scalix 1.5.1 → 1.5.2

package/dist/ipc-server.js

@@ -5,30 +5,76 @@
  * Protocol:
  *   stdin  (client→server): {"type":"request","id":"...","method":"...","params":{}}
  *                           {"type":"response","id":"...","result":{}}   (for confirmTool)
- *   stdout (server→client): {"type":"event","event":"...","data":{}}
+ *   stdout (server→client): {"type":"event","event":"...","data":{},"sessionId":"..."}
  *                           {"type":"response","id":"...","result":{}}
  *                           {"type":"request","id":"...","method":"confirmTool","params":{}}
+ *
+ * Multi-session: the server hosts one Agent per session so several chat tabs can
+ * run concurrent, isolated conversations. Session-scoped requests carry
+ * `params.sessionId` (missing → the `default` session, which always exists), and
+ * session-scoped events carry a top-level `sessionId`. Global events (ready,
+ * mcp:status, browser:frame) and global methods (getMemory, saveMemory,
+ * registerModels, setClientCapabilities, forgetLocalOrigin) are untagged.
  */
 import readline from 'node:readline';
 import { createAgent } from './agent.js';
 import { defaultTools } from './tools.js';
 import { extraTools } from './tools-extra.js';
+import { memoryTools } from './tools-memory.js';
 import { webTools } from './tools-web.js';
 import { advancedTools } from './tools-advanced.js';
 import { visionTools } from './tools-vision.js';
 import { voiceTools } from './tools-voice.js';
-import { browserTools, closeBrowser } from './tools-browser.js';
-import { loadMcpServices } from './mcp.js';
+import { browserTools, closeBrowser, setBrowserFrameSink } from './tools-browser.js';
+import { setLocalOriginApprover, listApprovedLocalOrigins, forgetLocalOrigin } from './browser-access.js';
+import { connectMcpServers } from './mcp.js';
 import { loadConfig, resolveActiveProvider, DEFAULT_LIMITS } from './settings.js';
+import { PERMISSION_MODES } from './sandbox.js';
 import { discoverPlugins, getPluginTools } from './plugins.js';
 import { isWorkspaceTrusted } from './workspace-trust.js';
 import { DEFAULT_MODELS, DEFAULT_INSTRUCTIONS, ENV_MODEL, fetchModelSpecs, registerUserModels, normalizeModelId, VERSION } from './constants.js';
-import { loadMemory, autoDetectConventions, saveMemory } from './project-memory.js';
+import { loadMemory, autoDetectConventions, saveMemory, addNote, detectCorrection } from './project-memory.js';
 import { buildProjectContext, contextToInstructions } from './context-builder.js';
-const pendingConfirms = new Map();
+// Server→client requests awaiting an answer. Keyed by request id; the value is
+// resolved with whatever `result` object the client sends back. confirmTool was
+// the only user of this for a long time — the browser agent's local-origin
+// prompt is the second, so the map holds raw results and each caller reads the
+// field it cares about.
+const MAX_PENDING_REQUESTS = 100;
+const MAX_IPC_MESSAGE_BYTES = 10 * 1024 * 1024; // 10 MB
+const pendingClientRequests = new Map();
 let confirmCounter = 0;
 function write(msg) {
-    process.stdout.write(JSON.stringify(msg) + '\n');
+    const payload = JSON.stringify(msg);
+    if (Buffer.byteLength(payload, 'utf8') > MAX_IPC_MESSAGE_BYTES) {
+        process.stderr.write(`IPC: outbound message exceeds ${MAX_IPC_MESSAGE_BYTES} bytes — dropped\n`);
+        return;
+    }
+    process.stdout.write(payload + '\n');
+}
+/**
+ * Ask the client something and wait for its answer. Falls back to `onTimeout`
+ * if the client stays silent — a front end that has gone away must not hang
+ * the agent, and silence is never taken as consent.
+ */
+function askClient(method, params, timeoutMs, onTimeout, read) {
+    if (pendingClientRequests.size >= MAX_PENDING_REQUESTS) {
+        return Promise.resolve(onTimeout);
+    }
+    const id = `confirm_${++confirmCounter}`;
+    write({ type: 'request', id, method, params });
+    return new Promise(resolve => {
+        let settled = false;
+        const finish = (v) => { if (!settled) {
+            settled = true;
+            resolve(v);
+        } };
+        const timer = setTimeout(() => {
+            pendingClientRequests.delete(id);
+            finish(onTimeout);
+        }, timeoutMs);
+        pendingClientRequests.set(id, (result) => { clearTimeout(timer); finish(read(result)); });
+    });
 }
 async function buildInstructions() {
     let base = DEFAULT_INSTRUCTIONS;
@@ -89,7 +135,6 @@ export async function runIpcServer() {
     const baseUrl = active.baseUrl;
     if (active.provider === 'scalix')
         fetchModelSpecs(baseUrl, apiKey).catch(() => { });
-    const mcpTools = loadMcpServices();
     // Only discover/load project-local plugins in a trusted workspace — plugins
     // dynamically import and execute code from the project directory.
     const plugins = isWorkspaceTrusted() ? await discoverPlugins(process.cwd()) : [];
@@ -97,77 +142,128 @@ export async function runIpcServer() {
         process.stderr.write('IPC: project plugins skipped (untrusted workspace)\n');
     }
     const pluginTools = getPluginTools(plugins);
-    const allTools = [...defaultTools, ...extraTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...mcpTools, ...pluginTools];
+    const allTools = [...defaultTools, ...extraTools, ...memoryTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...pluginTools];
     const instructions = await buildInstructions();
-    // Bidirectional confirm: send request to VS Code, wait for response
-    const confirmToolCall = async (toolName, args) => {
-        const id = `confirm_${++confirmCounter}`;
-        write({ type: 'request', id, method: 'confirmTool', params: { name: toolName, args } });
-        return new Promise(resolve => {
-            let resolved = false;
-            const safeResolve = (v) => { if (!resolved) {
-                resolved = true;
-                resolve(v);
-            } };
-            pendingConfirms.set(id, { resolve: safeResolve });
-            const timer = setTimeout(() => {
-                if (pendingConfirms.has(id)) {
-                    pendingConfirms.delete(id);
-                    safeResolve(false);
-                }
-            }, 60_000);
-            pendingConfirms.set(id, { resolve: (v) => { clearTimeout(timer); safeResolve(v); } });
+    // Bidirectional confirm: send request to the client, wait for response.
+    // Each session tags its own prompt so the GUI can show it in the tab whose
+    // tool is actually trying to run.
+    const confirmFor = (sessionId) => (toolName, args) => askClient('confirmTool', { sessionId, name: toolName, args }, 60_000, false, r => r?.allowed ?? false);
+    const permissionMode = (process.env.SCALIX_PERMISSION_MODE || config.permissionMode || 'default');
+    // ─── Multi-session registry ───
+    // One Agent per chat tab so parallel conversations never share context or
+    // serialize on each other. The `default` session always exists, so older
+    // clients that never send a sessionId keep exactly the old behaviour.
+    const MAX_SESSIONS = 16;
+    const SESSION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+    const sessions = new Map();
+    let mcpHub = null;
+    const forwardSessionEvents = (sessionId, agent) => {
+        const ev = (event, data) => write({ type: 'event', event, data, sessionId });
+        agent.on('stream:delta', (d, a) => ev('stream:delta', { delta: d, accumulated: a }));
+        agent.on('stream:end', (t) => ev('stream:end', { text: t }));
+        agent.on('tool:call', (n, a) => ev('tool:call', { name: n, args: a }));
+        agent.on('tool:result', (n, r) => ev('tool:result', { name: n, result: r }));
+        agent.on('tool:blocked', (n, r) => ev('tool:blocked', { name: n, reason: r }));
+        agent.on('step:start', (i) => ev('step:start', i));
+        agent.on('step:done', (i) => ev('step:done', i));
+        agent.on('turn:summary', (i) => ev('turn:summary', i));
+        agent.on('thinking:start', () => ev('thinking:start'));
+        agent.on('thinking:end', () => ev('thinking:end'));
+        agent.on('usage', (d) => ev('usage', d));
+        agent.on('error', (e) => ev('error', { message: e.message }));
+        agent.on('context:compress', (i) => ev('context:compress', i));
+        agent.on('context:usage', (i) => ev('context:usage', i));
+    };
+    const addSession = (id, override) => {
+        const existing = sessions.get(id);
+        if (existing)
+            return existing;
+        if (sessions.size >= MAX_SESSIONS) {
+            throw new Error(`Session limit reached (${MAX_SESSIONS}) — close a chat tab first.`);
+        }
+        // Per-session provider/creds: overrides let each tab use a different AI provider
+        // (Scalix, OpenAI, etc.) with its own API key, base URL, and model selection.
+        const sessionProvider = override?.provider ?? active.provider;
+        const sessionApiKey = override?.apiKey ?? apiKey;
+        const sessionBaseUrl = override?.baseUrl ?? baseUrl;
+        const sessionCloudApiKey = override?.cloudApiKey ?? active.cloudApiKey;
+        const sessionCloudBaseUrl = override?.cloudBaseUrl ?? active.cloudBaseUrl;
+        const sessionModels = override?.model ?? selectedModels;
+        const sessionPermissionMode = override?.permissionMode ?? permissionMode;
+        const agent = createAgent({
+            apiKey: sessionApiKey,
+            baseUrl: sessionBaseUrl,
+            provider: sessionProvider,
+            cloudApiKey: sessionCloudApiKey,
+            cloudBaseUrl: sessionCloudBaseUrl,
+            model: sessionModels,
+            instructions,
+            // A COPY per agent: refreshCloudTools/attachMcpHub mutate config.tools,
+            // and a shared array would double-register tools across sessions.
+            tools: [...allTools],
+            permissionMode: sessionPermissionMode,
+            maxSteps: limits.maxSteps,
+            maxMessages: limits.maxMessages,
+            contextManager: {
+                maxContextTokens: limits.maxContextTokens,
+                compressionThreshold: limits.compressionThreshold,
+                maxToolResultTokens: limits.maxToolResultTokens,
+            },
+            instructionLoader: buildInstructions,
+            confirmToolCall: confirmFor(id),
+            autoVerify: true,
         });
+        forwardSessionEvents(id, agent);
+        if (mcpHub)
+            agent.attachMcpHub(mcpHub);
+        const session = { id, agent, busy: false };
+        sessions.set(id, session);
+        // Platform tools register per agent; each session reports its own status,
+        // tagged with its id, exactly like the single-agent path did for default.
+        void agent.refreshCloudTools()
+            .then(status => { write({ type: 'event', event: 'cloud:status', data: status, sessionId: id }); })
+            .catch(err => { process.stderr.write(`IPC: cloud tools registration failed (${id}): ${err?.message || err}\n`); });
+        return session;
     };
-    const permissionMode = (process.env.SCALIX_PERMISSION_MODE || config.permissionMode || 'default');
-    const agent = createAgent({
-        apiKey,
-        baseUrl,
-        provider: active.provider,
-        cloudApiKey: active.cloudApiKey,
-        cloudBaseUrl: active.cloudBaseUrl,
-        model: selectedModels,
-        instructions,
-        tools: allTools,
-        permissionMode,
-        maxSteps: limits.maxSteps,
-        maxMessages: limits.maxMessages,
-        contextManager: {
-            maxContextTokens: limits.maxContextTokens,
-            compressionThreshold: limits.compressionThreshold,
-            maxToolResultTokens: limits.maxToolResultTokens,
-        },
-        instructionLoader: buildInstructions,
-        confirmToolCall,
-        autoVerify: true,
-    });
-    // Forward all agent events as JSONL
-    agent.on('stream:delta', (d, a) => write({ type: 'event', event: 'stream:delta', data: { delta: d, accumulated: a } }));
-    agent.on('stream:end', t => write({ type: 'event', event: 'stream:end', data: { text: t } }));
-    agent.on('tool:call', (n, a) => write({ type: 'event', event: 'tool:call', data: { name: n, args: a } }));
-    agent.on('tool:result', (n, r) => write({ type: 'event', event: 'tool:result', data: { name: n, result: r } }));
-    agent.on('tool:blocked', (n, r) => write({ type: 'event', event: 'tool:blocked', data: { name: n, reason: r } }));
-    agent.on('thinking:start', () => write({ type: 'event', event: 'thinking:start' }));
-    agent.on('thinking:end', () => write({ type: 'event', event: 'thinking:end' }));
-    agent.on('usage', d => write({ type: 'event', event: 'usage', data: d }));
-    agent.on('error', e => write({ type: 'event', event: 'error', data: { message: e.message } }));
-    agent.on('context:compress', i => write({ type: 'event', event: 'context:compress', data: i }));
-    agent.on('context:usage', i => write({ type: 'event', event: 'context:usage', data: i }));
+    const resolveSession = (params) => {
+        const id = typeof params?.sessionId === 'string' && params.sessionId ? params.sessionId : 'default';
+        const session = sessions.get(id);
+        if (!session)
+            throw new Error(`Unknown session: ${id}`);
+        return session;
+    };
+    const defaultSession = addSession('default');
     // Signal ready with capability info. `version` lets the extension detect
     // engine/extension drift (a globally-installed CLI can lag the bundled one).
-    write({ type: 'event', event: 'ready', data: { version: VERSION, tools: allTools.length, models: selectedModels, permissionMode } });
-    // Register the account's Scalix Cloud platform tools (deploy, database, …).
-    // Not awaited: the catalog fetch crosses the network and the extension's
-    // connect handshake must not wait on it — the tools join the set when the
-    // fetch lands. Without this call the GUI engine had NO scalix_* tools at
-    // all, and models asked to deploy invented SDKs and CLI flags instead.
-    void agent.refreshCloudTools()
-        .then(status => { write({ type: 'event', event: 'cloud:status', data: status }); })
-        .catch(err => { process.stderr.write(`IPC: cloud tools registration failed: ${err?.message || err}\n`); });
-    // Process JSONL from stdin
-    let busy = false;
+    // `multiSession` tells the extension it may open parallel chat sessions.
+    write({ type: 'event', event: 'ready', data: { version: VERSION, tools: allTools.length, models: selectedModels, permissionMode, multiSession: true } });
+    if (defaultSession.agent.getSkippedHookCount() > 0) {
+        process.stderr.write(`IPC: project hooks skipped (untrusted workspace): ${defaultSession.agent.getSkippedHookCount()}\n`);
+    }
+    // Connect configured MCP servers. Not awaited, for the same reason as the
+    // cloud catalog below: `npx -y <server>` can spend half a minute fetching a
+    // package on first run and the IDE's connect handshake must not sit behind
+    // it. The hub connects ONCE and is attached to every session agent — current
+    // and future — so all tabs share the same external tool processes.
+    void connectMcpServers()
+        .then(hub => {
+        mcpHub = hub;
+        for (const s of sessions.values())
+            s.agent.attachMcpHub(hub);
+        write({ type: 'event', event: 'mcp:status', data: hub.status() });
+        for (const st of hub.status()) {
+            if (st.state !== 'connected')
+                process.stderr.write(`IPC: MCP "${st.label}" ${st.state}: ${st.error ?? 'unknown error'}\n`);
+        }
+    })
+        .catch(err => { process.stderr.write(`IPC: MCP startup failed: ${err?.message || err}\n`); });
+    // Process JSONL from stdin — session-routed requests
     const rl = readline.createInterface({ input: process.stdin, crlfDelay: Infinity });
     rl.on('line', async (line) => {
+        if (Buffer.byteLength(line, 'utf8') > MAX_IPC_MESSAGE_BYTES) {
+            process.stderr.write(`IPC: inbound message exceeds ${MAX_IPC_MESSAGE_BYTES} bytes — dropped\n`);
+            return;
+        }
         let msg;
         try {
             msg = JSON.parse(line);
@@ -176,11 +272,11 @@ export async function runIpcServer() {
             process.stderr.write(`IPC: invalid JSON: ${line.slice(0, 100)}\n`);
             return;
         }
-        // Response to server-initiated confirmTool request
-        if (msg.type === 'response' && pendingConfirms.has(msg.id)) {
-            const { resolve } = pendingConfirms.get(msg.id);
-            pendingConfirms.delete(msg.id);
-            resolve(msg.result?.allowed ?? false);
+        // Response to a server-initiated request (confirmTool, confirmLocalBrowser)
+        if (msg.type === 'response' && pendingClientRequests.has(msg.id)) {
+            const resolve = pendingClientRequests.get(msg.id);
+            pendingClientRequests.delete(msg.id);
+            resolve(msg.result);
             return;
         }
         if (msg.type !== 'request')
@@ -188,63 +284,160 @@ export async function runIpcServer() {
         const { id, method, params } = msg;
         try {
             switch (method) {
+                case 'createSession': {
+                    const sid = typeof params?.sessionId === 'string' ? params.sessionId.trim() : '';
+                    if (!sid) {
+                        write({ type: 'response', id, error: { message: 'Missing sessionId' } });
+                        break;
+                    }
+                    if (!SESSION_ID_RE.test(sid)) {
+                        write({ type: 'response', id, error: { message: `Invalid sessionId: must match /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/` } });
+                        break;
+                    }
+                    const override = {};
+                    if (params?.provider && (params.provider === 'scalix' || params.provider === 'openai'))
+                        override.provider = params.provider;
+                    if (params?.apiKey && typeof params.apiKey === 'string')
+                        override.apiKey = params.apiKey;
+                    if (params?.baseUrl && typeof params.baseUrl === 'string')
+                        override.baseUrl = params.baseUrl;
+                    if (params?.cloudApiKey && typeof params.cloudApiKey === 'string')
+                        override.cloudApiKey = params.cloudApiKey;
+                    if (params?.cloudBaseUrl && typeof params.cloudBaseUrl === 'string')
+                        override.cloudBaseUrl = params.cloudBaseUrl;
+                    if (Array.isArray(params?.model))
+                        override.model = params.model;
+                    if (params?.permissionMode && PERMISSION_MODES.includes(params.permissionMode))
+                        override.permissionMode = params.permissionMode;
+                    try {
+                        const session = addSession(sid, override);
+                        write({ type: 'response', id, result: { sessionId: session.id, models: session.agent.getModels(), permissionMode: session.agent.getPermissionMode() } });
+                    }
+                    catch (err) {
+                        write({ type: 'response', id, error: { message: err.message } });
+                    }
+                    break;
+                }
+                case 'closeSession': {
+                    const sid = typeof params?.sessionId === 'string' ? params.sessionId.trim() : '';
+                    if (!sid) {
+                        write({ type: 'response', id, error: { message: 'Missing sessionId' } });
+                        break;
+                    }
+                    if (sid === 'default') {
+                        write({ type: 'response', id, error: { message: 'The default session cannot be closed' } });
+                        break;
+                    }
+                    const session = sessions.get(sid);
+                    if (session) {
+                        session.agent.abort();
+                        sessions.delete(sid);
+                    }
+                    write({ type: 'response', id, result: { success: true } });
+                    break;
+                }
+                case 'listSessions':
+                    write({ type: 'response', id, result: { sessions: [...sessions.keys()] } });
+                    break;
                 case 'send': {
                     if (!params?.content) {
                         write({ type: 'response', id, error: { message: 'Missing content' } });
                         break;
                     }
-                    if (busy) {
+                    let session;
+                    try {
+                        session = resolveSession(params);
+                    }
+                    catch (err) {
+                        write({ type: 'response', id, error: { message: err.message } });
+                        break;
+                    }
+                    if (session.busy) {
                         write({ type: 'response', id, error: { message: 'Agent is busy' } });
                         break;
                     }
-                    busy = true;
-                    write({ type: 'event', event: 'status', data: { status: 'thinking' } });
+                    session.busy = true;
+                    write({ type: 'event', event: 'status', data: { status: 'thinking' }, sessionId: session.id });
                     try {
+                        const content = params.content;
+                        const correction = detectCorrection(content);
+                        if (correction)
+                            addNote(process.cwd(), correction).catch(() => { });
                         const images = params.images;
-                        const text = await agent.send(params.content, images);
+                        const text = await session.agent.send(content, images);
                         write({ type: 'response', id, result: { text } });
                     }
                     catch (err) {
                         write({ type: 'response', id, error: { message: err.message } });
                     }
                     finally {
-                        busy = false;
-                        write({ type: 'event', event: 'status', data: { status: 'idle' } });
+                        session.busy = false;
+                        write({ type: 'event', event: 'status', data: { status: 'idle' }, sessionId: session.id });
+                    }
+                    break;
+                }
+                case 'getMemory': {
+                    const mem = await loadMemory(process.cwd());
+                    write({ type: 'response', id, result: { memory: mem } });
+                    break;
+                }
+                case 'saveMemory': {
+                    const note = params?.note;
+                    if (note && note.trim()) {
+                        await addNote(process.cwd(), note.trim());
+                        write({ type: 'response', id, result: { success: true } });
+                    }
+                    else {
+                        write({ type: 'response', id, error: { message: 'Note is required' } });
                     }
                     break;
                 }
-                case 'abort':
-                    agent.abort();
+                case 'abort': {
+                    const session = resolveSession(params);
+                    session.agent.abort();
                     write({ type: 'response', id, result: { success: true } });
                     break;
-                case 'clear':
-                    agent.clearHistory();
+                }
+                case 'clear': {
+                    const session = resolveSession(params);
+                    session.agent.clearHistory();
                     write({ type: 'response', id, result: { success: true } });
                     break;
+                }
                 case 'setModel': {
-                    // Same format rule as the headless REPL — the old handler accepted
-                    // any truthy string (typos included) and answered an EMPTY model
-                    // with success, both of which read back as "switched" in the UI.
+                    const session = resolveSession(params);
                     const requested = typeof params?.model === 'string' ? params.model.trim() : '';
                     if (!requested || !/^[a-zA-Z0-9][\w./:@-]*$/.test(requested)) {
                         write({ type: 'response', id, error: { message: `Invalid model id: "${requested || '(empty)'}"` } });
                         break;
                     }
-                    agent.setModel(normalizeModelId(requested));
-                    write({ type: 'response', id, result: { model: agent.getModels()[0] } });
+                    session.agent.setModel(normalizeModelId(requested));
+                    write({ type: 'response', id, result: { model: session.agent.getModels()[0] } });
+                    break;
+                }
+                case 'setPreset': {
+                    const session = resolveSession(params);
+                    try {
+                        session.agent.setPreset(params?.presetId);
+                        write({ type: 'response', id, result: { success: true } });
+                    }
+                    catch (err) {
+                        write({ type: 'response', id, error: { message: err.message } });
+                    }
                     break;
                 }
                 case 'compact': {
-                    const r = await agent.compact();
+                    const session = resolveSession(params);
+                    const r = await session.agent.compact();
                     write({ type: 'response', id, result: { message: r } });
                     break;
                 }
-                case 'getModels':
-                    write({ type: 'response', id, result: { models: agent.getModels() } });
+                case 'getModels': {
+                    const session = resolveSession(params);
+                    write({ type: 'response', id, result: { models: session.agent.getModels() } });
                     break;
+                }
                 case 'registerModels': {
-                    // A model spec added in the client mid-session must reach the agent
-                    // now; the config file is only read at engine start.
                     const specs = params?.models;
                     if (specs)
                         registerUserModels(specs);
@@ -252,27 +445,61 @@ export async function runIpcServer() {
                     break;
                 }
                 case 'getContextInfo': {
-                    const u = agent.getContextUsage();
+                    const session = resolveSession(params);
+                    const u = session.agent.getContextUsage();
                     write({ type: 'response', id, result: {
                             estimatedTokens: u.tokens, maxTokens: u.maxTokens,
-                            messageCount: agent.getMessages().length, utilization: u.percentage / 100,
-                            breakdown: agent.getContextBreakdown(),
+                            messageCount: session.agent.getMessages().length, utilization: u.percentage / 100,
+                            breakdown: session.agent.getContextBreakdown(),
                         } });
                     break;
                 }
-                case 'getMessages':
-                    write({ type: 'response', id, result: { messages: agent.getMessages() } });
+                case 'getMessages': {
+                    const session = resolveSession(params);
+                    write({ type: 'response', id, result: { messages: session.agent.getMessages() } });
                     break;
-                case 'loadMessages':
+                }
+                case 'loadMessages': {
+                    const session = resolveSession(params);
                     if (params?.messages)
-                        agent.loadMessages(params.messages);
+                        session.agent.loadMessages(params.messages);
                     write({ type: 'response', id, result: { success: true } });
                     break;
-                case 'setPermissionMode':
+                }
+                case 'setClientCapabilities': {
+                    if (params?.localBrowserPrompt) {
+                        setLocalOriginApprover(({ origin, url }) => askClient('confirmLocalBrowser', { origin, url }, 120_000, 'deny', r => (r?.verdict === 'always' || r?.verdict === 'once') ? r.verdict : 'deny'));
+                    }
+                    else {
+                        setLocalOriginApprover(null);
+                    }
+                    if (params?.browserFrames) {
+                        setBrowserFrameSink(frame => write({ type: 'event', event: 'browser:frame', data: frame }));
+                    }
+                    else {
+                        setBrowserFrameSink(null);
+                    }
+                    write({ type: 'response', id, result: {
+                            localBrowserPrompt: !!params?.localBrowserPrompt,
+                            browserFrames: !!params?.browserFrames,
+                            approvedLocalOrigins: listApprovedLocalOrigins(process.cwd()),
+                        } });
+                    break;
+                }
+                case 'forgetLocalOrigin': {
+                    const origin = typeof params?.origin === 'string' ? params.origin : '';
+                    if (origin)
+                        forgetLocalOrigin(origin, process.cwd());
+                    write({ type: 'response', id, result: { approvedLocalOrigins: listApprovedLocalOrigins(process.cwd()) } });
+                    break;
+                }
+                case 'setPermissionMode': {
+                    const session = resolveSession(params);
                     if (params?.mode)
-                        agent.setPermissionMode(params.mode);
-                    write({ type: 'response', id, result: { mode: agent.getPermissionMode() } });
+                        session.agent.setPermissionMode(params.mode);
+                    write({ type: 'response', id, result: { mode: session.agent.getPermissionMode() } });
                     break;
+                }
                 default:
                     write({ type: 'response', id, error: { message: `Unknown method: ${method}` } });
             }
@@ -281,9 +508,12 @@ export async function runIpcServer() {
             write({ type: 'response', id, error: { message: err.message } });
         }
     });
+    // stdio MCP servers are child processes of this one — closing the hub on the
+    // way out is what stops them outliving the IDE session.
+    const shutdown = () => Promise.all([closeBrowser(), mcpHub?.close() ?? Promise.resolve()]);
     rl.on('error', (err) => {
         process.stderr.write(`IPC readline error: ${err.message}\n`);
-        closeBrowser().finally(() => process.exit(1));
+        shutdown().finally(() => process.exit(1));
     });
-    rl.on('close', () => closeBrowser().finally(() => process.exit(0)));
+    rl.on('close', () => shutdown().finally(() => process.exit(0)));
 }

package/dist/keychain.js

@@ -1,4 +1,4 @@
-import { execFile } from 'node:child_process';
+import { execFile, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 import fs from 'node:fs/promises';
 import path from 'node:path';
@@ -159,6 +159,30 @@ export async function getApiKeyFromKeychain(account = ACCOUNT) {
     }
     return null;
 }
+/**
+ * `security add-generic-password` with the secret delivered over stdin.
+ *
+ * Returns false rather than throwing; the caller treats that as "no keychain"
+ * and falls back to the config file. There is deliberately no argv fallback —
+ * that is the thing this exists to avoid.
+ */
+function addGenericPasswordViaStdin(apiKey, account) {
+    return new Promise((resolve) => {
+        const child = spawn('security', [
+            'add-generic-password',
+            '-s', SERVICE,
+            '-a', account,
+            '-U',
+            '-w',
+        ], { stdio: ['pipe', 'ignore', 'ignore'] });
+        const timer = setTimeout(() => child.kill('SIGKILL'), KEYCHAIN_TIMEOUT_MS);
+        child.once('error', () => { clearTimeout(timer); resolve(false); });
+        child.once('close', (code) => { clearTimeout(timer); resolve(code === 0); });
+        // EPIPE if security exits before reading — already covered by the exit code.
+        child.stdin.on('error', () => { });
+        child.stdin.end(`${apiKey}\n${apiKey}\n`);
+    });
+}
 export async function setApiKeyInKeychain(apiKey, account = ACCOUNT) {
     if (keychainDisabled())
         return false;
@@ -178,14 +202,15 @@ export async function setApiKeyInKeychain(apiKey, account = ACCOUNT) {
             catch {
                 // entry didn't exist
             }
-            await exec('security', [
-                'add-generic-password',
-                '-s', SERVICE,
-                '-a', account,
-                '-w', apiKey,
-                '-U',
-            ]);
-            return true;
+            // `-w <key>` puts the API key in this process's argv, where every other
+            // user on the machine can read it out of `ps -ef` for as long as the call
+            // runs. `security` reads the secret from stdin when -w is given no value,
+            // so hand it over that way instead. Some releases prompt twice (enter,
+            // then confirm); writing the key on two lines satisfies both, and a
+            // single-read build simply ignores the trailing line.
+            if (await addGenericPasswordViaStdin(apiKey, account))
+                return true;
+            return false;
         }
         if (await isLinuxWithSecretTool()) {
             const child = exec('secret-tool', [