zcode-acp-server 0.21.4 → 0.23.0

package/dist/repl/run.js

@@ -1,1245 +0,0 @@
-/**
- * REPL orchestration (bare `zcode-acp`): spawn the bridge subprocess, connect
- * to it as an ACP client over stdio, create a session rooted at the current
- * directory, and pump session updates into the Ink UI.
- *
- * State lives here (plain variables + full rerender) — the App component is a
- * pure view over a snapshot. One process per conversation: closing the REPL
- * closes the bridge (its stdin-end shutdown path), which reaps the zcode
- * backend through the bridge's normal cleanup.
- */
-import { spawn } from "node:child_process";
-import { Readable, Writable } from "node:stream";
-import process from "node:process";
-import { fileURLToPath } from "node:url";
-import * as acp from "@agentclientprotocol/sdk";
-import { render } from "ink";
-import { createElement } from "react";
-import { z } from "zod";
-import { queryQuota } from "../quota/index.js";
-import { sandboxActive } from "../backend/sandbox.js";
-import { AGENT_INFO, warn } from "../utils.js";
-import { App, } from "./App.js";
-import { applyStatusUpdate, applyUpdate, createReplStatus, createTurnState, finishTurn, formatQuotaLine, handleLocalCommand, parseCommand, parseQuestionForm, planTextFromRawInput, seedStatusFromNewSession, selectLabel, } from "./model.js";
-import { HISTORY_MAX, historyPath, loadHistory, pushHistory, saveHistory } from "./history.js";
-import { fetchInstances, openHubSocket, resolveHubClient, sameWorkspace, } from "./hub.js";
-import { createLineEditor, replaceText } from "./input-buffer.js";
-export async function runRepl() {
-    // Crash containment: an unexpected throw is SURFACED, never fatal — it
-    // prints to stderr (stack included), lands as a dim note in the
-    // transcript, and the REPL keeps running. A circuit breaker is the only
-    // exit: if errors keep firing within the window the render tree itself is
-    // almost certainly broken and every frame would throw again — shutting
-    // down then beats a spinning error loop. Rejected promises are always
-    // log-only; the SDK resolves raced/aborted request promises late by
-    // design, and those settle as rejections we deliberately ignore.
-    const CRASH_WINDOW_MS = 10_000;
-    const CRASH_LIMIT = 5;
-    let crashTimes = [];
-    let repaintQueued = false;
-    process.on("uncaughtException", (err) => {
-        const now = Date.now();
-        crashTimes = crashTimes.filter((t) => now - t < CRASH_WINDOW_MS);
-        crashTimes.push(now);
-        const detail = err instanceof Error ? (err.stack ?? err.message) : String(err);
-        warn(`repl absorbed an error (${crashTimes.length}/${CRASH_LIMIT} recent): ${detail}`);
-        if (crashTimes.length >= CRASH_LIMIT) {
-            warn("repl: too many errors in a row — UI is likely broken, shutting down");
-            // Unmount so ink's stdin cleanup effects run (raw mode, bracketed
-            // paste): process.exit alone would leave the tty wedged. The tree may
-            // be exactly what's broken — guard the unmount.
-            try {
-                ink.unmount();
-            }
-            catch {
-                // ignore
-            }
-            try {
-                child.stdin?.end();
-            }
-            catch {
-                // ignore
-            }
-            setTimeout(() => {
-                try {
-                    child.kill("SIGKILL");
-                }
-                catch {
-                    // ignore
-                }
-                process.exit(1);
-            }, 1500).unref();
-            return;
-        }
-        const msg = (err instanceof Error ? err.message : String(err)).split("\n")[0] || "unknown error";
-        entries = [...entries, { kind: "note", text: `error absorbed: ${msg}` }];
-        // Repaint on a later tick: if the throw happened INSIDE a rerender,
-        // re-entering ink synchronously from this handler would just rethrow.
-        if (!repaintQueued && !exited) {
-            repaintQueued = true;
-            setTimeout(() => {
-                repaintQueued = false;
-                rerender();
-            }, 50);
-        }
-    });
-    process.on("unhandledRejection", (reason) => {
-        warn(`repl ignored an async failure: ${reason instanceof Error ? (reason.stack ?? reason.message) : String(reason)}`);
-    });
-    const serverJs = fileURLToPath(new URL("../index.js", import.meta.url));
-    const child = spawn(process.execPath, [serverJs], {
-        stdio: ["pipe", "pipe", "pipe"],
-    });
-    // Bridge stderr (gated debug logs + warns) never interleaves with the Ink
-    // UI; keep a tail so a bridge crash can be explained on exit.
-    let stderrTail = "";
-    child.stderr?.setEncoding("utf8");
-    child.stderr?.on("data", (d) => {
-        stderrTail = (stderrTail + d).slice(-2000);
-    });
-    // --- UI state (external store; every mutation rerenders a fresh snapshot) ---
-    let entries = [];
-    let turn = null;
-    let permission = null;
-    let question = null;
-    // Non-null while the /sessions picker is open (run-side holds the list; the
-    // App owns the row index).
-    let sessionPick = null;
-    let status = createReplStatus();
-    let busy = true;
-    let exited = false;
-    // True between a user submit and the stop message. The bridge also pushes
-    // idle-time updates right after session/new (available_commands, mode
-    // state, …) — without this gate those would spin up a phantom turn and
-    // show the "running" spinner with nothing in flight.
-    let turnActive = false;
-    // True while a prompt WE sent is in flight (its stop message closes the
-    // turn). Remote-initiated turns (mobile/second client) never deliver a stop
-    // here — they are closed by `$/zcode/turnState running:false` instead.
-    let promptInFlight = false;
-    // True between a `/sessions` resume and the drained history backlog: during
-    // this window streamed updates fold into static entries (see the pump).
-    // `loadSettled` gates the DRAIN: the bridge streams replay notifications
-    // while the load request is still in flight, so consuming early would let a
-    // >10ms gap between two replayed messages falsely end replay mode.
-    let replayMode = false;
-    // The live ACP session. Starts as the fresh session/new placeholder; a
-    // `/sessions` resume swaps it for an attached load of the picked backend
-    // session (same pump, same update routing). Declared with the other
-    // state, NOT at its bootstrap assignment below: /sessions can run while
-    // that await is still in flight, and assigning a `let` before its
-    // declaration executes is a TDZ ReferenceError.
-    let activeSession = null;
-    let resumedDuringStartup = false;
-    let loadSettled = true;
-    let replayTurn = null;
-    const REPLAY_QUIET_MS = 10;
-    // Resume loads only the last N messages (turn-aligned, ADR-0003 tail
-    // replay). Full replay of a huge session would flood the native
-    // scrollback with thousands of lines in one burst — a bounded recent tail
-    // gives context without the wall-of-text scroll jump.
-    const RESUME_TAIL_LIMIT = 50;
-    // Hub-proxied attach (ADR-0018): budget for the WebSocket open round-trip.
-    const REMOTE_OPEN_TIMEOUT_MS = 5000;
-    // Non-null while a hub-proxied remote attach is live: the raw socket pair
-    // feeding the remote connection. Teardown is client-side only — the owning
-    // serve bridge and its session are never touched.
-    let remote = null;
-    // ACP context of the connection that owns activeSession — the local bridge
-    // (assigned once cx exists) or, while attached, the remote bridge.
-    // Out-of-band calls (session/cancel) must reach the OWNING connection.
-    let activeCx = null;
-    // Hub discovery from env; null = no hub configured — the picker then works
-    // exactly as before this feature existed.
-    const hubRef = resolveHubClient();
-    const sleep = (ms) => new Promise((resolve) => setTimeout(() => resolve(null), ms));
-    // Prompts submitted while another turn runs (or before the session is
-    // ready); drained one per stop, FIFO.
-    const promptQueue = [];
-    // Native-scrollback model: completed entries print once via ink <Static>
-    // and become the terminal's own history (native smooth scroll, selection,
-    // search — the Claude Code pattern). Only a compact dynamic footer below
-    // (live-turn tail, queue panel, completion menu, input box) ever repaints.
-    // --- prompt line editor (external store): the App re-renders from fresh
-    // snapshots, so draft text must live out here to survive rerenders.
-    let editor = createLineEditor();
-    // --- prompt history (ADR-0008) ---
-    // Entries load once at startup; `historyIdx` points at the recalled entry
-    // (-1 = live draft). ↑ stashes the draft before walking back; ↓ past the
-    // newest entry restores it. State out here so recall survives repaints.
-    const historyFile = historyPath(process.cwd());
-    let history = [];
-    let historyIdx = -1;
-    let historyDraft = null;
-    try {
-        history = loadHistory(historyFile);
-    }
-    catch {
-        // loadHistory is already best-effort; this guard keeps even a throw from
-        // its own write-back path from killing startup.
-    }
-    /** Recall one entry older; stashes the live draft on the first step. */
-    function historyUp() {
-        if (history.length === 0 || exited)
-            return;
-        if (historyIdx === -1) {
-            historyDraft = editor.text;
-            historyIdx = history.length - 1;
-        }
-        else if (historyIdx > 0) {
-            historyIdx--;
-        }
-        else {
-            return;
-        }
-        editor = replaceText(history[historyIdx]);
-        rerender();
-    }
-    /** Walk one entry newer; past the newest, restore the stashed draft. */
-    function historyDown() {
-        if (historyIdx === -1 || exited)
-            return;
-        if (historyIdx < history.length - 1) {
-            historyIdx++;
-            editor = replaceText(history[historyIdx]);
-        }
-        else {
-            historyIdx = -1;
-            editor = replaceText(historyDraft ?? "");
-            historyDraft = null;
-        }
-        rerender();
-    }
-    // --- completion-menu visibility mirror ---
-    // InputLine publishes whether its menu is showing (plain var, no React
-    // state); the app-level key handler reads it so an open menu takes the
-    // first esc — dismissing it must not also interrupt a queued-up turn.
-    let completionMenuOpen = false;
-    // --- plan-quota indicator (prompt-line status suffix) ---
-    // Fetched once at startup and refreshed every QUOTA_TTL_MS; null (hidden)
-    // while the fetch runs or fails, so offline / auth-expired sessions just
-    // lose the suffix instead of nagging. The full card stays available via
-    // /quota. Failures are silent by design — warn() on every TTL tick would
-    // spam long-lived sessions.
-    let quotaLine = null;
-    let quotaFetchId = 0;
-    let quotaTimer = null;
-    const QUOTA_TTL_MS = 10 * 60 * 1000;
-    async function refreshQuota() {
-        const id = ++quotaFetchId;
-        try {
-            const result = await queryQuota();
-            if (exited || id !== quotaFetchId)
-                return; // stale reply — a newer fetch owns the line
-            const line = formatQuotaLine(result);
-            if (line !== quotaLine) {
-                quotaLine = line;
-                rerender();
-            }
-        }
-        catch {
-            // best-effort indicator: leave whatever was last shown in place
-        }
-    }
-    void refreshQuota();
-    quotaTimer = setInterval(() => void refreshQuota(), QUOTA_TTL_MS);
-    quotaTimer.unref();
-    // Bracketed paste (?2004) is armed by ink's usePaste hook inside InputLine
-    // and disarmed with its unmount — no manual terminal-mode management here.
-    const renderOpts = { exitOnCtrlC: false };
-    let ink = render(createElement(App, snapshot()), renderOpts);
-    function snapshot() {
-        return {
-            entries,
-            turn,
-            permission,
-            question,
-            sessionPick,
-            queued: [...promptQueue],
-            status,
-            busy,
-            replaying: replayMode,
-            editor,
-            applyEdit: (op) => {
-                if (exited)
-                    return;
-                editor = op(editor);
-                rerender();
-            },
-            quotaLine,
-            isMenuOpen: () => completionMenuOpen,
-            onMenuOpenChange: (open) => {
-                completionMenuOpen = open;
-            },
-            onSubmit: (text) => void onSubmit(text),
-            onCancelTurn,
-            onAnswerPermission: (id) => permissionResolver?.(id),
-            onAnswerQuestion: (answer) => {
-                const resolve = questionResolver;
-                questionResolver = null;
-                question = null;
-                rerender();
-                resolve?.(answer);
-            },
-            onPickSession: (sid) => sessionPickResolver?.(sid),
-            onHistoryUp: historyUp,
-            onHistoryDown: historyDown,
-            onExit: () => cleanup(0),
-        };
-    }
-    function rerender() {
-        if (!exited)
-            ink.rerender(createElement(App, snapshot()));
-    }
-    // --- Permission bridging: agent request → picker → response ---
-    let permissionResolver = null;
-    // --- AskUserQuestion bridging: elicitation form → picker → response ---
-    let questionResolver = null;
-    function askQuestion(form, signal) {
-        return new Promise((resolve) => {
-            const onAbort = () => {
-                questionResolver = null;
-                question = null;
-                rerender();
-                resolve(null);
-            };
-            const settle = (answer) => {
-                signal?.removeEventListener("abort", onAbort);
-                resolve(answer);
-            };
-            signal?.addEventListener("abort", onAbort, { once: true });
-            questionResolver = settle;
-            question = {
-                title: form.title,
-                multiSelect: form.multiSelect,
-                options: form.options,
-            };
-            rerender();
-        });
-    }
-    // --- /sessions bridging: list → picker → resume ---
-    let sessionPickResolver = null;
-    // Bumped by every session swap; async continuations compare their captured
-    // generation after each await and bail when another swap went first —
-    // otherwise a slow session/load could reseed status into a FRESH session.
-    let swapGen = 0;
-    // --- ACP client connection ---
-    const stream = acp.ndJsonStream(Writable.toWeb(child.stdin), Readable.toWeb(child.stdout));
-    // One ACP client connection with the REPL's full handler chain — used for
-    // the local bridge AND, per attach, for hub-proxied remote bridges
-    // (ADR-0018): both peers are plain ACP agents, and permission, elicitation,
-    // and turn-state handling are identical.
-    function buildConnection(acpStream) {
-        const app = acp
-            .client({ name: "zcode-acp" })
-            .onRequest("session/request_permission", async (ctx) => {
-            // A remote client (mobile/hub) may answer the broadcast request first;
-            // the bridge then cancels this losing copy and the SDK aborts
-            // ctx.signal — settle here so our picker dismisses instead of hanging.
-            const id = await new Promise((resolve) => {
-                const onAbort = () => {
-                    permissionResolver = null;
-                    permission = null;
-                    rerender();
-                    resolve(null);
-                };
-                ctx.signal.addEventListener("abort", onAbort, { once: true });
-                permissionResolver = (v) => {
-                    ctx.signal.removeEventListener("abort", onAbort);
-                    resolve(v);
-                };
-                const options = ctx.params.options.map((o) => ({ id: o.optionId, name: o.name }));
-                // ExitPlanMode arrives as an approve/reject permission pair (see
-                // interaction/adapter.ts). The plan text rides toolCall.rawInput
-                // ({plan}); the footer popup cannot scroll a long document, so print
-                // the full plan into the transcript and keep the popup to a pointer.
-                const isPlan = options.length === 2 && options.every((o) => o.id === "approve" || o.id === "reject");
-                const raw = ctx.params.toolCall?.rawInput;
-                let detail;
-                if (isPlan) {
-                    const plan = planTextFromRawInput(raw);
-                    if (plan) {
-                        entries = [...entries, { kind: "plan", text: plan }];
-                        const firstLine = plan.split("\n").find((l) => l.trim()) ?? "";
-                        detail = `plan printed above — ${firstLine.trim().slice(0, 80)}`;
-                    }
-                    else {
-                        detail = "(no plan text in the request)";
-                    }
-                }
-                else {
-                    detail = typeof raw === "string" ? raw : undefined;
-                }
-                permission = {
-                    heading: isPlan ? "plan approval" : "permission requested",
-                    title: ctx.params.toolCall?.title ?? "tool call",
-                    detail,
-                    options,
-                };
-                rerender();
-            });
-            permissionResolver = null;
-            permission = null;
-            rerender();
-            return id === null
-                ? { outcome: { outcome: "cancelled" } }
-                : { outcome: { outcome: "selected", optionId: id } };
-        })
-            .onRequest("elicitation/create", async (ctx) => {
-            // AskUserQuestion arrives as the bridge's form elicitation. Each
-            // question walks the picker sequentially; skipped questions omit
-            // their key (the backend treats them as unanswered).
-            const forms = parseQuestionForm(ctx.params);
-            if (!forms)
-                return { action: "decline", reason: "unsupported elicitation form" };
-            const content = {};
-            for (const form of forms) {
-                const answer = await askQuestion(form, ctx.signal);
-                // A remote client winning the broadcast aborts our request via
-                // ctx.signal — stop answering instead of walking remaining questions.
-                if (ctx.signal.aborted)
-                    return { action: "decline", reason: "cancelled" };
-                if (answer === null)
-                    continue; // skipped
-                if (form.multiSelect) {
-                    const merged = [...answer.picked, ...(answer.custom ? [answer.custom] : [])];
-                    if (merged.length > 0)
-                        content[form.key] = merged;
-                }
-                else {
-                    content[form.key] = answer.custom || answer.picked[0] || "";
-                }
-            }
-            return { action: "accept", content };
-        })
-            // Out-of-band turn indicator broadcast by the bridge on every prompt start
-            // and end. Drives turns the REPL did NOT start itself: a mobile/second
-            // client prompting this session must render here too — without it those
-            // updates would be silently dropped (the pump only folds updates while a
-            // turn is active).
-            .onNotification("$/zcode/turnState", z.object({ sessionId: z.string(), running: z.boolean() }), (ctx) => {
-            if (!activeSession || ctx.params.sessionId !== activeSession.sessionId)
-                return;
-            if (ctx.params.running) {
-                // Local prompts already opened the turn in startTurn; idempotent.
-                if (!turnActive && !replayMode) {
-                    turn = createTurnState();
-                    turnActive = true;
-                    rerender();
-                }
-            }
-            else if (turnActive && !promptInFlight) {
-                // Remote turn finished (no stop message reaches non-initiators).
-                entries = [...entries, ...finishTurn(turn ?? createTurnState())];
-                turn = null;
-                turnActive = false;
-                drainQueue();
-                rerender();
-            }
-        })
-            .connect(acpStream);
-        return app;
-    }
-    const app = buildConnection(stream);
-    const cx = app.agent;
-    // Advertise form-elicitation so AskUserQuestion routes here as a
-    // structured form instead of permission-popups labeled "permission
-    // requested". The SDK never sends a protocol-level initialize on the
-    // client's behalf, so this request() IS the handshake (the bridge rejects
-    // any earlier non-initialize message). Sent via the generic request() —
-    // the typed helper lives on the Agent interface, not the ClientContext we
-    // hold.
-    await cx.request("initialize", {
-        protocolVersion: 1,
-        clientCapabilities: {
-            fs: { readTextFile: false, writeTextFile: false },
-            elicitation: { form: {} },
-        },
-        clientInfo: { name: "zcode-acp", title: "zcode-acp REPL", version: AGENT_INFO.version },
-    });
-    // Hub-incubated session resume (ADR-0017): the .command script exports the
-    // requested backend session id, so a remotely resumed conversation boots
-    // straight into it instead of a fresh prompt line. Empty when started by
-    // hand — plain local runs never see the variable.
-    const bootResumeSid = (process.env.ZCODE_ACP_RESUME_SESSION ?? "").trim();
-    try {
-        if (bootResumeSid) {
-            // Boot directly into the requested session; on a failed load (store
-            // entry gone, foreign workspace refused by serve mode) fall back to a
-            // fresh one so the window still lands on a usable prompt line — the
-            // failure note stays visible above.
-            const resumed = await resumeInto({
-                sessionId: bootResumeSid,
-                cwd: process.cwd(),
-                title: null,
-                updatedAt: null,
-            });
-            if (resumed === "failed") {
-                const fresh = await cx.buildSession(process.cwd()).start();
-                activeSession = fresh;
-                status = seedStatusFromNewSession(status, fresh.newSessionResponse);
-            }
-            // "superseded" (the user raced a /sessions pick during this load)
-            // leaves the state to whichever swap went last — no fallback.
-        }
-        else {
-            const fresh = await cx.buildSession(process.cwd()).start();
-            if (resumedDuringStartup) {
-                // The user picked a session from /sessions while this cold-start
-                // round-trip was still in flight — the fresh placeholder is already
-                // obsolete and its default status must not overwrite the resumed
-                // session's own seeded selects. Discard it, keep what they expect.
-                fresh.dispose();
-            }
-            else {
-                activeSession = fresh;
-                // The initial config options ride the session/new response body, not a
-                // notification — seed the status from it; later switches push updates.
-                status = seedStatusFromNewSession(status, activeSession.newSessionResponse);
-            }
-        }
-    }
-    catch (err) {
-        entries = [
-            ...entries,
-            {
-                kind: "note",
-                text: `failed to start session: ${err instanceof Error ? err.message : String(err)}`,
-            },
-        ];
-        rerender();
-        cleanup(1);
-        return;
-    }
-    busy = false;
-    drainQueue();
-    // --- Update pump: fold notifications into the live turn, stop closes it ---
-    void (async () => {
-        for (;;) {
-            let msg;
-            try {
-                if (replayMode) {
-                    // Wait for the load response before draining: only then is the
-                    // whole replay backlog guaranteed to be queued, making the quiet
-                    // timeout a reliable end-of-replay signal.
-                    if (!loadSettled) {
-                        await sleep(REPLAY_QUIET_MS);
-                        continue;
-                    }
-                    msg = await Promise.race([activeSession.nextUpdate(), sleep(REPLAY_QUIET_MS)]);
-                    if (msg === null) {
-                        // Backlog drained — flush the folded history as static entries.
-                        replayMode = false;
-                        if (replayTurn) {
-                            entries = [...entries, ...finishTurn(replayTurn)];
-                            replayTurn = null;
-                        }
-                        rerender();
-                        continue;
-                    }
-                }
-                else {
-                    msg = await activeSession.nextUpdate();
-                }
-            }
-            catch {
-                // A `/sessions` resume disposes the previous ActiveSession, which
-                // fails this pending read — re-arm on the (possibly new) session
-                // instead of killing the pump and orphaning every later update.
-                await sleep(REPLAY_QUIET_MS * 2);
-                continue;
-            }
-            if (msg.kind === "stop") {
-                promptInFlight = false;
-                entries = [...entries, ...finishTurn(turn ?? createTurnState(), msg.response.stopReason)];
-                turn = null;
-                turnActive = false;
-                drainQueue();
-            }
-            else {
-                // Status pushes (command menu, config selects) fold regardless of turn
-                // activity — the update that follows a `/model X` switch arrives while
-                // that slash turn is still open. Turn payloads and replayed history
-                // fold into their respective buffers.
-                const nextStatus = applyStatusUpdate(status, msg.update);
-                const statusChanged = nextStatus !== status;
-                status = nextStatus;
-                if (replayMode && replayTurn) {
-                    // Fold silently: replayed history isn't rendered per message
-                    // (thousands of full-frame renders froze input on big sessions).
-                    // App shows one static "restoring history…" row instead; the drain
-                    // below paints the whole transcript once.
-                    replayTurn = applyUpdate(replayTurn, msg.update);
-                }
-                else if (turnActive) {
-                    turn = applyUpdate(turn ?? createTurnState(), msg.update);
-                    rerender();
-                }
-                else if (msg.update.sessionUpdate === "user_message_chunk") {
-                    // A remote-initiated prompt's echo lands BEFORE the turnState
-                    // running notification (separate frames through the hub): open the
-                    // turn here so the prompt text renders instead of being dropped.
-                    // The running:true that follows is idempotent; running:false closes
-                    // this turn exactly like any remote turn.
-                    turn = applyUpdate(createTurnState(), msg.update);
-                    turnActive = true;
-                    rerender();
-                }
-                else if (statusChanged) {
-                    rerender();
-                }
-            }
-        }
-    })();
-    async function onSubmit(text, viaQueue = false) {
-        // Every submit is history (slash commands included, verbatim) — recall
-        // exists precisely for command incantations. Recorded ONCE, at first
-        // submission: the queue drain re-enters through here (viaQueue) and its
-        // entries were already recorded when they were queued.
-        if (!viaQueue) {
-            // Keep memory in step with the file: saveHistory trims to the newest
-            // HISTORY_MAX entries on disk; slice here so a long-lived session's
-            // in-memory array cannot outgrow the same bound.
-            history = pushHistory(history, text).slice(-HISTORY_MAX);
-            saveHistory(historyFile, history);
-            historyIdx = -1;
-            historyDraft = null;
-        }
-        const cmd = parseCommand(text);
-        if (cmd === "exit") {
-            cleanup(0);
-            return;
-        }
-        if (cmd === "sessions") {
-            entries = [...entries, { kind: "user", text }];
-            void openSessionPicker();
-            return;
-        }
-        if (cmd === "new") {
-            void startFreshSession();
-            return;
-        }
-        entries = [...entries, { kind: "user", text }];
-        // REPL-local commands (help / arg-less listing forms) render here and
-        // never reach the bridge; everything else is a prompt (slash interception
-        // lives bridge-side, same path editors use).
-        const local = handleLocalCommand(text, status);
-        if (local) {
-            entries = [...entries, ...local];
-            rerender();
-            return;
-        }
-        if (!activeSession || turnActive) {
-            // Follow-ups while a turn is running (or the session is still starting)
-            // are queued; the stop handler drains them one at a time. Resetting the
-            // live turn here would discard its entries mid-stream.
-            promptQueue.push(text);
-            rerender();
-            return;
-        }
-        await startTurn(text);
-    }
-    async function startTurn(text) {
-        turn = createTurnState();
-        turnActive = true;
-        promptInFlight = true;
-        rerender();
-        try {
-            await activeSession.prompt(text);
-        }
-        catch (err) {
-            // The pump's stop message still flushes the turn; surface the error too.
-            // The queue is NOT drained here: racing a queued prompt against the
-            // pending stop would close that next turn prematurely.
-            entries = [
-                ...entries,
-                {
-                    kind: "note",
-                    text: `prompt failed: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ];
-            turn = null;
-            turnActive = false;
-            promptInFlight = false;
-            rerender();
-        }
-    }
-    /** Start the next queued prompt after a turn ends; go idle when empty. */
-    function drainQueue() {
-        const next = promptQueue.shift();
-        if (next === undefined) {
-            turnActive = false;
-            rerender();
-            return;
-        }
-        // Route through onSubmit, not startTurn directly: queued entries still
-        // go through command parsing (a queued "/help" must render locally,
-        // "/exit" must exit — never reach the bridge as a literal prompt).
-        void onSubmit(next, true);
-    }
-    function onCancelTurn() {
-        if (!activeSession || !turn)
-            return;
-        try {
-            // The connection that OWNS the active session — the local bridge, or
-            // the hub-proxied remote bridge while attached (ADR-0018).
-            void (activeCx ?? cx).notify("session/cancel", { sessionId: activeSession.sessionId });
-        }
-        catch {
-            // best-effort; a second ctrl-c exits outright
-        }
-    }
-    /**
-     * `/sessions`: list this project's sessions via ACP `session/list` (the
-     * backend filters by workspace), merge in sessions currently live on hub
-     * instances (ADR-0018, marked `live`), let the user pick one interactively,
-     * then attach: through the hub when the session is live somewhere (live
-     * updates), otherwise a local `session/load` resume (tail replay).
-     */
-    async function openSessionPicker() {
-        if (turnActive) {
-            entries = [
-                ...entries,
-                { kind: "note", text: "a turn is running — try /sessions when it finishes" },
-            ];
-            rerender();
-            return;
-        }
-        let list;
-        try {
-            list = (await cx.request("session/list", { cwd: process.cwd() }));
-        }
-        catch (err) {
-            entries = [
-                ...entries,
-                {
-                    kind: "note",
-                    text: `failed to list sessions: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ];
-            rerender();
-            return;
-        }
-        const items = (list.sessions ?? []).map((s) => ({
-            sessionId: s.sessionId,
-            cwd: s.cwd ?? "",
-            title: s.title ?? null,
-            updatedAt: s.updatedAt ?? null,
-        }));
-        // Live view (ADR-0018): merge sessions currently registered on hub
-        // instances for this project. Best-effort — no hub configured, hub down,
-        // or auth trouble just means no `live` markers and plain local resumes,
-        // exactly like before the feature existed.
-        const liveOn = new Map();
-        if (hubRef) {
-            try {
-                for (const inst of await fetchInstances(hubRef, { timeoutMs: 2000 })) {
-                    if (!sameWorkspace(inst.workspace, process.cwd()))
-                        continue;
-                    for (const s of inst.sessions ?? []) {
-                        liveOn.set(s.sessionId, { inst, running: s.status === "running" });
-                    }
-                }
-            }
-            catch {
-                // hub unreachable — local list only
-            }
-        }
-        for (const [sid, { inst, running }] of liveOn) {
-            const existing = items.find((s) => s.sessionId === sid);
-            const meta = inst.sessions?.find((s) => s.sessionId === sid);
-            if (existing) {
-                existing.live = true;
-                existing.running = running;
-                existing.title = existing.title ?? meta?.title ?? null;
-                existing.updatedAt = existing.updatedAt ?? meta?.updatedAt ?? null;
-            }
-            else {
-                items.push({
-                    sessionId: sid,
-                    cwd: inst.workspace ?? "",
-                    title: meta?.title ?? null,
-                    updatedAt: meta?.updatedAt ?? null,
-                    live: true,
-                    running,
-                });
-            }
-        }
-        if (items.length === 0) {
-            entries = [...entries, { kind: "note", text: "no previous sessions in this project yet" }];
-            rerender();
-            return;
-        }
-        const sid = await new Promise((resolve) => {
-            sessionPickResolver = resolve;
-            sessionPick = { items };
-            rerender();
-        });
-        sessionPick = null;
-        sessionPickResolver = null;
-        rerender();
-        const picked = items.find((s) => s.sessionId === sid);
-        if (sid && picked) {
-            resumedDuringStartup = true;
-            const live = liveOn.get(sid);
-            if (hubRef && live)
-                await attachRemote(picked, live.inst);
-            else
-                await resumeInto(picked);
-        }
-    }
-    /**
-     * Swap the live session for a loaded one. The bridge streams the whole
-     * conversation back as `session/update` notifications before resolving the
-     * `session/load` request, so an ActiveSession must be attached BEFORE the
-     * request goes out or every replayed message is dropped by the SDK's
-     * update router. `attachSession` is @internal in the typings but stable at
-     * runtime — the only client-side path from a raw sessionId to update
-     * routing (`buildSession().start()` only covers session/new). Resolves
-     * "loaded" once the restored history is seeded, "failed" when the load
-     * request errored (a note is printed; the attached session stays put —
-     * the caller decides any fallback), "superseded" when another swap went
-     * first and owns the state now.
-     */
-    async function resumeInto(picked) {
-        const gen = ++swapGen;
-        const loaded = cx.attachSession({ sessionId: picked.sessionId });
-        // Switching to a LOCAL session tears down any hub attach first: its
-        // socket, connection context, and permission-handler slot must not
-        // outlive the swap.
-        closeRemoteAttach();
-        activeSession?.dispose();
-        activeSession = loaded;
-        replayTurn = createTurnState();
-        replayMode = true;
-        loadSettled = false;
-        // Paint the restoring-history hint BEFORE the (long) load round-trip.
-        rerender();
-        let resumeMeta = null;
-        try {
-            const resp = (await cx.request("session/load", {
-                sessionId: picked.sessionId,
-                cwd: process.cwd(),
-                mcpServers: [],
-                // Tail replay (ADR-0003): bounded recent history instead of the full
-                // transcript — the REPL scrollback doesn't need 10k lines at once.
-                _meta: { zcode: { limit: RESUME_TAIL_LIMIT } },
-            }));
-            if (gen !== swapGen)
-                return "superseded"; // another swap went first — this load is stale
-            status = seedStatusFromNewSession(status, resp);
-            resumeMeta = resp.replayMeta ?? null;
-        }
-        catch (err) {
-            if (gen !== swapGen)
-                return "superseded"; // stale — another swap owns the state now
-            replayMode = false;
-            replayTurn = null;
-            entries = [
-                ...entries,
-                {
-                    kind: "note",
-                    text: `resume failed: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ];
-            rerender();
-            return "failed";
-        }
-        finally {
-            // Same generation guard as attachRemote: a stale resume resolving after
-            // a newer swap must not end that swap's replay drain early.
-            if (gen === swapGen)
-                loadSettled = true;
-        }
-        const title = picked.title?.trim() || picked.sessionId.slice(0, 8);
-        const m = resumeMeta;
-        // Loaded mid-turn (e.g. a hub client prompted this local bridge while the
-        // REPL was detached): the running flag rides the load response — no start
-        // notification will fire for an already-started turn.
-        if (m?.turnActive && !turnActive) {
-            turn = createTurnState();
-            turnActive = true;
-        }
-        const truncated = m?.hasMore && typeof m.replayedMessages === "number" && typeof m.totalMessages === "number"
-            ? ` — showing last ${m.replayedMessages} of ${m.totalMessages} messages`
-            : "";
-        entries = [
-            ...entries,
-            { kind: "note", text: `resumed "${title}"${truncated || " — history restored above"}` },
-        ];
-        rerender();
-        return "loaded";
-    }
-    /**
-     * Client-side teardown of a hub-proxied attach. Never touches the owning
-     * bridge: closing the proxied socket just removes this client from the
-     * owner's broadcast registry — the session (and any turn on it) continues.
-     */
-    function closeRemoteAttach() {
-        if (!remote)
-            return;
-        try {
-            remote.ws.close();
-        }
-        catch {
-            // ignore
-        }
-        remote = null;
-        activeCx = null;
-    }
-    /**
-     * Attach to a session live on ANOTHER bridge instance through the hub's WS
-     * proxy (ADR-0018): the REPL becomes a second ACP client at the owner, so
-     * replay and live stream are native client fan-out — the only way to watch
-     * a session another process is driving (the CLI's own backend holds just a
-     * frozen resident snapshot of those). Any failure falls back to the plain
-     * local resume.
-     */
-    async function attachRemote(picked, inst) {
-        if (!hubRef)
-            return;
-        const gen = ++swapGen;
-        let socket = null;
-        // A remote client can race a prompt into the CURRENT session during the
-        // attach's await windows; swapping then would orphan that turn (same
-        // discipline as /new) — bail out and stay put instead.
-        const racedTurn = () => {
-            if (gen !== swapGen) {
-                socket?.ws.close();
-                return true;
-            }
-            if (turnActive) {
-                socket?.ws.close();
-                entries = [
-                    ...entries,
-                    { kind: "note", text: "a turn started while attaching — staying in the current session" },
-                ];
-                rerender();
-                return true;
-            }
-            return false;
-        };
-        try {
-            socket = await openHubSocket(hubRef, inst.id, REMOTE_OPEN_TIMEOUT_MS);
-            const sock = socket;
-            if (racedTurn())
-                return;
-            const rapp = buildConnection(acp.ndJsonStream(Writable.toWeb(sock.duplex), Readable.toWeb(sock.duplex)));
-            const rcx = rapp.agent;
-            // The bridge answers only initialize until the handshake completes —
-            // same requirement as the local connection's startup.
-            await rcx.request("initialize", {
-                protocolVersion: 1,
-                clientCapabilities: {
-                    fs: { readTextFile: false, writeTextFile: false },
-                    elicitation: { form: {} },
-                },
-                clientInfo: { name: "zcode-acp", title: "zcode-acp REPL", version: AGENT_INFO.version },
-            });
-            if (racedTurn())
-                return;
-            // Attach BEFORE the load request goes out — same ordering constraint as
-            // the local resume, or every replayed update is dropped by the SDK's
-            // update router.
-            const loaded = rcx.attachSession({ sessionId: picked.sessionId });
-            // Loss detection: the hub or the owning bridge going away must not leave
-            // a frozen "live" view (or the pump spinning on a dead read).
-            sock.ws.once("close", () => {
-                // Recovery only when THIS socket is still the active attach. The
-                // generation is deliberately not consulted: if a second attach is
-                // still mid-flight, the first attach's session IS the live view, so
-                // its loss must recover; once another attach (or /new) owns the slot,
-                // the ws identity check is what makes this handler inert.
-                if (remote?.ws !== sock.ws)
-                    return;
-                remote = null;
-                activeCx = null;
-                // The remote stream is dead — no stop or turnState will ever arrive,
-                // so any open turn UI is force-closed here rather than left spinning.
-                if (turnActive) {
-                    entries = [
-                        ...entries,
-                        ...finishTurn(turn ?? createTurnState(), "remote connection lost"),
-                    ];
-                    turn = null;
-                    turnActive = false;
-                    promptInFlight = false;
-                }
-                entries = [
-                    ...entries,
-                    {
-                        kind: "note",
-                        text: "remote attach lost — starting a fresh local session (use /sessions to reload)",
-                    },
-                ];
-                rerender();
-                void startFreshSession();
-            });
-            // Any previous attach is torn down first — its socket, its connection
-            // context, and its permission-handler slot all go with it.
-            closeRemoteAttach();
-            activeSession?.dispose();
-            activeSession = loaded;
-            activeCx = rcx;
-            remote = { ws: sock.ws, duplex: sock.duplex };
-            replayTurn = createTurnState();
-            replayMode = true;
-            loadSettled = false;
-            rerender();
-            let resp;
-            try {
-                resp = (await rcx.request("session/load", {
-                    sessionId: picked.sessionId,
-                    cwd: process.cwd(),
-                    mcpServers: [],
-                    // Tail replay (ADR-0003), same bound as the local resume.
-                    _meta: { zcode: { limit: RESUME_TAIL_LIMIT } },
-                }));
-            }
-            finally {
-                // The whole backlog is queued once the load resolves — without this
-                // the pump waits for a quiet window that never opens. Generation
-                // guarded: a stale load resolving after a newer swap (which owns the
-                // flag now) must not end that swap's replay drain early.
-                if (gen === swapGen)
-                    loadSettled = true;
-            }
-            if (gen !== swapGen)
-                return; // stale — another swap owns the state now
-            status = seedStatusFromNewSession(status, resp);
-            const m = resp.replayMeta ?? null;
-            // A turn already running at attach time (the mobile mid-turn — the main
-            // scenario) never sends a start notification we could hear; this flag in
-            // the load response is the only signal.
-            if (m?.turnActive && !turnActive) {
-                turn = createTurnState();
-                turnActive = true;
-            }
-            const title = picked.title?.trim() || picked.sessionId.slice(0, 8);
-            const truncated = m?.hasMore && typeof m.replayedMessages === "number" && typeof m.totalMessages === "number"
-                ? ` — showing last ${m.replayedMessages} of ${m.totalMessages} messages`
-                : "";
-            entries = [
-                ...entries,
-                {
-                    kind: "note",
-                    text: `attached live "${title}" via hub (${inst.origin ?? "remote"} instance ${inst.id.slice(0, 8)})${truncated}`,
-                },
-            ];
-            rerender();
-        }
-        catch (err) {
-            const why = err instanceof Error ? err.message : String(err);
-            if (gen !== swapGen)
-                return; // another swap owns the state now
-            try {
-                socket?.ws.close();
-            }
-            catch {
-                // ignore
-            }
-            // Only this attach's own state may be cleared here: a failure BEFORE
-            // installation leaves the previous attach's socket live in `remote`,
-            // and clearing it would orphan that ws (its permission fan-out would
-            // keep reaching this REPL with nothing left to close it).
-            if (socket && remote?.ws === socket.ws) {
-                remote = null;
-                activeCx = null;
-            }
-            entries = [
-                ...entries,
-                { kind: "note", text: `remote attach failed (${why}) — loading locally instead` },
-            ];
-            rerender();
-            // Fall back to the plain local load. If the swap had already completed,
-            // resumeInto disposes the (now stream-less) remote session itself; if it
-            // hadn't, it disposes the previous session as any resume would.
-            await resumeInto(picked);
-        }
-    }
-    /** Fresh welcome panel entry; reused by startup and `/new`. */
-    function welcomeEntry() {
-        return {
-            kind: "welcome",
-            info: {
-                version: AGENT_INFO.version,
-                cwd: process.cwd(),
-                model: selectLabel(status.model),
-                mode: selectLabel(status.mode),
-                thought: selectLabel(status.thought),
-                // Live decision (env OR this project's sandbox.json — ADR-0011) so a
-                // project-armed sandbox shows here too; on non-macOS this may warn
-                // alongside the bridge, which is honest about the unsupported request.
-                sandbox: sandboxActive() ? "sandbox: on — writes confined to the workspace" : "",
-            },
-        };
-    }
-    /**
-     * `/new` (ADR-0010): swap the live session for a fresh backend-created one,
-     * strictly client-side — routing the command to the backend's slash
-     * interception would rotate the session id out from under the update pump.
-     * Reuses the session/new bootstrap; the swap refuses while a turn runs or
-     * startup is still in flight (same preempt discipline as /sessions).
-     */
-    async function startFreshSession() {
-        if (busy || turnActive) {
-            entries = [
-                ...entries,
-                { kind: "user", text: "/new" },
-                {
-                    kind: "note",
-                    text: turnActive
-                        ? "a turn is running — esc interrupts it first"
-                        : "still starting up — try /new again in a moment",
-                },
-            ];
-            rerender();
-            return;
-        }
-        const gen = ++swapGen;
-        try {
-            const fresh = await cx.buildSession(process.cwd()).start();
-            if (gen !== swapGen) {
-                fresh.dispose(); // another swap went first — this placeholder is junk
-                return;
-            }
-            if (turnActive) {
-                // A turn raced into the old session during the session/new roundtrip
-                // (a local submit or a remote client). Swapping now would orphan it:
-                // disposing the session takes its update pump down and the
-                // completion event is filtered by session id, so turnActive would
-                // stick forever and wedge the REPL. Keep the current session.
-                fresh.dispose();
-                entries = [
-                    ...entries,
-                    { kind: "user", text: "/new" },
-                    {
-                        kind: "note",
-                        text: "a turn started while /new was swapping — staying in the current session",
-                    },
-                ];
-                rerender();
-                return;
-            }
-            // `/new` means a fresh LOCAL session: a hub-proxied attach is torn down
-            // first (client-side only — the owner keeps running).
-            closeRemoteAttach();
-            activeSession?.dispose();
-            activeSession = fresh;
-            status = seedStatusFromNewSession(status, fresh.newSessionResponse);
-            // Any in-flight /sessions replay is dead: its pump read fails into the
-            // catch/re-arm path, and its stale continuations bail on swapGen.
-            replayMode = false;
-            replayTurn = null;
-            loadSettled = true;
-            // Native-scrollback model: entries are APPEND-ONLY — ink <Static> has
-            // already printed everything before its print cursor, so shrinking the
-            // array would silently drop the divider. The old conversation stays in
-            // the terminal's own history (that's the model's whole point).
-            entries = [
-                ...entries,
-                { kind: "user", text: "/new" },
-                {
-                    kind: "note",
-                    text: "── new session started — the previous conversation stays in /sessions ──",
-                },
-            ];
-            editor = createLineEditor();
-            rerender();
-        }
-        catch (err) {
-            entries = [
-                ...entries,
-                { kind: "user", text: "/new" },
-                {
-                    kind: "note",
-                    text: `failed to start a new session: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ];
-            rerender();
-        }
-    }
-    // Terminal resize: the dynamic footer re-wraps at the new width via a
-    // plain rerender. Already-printed scrollback keeps its old wrapping —
-    // that's exactly how native-history CLIs (Claude Code et al.) behave.
-    const onResize = () => {
-        if (exited)
-            return;
-        rerender();
-    };
-    if (process.stdout.isTTY)
-        process.stdout.on("resize", onResize);
-    function cleanup(code) {
-        if (exited)
-            return;
-        exited = true;
-        try {
-            if (quotaTimer !== null)
-                clearInterval(quotaTimer);
-            quotaTimer = null;
-        }
-        catch {
-            // ignore
-        }
-        try {
-            process.stdout.off("resize", onResize);
-        }
-        catch {
-            // ignore
-        }
-        // Each step is guarded: one throwing (e.g. unmount during a render) must
-        // not skip the child shutdown and leave the process hanging.
-        try {
-            activeSession?.dispose();
-        }
-        catch {
-            // ignore
-        }
-        try {
-            // Closing the proxied socket only detaches this client — the owning
-            // serve bridge and its session are never touched from here.
-            closeRemoteAttach();
-        }
-        catch {
-            // ignore
-        }
-        try {
-            ink.unmount();
-        }
-        catch {
-            // ignore
-        }
-        try {
-            // Graceful path: closing stdin triggers the bridge's own shutdown,
-            // which reaps the zcode backend group.
-            child.stdin?.end();
-        }
-        catch {
-            // ignore
-        }
-        setTimeout(() => child.kill("SIGKILL"), 3000).unref();
-        // Hard fallback: if the bridge ignores stdin-close shutdown (or the exit
-        // event is lost), the REPL still exits instead of hanging forever.
-        setTimeout(() => process.exit(code), 5000);
-        child.once("exit", () => {
-            if (code !== 0 && stderrTail.trim()) {
-                process.stderr.write(`\nbridge stderr tail:\n${stderrTail}\n`);
-            }
-            process.exit(code);
-        });
-    }
-    // Bridge died under us (crash, backend failure) — report and exit hard.
-    child.once("exit", (code) => {
-        if (exited)
-            return;
-        exited = true;
-        ink.unmount();
-        process.stderr.write(`bridge exited unexpectedly (code ${code})\n${stderrTail.trim() ? `stderr tail:\n${stderrTail}` : ""}\n`);
-        process.exit(1);
-    });
-    // Welcome panel as the first transcript entry — branding, session info,
-    // seeded config, and key hints; pushed into scrollback by the first prompt.
-    entries = [welcomeEntry()];
-    rerender();
-}
-//# sourceMappingURL=run.js.map