linkshell-cli 0.2.64 → 0.2.66

package/dist/cli/src/runtime/acp/json-rpc.js

@@ -0,0 +1,150 @@
+import { spawn } from "node:child_process";
+export class JsonRpcStdioTransport {
+    command;
+    framing;
+    onNotification;
+    onRequest;
+    onExit;
+    child;
+    nextId = 1;
+    pending = new Map();
+    buffer = "";
+    constructor(command, framing, onNotification, onRequest, onExit) {
+        this.command = command;
+        this.framing = framing;
+        this.onNotification = onNotification;
+        this.onRequest = onRequest;
+        this.onExit = onExit;
+    }
+    start(cwd) {
+        if (this.child)
+            return;
+        this.child = spawn(this.command, {
+            cwd,
+            shell: true,
+            stdio: ["pipe", "pipe", "pipe"],
+            env: process.env,
+        });
+        this.child.stdout.setEncoding("utf8");
+        this.child.stderr.setEncoding("utf8");
+        this.child.stdout.on("data", (chunk) => this.read(chunk));
+        this.child.stderr.on("data", (chunk) => {
+            const trimmed = chunk.trim();
+            if (trimmed)
+                process.stderr.write(`[agent:stderr] ${trimmed}\n`);
+        });
+        this.child.on("error", (error) => this.failAll(error.message));
+        this.child.on("exit", (code, signal) => {
+            this.failAll(`ACP agent exited (code=${code ?? "null"}, signal=${signal ?? "null"})`);
+        });
+    }
+    request(method, params, timeoutMs = 30_000) {
+        if (!this.child || this.child.stdin.destroyed) {
+            return Promise.reject(new Error("ACP agent is not running"));
+        }
+        const id = this.nextId++;
+        const message = { jsonrpc: "2.0", id, method, params };
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new Error(`ACP request timed out: ${method}`));
+            }, timeoutMs);
+            this.pending.set(id, { resolve, reject, timer });
+            this.write(message);
+        });
+    }
+    notify(method, params) {
+        this.write({ jsonrpc: "2.0", method, params });
+    }
+    stop() {
+        const child = this.child;
+        this.child = undefined;
+        if (child && !child.killed)
+            child.kill("SIGTERM");
+        this.failAll("ACP transport stopped");
+    }
+    write(message) {
+        const raw = JSON.stringify(message);
+        if (this.framing === "newline") {
+            this.child?.stdin.write(`${raw}\n`);
+            return;
+        }
+        this.child?.stdin.write(`Content-Length: ${Buffer.byteLength(raw, "utf8")}\r\n\r\n${raw}`);
+    }
+    read(chunk) {
+        this.buffer += chunk;
+        while (this.buffer.length > 0) {
+            const contentLengthMatch = this.buffer.match(/^Content-Length:\s*(\d+)\r?\n/i);
+            if (contentLengthMatch) {
+                const headerEnd = this.buffer.indexOf("\r\n\r\n");
+                const altHeaderEnd = this.buffer.indexOf("\n\n");
+                const end = headerEnd >= 0 ? headerEnd + 4 : altHeaderEnd >= 0 ? altHeaderEnd + 2 : -1;
+                if (end < 0)
+                    return;
+                const length = Number(contentLengthMatch[1]);
+                if (this.buffer.length < end + length)
+                    return;
+                const raw = this.buffer.slice(end, end + length);
+                this.buffer = this.buffer.slice(end + length);
+                this.dispatch(raw);
+                continue;
+            }
+            const newline = this.buffer.indexOf("\n");
+            if (newline < 0)
+                return;
+            const raw = this.buffer.slice(0, newline).trim();
+            this.buffer = this.buffer.slice(newline + 1);
+            if (raw)
+                this.dispatch(raw);
+        }
+    }
+    dispatch(raw) {
+        let message;
+        try {
+            message = JSON.parse(raw);
+        }
+        catch {
+            return;
+        }
+        if ("id" in message && ("result" in message || "error" in message)) {
+            const pending = this.pending.get(message.id);
+            if (!pending)
+                return;
+            this.pending.delete(message.id);
+            clearTimeout(pending.timer);
+            const response = message;
+            if (response.error)
+                pending.reject(new Error(response.error.message));
+            else
+                pending.resolve(response.result);
+            return;
+        }
+        if ("method" in message && "id" in message) {
+            Promise.resolve(this.onRequest(message.method, message.params))
+                .then((result) => this.write({ jsonrpc: "2.0", id: message.id, result }))
+                .catch((error) => {
+                this.write({
+                    jsonrpc: "2.0",
+                    id: message.id,
+                    error: {
+                        code: -32000,
+                        message: error instanceof Error ? error.message : String(error),
+                    },
+                });
+            });
+            return;
+        }
+        if ("method" in message) {
+            this.onNotification(message.method, message.params);
+        }
+    }
+    failAll(message) {
+        this.onExit(message);
+        for (const [, pending] of this.pending) {
+            clearTimeout(pending.timer);
+            pending.reject(new Error(message));
+        }
+        this.pending.clear();
+    }
+}
+//# sourceMappingURL=json-rpc.js.map

package/dist/cli/src/runtime/acp/json-rpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-rpc.js","sourceRoot":"","sources":["../../../../../src/runtime/acp/json-rpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAyBhF,MAAM,OAAO,qBAAqB;IAcb;IACA;IACA;IACA;IACA;IAjBX,KAAK,CAA6C;IAClD,MAAM,GAAG,CAAC,CAAC;IACX,OAAO,GAAG,IAAI,GAAG,EAOtB,CAAC;IACI,MAAM,GAAG,EAAE,CAAC;IAEpB,YACmB,OAAe,EACf,OAAqB,EACrB,cAAyD,EACzD,SAA0E,EAC1E,MAAiC;QAJjC,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAc;QACrB,mBAAc,GAAd,cAAc,CAA2C;QACzD,cAAS,GAAT,SAAS,CAAiE;QAC1E,WAAM,GAAN,MAAM,CAA2B;IACjD,CAAC;IAEJ,KAAK,CAAC,GAAW;QACf,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;YAC/B,GAAG;YACH,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,OAAO;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,OAAO,IAAI,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,OAAO,CAAC,0BAA0B,IAAI,IAAI,MAAM,YAAY,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,MAAc,EAAE,MAAgB,EAAE,SAAS,GAAG,MAAM;QAC1D,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,OAAO,GAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACvE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC,CAAC;YACxD,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,MAAgB;QACrC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,IAAI;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,OAAuB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;IAC7F,CAAC;IAEO,IAAI,CAAC,KAAa;QACxB,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC/E,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAClD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACjD,MAAM,GAAG,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvF,IAAI,GAAG,GAAG,CAAC;oBAAE,OAAO;gBACpB,MAAM,MAAM,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7C,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,GAAG,MAAM;oBAAE,OAAO;gBAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,CAAC;gBACjD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;gBAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,GAAG;gBAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,GAAW;QAC1B,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;YACnE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAChC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,OAA0B,CAAC;YAC5C,IAAI,QAAQ,CAAC,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;;gBACjE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;iBAC5D,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;iBACxE,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,IAAI,CAAC,KAAK,CAAC;oBACT,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAChE;iBACF,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACL,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/cli/src/runtime/acp/provider-resolver.d.ts

@@ -0,0 +1,13 @@
+export type AgentProvider = "codex" | "claude" | "custom";
+export type AgentProtocol = "acp" | "codex-app-server";
+export type AgentFraming = "content-length" | "newline";
+export interface AgentCommandConfig {
+    command: string;
+    provider: AgentProvider;
+    protocol: AgentProtocol;
+    framing: AgentFraming;
+}
+export declare function resolveAgentCommand(input: {
+    provider: AgentProvider;
+    command?: string;
+}): AgentCommandConfig | null;

package/dist/cli/src/runtime/acp/provider-resolver.js

@@ -0,0 +1,22 @@
+export function resolveAgentCommand(input) {
+    const explicit = input.command?.trim();
+    if (explicit) {
+        const isCodexAppServer = /\bcodex\b/.test(explicit) && /\bapp-server\b/.test(explicit);
+        return {
+            provider: input.provider,
+            command: explicit,
+            protocol: isCodexAppServer ? "codex-app-server" : "acp",
+            framing: isCodexAppServer ? "newline" : "content-length",
+        };
+    }
+    if (input.provider === "codex") {
+        return {
+            provider: "codex",
+            command: "codex app-server --listen stdio://",
+            protocol: "codex-app-server",
+            framing: "newline",
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=provider-resolver.js.map

package/dist/cli/src/runtime/acp/provider-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-resolver.js","sourceRoot":"","sources":["../../../../../src/runtime/acp/provider-resolver.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,mBAAmB,CAAC,KAGnC;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,gBAAgB,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvF,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK;YACvD,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB;SACzD,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,oCAAoC;YAC7C,QAAQ,EAAE,kBAAkB;YAC5B,OAAO,EAAE,SAAS;SACnB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/src/runtime/bridge-session.d.ts

@@ -1,4 +1,5 @@
 import type { ProviderConfig } from "../providers.js";
+import type { AgentProvider } from "./acp/provider-resolver.js";
 export interface BridgeSessionOptions {
     gatewayUrl: string;
     gatewayHttpUrl: string;
@@ -12,6 +13,10 @@ export interface BridgeSessionOptions {
     screen?: boolean;
     providerConfig: ProviderConfig;
     authToken?: string;
+    keepAwake?: boolean;
+    agentUi?: boolean;
+    agentProvider?: AgentProvider;
+    agentCommand?: string;
 }
 export declare class BridgeSession {
     private readonly options;
@@ -30,6 +35,8 @@ export declare class BridgeSession {
     private screenCapture;
     private screenShare;
     private tunnelSockets;
+    private keepAwake;
+    private agentSession;
     constructor(options: BridgeSessionOptions);
     private log;
     start(): Promise<void>;
@@ -61,6 +68,8 @@ export declare class BridgeSession {
     private autoResolvePending;
     /** Drain all pending permissions for a terminal (session ended, stop, etc.) */
     private drainPendingPermissions;
+    private resolvePendingPermission;
+    private sendPermissionSnapshot;
     private cleanupHookServer;
     /** Remove hook entries containing our marker from a JSON config file */
     private removeHookEntries;

package/dist/cli/src/runtime/bridge-session.js

@@ -10,11 +10,19 @@ import { ScrollbackBuffer } from "./scrollback.js";
 import { ScreenFallback } from "./screen-fallback.js";
 import { ScreenShare } from "./screen-share.js";
 import { getLanIp } from "../utils/lan-ip.js";
+import { startKeepAwake } from "../utils/keep-awake.js";
+import { AgentSessionProxy } from "./acp/agent-session.js";
 const HEARTBEAT_INTERVAL = 15_000;
 const RECONNECT_BASE_DELAY = 1_000;
 const RECONNECT_MAX_DELAY = 30_000;
 const RECONNECT_MAX_ATTEMPTS = 20;
 const DEFAULT_TERMINAL_ID = "default";
+const HOOK_BODY_LIMIT = 256 * 1024;
+const PERMISSION_REQUEST_TIMEOUT_MS = Number(process.env.LINKSHELL_PERMISSION_TIMEOUT_MS ?? 5 * 60_000);
+function isLinkShellHookEntry(entry) {
+    const raw = JSON.stringify(entry);
+    return /\/hook\?m=lsh-[^"'\s]+/.test(raw);
+}
 function getPairingGatewayParam(gatewayHttpUrl) {
     try {
         const url = new URL(gatewayHttpUrl);
@@ -64,6 +72,12 @@ function resolvePairingGateway(gatewayHttpUrl, pairingGateway) {
         }
     }
 }
+function normalizeAgentProvider(provider) {
+    if (provider === "claude" || provider === "custom") {
+        return provider;
+    }
+    return "codex";
+}
 export class BridgeSession {
     options;
     socket;
@@ -82,6 +96,8 @@ export class BridgeSession {
     screenCapture;
     screenShare;
     tunnelSockets = new Map();
+    keepAwake;
+    agentSession;
     constructor(options) {
         this.options = options;
         this.sessionId = options.sessionId ?? "";
@@ -96,6 +112,24 @@ export class BridgeSession {
         if (!this.sessionId) {
             await this.createPairing();
         }
+        if (this.options.keepAwake) {
+            this.keepAwake = startKeepAwake();
+        }
+        else {
+            process.stderr.write("[bridge] keep-awake disabled\n");
+        }
+        if (this.options.agentUi) {
+            const agentProvider = normalizeAgentProvider(this.options.agentProvider ?? this.options.providerConfig.provider);
+            this.agentSession = new AgentSessionProxy({
+                sessionId: this.sessionId,
+                cwd: process.cwd(),
+                provider: agentProvider,
+                command: this.options.agentCommand,
+                verbose: this.options.verbose,
+                send: (envelope) => this.send(envelope),
+            });
+            process.stderr.write("[bridge] agent GUI channel enabled\n");
+        }
         await this.spawnTerminal(DEFAULT_TERMINAL_ID, process.cwd());
         this.connectGateway();
     }
@@ -180,7 +214,14 @@ export class BridgeSession {
             this.startHeartbeat();
         });
         this.socket.on("message", (data) => {
-            const envelope = parseEnvelope(data.toString());
+            let envelope;
+            try {
+                envelope = parseEnvelope(data.toString());
+            }
+            catch (err) {
+                this.log(`invalid gateway message ignored: ${err}`);
+                return;
+            }
             this.log(`recv ${envelope.type}${envelope.seq !== undefined ? ` seq=${envelope.seq}` : ""}`);
             this.handleMessage(envelope).catch((err) => {
                 this.log(`handleMessage error: ${err}`);
@@ -374,7 +415,7 @@ export class BridgeSession {
                 const p = parseTypedPayload("session.resume", envelope.payload);
                 // Replay all terminals
                 for (const [termId, term] of this.terminals) {
-                    this.replayFrom(termId, term, p.lastAckedSeq);
+                    this.replayFrom(termId, term, p.lastAckedSeqByTerminal[termId] ?? p.lastAckedSeq);
                 }
                 // Also send terminal list so client knows what's available
                 this.sendTerminalList();
@@ -401,6 +442,35 @@ export class BridgeSession {
                 this.screenShare?.handleIceCandidate(p.candidate, p.sdpMid, p.sdpMLineIndex);
                 break;
             }
+            case "agent.initialize":
+            case "agent.session.new":
+            case "agent.session.load":
+            case "agent.session.list":
+            case "agent.prompt":
+            case "agent.cancel":
+            case "agent.permission.response": {
+                if (!this.agentSession) {
+                    this.send(createEnvelope({
+                        type: "agent.capabilities",
+                        sessionId: this.sessionId,
+                        payload: {
+                            enabled: false,
+                            provider: normalizeAgentProvider(this.options.agentProvider ?? this.options.providerConfig.provider),
+                            error: "Agent GUI is not enabled. Start CLI with --agent-ui.",
+                            supportsSessionList: false,
+                            supportsSessionLoad: false,
+                            supportsImages: false,
+                            supportsAudio: false,
+                            supportsPermission: false,
+                            supportsPlan: false,
+                            supportsCancel: false,
+                        },
+                    }));
+                    break;
+                }
+                await this.agentSession.handleEnvelope(envelope);
+                break;
+            }
             case "file.upload": {
                 const p = parseTypedPayload("file.upload", envelope.payload);
                 const ext = p.filename.split(".").pop() || "png";
@@ -415,22 +485,8 @@ export class BridgeSession {
             }
             case "permission.decision": {
                 const p = envelope.payload;
-                const resolve = this.pendingPermissions.get(p.requestId);
-                if (resolve) {
-                    this.pendingPermissions.delete(p.requestId);
-                    resolve(p.decision);
+                if (this.resolvePendingPermission(p.requestId, p.decision)) {
                     this.log(`permission decision for ${p.requestId}: ${p.decision}`);
-                    // Pop from permission stack
-                    if (p.decision === "allow" || p.decision === "deny") {
-                        const stack = this.permissionStacks.get(tid);
-                        if (stack) {
-                            const idx = stack.findIndex((s) => s.requestId === p.requestId);
-                            if (idx >= 0)
-                                stack.splice(idx, 1);
-                            if (stack.length === 0)
-                                this.permissionStacks.delete(tid);
-                        }
-                    }
                 }
                 else {
                     this.log(`no pending permission for ${p.requestId}`);
@@ -740,8 +796,21 @@ export class BridgeSession {
                 return;
             }
             let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
+            let bodyTooLarge = false;
+            req.on("data", (chunk) => {
+                if (bodyTooLarge)
+                    return;
+                body += chunk.toString();
+                if (Buffer.byteLength(body, "utf8") > HOOK_BODY_LIMIT) {
+                    bodyTooLarge = true;
+                    res.writeHead(413);
+                    res.end("payload too large");
+                    req.destroy();
+                }
+            });
             req.on("end", () => {
+                if (bodyTooLarge || res.writableEnded)
+                    return;
                 this.log(`hook body (${body.length} bytes): ${body.slice(0, 200)}`);
                 try {
                     const event = JSON.parse(body);
@@ -749,15 +818,27 @@ export class BridgeSession {
                     // PermissionRequest: hold connection, wait for user decision from mobile app
                     if (hookName === "PermissionRequest") {
                         const requestId = `pr-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-                        this.pendingPermissions.set(requestId, (decision) => {
-                            const responseJson = JSON.stringify({
-                                hookSpecificOutput: {
-                                    hookEventName: "PermissionRequest",
-                                    decision: { behavior: decision },
-                                },
-                            });
-                            res.writeHead(200, { "Content-Type": "application/json" });
-                            res.end(responseJson);
+                        const timeout = setTimeout(() => {
+                            if (this.resolvePendingPermission(requestId, "deny")) {
+                                this.log(`permission request ${requestId} timed out`);
+                                this.sendPermissionSnapshot(terminalId, "thinking", "permission timed out");
+                            }
+                        }, PERMISSION_REQUEST_TIMEOUT_MS);
+                        this.pendingPermissions.set(requestId, {
+                            terminalId,
+                            timeout,
+                            resolve: (decision) => {
+                                if (res.writableEnded)
+                                    return;
+                                const responseJson = JSON.stringify({
+                                    hookSpecificOutput: {
+                                        hookEventName: "PermissionRequest",
+                                        decision: { behavior: decision },
+                                    },
+                                });
+                                res.writeHead(200, { "Content-Type": "application/json" });
+                                res.end(responseJson);
+                            },
                         });
                         // Send status with requestId so app can route decision back
                         this.handleHookEvent(terminalId, event, provider, requestId);
@@ -814,7 +895,14 @@ export class BridgeSession {
         }
         catch { /* doesn't exist yet */ }
         const hookEntry = { matcher: "", hooks: [{ type: "command", command: curlCmd, timeout: 5 }] };
-        const permissionEntry = { matcher: "", hooks: [{ type: "command", command: curlCmd, timeout: 86400 }] };
+        const permissionEntry = {
+            matcher: "",
+            hooks: [{
+                    type: "command",
+                    command: curlCmd,
+                    timeout: Math.ceil((PERMISSION_REQUEST_TIMEOUT_MS + 30_000) / 1000),
+                }],
+        };
         const hookEvents = {
             PreToolUse: hookEntry,
             PostToolUse: hookEntry,
@@ -829,7 +917,7 @@ export class BridgeSession {
         for (const [eventName, entry] of Object.entries(hookEvents)) {
             let arr = Array.isArray(existingHooks[eventName]) ? existingHooks[eventName] : [];
             // Remove any dead linkshell hook entries (from previous instances)
-            arr = arr.filter((e) => !JSON.stringify(e).includes("/hook"));
+            arr = arr.filter((e) => !isLinkShellHookEntry(e));
             arr.push(entry);
             existingHooks[eventName] = arr;
         }
@@ -884,7 +972,7 @@ export class BridgeSession {
         const existingHooks = existing.hooks ?? {};
         for (const [eventName, entry] of Object.entries(hookEvents)) {
             let arr = Array.isArray(existingHooks[eventName]) ? existingHooks[eventName] : [];
-            arr = arr.filter((e) => !JSON.stringify(e).includes("/hook"));
+            arr = arr.filter((e) => !isLinkShellHookEntry(e));
             arr.push(entry);
             existingHooks[eventName] = arr;
         }
@@ -914,7 +1002,7 @@ export class BridgeSession {
         const existingHooks = (existing.hooks ?? {});
         for (const [eventName, entry] of Object.entries(hookEvents)) {
             let arr = Array.isArray(existingHooks[eventName]) ? existingHooks[eventName] : [];
-            arr = arr.filter((e) => !JSON.stringify(e).includes("/hook"));
+            arr = arr.filter((e) => !isLinkShellHookEntry(e));
             arr.push(entry);
             existingHooks[eventName] = arr;
         }
@@ -949,7 +1037,7 @@ export class BridgeSession {
         const existingHooks = existing.hooks ?? {};
         for (const [eventName, entry] of Object.entries(hookEvents)) {
             let arr = Array.isArray(existingHooks[eventName]) ? existingHooks[eventName] : [];
-            arr = arr.filter((e) => !JSON.stringify(e).includes("/hook"));
+            arr = arr.filter((e) => !isLinkShellHookEntry(e));
             arr.push(entry);
             existingHooks[eventName] = arr;
         }
@@ -1180,10 +1268,7 @@ export class BridgeSession {
     }
     /** Auto-resolve a single pending permission (user acted in terminal) */
     autoResolvePending(requestId) {
-        const resolve = this.pendingPermissions.get(requestId);
-        if (resolve) {
-            this.pendingPermissions.delete(requestId);
-            resolve("allow");
+        if (this.resolvePendingPermission(requestId, "allow")) {
             this.log(`auto-resolved pending permission ${requestId} (user acted in terminal)`);
         }
     }
@@ -1192,15 +1277,48 @@ export class BridgeSession {
         const stack = this.permissionStacks.get(terminalId);
         if (!stack)
             return;
-        for (const entry of stack) {
-            const resolve = this.pendingPermissions.get(entry.requestId);
-            if (resolve) {
-                this.pendingPermissions.delete(entry.requestId);
-                resolve("deny");
+        for (const entry of [...stack]) {
+            if (this.resolvePendingPermission(entry.requestId, "deny")) {
                 this.log(`drained pending permission ${entry.requestId}`);
             }
         }
     }
+    resolvePendingPermission(requestId, decision) {
+        const pending = this.pendingPermissions.get(requestId);
+        if (!pending)
+            return false;
+        this.pendingPermissions.delete(requestId);
+        clearTimeout(pending.timeout);
+        pending.resolve(decision);
+        const stack = this.permissionStacks.get(pending.terminalId);
+        if (stack) {
+            const idx = stack.findIndex((entry) => entry.requestId === requestId);
+            if (idx >= 0)
+                stack.splice(idx, 1);
+            if (stack.length === 0)
+                this.permissionStacks.delete(pending.terminalId);
+        }
+        return true;
+    }
+    sendPermissionSnapshot(terminalId, phase, summary) {
+        const stack = this.permissionStacks.get(terminalId);
+        const topPermission = stack && stack.length > 0 ? stack[stack.length - 1] : undefined;
+        const pendingPermissionCount = stack?.length ?? 0;
+        const term = this.terminals.get(terminalId);
+        const seq = term ? term.statusSeq++ : 0;
+        this.send(createEnvelope({
+            type: "terminal.status",
+            sessionId: this.sessionId,
+            terminalId,
+            payload: {
+                phase,
+                seq,
+                ...(summary && { summary }),
+                ...(topPermission && { topPermission }),
+                ...(pendingPermissionCount > 0 && { pendingPermissionCount }),
+            },
+        }));
+    }
     cleanupHookServer(term) {
         // Drain any pending permission requests for this terminal
         this.drainPendingPermissions(term.id);
@@ -1374,6 +1492,10 @@ export class BridgeSession {
         this.exited = true;
         this.stopHeartbeat();
         this.stopScreenCapture();
+        this.agentSession?.stop();
+        this.agentSession = undefined;
+        this.keepAwake?.stop();
+        this.keepAwake = undefined;
         if (this.reconnectTimer) {
             clearTimeout(this.reconnectTimer);
             this.reconnectTimer = undefined;