zidane 7.2.5 → 8.0.4

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022-present Yaël GUILLOUX
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -37,6 +37,12 @@ bun run auth                                    # Anthropic + OpenAI Codex OAuth
 bun start --prompt "create a hello world app"
 ```
 
+The chat host on a server (`zidane-server`; TUI and desktop windows attach over WebSocket): the image `ghcr.io/tahul/zidane-server` (`linux/amd64`, `linux/arm64`) or the binaries attached to each [GitHub release](https://github.com/Tahul/zidane/releases). See [SERVER.md](./docs/SERVER.md#install).
+
+```bash
+docker run -d --name zidane -v zidane-data:/data -p 127.0.0.1:4280:4280 ghcr.io/tahul/zidane-server:7.2
+```
+
 ## Agent Setup
 
 ```ts
@@ -83,7 +89,9 @@ createAgent({
     compactStrategy: 'off',          // 'off' | 'tail' (non-Anthropic compaction)
     compactThreshold: 131_072,       // 128 KiB
     compactKeepTurns: 4,
-    mediaKeepTurns: undefined,       // age old image/document base64 off the wire; chat profiles use 8
+    mediaKeepTurns: undefined,       // age image/document base64 off the wire after N messages; wins over mediaBudget
+    mediaBudget: undefined,          // keep media inline until near the provider's caps; chat profiles use { maxItems: 80, maxBytes: 20 MiB }
+    maxImageEdge: undefined,         // shrink oversize PNGs once, at entry; chat profiles use 2000
     autoCompact: false,              // loop-native LLM summary at N% of the window; chat profiles enable it
     toolDisclosure: 'eager',         // 'eager' | 'lazy' (hide MCP schemas behind tool_search)
     toolSearch: { tool: true, limit: 20, mode: 'unlock' }, // 'dispatch' = stable tool list via call_tool
@@ -181,6 +189,16 @@ Credentials come from Zidane's app credential store (`~/.zidane/credentials.json
 
 For Zed config, model selection, stdio framing details, session persistence, and in-process usage via `zidane/acp`, see [docs/ACP.md](./docs/ACP.md).
 
+### Vim / Neovim
+
+`editors/vim` is a Vim 9 / Neovim 0.9+ plugin built on `zidane-acp`. It gives you a quick panel you can pop over any window (buffers, NERDTree, netrw, …), with editor tools so the agent can inspect your setup, read `:help`, and run commands once you approve them.
+
+```vim
+Plug 'Tahul/zidane', { 'rtp': 'editors/vim' }
+```
+
+`<Leader>z` or `:Zidane [prompt]` opens it; a visual selection is sent as context. See `:help zidane`.
+
 ## Providers
 
 All providers accept runtime credentials via params. Env vars are fallbacks.
@@ -405,7 +423,13 @@ agent.hooks.hook('context:transform', (ctx) => {
 
 `behavior.compactStrategy: 'tail'` elides older `tool_result` blocks once their combined size exceeds `compactThreshold` (default 128 KiB); the newest `compactKeepTurns` (default 4) stay intact. Anthropic users should prefer the server-side `context-management-2025-06-27` beta via `anthropic({ extraBetas, contextManagement })` — token-accurate.
 
-`behavior.mediaKeepTurns` is separate: it ages old inline image/document base64 off the provider wire while keeping bytes in `session.turns`. Aged media becomes an `attachment://<hash>` marker that `read_file path="attachment://..."` can re-inline. SDK default is off; built-in chat profiles set it to `8`. Proactive age-out only runs when `read_file` is registered.
+Media has its own knobs. Aged media becomes an `attachment://<hash>` marker on the wire that `read_file path="attachment://..."` can re-inline; `session.turns` keeps the bytes.
+
+- `behavior.mediaBudget` keeps inline images/documents on the wire until a request nears the provider's hard limits (`maxItems` blocks or `maxBytes` of base64), then ages out the oldest in steps of half the limit. Each age-out rewrites an earlier message and resets the prompt cache, so batching them is what keeps long image-heavy sessions cheap. `maxItems` drops to the provider's `capabilities.maxMediaPerRequest` when lower (Bedrock: 20). Built-in chat profiles, `runHeadless` and `restateBehavior()` use `{ maxItems: 80, maxBytes: 20 MiB }`.
+- `behavior.maxImageEdge` shrinks PNGs larger than N px on their longest edge once, when they enter the session, with a built-in `node:zlib` codec (no native dependency). Those defaults use `2000`: past it, a request carrying more than 20 images is rejected.
+- `behavior.mediaKeepTurns` is the older positional policy: media older than N messages ages out. It takes precedence over `mediaBudget` when set, and only runs when `read_file` is registered.
+
+All three are off in the SDK by default.
 
 `behavior.autoCompact` is the heavy lever: loop-native auto-compaction. Once a turn's effective input crosses `threshold` (default `0.85`) of the context window, the loop runs a real LLM summary over the older turns, appends a `compact-summary` marker + file/skill restoration to the session, and continues — mid-run and at end-of-run. Window source is `autoCompact.contextWindow` → `provider.meta.contextWindow` (inert without one). Observe via the `compact:start` / `compact:end` hooks. SDK default off; chat profiles enable it. Distinct from `compactStrategy` (per-turn wire-only `tool_result` trim) and the always-on reactive `context_exceeded` recovery.
 
@@ -413,16 +437,18 @@ agent.hooks.hook('context:transform', (ctx) => {
 
 `behavior.elideStaleReads` decides what happens when an `edit` / `multi_edit` / `write_file` succeeds on a file the model read earlier in the run:
 
-- `'notice'` — append-only: a persisted `<system-reminder>` naming the stale path rides the mutating tool's own result. Never rewrites cached prefix bytes, so the prompt cache is untouched. The built-in chat profiles ship this.
+- `'notice'` — append-only: a persisted `<system-reminder>` naming the stale path rides the mutating tool's own result. Never rewrites cached prefix bytes, so the prompt cache is untouched.
 - `'stub'` (or legacy `true`) — replace the stale read's output on the wire with a short stub. Reclaims the stale bytes from context, but each newly-stale read re-bills the conversation at the cache-write rate — only worth it under real context-window pressure.
-- `false` (default) — off. Detection is identical in both modes (success markers only; failed edits and no-op writes stale nothing), and dedup honesty around mutations holds in **every** mode — see below.
+- `false` (default; also what the built-in chat profiles ship) — off. Detection is identical in both modes (success markers only; failed edits and no-op writes stale nothing), and dedup honesty around mutations holds in **every** mode — see below.
 
 See `docs/ARCHITECTURE.md` § *Cache-stable configuration* for the measured economics.
 
 ### Read dedup + read-before-edit guard
 
 - `behavior.dedupReads` (default **on**) — `read_file` returns `"unchanged since the previous read"` on identical re-reads. Per-session content-hash. Mutations are honest by construction: after an `edit`/`multi_edit`/`write_file` touches a file, the next re-read serves the full fresh body instead of the stub, then dedup resumes.
-- `behavior.requireReadBeforeEdit` (default **off** in the SDK core; **on** in the built-in `BUILD_AGENT` / `PLAN_AGENT` chat profiles) — `edit` / `multi_edit` reject when the file hasn't been read this session or has drifted. The refusal is a recoverable `tool_result` (tells the model to `read_file` first), and `write_file` seeds read-state so the write→edit flow needs no extra read.
+- `behavior.requireReadBeforeEdit` (default **off**, including the built-in chat profiles) — `edit` / `multi_edit` reject when the file hasn't been read this session or has drifted. The refusal is a recoverable `tool_result` (tells the model to `read_file` first), and `write_file` seeds read-state so the write→edit flow needs no extra read.
+- `behavior.trackShellReads` (default **off**) — with the gate on, plain shell reads (`cat`, `head`, `tail`, `nl`, `sed -n '<range>p'`) also count as reads, so the gate stops refusing files the model inspected through `shell`.
+- `behavior.shellToolNudges` (default **off**; **on** in the chat profiles) — when a `shell` call does a pure read, a pure search, or a scripted file edit, append one line pointing at `read_file` / `grep` / `edit`, at most `maxPerKind` (2) times per kind per session.
 - `behavior.repeatGuard` (default **off** in the SDK core; **on** in the chat profiles) — breaks consecutive-identical tool streaks: blocks the Nth back-to-back identical call (default 4) with a pivot suggestion, aborts the run at the Mth (default 8) via the agent's `AbortController`. Defaults track the built-in `shell` + `read_file` tools; configurable via `RepeatGuardConfig`.
 
 Tracking and the dedup short-circuit are **independent** — turning `dedupReads` off does NOT disable `requireReadBeforeEdit`. Read-state keys are canonical absolute paths (resolved through `node:path`), so `read_file('src/x')` and `edit('./src/x', …)` resolve to the same entry. For subagent-shared tracking without shared turn history, use `createSpawnTool({ shareReadState: true })`.
@@ -938,6 +964,8 @@ Full index with a "where does X live" map: [docs/README.md](./docs/README.md).
 | Chat + surfaces | [CHAT.md](./docs/CHAT.md) | `zidane/chat`: renderer-agnostic engine — config, sessions, settings, safe mode, todos, commands, completion. |
 | Chat + surfaces | [TUI.md](./docs/TUI.md) | `zidane/tui`: terminal shell — screens, keybindings, modals, theming, file layout. |
 | Chat + surfaces | [IPC.md](./docs/IPC.md) | `zidane/ipc`: shared chat host + daemon; every RPC and signal; TUI/GUI parity. |
+| Chat + surfaces | [SERVER.md](./docs/SERVER.md) | `zidane-server`: the chat host on a remote machine ([GHCR image, release binaries](./docs/SERVER.md#install), [Coolify](./docs/SERVER.md#deploy-on-coolify), TLS/proxy, tokens, security, operations). |
+| Chat + surfaces | [MACHINES.md](./docs/MACHINES.md) | Machines: a computer lends a host its folders and shell (`local@laptop`, `zidane machine share`, "share this computer"), or a server lends itself to a local host (`local@server`); protocol, offline semantics, project files, sandbox, security. |
 | Chat + surfaces | [ARTIFACTS.md](./docs/ARTIFACTS.md) | Session artifacts: what a session produced (PRs, branches, commits, files) — model, producers, surfaces, IPC. |
 | Chat + surfaces | [EXTENSIONS.md](./docs/EXTENSIONS.md) | User extensions: `defineExtension`, the full `ctx` API, discovery, installing, authoring patterns. |
 | Integrations | [PLUGINS.md](./docs/PLUGINS.md) | `zidane/plugins`: Agent Plugins 1.0.0 loader (skills + MCP servers as portable packages). |
@@ -946,4 +974,4 @@ Full index with a "where does X live" map: [docs/README.md](./docs/README.md).
 
 ## License
 
-ISC
+MIT

package/dist/{acp-D-tVyUjw.js → acp-DQDhi2dj.js}

@@ -1,16 +1,20 @@
-import { P as defaultPromptMessage } from "./openai-compat-Dy56weK8.js";
-import { u as toolResultToText } from "./types-CWgENVLY.js";
-import { Ct as basic_default, or as readStateKey, rr as hashContent, sr as resolveReadStateMap, t as createAgent } from "./agent-D0zZnGbt.js";
-import { r as createProcessContext } from "./contexts-CRE9pw07.js";
+import { At as basic_default, Kt as wholeReadRefusal, t as createAgent } from "./agent-DSLNmBp0.js";
 import { u as errorMessage } from "./errors-DKiMrOKq.js";
-import { o as loadSession, t as createSession } from "./session-BqRP1hS7.js";
+import { d as toolResultToText, o as isThinkingLevel } from "./types-Cu0ZGDu9.js";
+import { a as projectRootOf, t as findGitRoot } from "./project-root-B8zADr4o.js";
+import { a as readFileTargets, r as readFileBatchHeader } from "./format-bytes-C7tfc3Zm.js";
+import { D as resolveReadStateMap, E as readStateKey, x as hashContent } from "./tool-state-Dku6YqAB.js";
+import { F as defaultPromptMessage } from "./openai-compat-CFrpH7uq.js";
+import { o as loadSession } from "./session-xh9JXu6i.js";
 import { t as effectiveInputFromTurn } from "./stats-DAKBEKjc.js";
-import { a as successResponse, i as errorResponse, r as createJsonRpcConnection } from "./json-rpc-rSWMUh9b.js";
-import { r as fetchUrl } from "./fetch-url-DX75gpL0.js";
+import { t as createProcessContext } from "./contexts-d7UolYot.js";
+import { a as errorResponse, o as successResponse, r as createJsonRpcConnection } from "./json-rpc--HXQti1E.js";
+import { r as fetchUrl } from "./fetch-url-Ct2TjDWt.js";
 import { webSearch } from "./tools/web-search.js";
-import { basename, resolve } from "node:path";
+import { o as newSession } from "./session-factory-BUGY5P40.js";
 import { Buffer } from "node:buffer";
 import { readFileSync } from "node:fs";
+import { basename, resolve } from "node:path";
 import { parseArgs } from "node:util";
 //#region src/start/shared-options.ts
 const validThinkingLevels = [
@@ -366,6 +370,109 @@ function parseHeaderArgs(raw, flag) {
 	return headers;
 }
 //#endregion
+//#region src/acp/client-declared-tools.ts
+/** JSON-RPC method the agent sends to the client to run a client-declared tool. */
+const CLIENT_TOOL_CALL_METHOD = "_zidane/tool_call";
+/** Notification the agent sends when it abandons a pending {@link CLIENT_TOOL_CALL_METHOD}. */
+const CLIENT_TOOL_CANCEL_METHOD = "_zidane/tool_call_cancel";
+const TOOL_NAME_PATTERN = /^[a-z][\w-]{0,63}$/i;
+/** Malformed or colliding `_meta.zidane.clientTools`. */
+var ClientToolSpecError = class extends Error {
+	code = -32602;
+};
+/**
+* Validate `_meta.zidane.clientTools`. Returns `undefined` when the key is
+* absent (so resume can keep the existing set) and throws on malformed specs.
+*/
+function parseClientToolSpecs(meta) {
+	const zidane = meta?.zidane;
+	if (zidane === void 0 || zidane === null) return void 0;
+	if (!isRecord$1(zidane)) throw new ClientToolSpecError("_meta.zidane must be an object.");
+	const raw = zidane.clientTools;
+	if (raw === void 0) return void 0;
+	if (!Array.isArray(raw)) throw new ClientToolSpecError("_meta.zidane.clientTools must be an array.");
+	const seen = /* @__PURE__ */ new Set();
+	return raw.map((entry, index) => {
+		if (!isRecord$1(entry)) throw new ClientToolSpecError(`clientTools[${index}] must be an object.`);
+		const { name, description, inputSchema, mutating } = entry;
+		if (typeof name !== "string" || !TOOL_NAME_PATTERN.test(name)) throw new ClientToolSpecError(`clientTools[${index}].name must match ${TOOL_NAME_PATTERN}.`);
+		if (seen.has(name)) throw new ClientToolSpecError(`Duplicate client tool: ${name}`);
+		seen.add(name);
+		if (typeof description !== "string" || description.length === 0) throw new ClientToolSpecError(`clientTools[${index}].description must be a non-empty string.`);
+		if (inputSchema !== void 0 && (!isRecord$1(inputSchema) || inputSchema.type !== "object")) throw new ClientToolSpecError(`clientTools[${index}].inputSchema must be a JSON Schema with type "object".`);
+		if (mutating !== void 0 && typeof mutating !== "boolean") throw new ClientToolSpecError(`clientTools[${index}].mutating must be a boolean.`);
+		return {
+			name,
+			description,
+			inputSchema: inputSchema ?? {
+				type: "object",
+				properties: {}
+			},
+			mutating: mutating ?? false
+		};
+	});
+}
+/** Client tools may add to the host tool set, never shadow it. */
+function assertNoClientToolClash(hostTools, specs) {
+	const taken = /* @__PURE__ */ new Set();
+	for (const [key, tool] of Object.entries(hostTools ?? {})) {
+		taken.add(key);
+		taken.add(tool.spec.name);
+	}
+	const clash = specs.find((spec) => taken.has(spec.name));
+	if (clash) throw new ClientToolSpecError(`Client tool "${clash.name}" collides with a built-in tool.`);
+}
+function createClientDeclaredTools(specs, options) {
+	const tools = {};
+	for (const spec of specs) tools[spec.name] = {
+		spec: {
+			name: spec.name,
+			description: spec.description,
+			inputSchema: spec.inputSchema
+		},
+		async execute(input, ctx) {
+			const response = await raceAbort(options.client.sendRequest(CLIENT_TOOL_CALL_METHOD, {
+				sessionId: options.sessionId,
+				toolCallId: ctx.callId,
+				name: spec.name,
+				input
+			}), ctx.signal, () => notifyCancel(options, ctx.callId));
+			const content = typeof response?.content === "string" ? response.content : "";
+			if (response?.isError === true) throw new Error(content || `${spec.name} failed in the client.`);
+			return content;
+		}
+	};
+	return tools;
+}
+function notifyCancel(options, toolCallId) {
+	try {
+		Promise.resolve(options.client.sendNotification(CLIENT_TOOL_CANCEL_METHOD, {
+			sessionId: options.sessionId,
+			toolCallId
+		})).catch(() => {});
+	} catch {}
+}
+function raceAbort(promise, signal, onCancel) {
+	if (signal.aborted) return Promise.reject(signal.reason ?? /* @__PURE__ */ new Error("Aborted."));
+	return new Promise((resolve, reject) => {
+		const onAbort = () => {
+			onCancel();
+			reject(signal.reason ?? /* @__PURE__ */ new Error("Aborted."));
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
+		promise.then((value) => {
+			signal.removeEventListener("abort", onAbort);
+			resolve(value);
+		}, (err) => {
+			signal.removeEventListener("abort", onAbort);
+			reject(err);
+		});
+	});
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
 //#region src/acp/mapping.ts
 function acpMcpServersToZidane(servers) {
 	if (!servers) return [];
@@ -482,7 +589,6 @@ function acpPromptToPromptParts(prompt) {
 				type: "text",
 				text: JSON.stringify(block)
 			});
-			break;
 	}
 	return {
 		prompt: parts,
@@ -694,24 +800,57 @@ function findToolEntry(tools, canonicalName) {
 	return null;
 }
 function wrapReadFile(base, options) {
-	return {
-		...base,
-		async execute(input, ctx) {
-			const path = typeof input.path === "string" ? input.path : "";
-			if (!path) return "Read error: missing path.";
-			const absPath = resolveAcpPath(ctx.handle.cwd, path);
-			const line = lineOrDefault(input.offset);
-			const limit = positiveNumberOrNull(input.limit);
+	const readOne = async (input, ctx) => {
+		const path = typeof input.path === "string" ? input.path : "";
+		if (!path) return "Read error: missing path.";
+		const absPath = resolveAcpPath(ctx.handle.cwd, path);
+		const limit = positiveNumberOrNull(input.limit);
+		const fromEnd = typeof input.offset === "number" && Number.isFinite(input.offset) && input.offset < 0;
+		let line = lineOrDefault(input.offset);
+		let content;
+		if (fromEnd) {
+			const refusal = await wholeReadRefusal(ctx.execution, ctx.handle, path, "read");
+			if (refusal) return refusal;
+			const response = await options.client.sendRequest("fs/read_text_file", {
+				sessionId: options.sessionId,
+				path: absPath
+			});
+			const whole = typeof response.content === "string" ? response.content : "";
+			const lines = whole.split("\n");
+			if (whole.endsWith("\n")) lines.pop();
+			line = Math.max(1, lines.length + Math.floor(input.offset) + 1);
+			content = lines.slice(line - 1, limit !== null ? line - 1 + limit : void 0).join("\n");
+		} else {
 			const response = await options.client.sendRequest("fs/read_text_file", {
 				sessionId: options.sessionId,
 				path: absPath,
 				line,
 				...limit !== null ? { limit } : {}
 			});
-			const content = typeof response.content === "string" ? response.content : "";
-			seedReadState(ctx, absPath, content, line ?? 1, limit ?? Number.POSITIVE_INFINITY);
-			if (input.lineNumbers === false) return content;
-			return withLineNumbers(content, line ?? 1);
+			content = typeof response.content === "string" ? response.content : "";
+		}
+		seedReadState(ctx, absPath, content, line, limit ?? Number.POSITIVE_INFINITY);
+		if (input.lineNumbers === false) return content;
+		return withLineNumbers(content, line);
+	};
+	return {
+		...base,
+		async execute(input, ctx) {
+			if (input.paths === void 0) return readOne(input, ctx);
+			if (Array.isArray(input.paths) && input.paths.length > 20) return `Read error: \`paths\` holds ${input.paths.length} entries; the limit is 20 per call. Split the batch.`;
+			const targets = readFileTargets(input);
+			if (targets.length === 0) return "Read error: `paths` must be a non-empty array of `{ path, offset?, limit? }` entries.";
+			const sections = [];
+			for (const target of targets) {
+				const body = await readOne({
+					path: target.path,
+					offset: target.offset,
+					limit: target.limit,
+					lineNumbers: input.lineNumbers
+				}, ctx);
+				sections.push(`${readFileBatchHeader(target.path)}\n${body}`);
+			}
+			return sections.join("\n\n");
 		}
 	};
 }
@@ -814,14 +953,6 @@ function seedReadState(ctx, path, content, offset, limit) {
 		mtimeMs: Date.now()
 	});
 }
-//#endregion
-//#region src/acp/server.ts
-const ACP_AGENT_VERSION = "1";
-const MODEL_CONFIG_ID = "model";
-const MODE_CONFIG_ID = "mode";
-const THINKING_CONFIG_ID = "thinking";
-const MODEL_OPTION_CONFIG_PREFIX = "model_option:";
-const PLAN_MODE_ID = "plan";
 const PLAN_READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
 	"read_file",
 	"list_files",
@@ -831,6 +962,22 @@ const PLAN_READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
 	"fetch_url",
 	"skills_read"
 ]);
+/** Plan mode keeps the read-only built-ins plus client tools not marked `mutating`. */
+function filterPlanTools(runtime) {
+	const filtered = {};
+	for (const [key, tool] of Object.entries(runtime.tools ?? {})) if (isPlanReadOnlyTool(tool.spec.name, runtime)) filtered[key] = tool;
+	return filtered;
+}
+function isPlanReadOnlyTool(name, runtime) {
+	return PLAN_READ_ONLY_TOOLS.has(name) || runtime.clientTools.some((tool) => tool.name === name && !tool.mutating);
+}
+//#endregion
+//#region src/acp/server.ts
+const ACP_AGENT_VERSION = "1";
+const MODEL_CONFIG_ID = "model";
+const MODE_CONFIG_ID = "mode";
+const THINKING_CONFIG_ID = "thinking";
+const MODEL_OPTION_CONFIG_PREFIX = "model_option:";
 /**
 * Search/fetch tools layered onto the DEFAULT ACP session (i.e. only when the
 * host passes no `preset` of its own). The `basic` preset ships neither — they
@@ -956,7 +1103,10 @@ var AcpServerImpl = class {
 		this.peer = peer;
 	}
 	async handleMessage(message) {
-		if (!isObject(message) || typeof message.method !== "string") return errorResponse(normalizeId("id" in message ? message.id : null), -32600, "Invalid JSON-RPC request.");
+		if (!isObject(message) || typeof message.method !== "string") {
+			const id = "id" in message ? message.id : null;
+			return errorResponse(normalizeId(id), -32600, "Invalid JSON-RPC request.");
+		}
 		if (!("id" in message)) {
 			await this.handleNotification(message.method, message.params);
 			return null;
@@ -1000,10 +1150,7 @@ var AcpServerImpl = class {
 	}
 	async handleNotification(method, params) {
 		switch (method) {
-			case "session/cancel":
-				this.cancel(asObject(params));
-				break;
-			default: break;
+			case "session/cancel": this.cancel(asObject(params));
 		}
 	}
 	initialize(params) {
@@ -1022,7 +1169,8 @@ var AcpServerImpl = class {
 					close: {},
 					additionalDirectories: {}
 				},
-				auth: { ...this.options.logout ? { logout: {} } : {} }
+				auth: { ...this.options.logout ? { logout: {} } : {} },
+				_meta: { zidane: { clientTools: true } }
 			},
 			agentInfo: this.options.agentInfo ?? {
 				name: "zidane",
@@ -1055,7 +1203,8 @@ var AcpServerImpl = class {
 		const runtime = await this.createRuntime({
 			cwd: params.cwd,
 			additionalDirectories: params.additionalDirectories,
-			mcpServers: params.mcpServers ?? []
+			mcpServers: params.mcpServers ?? [],
+			_meta: params._meta
 		}, params.sessionId, true);
 		this.deferAvailableCommands(runtime.sessionId);
 		return this.sessionStateResponse(runtime);
@@ -1092,15 +1241,23 @@ var AcpServerImpl = class {
 			sessions: [...this.sessions.values()].filter((runtime) => !params.cwd || runtime.cwd === params.cwd).map((runtime) => sessionInfo(runtime)),
 			nextCursor: null
 		};
-		const ids = await store.list({
+		const roots = params.cwd ? [.../* @__PURE__ */ new Set([
+			projectRootOf(params.cwd),
+			findGitRoot(params.cwd) ?? params.cwd,
+			params.cwd
+		])] : [void 0];
+		const idLists = await Promise.all(roots.map((root) => store.list({
 			limit: 100,
-			...params.cwd ? { projectRoot: params.cwd } : {}
-		});
+			...root ? { projectRoot: root } : {}
+		})));
+		const ids = [...new Set(idLists.flat())];
 		const sessions = [];
 		for (const id of ids) {
 			const loaded = await store.load(id);
 			if (!loaded) continue;
-			const cwd = loaded.projectRoot ?? params.cwd ?? this.sessions.get(loaded.id)?.cwd;
+			const stampedCwd = typeof loaded.metadata.cwd === "string" && loaded.metadata.cwd ? loaded.metadata.cwd : void 0;
+			if (params.cwd && (stampedCwd ?? loaded.projectRoot) !== params.cwd) continue;
+			const cwd = stampedCwd ?? loaded.projectRoot ?? params.cwd ?? this.sessions.get(loaded.id)?.cwd;
 			if (!cwd) continue;
 			sessions.push({
 				sessionId: loaded.id,
@@ -1243,8 +1400,8 @@ var AcpServerImpl = class {
 		};
 	}
 	toolsForMode(runtime) {
-		if (runtime.modeId !== PLAN_MODE_ID) return {};
-		return { tools: filterPlanTools(runtime.tools) };
+		if (runtime.modeId !== "plan") return {};
+		return { tools: filterPlanTools(runtime) };
 	}
 	refreshModelDependentConfigOptions(runtime, choiceId) {
 		const insertAfter = (option) => option.id === MODEL_CONFIG_ID;
@@ -1316,10 +1473,17 @@ var AcpServerImpl = class {
 				const nextMcpServers = params.mcpServers === void 0 ? existing.mcpServers : acpMcpServersToZidane(params.mcpServers);
 				if (!sameStringArray(existing.additionalDirectories, nextAdditionalDirectories)) throw new AcpProtocolError(-32602, `Session ${requestedSessionId} is already active with different additionalDirectories; close it before resuming with changed roots.`);
 				if (!sameJson(existing.mcpServers, nextMcpServers)) throw new AcpProtocolError(-32602, `Session ${requestedSessionId} is already active with different MCP servers; close it before resuming with changed MCP configuration.`);
+				const nextClientTools = parseClientToolSpecs(params._meta) ?? existing.clientTools;
+				if (!sameJson(existing.clientTools, nextClientTools)) throw new AcpProtocolError(-32602, `Session ${requestedSessionId} is already active with different client tools; close it before resuming with changed tools.`);
 				return existing;
 			}
 		}
 		const mcpServers = acpMcpServersToZidane(params.mcpServers);
+		const clientTools = parseClientToolSpecs(params._meta) ?? [];
+		const base = this.options.preset ?? withAcpDefaultTools(basic_default);
+		const agentOptions = this.options.agentOptions ?? {};
+		const hostTools = mergeTools(base.tools, agentOptions.tools, this.options.tools);
+		assertNoClientToolClash(hostTools, clientTools);
 		const session = await this.resolveSession(requestedSessionId, params.cwd, mustExist);
 		const execution = this.resolveExecution(params);
 		const initialChoiceId = this.defaultModelChoiceId;
@@ -1327,9 +1491,13 @@ var AcpServerImpl = class {
 		const provider = router ? router.provider : this.resolveProvider();
 		const runModel = initialChoiceId !== void 0 ? this.modelChoices.find((choice) => choice.id === initialChoiceId).model : this.options.model;
 		const sessionId = session.id;
-		const base = this.options.preset ?? withAcpDefaultTools(basic_default);
-		const agentOptions = this.options.agentOptions ?? {};
-		const wrappedTools = wrapToolsForAcpClient(mergeTools(base.tools, agentOptions.tools, this.options.tools), {
+		const wrappedTools = wrapToolsForAcpClient(clientTools.length > 0 ? {
+			...hostTools,
+			...createClientDeclaredTools(clientTools, {
+				client: this.requirePeer(),
+				sessionId
+			})
+		} : hostTools, {
 			client: this.requirePeer(),
 			sessionId,
 			capabilities: this.clientCapabilities,
@@ -1357,6 +1525,7 @@ var AcpServerImpl = class {
 			cwd: params.cwd,
 			additionalDirectories: params.additionalDirectories ?? [],
 			mcpServers,
+			clientTools,
 			session,
 			execution,
 			agent,
@@ -1382,21 +1551,11 @@ var AcpServerImpl = class {
 			const existing = await loadSession(store, sessionId);
 			if (existing) return existing;
 			if (mustExist) throw new AcpProtocolError(-32002, `Unknown session: ${sessionId}`);
-			const created = await createSession({
-				id: sessionId,
-				store,
-				projectRoot: cwd,
-				metadata: { title: "ACP session" }
-			});
-			await created.save();
-			return created;
-		}
-		if (sessionId && mustExist) throw new AcpProtocolError(-32002, `Unknown session: ${sessionId}`);
-		const created = await createSession({
-			...sessionId ? { id: sessionId } : {},
-			...store ? { store } : {},
-			projectRoot: cwd,
-			metadata: { title: "ACP session" }
+		} else if (sessionId && mustExist) throw new AcpProtocolError(-32002, `Unknown session: ${sessionId}`);
+		const created = await newSession(store, {
+			cwd,
+			title: "ACP session",
+			...sessionId ? { id: sessionId } : {}
 		});
 		if (store) await created.save();
 		return created;
@@ -1414,12 +1573,12 @@ var AcpServerImpl = class {
 	installHookAdapter(runtime) {
 		const seenTools = /* @__PURE__ */ new Set();
 		runtime.agent.hooks.hook("tool:gate", (ctx) => {
-			if (runtime.modeId !== PLAN_MODE_ID || isPlanReadOnlyTool(ctx.name)) return;
+			if (runtime.modeId !== "plan" || isPlanReadOnlyTool(ctx.name, runtime)) return;
 			ctx.block = true;
 			ctx.reason = `Plan mode is read-only. Switch to Build mode before using \`${ctx.name}\`.`;
 		});
 		runtime.agent.hooks.hook("mcp:tool:gate", (ctx) => {
-			if (runtime.modeId !== PLAN_MODE_ID) return;
+			if (runtime.modeId !== "plan") return;
 			ctx.block = true;
 			ctx.reason = `Plan mode is read-only. Switch to Build mode before using MCP tool \`${ctx.tool}\`.`;
 		});
@@ -1444,7 +1603,7 @@ var AcpServerImpl = class {
 			});
 		});
 		runtime.agent.hooks.hook("tool:gate", async (ctx) => {
-			if (!this.shouldRequestPermission(ctx.name, ctx.input)) return;
+			if (!this.shouldRequestPermission(ctx.name, ctx.input, runtime)) return;
 			const key = permissionKey(ctx.name, ctx.input);
 			const cached = runtime.config.get(key);
 			if (cached === "allow") return;
@@ -1549,9 +1708,10 @@ var AcpServerImpl = class {
 		const fromMeta = runtime.provider.meta.contextWindow;
 		if (typeof fromMeta === "number" && Number.isFinite(fromMeta) && fromMeta > 0) return fromMeta;
 	}
-	shouldRequestPermission(name, input) {
+	shouldRequestPermission(name, input, runtime) {
 		const policy = this.options.permission;
 		if (policy?.enabled !== true || !this.peer) return false;
+		if (runtime.clientTools.some((tool) => tool.name === name && tool.mutating)) return true;
 		if (policy.toolMatcher) return policy.toolMatcher(name, input);
 		return name === "shell" || name === "write_file" || name === "edit" || name === "multi_edit";
 	}
@@ -1645,14 +1805,6 @@ function mergeMcpServers(...sources) {
 	for (const source of sources) for (const server of source ?? []) byName.set(server.name, server);
 	return [...byName.values()];
 }
-function filterPlanTools(tools) {
-	const filtered = {};
-	for (const [key, tool] of Object.entries(tools ?? {})) if (isPlanReadOnlyTool(tool.spec.name)) filtered[key] = tool;
-	return filtered;
-}
-function isPlanReadOnlyTool(name) {
-	return PLAN_READ_ONLY_TOOLS.has(name);
-}
 function cloneConfigOptions(options) {
 	return options.map((option) => ({
 		...option,
@@ -1674,9 +1826,6 @@ function configValue(options, id) {
 function isGeneratedModelOptionConfig(id) {
 	return id.startsWith(MODEL_OPTION_CONFIG_PREFIX);
 }
-function isThinkingLevel(value) {
-	return typeof value === "string" && validThinkingLevels.includes(value);
-}
 function thinkingLabel(level) {
 	return level === "xhigh" ? "Extra high" : level.charAt(0).toUpperCase() + level.slice(1);
 }
@@ -1702,6 +1851,10 @@ function toRpcError(err) {
 		message: err.message,
 		...err.data !== void 0 ? { data: err.data } : {}
 	};
+	if (err instanceof ClientToolSpecError) return {
+		code: err.code,
+		message: err.message
+	};
 	return {
 		code: -32603,
 		message: err instanceof Error ? err.message : String(err)
@@ -1762,6 +1915,6 @@ function runAcpStdioServer(options) {
 	};
 }
 //#endregion
-export { wrapToolsForAcpClient as a, sessionBlocksToAcp as c, StartUsageError as d, buildStartLocalOptions as f, startProviderNames as h, withAcpDefaultTools as i, stopReasonFromRun as l, startLocalArgOptions as m, AcpProtocolError as n, acpMcpServersToZidane as o, parseStartArgValues as p, createAcpServer as r, acpPromptToPromptParts as s, runAcpStdioServer as t, toolResultToAcpContent as u };
+export { parseStartArgValues as _, wrapToolsForAcpClient as a, sessionBlocksToAcp as c, CLIENT_TOOL_CALL_METHOD as d, CLIENT_TOOL_CANCEL_METHOD as f, buildStartLocalOptions as g, StartUsageError as h, withAcpDefaultTools as i, stopReasonFromRun as l, parseClientToolSpecs as m, AcpProtocolError as n, acpMcpServersToZidane as o, createClientDeclaredTools as p, createAcpServer as r, acpPromptToPromptParts as s, runAcpStdioServer as t, toolResultToAcpContent as u, startLocalArgOptions as v, startProviderNames as y };
 
-//# sourceMappingURL=acp-D-tVyUjw.js.map
+//# sourceMappingURL=acp-DQDhi2dj.js.map