @@ var HARNESS_REMOTE_ALLOWLIST = [
 ];
 var allowedEndpoints = new Set(HARNESS_REMOTE_ALLOWLIST);
 var HarnessRemoteBridge = class {
-  constructor(gateway, publish, logger) {
+  constructor(gateway, publish, logger, harnessVersion) {
     this.gateway = gateway;
     this.publish = publish;
     this.logger = logger;
+    this.harnessVersion = harnessVersion;
   }
   streams = /* @__PURE__ */ new Map();
   incomingTransfers = /* @__PURE__ */ new Map();
@@ -22663,7 +23152,7 @@ var HarnessRemoteBridge = class {
     const startedAt = performance.now();
     const signal = AbortSignal.timeout(6e4);
     try {
-      const nativeResult = await this.gateway.dispatch(params.endpoint, params.payload, signal);
+      const nativeResult = params.endpoint === "commands/execute" ? await dispatchCommandForHost(this.gateway, params.payload, signal, this.harnessVersion) : await this.gateway.dispatch(params.endpoint, params.payload, signal);
       const result = params.endpoint === "directoryPicker/list" && needsDirectoryFallback(nativeResult) ? await this.directoryList(params.payload, signal) : nativeResult;
       this.logger?.debug("harness remote call ok", {
         endpoint: params.endpoint,
@@ -22862,6 +23351,29 @@ var HarnessRemoteBridge = class {
     for (const [id2, transfer] of this.outgoingTransfers) if (transfer.touchedAt < cutoff) this.outgoingTransfers.delete(id2);
   }
 };
+async function dispatchCommandForHost(gateway, payload, signal, harnessVersion) {
+  const parsed = commandExecutePayloadSchema.parse(payload);
+  const legacyPayload = {
+    args: {
+      agentId: parsed.args.agentId,
+      line: parsed.args.line,
+      images: parsed.args.images ?? []
+    }
+  };
+  const currentPayload = {
+    args: {
+      agentId: parsed.args.agentId,
+      line: parsed.args.line,
+      submittedAttachments: parsed.args.submittedAttachments ?? []
+    }
+  };
+  const args = harnessSessionGeneration(harnessVersion) === "v3" ? currentPayload : legacyPayload;
+  return gateway.dispatch(
+    "commands/execute",
+    args,
+    signal
+  );
+}
 function decodeCanonicalBase642(value) {
   const bytes = Buffer.from(value, "base64");
   if (bytes.toString("base64") !== value) throw new RpcError("INVALID_MESSAGE", "The Harness Remote transfer chunk is invalid.");
@@ -22884,13 +23396,13 @@ function needsDirectoryFallback(result) {
 }
 function requestArgs(payload) {
   const root = record5(payload);
-  const args = isRecord8(root.args) ? root.args : root;
+  const args = isRecord9(root.args) ? root.args : root;
   return record5(args.request ?? args._request ?? args);
 }
 function record5(value) {
-  return isRecord8(value) ? value : {};
+  return isRecord9(value) ? value : {};
 }
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -23084,7 +23596,7 @@ var CodexAppServerClient = class {
       this.handleProcessFailure("CODEX_INVALID_RESPONSE", new Error("Codex App Server emitted invalid JSON."));
       return;
     }
-    if (!isRecord9(value)) {
+    if (!isRecord10(value)) {
       this.handleProcessFailure("CODEX_INVALID_RESPONSE", new Error("Codex App Server emitted an invalid message."));
       return;
     }
@@ -23129,12 +23641,12 @@ var CodexAppServerClient = class {
   }
 };
 function safeUpstreamError(value) {
-  if (!isRecord9(value) || typeof value.message !== "string") return "Codex App Server rejected the request.";
+  if (!isRecord10(value) || typeof value.message !== "string") return "Codex App Server rejected the request.";
   const message = value.message.toLowerCase();
   if (message.includes("active writer")) return "Codex thread already has an active writer.";
   return message.includes("not initialized") ? "Codex App Server is not initialized." : "Codex App Server rejected the request.";
 }
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -23266,9 +23778,8 @@ var transferChunkSchema3 = external_exports.object({
 }).strict();
 var transferIdSchema3 = external_exports.object({ transferId: external_exports.string().uuid() }).strict();
 var transferReadSchema3 = external_exports.object({ transferId: external_exports.string().uuid(), index: external_exports.number().int().nonnegative() }).strict();
-var MAX_ACTIVE_STREAMS2 = 16;
-var MAX_ACTIVE_TRANSFERS2 = 2;
-var TRANSFER_IDLE_MS2 = 2 * 6e4;
+var MAX_ACTIVE_STREAMS2 = MAX_ALPHA_STREAMS_PER_CONNECTION;
+var MAX_ACTIVE_TRANSFERS2 = MAX_ACTIVE_TRANSFERS_PER_DIRECTION;
 var INLINE_TRANSFER_RESPONSE_BYTES3 = 2 * 1024 * 1024;
 var CodexPeerBridge = class {
   constructor(domain, context, publish, logger) {
@@ -23482,7 +23993,7 @@ var CodexPeerBridge = class {
     await this.domain.detachPeer(this.context.connectionId);
   }
   pruneTransfers() {
-    const staleBefore = Date.now() - TRANSFER_IDLE_MS2;
+    const staleBefore = Date.now() - TRANSFER_IDLE_MS;
     for (const [id2, transfer] of this.incomingTransfers) {
       if (transfer.touchedAt < staleBefore) this.incomingTransfers.delete(id2);
     }
@@ -23504,15 +24015,15 @@ function decodeCanonicalBase643(value) {
   }
   return decoded;
 }
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function safeErrorCode2(error) {
-  if (isRecord10(error) && typeof error.code === "string") return error.code;
+  if (isRecord11(error) && typeof error.code === "string") return error.code;
   return "UNKNOWN";
 }
 function safeMethod(input2) {
-  return isRecord10(input2) && typeof input2.method === "string" ? input2.method : "invalid";
+  return isRecord11(input2) && typeof input2.method === "string" ? input2.method : "invalid";
 }
 function concatChunks3(chunks, totalBytes) {
   const output = new Uint8Array(totalBytes);
@@ -23929,14 +24440,14 @@ var CodexRemoteDomain = class {
       await this.assertResultThreadAllowed(result);
       if (codexPermissionPresetFromResponse(result) !== params.permissionPreset) {
         await this.callUpstream("thread/settings/update", { threadId, ...settings });
-        result = { ...isRecord11(result) ? result : {}, ...settings, sandbox: settings.sandboxPolicy };
+        result = { ...isRecord12(result) ? result : {}, ...settings, sandbox: settings.sandboxPolicy };
       }
     }
     await this.publishPermission(threadId, result);
     return result;
   }
   async publishPermission(threadId, value) {
-    const source = isRecord11(value) ? value : {};
+    const source = isRecord12(value) ? value : {};
     const threadSettings = { approvalPolicy: source.approvalPolicy, sandboxPolicy: source.sandboxPolicy ?? source.sandbox };
     await this.handleInbound({ kind: "notification", method: "thread/settings/updated", params: { threadId, threadSettings } });
   }
@@ -24032,9 +24543,9 @@ var CodexRemoteDomain = class {
         itemsView,
         ...cursor2 === void 0 ? {} : { cursor: cursor2 }
       });
-      const pageResult = isRecord11(result) ? result : {};
+      const pageResult = isRecord12(result) ? result : {};
       for (const rawTurn of array2(pageResult.data)) {
-        if (!isRecord11(rawTurn)) continue;
+        if (!isRecord12(rawTurn)) continue;
         const turnId = typeof rawTurn.id === "string" ? rawTurn.id : void 0;
         const items = rawTurn.itemsView === "full" || turnId === void 0 ? array2(rawTurn.items) : await this.readThreadItems(connectionId, threadId, turnId, array2(rawTurn.items));
         turns.push({ ...rawTurn, items });
@@ -24056,9 +24567,9 @@ var CodexRemoteDomain = class {
           sortDirection: "asc",
           ...cursor2 === void 0 ? {} : { cursor: cursor2 }
         });
-        const pageResult = isRecord11(result) ? result : {};
+        const pageResult = isRecord12(result) ? result : {};
         for (const entry of array2(pageResult.data)) {
-          if (isRecord11(entry) && entry.item !== void 0) items.push(entry.item);
+          if (isRecord12(entry) && entry.item !== void 0) items.push(entry.item);
         }
         cursor2 = typeof pageResult.nextCursor === "string" && pageResult.nextCursor.length > 0 ? pageResult.nextCursor : void 0;
         if (cursor2 === void 0) break;
@@ -24122,7 +24633,7 @@ var CodexRemoteDomain = class {
     return [...this.peers.values()].some((peer) => peer.hasThreadSubscription(threadId));
   }
   resolveUpstreamApproval(params) {
-    if (!isRecord11(params) || typeof params.requestId !== "string" && typeof params.requestId !== "number") return;
+    if (!isRecord12(params) || typeof params.requestId !== "string" && typeof params.requestId !== "number") return;
     for (const [handle, approval] of this.approvals) {
       if (approval.upstreamId === params.requestId) this.approvals.delete(handle);
     }
@@ -24339,24 +24850,24 @@ function codexBinaryCandidates(configured, hostPlatform = process.platform, user
   ])];
 }
 function parseCallEnvelope(input2) {
-  if (!isRecord11(input2) || typeof input2.method !== "string" || !("params" in input2) || Object.keys(input2).some((key) => key !== "method" && key !== "params")) {
+  if (!isRecord12(input2) || typeof input2.method !== "string" || !("params" in input2) || Object.keys(input2).some((key) => key !== "method" && key !== "params")) {
     throw new RpcError("INVALID_MESSAGE", "The Codex call envelope is invalid.");
   }
   return { method: input2.method, params: input2.params };
 }
 function parseRespond(input2) {
-  if (!isRecord11(input2) || typeof input2.requestHandle !== "string" || !["accept", "decline", "cancel"].includes(String(input2.decision)) || Object.keys(input2).some((key) => key !== "requestHandle" && key !== "decision")) {
+  if (!isRecord12(input2) || typeof input2.requestHandle !== "string" || !["accept", "decline", "cancel"].includes(String(input2.decision)) || Object.keys(input2).some((key) => key !== "requestHandle" && key !== "decision")) {
     throw new RpcError("INVALID_MESSAGE", "The Codex approval response is invalid.");
   }
   return input2;
 }
 function accountCanRun(result) {
-  if (!isRecord11(result) || typeof result.requiresOpenaiAuth !== "boolean") return false;
-  return result.requiresOpenaiAuth === false || isRecord11(result.account);
+  if (!isRecord12(result) || typeof result.requiresOpenaiAuth !== "boolean") return false;
+  return result.requiresOpenaiAuth === false || isRecord12(result.account);
 }
 function sanitizeAccount(result) {
-  if (!isRecord11(result)) throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned invalid account state.");
-  const account = isRecord11(result.account) ? result.account : void 0;
+  if (!isRecord12(result)) throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned invalid account state.");
+  const account = isRecord12(result.account) ? result.account : void 0;
   return {
     authenticated: account !== void 0 || result.requiresOpenaiAuth === false,
     requiresOpenaiAuth: result.requiresOpenaiAuth === true,
@@ -24369,11 +24880,11 @@ function sanitizeAccount(result) {
   };
 }
 function sanitizeThreadList(result) {
-  if (!isRecord11(result) || !Array.isArray(result.data)) {
+  if (!isRecord12(result) || !Array.isArray(result.data)) {
     throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned an invalid thread list.");
   }
   const data = result.data.flatMap((value) => {
-    if (!isRecord11(value) || typeof value.id !== "string") return [];
+    if (!isRecord12(value) || typeof value.id !== "string") return [];
     return [{
       id: value.id,
       ...typeof value.sessionId === "string" ? { sessionId: value.sessionId } : {},
@@ -24385,7 +24896,7 @@ function sanitizeThreadList(result) {
       ...typeof value.updatedAt === "number" && Number.isFinite(value.updatedAt) ? { updatedAt: value.updatedAt } : {},
       ...typeof value.archived === "boolean" ? { archived: value.archived } : {},
       ...typeof value.isPinned === "boolean" ? { isPinned: value.isPinned } : {},
-      ...isRecord11(value.status) ? { status: value.status } : {}
+      ...isRecord12(value.status) ? { status: value.status } : {}
     }];
   });
   return {
@@ -24395,18 +24906,18 @@ function sanitizeThreadList(result) {
   };
 }
 function filterThreadListByWorkspaceAuthority(result, authority) {
-  if (!isRecord11(result) || !Array.isArray(result.data)) {
+  if (!isRecord12(result) || !Array.isArray(result.data)) {
     throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned an invalid thread list.");
   }
   return {
     ...result,
-    data: result.data.map((record6) => isRecord11(record6) ? record6 : void 0).filter((thread) => thread !== void 0 && isThreadAllowedByWorkspaceAuthority(thread, authority))
+    data: result.data.map((record6) => isRecord12(record6) ? record6 : void 0).filter((thread) => thread !== void 0 && isThreadAllowedByWorkspaceAuthority(thread, authority))
   };
 }
 function sanitizeProject(value) {
-  if (!isRecord11(value) || typeof value.id !== "string" || typeof value.name !== "string") return void 0;
+  if (!isRecord12(value) || typeof value.id !== "string" || typeof value.name !== "string") return void 0;
   const roots = Array.isArray(value.roots) ? value.roots.flatMap((root) => {
-    const path = isRecord11(root) && typeof root.path === "string" && root.path.length > 0 ? root.path : void 0;
+    const path = isRecord12(root) && typeof root.path === "string" && root.path.length > 0 ? root.path : void 0;
     return path === void 0 || !isAbsolute3(path) ? [] : [{ path }];
   }) : [];
   if (roots.length === 0) return void 0;
@@ -24420,7 +24931,7 @@ function sanitizeProject(value) {
   };
 }
 function sanitizeProjectList(result) {
-  if (!isRecord11(result) || !Array.isArray(result.data)) {
+  if (!isRecord12(result) || !Array.isArray(result.data)) {
     throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned an invalid project list.");
   }
   const data = result.data.flatMap((value) => sanitizeProject(value) ?? []);
@@ -24430,7 +24941,7 @@ function sanitizeProjectList(result) {
   };
 }
 function sanitizeProjectCreate(result) {
-  const project = isRecord11(result) ? sanitizeProject(result.project) : void 0;
+  const project = isRecord12(result) ? sanitizeProject(result.project) : void 0;
   if (project === void 0) {
     throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned an invalid created project.");
   }
@@ -24462,19 +24973,19 @@ function codexDirectoryCrumbs(root, path) {
   return crumbs2;
 }
 function extractThread(result) {
-  return isRecord11(result) && isRecord11(result.thread) ? result.thread : void 0;
+  return isRecord12(result) && isRecord12(result.thread) ? result.thread : void 0;
 }
 function extractTurnId(result) {
-  if (!isRecord11(result)) return void 0;
+  if (!isRecord12(result)) return void 0;
   if (typeof result.turnId === "string" && result.turnId.length > 0) return result.turnId;
-  if (isRecord11(result.turn) && typeof result.turn.id === "string" && result.turn.id.length > 0) return result.turn.id;
+  if (isRecord12(result.turn) && typeof result.turn.id === "string" && result.turn.id.length > 0) return result.turn.id;
   return void 0;
 }
 function extractThreadId(params) {
-  if (!isRecord11(params)) return void 0;
+  if (!isRecord12(params)) return void 0;
   if (typeof params.threadId === "string") return params.threadId;
-  if (isRecord11(params.thread) && typeof params.thread.id === "string") return params.thread.id;
-  if (isRecord11(params.turn) && typeof params.turn.threadId === "string") return params.turn.threadId;
+  if (isRecord12(params.thread) && typeof params.thread.id === "string") return params.thread.id;
+  if (isRecord12(params.turn) && typeof params.turn.threadId === "string") return params.turn.threadId;
   return void 0;
 }
 function optionalInteger2(value) {
@@ -24516,13 +25027,13 @@ function mapCodexImageInputs(params) {
   return {
     ...params,
     input: params.input.map((value) => {
-      if (!isRecord11(value) || value.type !== "image" || typeof value.mediaType !== "string" || typeof value.data !== "string") return value;
+      if (!isRecord12(value) || value.type !== "image" || typeof value.mediaType !== "string" || typeof value.data !== "string") return value;
       return { type: "image", url: `data:${value.mediaType};base64,${value.data}` };
     })
   };
 }
 function sanitizeApprovalParams(params, requestHandle) {
-  if (!isRecord11(params)) return { requestHandle };
+  if (!isRecord12(params)) return { requestHandle };
   const safe = { ...params };
   delete safe.proposedExecpolicyAmendment;
   delete safe.additionalPermissions;
@@ -24553,7 +25064,7 @@ function isProjectListFallbackError(error) {
 function canTryNextBinary(error) {
   return !(error instanceof RpcError) || !["CODEX_AUTH_REQUIRED", "CODEX_CLOSED"].includes(error.code);
 }
-function isRecord11(value) {
+function isRecord12(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function array2(value) {
@@ -24566,7 +25077,119 @@ function isActiveWriterMessage(message) {
   return message.toLowerCase().includes("active writer");
 }
 
+// src/acp.ts
+import { spawn as spawn3 } from "node:child_process";
+var AcpGateway = class {
+  constructor(adapters) {
+    this.adapters = adapters;
+  }
+  get(p) {
+    const list = this.adapters instanceof Object && "backend" in this.adapters ? [this.adapters] : [...this.adapters];
+    const a = list.find((x) => !p.backend || x.backend === p.backend);
+    if (!a) throw new Error("CAPABILITY_NOT_SUPPORTED");
+    return a;
+  }
+  initialize(p) {
+    return this.get(p).initialize(p);
+  }
+  sessionNew(p) {
+    return this.get(p).sessionNew(p);
+  }
+  sessionLoad(p) {
+    const a = this.get(p);
+    if (!a.sessionLoad) throw new Error("CAPABILITY_NOT_SUPPORTED");
+    return a.sessionLoad(p);
+  }
+  prompt(p, emit) {
+    return this.get(p).prompt(p, emit);
+  }
+  respondPermission(p) {
+    const a = this.get(p);
+    if (!a.respondPermission) throw new Error("CAPABILITY_NOT_SUPPORTED");
+    return a.respondPermission(p);
+  }
+  cancel(p) {
+    const a = this.get(p);
+    if (!a.cancel) throw new Error("CAPABILITY_NOT_SUPPORTED");
+    return a.cancel(p);
+  }
+  setMode(p) {
+    const a = this.get(p);
+    if (!a.setMode) throw new Error("CAPABILITY_NOT_SUPPORTED");
+    return a.setMode(p);
+  }
+};
+var StdioAcpAdapter = class {
+  constructor(config) {
+    this.config = config;
+    this.backend = config.id;
+  }
+  backend;
+  child;
+  nextId = 1;
+  ensure() {
+    if (!this.child) this.child = spawn3(this.config.command, this.config.args ?? [], { cwd: this.config.cwd, stdio: "pipe" });
+    return this.child;
+  }
+  async initialize(params) {
+    await this.call("initialize", params);
+    return { protocolVersion: 1, capability: "agent.acp.v1", backend: this.backend, capabilities: ["session.new", "session.load", "session.prompt", "session.cancel"] };
+  }
+  async sessionNew(params) {
+    const r = await this.call("session/new", params);
+    if (!r.sessionId) throw new Error("INVALID_MESSAGE");
+    return { sessionId: r.sessionId };
+  }
+  async sessionLoad(params) {
+    const r = await this.call("session/load", params);
+    if (!r.sessionId) throw new Error("INVALID_MESSAGE");
+    return { sessionId: r.sessionId };
+  }
+  async prompt(params, emit) {
+    await this.call("session/prompt", params, async (n) => emit({ sessionId: params.sessionId, update: n, seq: this.nextId++ }));
+  }
+  async cancel(p) {
+    await this.call("session/cancel", p);
+  }
+  async setMode(p) {
+    await this.call("session/set_mode", p);
+  }
+  async respondPermission(p) {
+    await this.call("session/request_permission", p);
+  }
+  async close() {
+    this.child?.kill();
+    this.child = void 0;
+  }
+  call(method, params, onNotification) {
+    const c = this.ensure();
+    const id2 = this.nextId++;
+    c.stdin.write(JSON.stringify({ jsonrpc: "2.0", id: id2, method, params }) + "\n");
+    return new Promise((resolve3, reject) => {
+      let buf = "";
+      const onData = async (d) => {
+        buf += d;
+        const lines = buf.split("\n");
+        buf = lines.pop() ?? "";
+        for (const l of lines) {
+          try {
+            const m = JSON.parse(l);
+            if (m.id === id2) {
+              c.stdout.off("data", onData);
+              m.error ? reject(new Error(m.error.message ?? "ACP error")) : resolve3(m.result);
+            } else if (m.method && onNotification) await onNotification(m.params);
+          } catch {
+          }
+        }
+      };
+      c.stdout.on("data", onData);
+      c.once("error", reject);
+    });
+  }
+};
+
 // src/service.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
 var HostPluginRuntime = class {
   constructor(config, identities, apiProxy, logger, localGateway, fileViewerHost) {
     this.config = config;
@@ -24588,7 +25211,8 @@ var HostPluginRuntime = class {
       const harnessRemote = this.localGateway?.supportsCarrier === true ? new HarnessRemoteBridge(
         this.localGateway,
         (event, data) => send(createEvent(event, data)),
-        this.logger
+        this.logger,
+        this.harnessVersion
       ) : void 0;
       const fileViewer = new RemoteFileViewerBridge(
         () => this.fileViewerHost?.(),
@@ -24598,6 +25222,8 @@ var HostPluginRuntime = class {
         context,
         (event, data) => send(createEvent(event, data))
       );
+      const adapters = (config.acp?.backends ?? []).filter((item) => item.enabled && this.acpAvailable(item.command)).map((item) => new StdioAcpAdapter(item));
+      const acp = config.acp?.enabled && adapters.length > 0 ? new AcpGateway(adapters) : void 0;
       return new RpcRouter(
         harnessApi,
         void 0,
@@ -24605,7 +25231,8 @@ var HostPluginRuntime = class {
         fileViewer,
         harnessRemote,
         () => this.hostCapabilities(),
-        codex
+        codex,
+        acp
       );
     }, this.logger);
     if (config.serverUrl !== void 0) {
@@ -24658,9 +25285,21 @@ var HostPluginRuntime = class {
       ...error === void 0 ? {} : { error },
       ...authorization?.account === void 0 ? {} : { account: authorization.account },
       authorized: authorization !== void 0,
-      accountRequired: error === "ACCOUNT_AUTH_REQUIRED" || error === "AUTH_INVALID" || error === "TOKEN_EXPIRED"
+      accountRequired: error === "ACCOUNT_AUTH_REQUIRED" || error === "AUTH_INVALID" || error === "TOKEN_EXPIRED",
+      connectedClients: this.listConnectedClients()
     };
   }
+  listConnectedClients() {
+    return this.connections.connectedPeers().map((peer) => {
+      const trusted = this.identities.trustedPeer(peer.deviceId);
+      return {
+        deviceId: peer.deviceId,
+        name: trusted?.name.trim() ?? "",
+        ...trusted === void 0 ? {} : { platform: trusted.platform },
+        ...peer.mode === void 0 ? {} : { mode: peer.mode }
+      };
+    });
+  }
   localHarnessVersion() {
     return this.harnessVersion;
   }
@@ -24838,13 +25477,25 @@ var HostPluginRuntime = class {
         harnessSessionGeneration(this.harnessVersion) === "v3" ? "harness.remote.v3" : "harness.remote.v1",
         "harness.remote.transfer.v1"
       );
-    } else if (this.apiProxy !== void 0) {
+    }
+    if (this.apiProxy !== void 0) {
       capabilities.push("harness.api.v1", "harness.api.transfer.v1");
     }
     if (this.fileViewerHost?.() !== void 0) capabilities.push("fileviewer.read.v1");
     if (this.codex.isAvailable()) capabilities.push("codex.appserver.v1", "codex.appserver.transfer.v1");
+    if (this.config.acp?.enabled) {
+      for (const item of this.config.acp.backends) if (item.enabled && this.acpAvailable(item.command)) capabilities.push(`agent.acp.v1.${item.id}`);
+    }
     return capabilities;
   }
+  acpAvailable(command) {
+    try {
+      execFileSync2(process.platform === "win32" ? "where" : "which", [command], { stdio: "ignore" });
+      return true;
+    } catch {
+      return false;
+    }
+  }
   requireLocalCodexPeer() {
     if (!this.codex.isAvailable()) {
       throw new RpcError("CODEX_UNAVAILABLE", "Local CodeX is disabled or unavailable on this Host.");
@@ -25293,7 +25944,7 @@ function remoteStatusLines(target) {
     `Device: ${status2.deviceId ?? "not initialized"}`,
     `Authorization: ${status2.authorized ? status2.account === void 0 ? "logged in" : `logged in (${status2.account})` : "logged out"}`,
     `Server connection: ${connection}`,
-    `Harness Remote API: ${capabilities.has("harness.api.v1") ? "available (ApiProxy)" : capabilities.has("harness.remote.v1") ? "available (Typert Remote)" : "unavailable"}`,
+    `Harness Remote API: ${capabilities.has("harness.api.v1") ? "available (ApiProxy)" : capabilities.has("harness.remote.v3") ? "available (Typert Remote Session V3)" : capabilities.has("harness.remote.v1") ? "available (Typert Remote)" : "unavailable"}`,
     `Remote clients: ${diagnostics.activeConnections}`,
     `Codex Remote: ${codex.enabled ? codex.state : "disabled"}`,
     "",
@@ -25566,6 +26217,7 @@ function apply(ctx, input2 = {}) {
   const activateWhenCarrierReady = (runtimeContext) => {
     const gateway = runtimeContext.get("typertGateway");
     const connection = runtimeContext.get("connection");
+    const webServer = runtimeContext.get("webServer");
     let disposePendingControl;
     const installPendingControl = () => {
       if (connection === void 0 || disposePendingControl !== void 0) return;
@@ -25577,7 +26229,7 @@ function apply(ctx, input2 = {}) {
           void 0,
           void 0
         );
-        return control.register(connection);
+        return control.register(connection, webServer);
       }, "dsh-remote pending control");
     };
     const startActiveRuntime = async (activeContext) => {
@@ -25611,13 +26263,14 @@ async function activate(ctx, input2, tuiBinding) {
     reportSettingsMigration(ctx, await migration);
   }
   const connection = ctx.get("connection");
+  const webServer = ctx.get("webServer");
   const resolvedConfig = resolveConfig(settingsScope?.get() ?? input2);
   const config = connection === void 0 && resolvedConfig.serverUrl === void 0 ? { ...resolvedConfig, serverUrl: DEFAULT_REMOTE_SERVER_URL } : resolvedConfig;
   const defaultIdentityDirectory = new IdentityStore().directory;
   if (!config.enabled) {
     if (connection !== void 0) {
       const controlRuntime2 = new PluginControlRuntime(config, defaultIdentityDirectory, settingsScope, void 0, void 0);
-      ctx.effect(() => controlRuntime2.register(connection), "dsh-remote disabled control");
+      ctx.effect(() => controlRuntime2.register(connection, webServer), "dsh-remote disabled control");
     }
     return;
   }
@@ -25676,7 +26329,7 @@ async function activate(ctx, input2, tuiBinding) {
   if (tuiBinding !== void 0) tuiBinding.target = tuiTarget;
   await disableLegacyLoaderEntries(ctx, logger);
   await ctx.effect(async () => {
-    const disposeControl = controlRuntime?.register(connection);
+    const disposeControl = controlRuntime?.register(connection, webServer);
     try {
       await runtime.start();
       if (clientRuntime !== void 0) {
@@ -25759,6 +26412,7 @@ function isPlainRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 export {
+  AcpGateway,
   ApiProxySwitch,
   CODEX_APP_ALLOWLIST,
   ClientModeError,