subharness 0.0.3 → 0.0.5

package/dist/adapters/fx-profile.js

@@ -0,0 +1,101 @@
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { AgentError } from "../errors.js";
+const profileLimit = 1024 * 1024;
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+export function fxCustomConnection(settings, provider) {
+    if (!/^[A-Za-z][A-Za-z0-9_-]{0,63}$/u.test(provider) || ["gateway", "codex", "grok"].includes(provider.toLowerCase())) {
+        throw new AgentError("INVALID_CONFIG", "fx direct API keys require a valid native custom connection name.");
+    }
+    const definitions = settings.providers;
+    const selected = record(definitions) && Object.hasOwn(definitions, provider) ? definitions[provider] : undefined;
+    if (!record(selected))
+        throw new AgentError("INVALID_CONFIG", "The selected fx custom connection is not configured in the native profile.");
+    if (selected.protocol !== "openai-chat-completions" || !record(selected.auth) || selected.auth.type !== "bearer") {
+        throw new AgentError("UNSUPPORTED_OPTION", "fx direct API keys require a native Chat Completions connection with bearer environment authentication.");
+    }
+    const slot = selected.auth.env;
+    if (typeof slot !== "string" || !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/u.test(slot) || unsafeCredentialSlot(slot)) {
+        throw new AgentError("INVALID_CONFIG", "The fx custom connection credential slot cannot control the process, routing, or diagnostics.");
+    }
+    const raw = selected.base_url;
+    try {
+        if (typeof raw !== "string" || raw.length > 2048 || /[^\x21-\x7e]|[\\?#]/u.test(raw) || !/^https?:\/\//iu.test(raw)
+            || /^https?:\/\/[^/]*@/iu.test(raw))
+            throw new Error();
+        const url = new URL(raw);
+        if (!url.hostname || url.username || url.password || url.port === "0"
+            || (url.protocol === "http:" && !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+            throw new Error();
+        return { endpoint: raw.endsWith("/") ? raw.slice(0, -1) : raw, keySlot: slot };
+    }
+    catch {
+        throw new AgentError("INVALID_CONFIG", "The fx custom connection requires a valid HTTPS or loopback HTTP endpoint without credentials, query, or fragment.");
+    }
+}
+function unsafeCredentialSlot(slot) {
+    const upper = slot.toUpperCase();
+    return ["HOME", "PATH", "SHELL", "ENV", "BASH_ENV", "ZDOTDIR", "PWD", "OLDPWD", "USER", "LOGNAME", "TMPDIR", "TMP", "TEMP",
+        "AI_GATEWAY_API_KEY", "VERCEL_OIDC_TOKEN", "HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "NO_PROXY"].includes(upper)
+        || /^(?:FX_|NODE_|LD_|DYLD_|XDG_|SSL_|OPENSSL_|SUBHARNESS_)/u.test(upper);
+}
+export async function readFxProfile(env) {
+    let file;
+    try {
+        file = await open(join(env.HOME || homedir(), ".fx/settings.json"), constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0));
+        const stat = await file.stat();
+        if (!stat.isFile() || stat.size > profileLimit)
+            throw new Error("Invalid profile size or type");
+        const buffer = Buffer.alloc(profileLimit + 1);
+        let length = 0;
+        while (length < buffer.length) {
+            const { bytesRead } = await file.read(buffer, length, buffer.length - length, length);
+            if (!bytesRead)
+                break;
+            length += bytesRead;
+        }
+        if (length > profileLimit)
+            throw new Error("Profile exceeds limit");
+        const bytes = buffer.subarray(0, length);
+        const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+        const settings = JSON.parse(text);
+        rejectDuplicateKeys(text);
+        if (!settings || typeof settings !== "object" || Array.isArray(settings))
+            throw new Error("Invalid profile shape");
+        return { settings: settings, fingerprint: createHash("sha256").update(bytes).digest("hex") };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { settings: {}, fingerprint: "missing" };
+        throw new AgentError("INVALID_CONFIG", "fx native settings must be a valid bounded JSON object in a regular profile file.");
+    }
+    finally {
+        await file?.close();
+    }
+}
+/** JSON.parse validates syntax first; this scan retains duplicate-key evidence. */
+function rejectDuplicateKeys(text) {
+    const containers = [];
+    for (const match of text.matchAll(/"(?:\\.|[^"\\])*"|[{}\[\]]/gu)) {
+        const token = match[0];
+        if (token === "{")
+            containers.push(new Set());
+        else if (token === "[")
+            containers.push(undefined);
+        else if (token === "}" || token === "]")
+            containers.pop();
+        else if (/^\s*:/u.test(text.slice(match.index + token.length))) {
+            const keys = containers.at(-1);
+            const key = JSON.parse(token);
+            if (keys.has(key))
+                throw new Error("Duplicate native profile key");
+            keys.add(key);
+        }
+    }
+}
+//# sourceMappingURL=fx-profile.js.map

package/dist/adapters/fx-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fx-profile.js","sourceRoot":"","sources":["../../src/adapters/fx-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,YAAY,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjC,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAiC,EAAE,QAAgB;IACpF,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACtH,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,mEAAmE,CAAC,CAAC;IAC9G,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjH,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,4EAA4E,CAAC,CAAC;IAC5I,IAAI,QAAQ,CAAC,QAAQ,KAAK,yBAAyB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjH,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,yGAAyG,CAAC,CAAC;IACxJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;IAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+FAA+F,CAAC,CAAC;IAC1I,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;eAC9G,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG;eAChE,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAClH,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,oHAAoH,CAAC,CAAC;IAAC,CAAC;AAC3K,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM;QACxH,oBAAoB,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;WAC7G,0DAA0D,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAsB;IACxD,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,mBAAmB,CAAC,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7I,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC;YACtF,IAAI,CAAC,SAAS;gBAAE,MAAM;YACtB,MAAM,IAAI,SAAS,CAAC;QACtB,CAAC;QACD,IAAI,MAAM,GAAG,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACnH,OAAO,EAAE,QAAQ,EAAE,QAAmC,EAAE,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1H,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;QACxG,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,mFAAmF,CAAC,CAAC;IAC9H,CAAC;YAAS,CAAC;QAAC,MAAM,IAAI,EAAE,KAAK,EAAE,CAAC;IAAC,CAAC;AACpC,CAAC;AAED,mFAAmF;AACnF,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,UAAU,GAAgC,EAAE,CAAC;IACnD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,GAAG;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;aACzC,IAAI,KAAK,KAAK,GAAG;YAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;aAC9C,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG;YAAE,UAAU,CAAC,GAAG,EAAE,CAAC;aACrD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAW,CAAC;YACxC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACnE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { constants } from \"node:fs\";\nimport { open } from \"node:fs/promises\";\nimport { createHash } from \"node:crypto\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { AgentError } from \"../errors.js\";\n\nconst profileLimit = 1024 * 1024;\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nexport function fxCustomConnection(settings: Record<string, unknown>, provider: string): { endpoint: string; keySlot: string } {\n  if (!/^[A-Za-z][A-Za-z0-9_-]{0,63}$/u.test(provider) || [\"gateway\", \"codex\", \"grok\"].includes(provider.toLowerCase())) {\n    throw new AgentError(\"INVALID_CONFIG\", \"fx direct API keys require a valid native custom connection name.\");\n  }\n  const definitions = settings.providers;\n  const selected = record(definitions) && Object.hasOwn(definitions, provider) ? definitions[provider] : undefined;\n  if (!record(selected)) throw new AgentError(\"INVALID_CONFIG\", \"The selected fx custom connection is not configured in the native profile.\");\n  if (selected.protocol !== \"openai-chat-completions\" || !record(selected.auth) || selected.auth.type !== \"bearer\") {\n    throw new AgentError(\"UNSUPPORTED_OPTION\", \"fx direct API keys require a native Chat Completions connection with bearer environment authentication.\");\n  }\n  const slot = selected.auth.env;\n  if (typeof slot !== \"string\" || !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/u.test(slot) || unsafeCredentialSlot(slot)) {\n    throw new AgentError(\"INVALID_CONFIG\", \"The fx custom connection credential slot cannot control the process, routing, or diagnostics.\");\n  }\n  const raw = selected.base_url;\n  try {\n    if (typeof raw !== \"string\" || raw.length > 2048 || /[^\\x21-\\x7e]|[\\\\?#]/u.test(raw) || !/^https?:\\/\\//iu.test(raw)\n      || /^https?:\\/\\/[^/]*@/iu.test(raw)) throw new Error();\n    const url = new URL(raw);\n    if (!url.hostname || url.username || url.password || url.port === \"0\"\n      || (url.protocol === \"http:\" && ![\"localhost\", \"127.0.0.1\", \"[::1]\"].includes(url.hostname))) throw new Error();\n    return { endpoint: raw.endsWith(\"/\") ? raw.slice(0, -1) : raw, keySlot: slot };\n  } catch { throw new AgentError(\"INVALID_CONFIG\", \"The fx custom connection requires a valid HTTPS or loopback HTTP endpoint without credentials, query, or fragment.\"); }\n}\n\nfunction unsafeCredentialSlot(slot: string): boolean {\n  const upper = slot.toUpperCase();\n  return [\"HOME\", \"PATH\", \"SHELL\", \"ENV\", \"BASH_ENV\", \"ZDOTDIR\", \"PWD\", \"OLDPWD\", \"USER\", \"LOGNAME\", \"TMPDIR\", \"TMP\", \"TEMP\",\n    \"AI_GATEWAY_API_KEY\", \"VERCEL_OIDC_TOKEN\", \"HTTP_PROXY\", \"HTTPS_PROXY\", \"ALL_PROXY\", \"NO_PROXY\"].includes(upper)\n    || /^(?:FX_|NODE_|LD_|DYLD_|XDG_|SSL_|OPENSSL_|SUBHARNESS_)/u.test(upper);\n}\n\nexport async function readFxProfile(env: NodeJS.ProcessEnv): Promise<{ settings: Record<string, unknown>; fingerprint: string }> {\n  let file;\n  try {\n    file = await open(join(env.HOME || homedir(), \".fx/settings.json\"), constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0));\n    const stat = await file.stat();\n    if (!stat.isFile() || stat.size > profileLimit) throw new Error(\"Invalid profile size or type\");\n    const buffer = Buffer.alloc(profileLimit + 1);\n    let length = 0;\n    while (length < buffer.length) {\n      const { bytesRead } = await file.read(buffer, length, buffer.length - length, length);\n      if (!bytesRead) break;\n      length += bytesRead;\n    }\n    if (length > profileLimit) throw new Error(\"Profile exceeds limit\");\n    const bytes = buffer.subarray(0, length);\n    const text = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n    const settings: unknown = JSON.parse(text);\n    rejectDuplicateKeys(text);\n    if (!settings || typeof settings !== \"object\" || Array.isArray(settings)) throw new Error(\"Invalid profile shape\");\n    return { settings: settings as Record<string, unknown>, fingerprint: createHash(\"sha256\").update(bytes).digest(\"hex\") };\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return { settings: {}, fingerprint: \"missing\" };\n    throw new AgentError(\"INVALID_CONFIG\", \"fx native settings must be a valid bounded JSON object in a regular profile file.\");\n  } finally { await file?.close(); }\n}\n\n/** JSON.parse validates syntax first; this scan retains duplicate-key evidence. */\nfunction rejectDuplicateKeys(text: string): void {\n  const containers: (Set<string> | undefined)[] = [];\n  for (const match of text.matchAll(/\"(?:\\\\.|[^\"\\\\])*\"|[{}\\[\\]]/gu)) {\n    const token = match[0];\n    if (token === \"{\") containers.push(new Set());\n    else if (token === \"[\") containers.push(undefined);\n    else if (token === \"}\" || token === \"]\") containers.pop();\n    else if (/^\\s*:/u.test(text.slice(match.index! + token.length))) {\n      const keys = containers.at(-1)!;\n      const key = JSON.parse(token) as string;\n      if (keys.has(key)) throw new Error(\"Duplicate native profile key\");\n      keys.add(key);\n    }\n  }\n}\n"]}

package/dist/adapters/fx-rpc.d.ts

@@ -14,6 +14,7 @@ export declare class FxRpc {
     private sequence;
     private buffer;
     private failure?;
+    private closing;
     private readonly exited;
     private failureHandler;
     onMessage: (message: AcpEnvelope) => void;
@@ -26,4 +27,5 @@ export declare class FxRpc {
     private read;
     private invalid;
     private fail;
+    private closedError;
 }

package/dist/adapters/fx-rpc.js

@@ -1,5 +1,7 @@
 import { spawn } from "node:child_process";
 import { AgentError } from "../errors.js";
+import { processExitDescription } from "../process-diagnostics.js";
+import { nativeRpcErrorDescription } from "./rpc.js";
 /** A JSON-RPC 2.0 newline transport for fx's native ACP process. */
 export class FxRpc {
     child;
@@ -7,6 +9,7 @@ export class FxRpc {
     sequence = 0;
     buffer = "";
     failure;
+    closing = false;
     exited;
     failureHandler = () => { };
     onMessage = () => { };
@@ -15,16 +18,30 @@ export class FxRpc {
         this.child.stdout.setEncoding("utf8");
         this.child.stdout.on("data", chunk => this.read(chunk));
         this.child.stderr.resume();
-        this.child.stdin.on("error", () => this.fail(new AgentError("HARNESS_FAILED", "The fx ACP input connection closed.")));
+        this.child.stdin.on("error", () => setImmediate(() => {
+            if (!this.closing && this.child.exitCode === null && this.child.signalCode === null) {
+                this.fail(new AgentError("HARNESS_FAILED", "The fx ACP input connection closed."));
+            }
+        }));
         this.child.on("error", () => this.fail(new AgentError("HARNESS_UNAVAILABLE", "Cannot start fx. Install fx 0.0.9 or a compatible release and make it available on PATH.")));
-        this.exited = new Promise(resolve => this.child.once("close", () => {
-            this.fail(new AgentError("HARNESS_FAILED", "fx exited before the native operation completed."));
+        this.exited = new Promise(resolve => this.child.once("close", (code, signal) => {
+            if (this.closing) {
+                if (this.pending.size > 0)
+                    this.fail(new AgentError("HARNESS_FAILED", "The fx session closed before the native operation completed."));
+                else
+                    this.fail(this.closedError());
+            }
+            else {
+                this.fail(new AgentError("HARNESS_FAILED", `fx exited before the native operation completed${processExitDescription(code, signal)}.`));
+            }
             resolve();
         }));
     }
     request(method, params) {
         if (this.failure)
             return Promise.reject(this.failure);
+        if (this.closing)
+            return Promise.reject(this.closedError());
         const id = ++this.sequence;
         return new Promise((resolve, reject) => {
             this.pending.set(id, { method, resolve, reject });
@@ -34,6 +51,8 @@ export class FxRpc {
     send(message) {
         if (this.failure)
             throw this.failure;
+        if (this.closing)
+            throw this.closedError();
         this.child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", ...message })}\n`);
     }
     abort(error) {
@@ -48,6 +67,7 @@ export class FxRpc {
     async close() {
         if (this.child.exitCode !== null || this.child.signalCode !== null)
             return this.exited;
+        this.closing = true;
         this.child.kill("SIGTERM");
         const timer = setTimeout(() => this.child.kill("SIGKILL"), 2_000);
         timer.unref();
@@ -100,7 +120,10 @@ export class FxRpc {
                 const nativeCode = message.error?.code;
                 const unsupported = pending.method === "session/set_config_option" && (nativeCode === -32601 || nativeCode === -32602);
                 const code = unsupported ? "UNSUPPORTED_OPTION" : "NATIVE_ERROR";
-                pending.reject(new AgentError(code, code === "UNSUPPORTED_OPTION" ? "fx rejected the requested session option." : `fx rejected ${pending.method}. Check the native harness configuration.`));
+                const diagnostic = `fx rejected ${pending.method}${nativeRpcErrorDescription(message.error)}.`;
+                pending.reject(new AgentError(code, code === "UNSUPPORTED_OPTION"
+                    ? `${diagnostic} The requested session option is unsupported.`
+                    : diagnostic));
             }
             else {
                 pending.resolve(message.result);
@@ -120,5 +143,8 @@ export class FxRpc {
         this.pending.clear();
         this.failureHandler(error);
     }
+    closedError() {
+        return new AgentError("HARNESS_FAILED", "The fx session is closed.");
+    }
 }
 //# sourceMappingURL=fx-rpc.js.map

package/dist/adapters/fx-rpc.js.map

@@ -1 +1 @@
-{"version":3,"file":"fx-rpc.js","sourceRoot":"","sources":["../../src/adapters/fx-rpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAa1C,oEAAoE;AACpE,MAAM,OAAO,KAAK;IACC,KAAK,CAAiC;IACtC,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC9C,QAAQ,GAAG,CAAC,CAAC;IACb,MAAM,GAAG,EAAE,CAAC;IACZ,OAAO,CAAc;IACZ,MAAM,CAAgB;IAC/B,cAAc,GAAgC,GAAG,EAAE,GAAE,CAAC,CAAC;IAC/D,SAAS,GAAmC,GAAG,EAAE,GAAE,CAAC,CAAC;IAErD,YAAY,GAAW,EAAE,GAAsB,EAAE,KAAc;QAC7D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACrH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC,CAAC,CAAC;QACvH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,qBAAqB,EAAE,0FAA0F,CAAC,CAAC,CAAC,CAAC;QAC3K,IAAI,CAAC,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACjE,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,gBAAgB,EAAE,kDAAkD,CAAC,CAAC,CAAC;YAChG,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,OAAO,CAAC,MAAc,EAAE,MAAe;QACrC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC;QAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,OAAoB;QACvB,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,KAAiB;QACrB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IAED,iBAAiB,CAAC,OAAoC;QACpD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;QAC9B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACvF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;QAClE,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,IAAI,CAAC,MAAM,CAAC;QAClB,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAEO,IAAI,CAAC,KAAa;QACxB,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;YAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACjE,IAAI,OAAe,CAAC;QACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAC3B,IAAI,OAAoB,CAAC;YACzB,IAAI,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;YACpE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1H,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACvC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;oBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC/F,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,SAAS,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;uBAC1D,CAAC,MAAM,CAAC,SAAS,CAAE,KAA4B,CAAC,IAAI,CAAC;uBACrD,OAAQ,KAA+B,CAAC,OAAO,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3F,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,UAAU,GAAI,OAAO,CAAC,KAAmC,EAAE,IAAI,CAAC;gBACtE,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,KAAK,2BAA2B,IAAI,CAAC,UAAU,KAAK,CAAC,KAAK,IAAI,UAAU,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvH,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,cAAc,CAAC;gBACjE,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,MAAM,2CAA2C,CAAC,CAAC,CAAC;YAC/L,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,gBAAgB,EAAE,wCAAwC,CAAC,CAAC,CAAC;QACtF,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IAEO,IAAI,CAAC,KAAiB;QAC5B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;CACF","sourcesContent":["import { spawn, type ChildProcessWithoutNullStreams } from \"node:child_process\";\nimport { AgentError } from \"../errors.js\";\n\nexport type AcpEnvelope = {\n  jsonrpc?: string;\n  id?: string | number;\n  method?: string;\n  params?: any;\n  result?: any;\n  error?: unknown;\n};\n\ntype Pending = { method: string; resolve(value: any): void; reject(error: Error): void };\n\n/** A JSON-RPC 2.0 newline transport for fx's native ACP process. */\nexport class FxRpc {\n  private readonly child: ChildProcessWithoutNullStreams;\n  private readonly pending = new Map<number, Pending>();\n  private sequence = 0;\n  private buffer = \"\";\n  private failure?: AgentError;\n  private readonly exited: Promise<void>;\n  private failureHandler: (error: AgentError) => void = () => {};\n  onMessage: (message: AcpEnvelope) => void = () => {};\n\n  constructor(cwd: string, env: NodeJS.ProcessEnv, model?: string) {\n    this.child = spawn(\"fx\", model ? [\"acp\", \"--model\", model] : [\"acp\"], { cwd, env, stdio: [\"pipe\", \"pipe\", \"pipe\"] });\n    this.child.stdout.setEncoding(\"utf8\");\n    this.child.stdout.on(\"data\", chunk => this.read(chunk));\n    this.child.stderr.resume();\n    this.child.stdin.on(\"error\", () => this.fail(new AgentError(\"HARNESS_FAILED\", \"The fx ACP input connection closed.\")));\n    this.child.on(\"error\", () => this.fail(new AgentError(\"HARNESS_UNAVAILABLE\", \"Cannot start fx. Install fx 0.0.9 or a compatible release and make it available on PATH.\")));\n    this.exited = new Promise(resolve => this.child.once(\"close\", () => {\n      this.fail(new AgentError(\"HARNESS_FAILED\", \"fx exited before the native operation completed.\"));\n      resolve();\n    }));\n  }\n\n  request(method: string, params: unknown): Promise<any> {\n    if (this.failure) return Promise.reject(this.failure);\n    const id = ++this.sequence;\n    return new Promise((resolve, reject) => {\n      this.pending.set(id, { method, resolve, reject });\n      this.send({ id, method, params });\n    });\n  }\n\n  send(message: AcpEnvelope): void {\n    if (this.failure) throw this.failure;\n    this.child.stdin.write(`${JSON.stringify({ jsonrpc: \"2.0\", ...message })}\\n`);\n  }\n\n  abort(error: AgentError): void {\n    this.fail(error);\n    void this.close();\n  }\n\n  setFailureHandler(handler: (error: AgentError) => void): void {\n    this.failureHandler = handler;\n    if (this.failure) handler(this.failure);\n  }\n\n  async close(): Promise<void> {\n    if (this.child.exitCode !== null || this.child.signalCode !== null) return this.exited;\n    this.child.kill(\"SIGTERM\");\n    const timer = setTimeout(() => this.child.kill(\"SIGKILL\"), 2_000);\n    timer.unref();\n    await this.exited;\n    clearTimeout(timer);\n  }\n\n  private read(chunk: string): void {\n    this.buffer += chunk;\n    if (this.buffer.length > 16 * 1024 * 1024) return this.invalid();\n    let newline: number;\n    while ((newline = this.buffer.indexOf(\"\\n\")) >= 0) {\n      const line = this.buffer.slice(0, newline);\n      this.buffer = this.buffer.slice(newline + 1);\n      if (!line.trim()) continue;\n      let message: AcpEnvelope;\n      try { message = JSON.parse(line); } catch { return this.invalid(); }\n      if (!message || typeof message !== \"object\" || Array.isArray(message) || message.jsonrpc !== \"2.0\") return this.invalid();\n      if (typeof message.method === \"string\") {\n        if (Object.hasOwn(message, \"result\") || Object.hasOwn(message, \"error\")) return this.invalid();\n        this.onMessage(message);\n        continue;\n      }\n      if (typeof message.id !== \"number\") return this.invalid();\n      const hasResult = Object.hasOwn(message, \"result\");\n      const hasError = Object.hasOwn(message, \"error\");\n      if (hasResult === hasError) return this.invalid();\n      if (hasError) {\n        const error = message.error;\n        if (!error || typeof error !== \"object\" || Array.isArray(error)\n          || !Number.isInteger((error as { code?: unknown }).code)\n          || typeof (error as { message?: unknown }).message !== \"string\") return this.invalid();\n      }\n      const pending = this.pending.get(message.id);\n      if (!pending) continue;\n      this.pending.delete(message.id);\n      if (hasError) {\n        const nativeCode = (message.error as { code?: unknown } | null)?.code;\n        const unsupported = pending.method === \"session/set_config_option\" && (nativeCode === -32601 || nativeCode === -32602);\n        const code = unsupported ? \"UNSUPPORTED_OPTION\" : \"NATIVE_ERROR\";\n        pending.reject(new AgentError(code, code === \"UNSUPPORTED_OPTION\" ? \"fx rejected the requested session option.\" : `fx rejected ${pending.method}. Check the native harness configuration.`));\n      } else {\n        pending.resolve(message.result);\n      }\n    }\n  }\n\n  private invalid(): void {\n    this.fail(new AgentError(\"PROTOCOL_ERROR\", \"fx returned invalid ACP protocol data.\"));\n    void this.close();\n  }\n\n  private fail(error: AgentError): void {\n    if (this.failure) return;\n    this.failure = error;\n    for (const pending of this.pending.values()) pending.reject(error);\n    this.pending.clear();\n    this.failureHandler(error);\n  }\n}\n"]}
+{"version":3,"file":"fx-rpc.js","sourceRoot":"","sources":["../../src/adapters/fx-rpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAarD,oEAAoE;AACpE,MAAM,OAAO,KAAK;IACC,KAAK,CAAiC;IACtC,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC9C,QAAQ,GAAG,CAAC,CAAC;IACb,MAAM,GAAG,EAAE,CAAC;IACZ,OAAO,CAAc;IACrB,OAAO,GAAG,KAAK,CAAC;IACP,MAAM,CAAgB;IAC/B,cAAc,GAAgC,GAAG,EAAE,GAAE,CAAC,CAAC;IAC/D,SAAS,GAAmC,GAAG,EAAE,GAAE,CAAC,CAAC;IAErD,YAAY,GAAW,EAAE,GAAsB,EAAE,KAAc;QAC7D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACrH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE;YACnD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACpF,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,qBAAqB,EAAE,0FAA0F,CAAC,CAAC,CAAC,CAAC;QAC3K,IAAI,CAAC,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAC7E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,gBAAgB,EAAC,8DAA8D,CAAC,CAAC,CAAC;;oBACjI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,gBAAgB,EACvC,kDAAkD,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAChG,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,OAAO,CAAC,MAAc,EAAE,MAAe;QACrC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC;QAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,OAAoB;QACvB,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC;QACrC,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,KAAiB;QACrB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IAED,iBAAiB,CAAC,OAAoC;QACpD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;QAC9B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACvF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;QAClE,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,IAAI,CAAC,MAAM,CAAC;QAClB,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAEO,IAAI,CAAC,KAAa;QACxB,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;YAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACjE,IAAI,OAAe,CAAC;QACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAC3B,IAAI,OAAoB,CAAC;YACzB,IAAI,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;YACpE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1H,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACvC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;oBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC/F,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,SAAS,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;uBAC1D,CAAC,MAAM,CAAC,SAAS,CAAE,KAA4B,CAAC,IAAI,CAAC;uBACrD,OAAQ,KAA+B,CAAC,OAAO,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3F,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,UAAU,GAAI,OAAO,CAAC,KAAmC,EAAE,IAAI,CAAC;gBACtE,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,KAAK,2BAA2B,IAAI,CAAC,UAAU,KAAK,CAAC,KAAK,IAAI,UAAU,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvH,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,cAAc,CAAC;gBACjE,MAAM,UAAU,GAAG,eAAe,OAAO,CAAC,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC/F,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,IAAI,KAAK,oBAAoB;oBAC/D,CAAC,CAAC,GAAG,UAAU,+CAA+C;oBAC9D,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,gBAAgB,EAAE,wCAAwC,CAAC,CAAC,CAAC;QACtF,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IAEO,IAAI,CAAC,KAAiB;QAC5B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAEO,WAAW;QACjB,OAAO,IAAI,UAAU,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;IACvE,CAAC;CACF","sourcesContent":["import { spawn, type ChildProcessWithoutNullStreams } from \"node:child_process\";\nimport { AgentError } from \"../errors.js\";\nimport { processExitDescription } from \"../process-diagnostics.js\";\nimport { nativeRpcErrorDescription } from \"./rpc.js\";\n\nexport type AcpEnvelope = {\n  jsonrpc?: string;\n  id?: string | number;\n  method?: string;\n  params?: any;\n  result?: any;\n  error?: unknown;\n};\n\ntype Pending = { method: string; resolve(value: any): void; reject(error: Error): void };\n\n/** A JSON-RPC 2.0 newline transport for fx's native ACP process. */\nexport class FxRpc {\n  private readonly child: ChildProcessWithoutNullStreams;\n  private readonly pending = new Map<number, Pending>();\n  private sequence = 0;\n  private buffer = \"\";\n  private failure?: AgentError;\n  private closing = false;\n  private readonly exited: Promise<void>;\n  private failureHandler: (error: AgentError) => void = () => {};\n  onMessage: (message: AcpEnvelope) => void = () => {};\n\n  constructor(cwd: string, env: NodeJS.ProcessEnv, model?: string) {\n    this.child = spawn(\"fx\", model ? [\"acp\", \"--model\", model] : [\"acp\"], { cwd, env, stdio: [\"pipe\", \"pipe\", \"pipe\"] });\n    this.child.stdout.setEncoding(\"utf8\");\n    this.child.stdout.on(\"data\", chunk => this.read(chunk));\n    this.child.stderr.resume();\n    this.child.stdin.on(\"error\", () => setImmediate(() => {\n      if (!this.closing && this.child.exitCode === null && this.child.signalCode === null) {\n        this.fail(new AgentError(\"HARNESS_FAILED\", \"The fx ACP input connection closed.\"));\n      }\n    }));\n    this.child.on(\"error\", () => this.fail(new AgentError(\"HARNESS_UNAVAILABLE\", \"Cannot start fx. Install fx 0.0.9 or a compatible release and make it available on PATH.\")));\n    this.exited = new Promise(resolve => this.child.once(\"close\", (code, signal) => {\n      if (this.closing) {\n        if (this.pending.size > 0) this.fail(new AgentError(\"HARNESS_FAILED\",\"The fx session closed before the native operation completed.\"));\n        else this.fail(this.closedError());\n      } else {\n        this.fail(new AgentError(\"HARNESS_FAILED\",\n          `fx exited before the native operation completed${processExitDescription(code, signal)}.`));\n      }\n      resolve();\n    }));\n  }\n\n  request(method: string, params: unknown): Promise<any> {\n    if (this.failure) return Promise.reject(this.failure);\n    if (this.closing) return Promise.reject(this.closedError());\n    const id = ++this.sequence;\n    return new Promise((resolve, reject) => {\n      this.pending.set(id, { method, resolve, reject });\n      this.send({ id, method, params });\n    });\n  }\n\n  send(message: AcpEnvelope): void {\n    if (this.failure) throw this.failure;\n    if (this.closing) throw this.closedError();\n    this.child.stdin.write(`${JSON.stringify({ jsonrpc: \"2.0\", ...message })}\\n`);\n  }\n\n  abort(error: AgentError): void {\n    this.fail(error);\n    void this.close();\n  }\n\n  setFailureHandler(handler: (error: AgentError) => void): void {\n    this.failureHandler = handler;\n    if (this.failure) handler(this.failure);\n  }\n\n  async close(): Promise<void> {\n    if (this.child.exitCode !== null || this.child.signalCode !== null) return this.exited;\n    this.closing = true;\n    this.child.kill(\"SIGTERM\");\n    const timer = setTimeout(() => this.child.kill(\"SIGKILL\"), 2_000);\n    timer.unref();\n    await this.exited;\n    clearTimeout(timer);\n  }\n\n  private read(chunk: string): void {\n    this.buffer += chunk;\n    if (this.buffer.length > 16 * 1024 * 1024) return this.invalid();\n    let newline: number;\n    while ((newline = this.buffer.indexOf(\"\\n\")) >= 0) {\n      const line = this.buffer.slice(0, newline);\n      this.buffer = this.buffer.slice(newline + 1);\n      if (!line.trim()) continue;\n      let message: AcpEnvelope;\n      try { message = JSON.parse(line); } catch { return this.invalid(); }\n      if (!message || typeof message !== \"object\" || Array.isArray(message) || message.jsonrpc !== \"2.0\") return this.invalid();\n      if (typeof message.method === \"string\") {\n        if (Object.hasOwn(message, \"result\") || Object.hasOwn(message, \"error\")) return this.invalid();\n        this.onMessage(message);\n        continue;\n      }\n      if (typeof message.id !== \"number\") return this.invalid();\n      const hasResult = Object.hasOwn(message, \"result\");\n      const hasError = Object.hasOwn(message, \"error\");\n      if (hasResult === hasError) return this.invalid();\n      if (hasError) {\n        const error = message.error;\n        if (!error || typeof error !== \"object\" || Array.isArray(error)\n          || !Number.isInteger((error as { code?: unknown }).code)\n          || typeof (error as { message?: unknown }).message !== \"string\") return this.invalid();\n      }\n      const pending = this.pending.get(message.id);\n      if (!pending) continue;\n      this.pending.delete(message.id);\n      if (hasError) {\n        const nativeCode = (message.error as { code?: unknown } | null)?.code;\n        const unsupported = pending.method === \"session/set_config_option\" && (nativeCode === -32601 || nativeCode === -32602);\n        const code = unsupported ? \"UNSUPPORTED_OPTION\" : \"NATIVE_ERROR\";\n        const diagnostic = `fx rejected ${pending.method}${nativeRpcErrorDescription(message.error)}.`;\n        pending.reject(new AgentError(code, code === \"UNSUPPORTED_OPTION\"\n          ? `${diagnostic} The requested session option is unsupported.`\n          : diagnostic));\n      } else {\n        pending.resolve(message.result);\n      }\n    }\n  }\n\n  private invalid(): void {\n    this.fail(new AgentError(\"PROTOCOL_ERROR\", \"fx returned invalid ACP protocol data.\"));\n    void this.close();\n  }\n\n  private fail(error: AgentError): void {\n    if (this.failure) return;\n    this.failure = error;\n    for (const pending of this.pending.values()) pending.reject(error);\n    this.pending.clear();\n    this.failureHandler(error);\n  }\n\n  private closedError(): AgentError {\n    return new AgentError(\"HARNESS_FAILED\", \"The fx session is closed.\");\n  }\n}\n"]}

package/dist/adapters/fx-status.d.ts

@@ -0,0 +1,2 @@
+/** Credential diagnostics never release ownership on a timeout or unknown exit. */
+export declare function captureFxStatus(cwd: string, env: NodeJS.ProcessEnv): Promise<string>;

package/dist/adapters/fx-status.js

@@ -0,0 +1,96 @@
+import { spawn } from "node:child_process";
+import { AgentError } from "../errors.js";
+const outputLimit = 1024 * 1024;
+const ownsGroup = process.platform !== "win32";
+/** Credential diagnostics never release ownership on a timeout or unknown exit. */
+export async function captureFxStatus(cwd, env) {
+    const child = (() => {
+        try {
+            return spawn("fx", ["status", "--json"], { cwd, env, detached: ownsGroup, stdio: ["ignore", "pipe", "pipe"] });
+        }
+        catch {
+            throw new AgentError("INVALID_CONFIG", "fx credential-source verification could not start with the selected process configuration.");
+        }
+    })();
+    let failure;
+    let exitCode = null;
+    let exitSeen = false;
+    let bytes = 0;
+    const chunks = [];
+    let resolveExited;
+    let rejectRetirement;
+    const exited = new Promise(resolve => { resolveExited = resolve; });
+    const unconfirmed = new Promise((_resolve, reject) => { rejectRetirement = reject; });
+    const closed = new Promise(resolve => child.once("close", resolve));
+    let killTimer;
+    let retirementTimer;
+    const signal = (value) => {
+        if (child.pid === undefined)
+            return;
+        try {
+            if (ownsGroup)
+                process.kill(-child.pid, value);
+            else if (!exitSeen)
+                child.kill(value);
+        }
+        catch (error) {
+            if (error.code !== "ESRCH")
+                failure = new AgentError("CANCELLATION_FAILED", "fx credential-source verification could not retire its owned process.");
+        }
+    };
+    const stop = (error) => {
+        if (failure)
+            return;
+        failure = error;
+        signal("SIGTERM");
+        killTimer = setTimeout(() => signal("SIGKILL"), 250);
+        retirementTimer = setTimeout(() => rejectRetirement(new AgentError("CANCELLATION_FAILED", "fx credential-source verification did not confirm process termination.")), 1_250);
+    };
+    child.stdout.on("data", (chunk) => {
+        if (failure)
+            return;
+        bytes += chunk.byteLength;
+        if (bytes > outputLimit)
+            stop(new AgentError("PROTOCOL_ERROR", "fx returned oversized credential-source status."));
+        else
+            chunks.push(chunk);
+    });
+    child.stderr.resume();
+    child.once("error", error => {
+        const absent = error.code === "ENOENT";
+        stop(new AgentError(absent ? "HARNESS_UNAVAILABLE" : "PROTOCOL_ERROR", absent
+            ? "Cannot start fx. Install a compatible fx release and make it available on PATH."
+            : "fx credential-source verification failed to communicate with the native process."));
+        if (child.pid === undefined)
+            resolveExited();
+    });
+    child.once("exit", code => { exitSeen = true; exitCode = code; resolveExited(); });
+    const timer = setTimeout(() => stop(new AgentError("PROTOCOL_ERROR", "fx credential-source verification timed out.")), 2_000);
+    try {
+        await Promise.race([exited, unconfirmed]);
+    }
+    finally {
+        clearTimeout(timer);
+        clearTimeout(killTimer);
+        clearTimeout(retirementTimer);
+        signal("SIGKILL");
+        await retireStreams(child, closed);
+    }
+    if (failure)
+        throw failure;
+    if (exitCode !== 0)
+        throw new AgentError("PROTOCOL_ERROR", "fx credential-source verification exited without usable native status.");
+    return Buffer.concat(chunks).toString("utf8");
+}
+async function retireStreams(child, closed) {
+    let timer;
+    try {
+        await Promise.race([closed, new Promise(resolve => {
+                timer = setTimeout(() => { child.stdout.destroy(); child.stderr.destroy(); resolve(); }, 250);
+            })]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=fx-status.js.map

package/dist/adapters/fx-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fx-status.js","sourceRoot":"","sources":["../../src/adapters/fx-status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,WAAW,GAAG,IAAI,GAAG,IAAI,CAAC;AAChC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAE/C,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,GAAsB;IACvE,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE;QAClB,IAAI,CAAC;YAAC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QACvH,MAAM,CAAC;YAAC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,4FAA4F,CAAC,CAAC;QAAC,CAAC;IACjJ,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,OAA+B,CAAC;IACpC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,aAA0B,CAAC;IAC/B,IAAI,gBAA8C,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,GAAG,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,gBAAgB,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1E,IAAI,SAAqC,CAAC;IAC1C,IAAI,eAA2C,CAAC;IAEhD,MAAM,MAAM,GAAG,CAAC,KAAqB,EAAE,EAAE;QACvC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO;QACpC,IAAI,CAAC;YACH,IAAI,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;iBAC1C,IAAI,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,GAAG,IAAI,UAAU,CAAC,qBAAqB,EAAE,uEAAuE,CAAC,CAAC;QAClL,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAiB,EAAE,EAAE;QACjC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,KAAK,CAAC;QAChB,MAAM,CAAC,SAAS,CAAC,CAAC;QAClB,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;QACrD,eAAe,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC,qBAAqB,EAAE,wEAAwE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/K,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,IAAI,OAAO;YAAE,OAAO;QACpB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,WAAW;YAAE,IAAI,CAAC,IAAI,UAAU,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC,CAAC;;YAC9G,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACtB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;QAC1B,MAAM,MAAM,GAAI,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC;QAClE,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,gBAAgB,EAAE,MAAM;YAC3E,CAAC,CAAC,iFAAiF;YACnF,CAAC,CAAC,kFAAkF,CAAC,CAAC,CAAC;QACzF,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,aAAa,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,gBAAgB,EAAE,8CAA8C,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9H,IAAI,CAAC;QAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAAC,CAAC;YAC1C,CAAC;QACP,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,YAAY,CAAC,eAAe,CAAC,CAAC;QAC9B,MAAM,CAAC,SAAS,CAAC,CAAC;QAClB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC;IAC3B,IAAI,QAAQ,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,wEAAwE,CAAC,CAAC;IACrI,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAgE,EAAE,MAAqB;IAClH,IAAI,KAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;gBACtD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAChG,CAAC,CAAC,CAAC,CAAC,CAAC;IACP,CAAC;YAAS,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;AACpC,CAAC","sourcesContent":["import { spawn, type ChildProcessWithoutNullStreams } from \"node:child_process\";\nimport { AgentError } from \"../errors.js\";\n\nconst outputLimit = 1024 * 1024;\nconst ownsGroup = process.platform !== \"win32\";\n\n/** Credential diagnostics never release ownership on a timeout or unknown exit. */\nexport async function captureFxStatus(cwd: string, env: NodeJS.ProcessEnv): Promise<string> {\n  const child = (() => {\n    try { return spawn(\"fx\", [\"status\", \"--json\"], { cwd, env, detached: ownsGroup, stdio: [\"ignore\", \"pipe\", \"pipe\"] }); }\n    catch { throw new AgentError(\"INVALID_CONFIG\", \"fx credential-source verification could not start with the selected process configuration.\"); }\n  })();\n  let failure: AgentError | undefined;\n  let exitCode: number | null = null;\n  let exitSeen = false;\n  let bytes = 0;\n  const chunks: Buffer[] = [];\n  let resolveExited!: () => void;\n  let rejectRetirement!: (error: AgentError) => void;\n  const exited = new Promise<void>(resolve => { resolveExited = resolve; });\n  const unconfirmed = new Promise<never>((_resolve, reject) => { rejectRetirement = reject; });\n  const closed = new Promise<void>(resolve => child.once(\"close\", resolve));\n  let killTimer: NodeJS.Timeout | undefined;\n  let retirementTimer: NodeJS.Timeout | undefined;\n\n  const signal = (value: NodeJS.Signals) => {\n    if (child.pid === undefined) return;\n    try {\n      if (ownsGroup) process.kill(-child.pid, value);\n      else if (!exitSeen) child.kill(value);\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== \"ESRCH\") failure = new AgentError(\"CANCELLATION_FAILED\", \"fx credential-source verification could not retire its owned process.\");\n    }\n  };\n  const stop = (error: AgentError) => {\n    if (failure) return;\n    failure = error;\n    signal(\"SIGTERM\");\n    killTimer = setTimeout(() => signal(\"SIGKILL\"), 250);\n    retirementTimer = setTimeout(() => rejectRetirement(new AgentError(\"CANCELLATION_FAILED\", \"fx credential-source verification did not confirm process termination.\")), 1_250);\n  };\n  child.stdout.on(\"data\", (chunk: Buffer) => {\n    if (failure) return;\n    bytes += chunk.byteLength;\n    if (bytes > outputLimit) stop(new AgentError(\"PROTOCOL_ERROR\", \"fx returned oversized credential-source status.\"));\n    else chunks.push(chunk);\n  });\n  child.stderr.resume();\n  child.once(\"error\", error => {\n    const absent = (error as NodeJS.ErrnoException).code === \"ENOENT\";\n    stop(new AgentError(absent ? \"HARNESS_UNAVAILABLE\" : \"PROTOCOL_ERROR\", absent\n      ? \"Cannot start fx. Install a compatible fx release and make it available on PATH.\"\n      : \"fx credential-source verification failed to communicate with the native process.\"));\n    if (child.pid === undefined) resolveExited();\n  });\n  child.once(\"exit\", code => { exitSeen = true; exitCode = code; resolveExited(); });\n  const timer = setTimeout(() => stop(new AgentError(\"PROTOCOL_ERROR\", \"fx credential-source verification timed out.\")), 2_000);\n  try { await Promise.race([exited, unconfirmed]); }\n  finally {\n    clearTimeout(timer);\n    clearTimeout(killTimer);\n    clearTimeout(retirementTimer);\n    signal(\"SIGKILL\");\n    await retireStreams(child, closed);\n  }\n  if (failure) throw failure;\n  if (exitCode !== 0) throw new AgentError(\"PROTOCOL_ERROR\", \"fx credential-source verification exited without usable native status.\");\n  return Buffer.concat(chunks).toString(\"utf8\");\n}\n\nasync function retireStreams(child: Pick<ChildProcessWithoutNullStreams, \"stdout\" | \"stderr\">, closed: Promise<void>): Promise<void> {\n  let timer: NodeJS.Timeout | undefined;\n  try {\n    await Promise.race([closed, new Promise<void>(resolve => {\n      timer = setTimeout(() => { child.stdout.destroy(); child.stderr.destroy(); resolve(); }, 250);\n    })]);\n  } finally { clearTimeout(timer); }\n}\n"]}

package/dist/adapters/fx.js

@@ -1,15 +1,20 @@
+import { NativeApprovals } from "./approval-lifetime.js";
+import { fxApproval } from "./fx-approvals.js";
 import { AgentError } from "../errors.js";
-import { fxEnvironment, fxSettingsFingerprint, verifyFxAccess } from "./fx-auth.js";
+import { fxAccessRoute, fxEnvironment, fxSettingsFingerprint, verifyFxAccess } from "./fx-auth.js";
 import { FxRpc } from "./fx-rpc.js";
 import { verifyFxPermissionMode } from "./fx-permissions.js";
 import { startFxTools } from "./fx-tools.js";
 export async function openFx(options, createRpc = (cwd, env, model) => new FxRpc(cwd, env, model)) {
     if (options.harness.kind !== "fx")
         throw new AgentError("INVALID_CONFIG", "fx received configuration for a different harness.");
-    const env = fxEnvironment(options);
-    const baseline = await fxSettingsFingerprint(env);
-    await verifyFxAccess(options.cwd, env, options.access.type);
+    const route = await fxAccessRoute(options);
+    const baseline = route.settingsFingerprint ?? await fxSettingsFingerprint(options.env);
+    const env = fxEnvironment(options, route);
+    await verifyFxAccess(options.cwd, env, route, options.harness.model);
     await verifyFxPermissionMode(options.cwd, env, options.harness.permissionMode);
+    if (await fxSettingsFingerprint(env) !== baseline)
+        throw new AgentError("INVALID_CONFIG", "fx native settings changed during access verification. Start a new session.");
     const tools = await startFxTools(options.agent);
     let rpc;
     try {
@@ -31,17 +36,17 @@ export async function openFx(options, createRpc = (cwd, env, model) => new FxRpc
         });
         if (typeof created?.sessionId !== "string" || created.sessionId.length === 0)
             throw new AgentError("PROTOCOL_ERROR", "fx did not return a native session identifier.");
-        const selectedModel = verifySelection(created.configOptions, options.harness.model);
+        const selectedModel = verifySelection(created.configOptions, route.provider, options.harness.model);
         if (options.harness.effort !== undefined) {
             verifyEffortAvailable(created.configOptions, options.harness.effort);
             const configured = await startedRpc.request("session/set_config_option", { sessionId: created.sessionId, configId: "effort", value: options.harness.effort });
-            verifySelection(configured?.configOptions, selectedModel, options.harness.effort);
+            verifySelection(configured?.configOptions, route.provider, selectedModel, options.harness.effort);
         }
         if (await fxSettingsFingerprint(env) !== baseline)
             throw new AgentError("INVALID_CONFIG", "fx native settings changed during session startup. Start a new session.");
         if (startupFailure)
             throw startupFailure;
-        return new FxSession(startedRpc, created.sessionId, options, env, baseline, tools);
+        return new FxSession(startedRpc, created.sessionId, options, env, baseline, tools, route.provider, selectedModel);
     }
     catch (error) {
         await rpc?.close();
@@ -65,21 +70,21 @@ function option(options, id) {
         throw new AgentError("PROTOCOL_ERROR", "fx returned invalid native session options.");
     return options.find(value => value && typeof value === "object" && value.id === id);
 }
-function verifySelection(configOptions, requestedModel, effort) {
+function verifySelection(configOptions, requestedProvider, requestedModel, effort) {
     const provider = option(configOptions, "provider");
     const selectedModel = option(configOptions, "model");
     if (!provider || !selectedModel) {
         throw new AgentError("PROTOCOL_ERROR", "fx did not expose compatible native provider and model selectors.");
     }
-    if (provider.currentValue !== "gateway") {
-        throw new AgentError("INVALID_CONFIG", "fx selected a provider outside the authorized Gateway route.");
+    if (provider.currentValue !== requestedProvider) {
+        throw new AgentError("INVALID_CONFIG", "fx selected a provider outside the authorized route.");
     }
     const model = selectedModel.currentValue;
     if (typeof model !== "string" || model.length === 0) {
         throw new AgentError("INVALID_CONFIG", "fx could not select a verifiable native default for this connection. Supply --model <model>.");
     }
     if (requestedModel && model !== requestedModel) {
-        throw new AgentError("INVALID_CONFIG", "fx changed the explicitly selected Gateway model.");
+        throw new AgentError("INVALID_CONFIG", "fx changed the explicitly selected model.");
     }
     if (effort !== undefined && option(configOptions, "effort")?.currentValue !== effort) {
         throw new AgentError("INVALID_CONFIG", "fx did not apply the explicitly selected effort.");
@@ -99,21 +104,26 @@ class FxSession {
     env;
     settingsFingerprint;
     tools;
+    selectedProvider;
+    selectedModel;
     active;
     failure;
     retirement;
     first = true;
     closed = false;
-    constructor(rpc, sessionId, options, env, settingsFingerprint, tools) {
+    constructor(rpc, sessionId, options, env, settingsFingerprint, tools, selectedProvider, selectedModel) {
         this.rpc = rpc;
         this.sessionId = sessionId;
         this.options = options;
         this.env = env;
         this.settingsFingerprint = settingsFingerprint;
         this.tools = tools;
+        this.selectedProvider = selectedProvider;
+        this.selectedModel = selectedModel;
         rpc.setFailureHandler(error => {
             this.failure ??= error;
             const active = this.active;
+            active?.approvals.clear();
             this.retirement ??= this.rpc.close();
             if (active)
                 void this.retirement.then(() => this.finish(active, undefined, error));
@@ -123,31 +133,42 @@ class FxSession {
     message(message) {
         const active = this.active;
         const params = message.params;
+        if (message.method === "$/cancel_request" && active && (typeof params?.requestId === "string" || typeof params?.requestId === "number")) {
+            active.withdrawnApprovals.add(params.requestId);
+            active.approvals.withdraw(params.requestId);
+            return;
+        }
         if (message.id !== undefined) {
-            try {
-                this.rpc.send({ id: message.id, result: { outcome: { outcome: "cancelled" } } });
-            }
-            catch { /* cancellation will surface the transport failure */ }
-            if (!active) {
-                this.rpc.abort(new AgentError("INPUT_REQUIRED", "fx requested interactive input outside an active task."));
-            }
-            else if (!active.failure) {
-                active.failure = new AgentError("INPUT_REQUIRED", "fx requested interactive input or approval. Configure native permissions before retrying; no approval was granted.");
-                this.tools.stopAdmission();
+            if (active && active.submitted && !active.terminal && !active.cancelRequested && !active.failure && params?.sessionId === this.sessionId
+                && message.method === "session/request_permission" && this.options.onApproval) {
                 try {
-                    this.rpc.send({ method: "session/cancel", params: { sessionId: this.sessionId } });
+                    const request = fxApproval(params);
+                    void active.approvals.request(message.id, request, this.options.onApproval).then(content => {
+                        if (this.active === active && !active.terminal && !active.cancelRequested && !active.failure && !active.withdrawnApprovals.has(message.id)) {
+                            this.rpc.send({ id: message.id, result: { outcome: { outcome: "selected", optionId: content.decision } } });
+                        }
+                    }).catch(error => {
+                        if (!(error instanceof AgentError && error.code === "REQUEST_EXPIRED"))
+                            this.unsupportedRequest(message, active);
+                    });
+                    return;
                 }
-                catch { /* onFailure settles the turn */ }
-                active.cancellationTimer = setTimeout(() => {
-                    if (this.active === active && !active.terminal)
-                        this.rpc.abort(new AgentError("CANCELLATION_FAILED", "fx did not stop after requesting interactive input."));
-                }, 2_000);
-                active.cancellationTimer.unref();
+                catch { /* Unsupported requests retain the explicit input failure path. */ }
             }
+            this.unsupportedRequest(message, active);
             return;
         }
         if (params?.sessionId !== this.sessionId)
             return;
+        if (message.method === "session/update" && params.update?.sessionUpdate === "config_option_update") {
+            try {
+                verifySelection(params.update.configOptions, this.selectedProvider, this.selectedModel, this.options.harness.effort);
+            }
+            catch (error) {
+                this.rpc.abort(error);
+            }
+            return;
+        }
         if (!active || message.method !== "session/update")
             return;
         const update = params.update;
@@ -173,10 +194,34 @@ class FxSession {
         else
             active.text += update.content.text;
     }
+    unsupportedRequest(message, active) {
+        try {
+            this.rpc.send({ id: message.id, result: { outcome: { outcome: "cancelled" } } });
+        }
+        catch { /* cancellation will surface the transport failure */ }
+        if (!active) {
+            this.rpc.abort(new AgentError("INPUT_REQUIRED", "fx requested interactive input outside an active task."));
+        }
+        else if (!active.failure) {
+            active.failure = new AgentError("INPUT_REQUIRED", "fx requested interactive input or approval. Configure native permissions before retrying; no approval was granted.");
+            active.approvals.clear();
+            this.tools.stopAdmission();
+            try {
+                this.rpc.send({ method: "session/cancel", params: { sessionId: this.sessionId } });
+            }
+            catch { /* onFailure settles the turn */ }
+            active.cancellationTimer = setTimeout(() => {
+                if (this.active === active && !active.terminal)
+                    this.rpc.abort(new AgentError("CANCELLATION_FAILED", "fx did not stop after requesting interactive input."));
+            }, 2_000);
+            active.cancellationTimer.unref();
+        }
+    }
     async finish(active, result, failure) {
         if (active.terminal)
             return;
         active.terminal = true;
+        active.approvals.clear();
         active.resolveNativeStopped();
         if (active.cancellationTimer)
             clearTimeout(active.cancellationTimer);
@@ -208,7 +253,7 @@ class FxSession {
         const completion = new Promise((a, b) => { resolve = a; reject = b; });
         const admission = new Promise(resolveAdmission => { releaseAdmission = resolveAdmission; });
         const nativeStopped = new Promise(resolveStopped => { resolveNativeStopped = resolveStopped; });
-        const active = { text: "", responseBytes: 0, responseTooLarge: false, completion, resolve, reject, terminal: false, submitted: false, cancelRequested: false, admission, releaseAdmission, nativeStopped, resolveNativeStopped };
+        const active = { approvals: new NativeApprovals(), withdrawnApprovals: new Set(), text: "", responseBytes: 0, responseTooLarge: false, completion, resolve, reject, terminal: false, submitted: false, cancelRequested: false, admission, releaseAdmission, nativeStopped, resolveNativeStopped };
         this.active = active;
         void completion.catch(() => { });
         try {
@@ -248,6 +293,7 @@ class FxSession {
         if (!active)
             return;
         active.cancelRequested = true;
+        active.approvals.clear();
         this.tools.stopAdmission();
         await bounded(active.admission, 2_000);
         const admittedTools = this.tools.drain();
@@ -276,6 +322,7 @@ class FxSession {
         try {
             if (this.active) {
                 this.active.cancelRequested = true;
+                this.active.approvals.clear();
                 await bounded(this.active.admission, 2_000);
                 if (this.active.submitted && !this.active.terminal)
                     this.rpc.send({ method: "session/cancel", params: { sessionId: this.sessionId } });