@botcord/daemon 0.2.6 → 0.2.9

package/src/provision.ts

@@ -4,7 +4,7 @@
  * side effects (register agent, write credentials, load route, add/remove
  * gateway channel) and return an ack payload.
  */
-import { existsSync, rmSync, unlinkSync } from "node:fs";
+import { existsSync, readFileSync, rmSync, unlinkSync } from "node:fs";
 import { homedir } from "node:os";
 import path from "node:path";
 import {
@@ -55,6 +55,7 @@ import {
 } from "./agent-workspace.js";
 import { detectRuntimes, getAdapterModule } from "./adapters/runtimes.js";
 import { log as daemonLog } from "./log.js";
+import { discoverAgentCredentials } from "./agent-discovery.js";
 
 /** Options accepted by {@link createProvisioner}. */
 export interface ProvisionerOptions {
@@ -267,6 +268,8 @@ interface ProvisionCtx {
   register: typeof BotCordClient.register;
 }
 
+const openclawProvisionLocks = new Map<string, Promise<unknown>>();
+
 async function provisionAgent(
   params: ProvisionAgentParams,
   ctx: ProvisionCtx,
@@ -278,13 +281,53 @@ async function provisionAgent(
   const explicitCwd = params.credentials?.cwd ?? params.cwd;
   assertSafeCwd(explicitCwd);
 
+  const openclawSel = pickOpenclawSelection(params);
+  if (openclawSel.gateway && openclawSel.agent) {
+    return withOpenclawProvisionLock(openclawSel.gateway, openclawSel.agent, async () => {
+      const existing = findCredentialsByOpenclaw(openclawSel.gateway!, openclawSel.agent!);
+      if (existing) {
+        daemonLog.info("provision_agent: openclaw binding already exists", {
+          gateway: openclawSel.gateway,
+          openclawAgent: openclawSel.agent,
+          agentId: existing.agentId,
+        });
+        return installExistingOpenclawBinding(existing.agentId, ctx);
+      }
+      const cfg = loadConfig();
+      const credentials = await materializeCredentials(params, cfg, ctx, explicitCwd);
+      return installLocalAgent(credentials, {
+        ...ctx,
+        cfg,
+        bio: params.bio,
+        source: params.credentials ? "hub-supplied" : "registered",
+      });
+    });
+  }
+
   const cfg = loadConfig();
   const credentials = await materializeCredentials(params, cfg, ctx, explicitCwd);
+  return installLocalAgent(credentials, {
+    ...ctx,
+    cfg,
+    bio: params.bio,
+    source: params.credentials ? "hub-supplied" : "registered",
+  });
+}
+
+async function installLocalAgent(
+  credentials: StoredBotCordCredentials,
+  ctx: ProvisionCtx & {
+    cfg: DaemonConfig;
+    bio?: string;
+    source: "hub-supplied" | "registered" | "adopted-openclaw";
+  },
+): Promise<ProvisionedAgent> {
+  const cfg = ctx.cfg;
   daemonLog.debug("provision: credentials materialized", {
     agentId: credentials.agentId,
     hubUrl: credentials.hubUrl,
     runtime: credentials.runtime ?? null,
-    source: params.credentials ? "hub-supplied" : "registered",
+    source: ctx.source,
   });
 
   const credentialsFile = writeCredentialsFile(
@@ -298,7 +341,7 @@ async function provisionAgent(
   try {
     ensureAgentWorkspace(credentials.agentId, {
       displayName: credentials.displayName,
-      bio: params.bio,
+      bio: ctx.bio,
       runtime: credentials.runtime,
       keyId: credentials.keyId,
       savedAt: credentials.savedAt,
@@ -358,37 +401,7 @@ async function provisionAgent(
   // Hot-add the synthesized per-agent managed route so the next turn picks
   // the agent's runtime + workspace cwd without waiting for reload_config.
   try {
-    const synthRoute: import("./gateway/index.js").GatewayRoute = {
-      match: { accountId: credentials.agentId },
-      runtime: credentials.runtime ?? cfg.defaultRoute.adapter,
-      cwd: credentials.cwd ?? agentWorkspaceDir(credentials.agentId),
-    };
-    if (synthRoute.runtime === "openclaw-acp") {
-      // Resolve gateway from the freshly written credentials + the live
-      // openclawGateways registry. A missing/unknown gateway here yields a
-      // disabled route (set_route style); next turn for this agent falls
-      // back to defaultRoute. Caller already validated via reload semantics.
-      const profile = (cfg.openclawGateways ?? []).find(
-        (g) => g.name === credentials.openclawGateway,
-      );
-      if (profile) {
-        // Run the same tokenFile-aware resolver `toGatewayConfig` uses so the
-        // first turn after provisioning doesn't auth-fail when the gateway
-        // ships its bearer via `tokenFile` instead of an inline `token`.
-        const prepared = prepareGatewayProfile(profile);
-        synthRoute.gateway = {
-          name: prepared.name,
-          url: prepared.url,
-          ...(prepared.resolvedToken ? { token: prepared.resolvedToken } : {}),
-          ...(credentials.openclawAgent
-            ? { openclawAgent: credentials.openclawAgent }
-            : prepared.defaultAgent
-              ? { openclawAgent: prepared.defaultAgent }
-              : {}),
-        };
-      }
-    }
-    ctx.gateway.upsertManagedRoute(credentials.agentId, synthRoute);
+    upsertManagedRouteForCredentials(credentials, cfg, ctx.gateway);
   } catch (err) {
     // Rollback the channel + config + credentials on managed-route failure
     // (shouldn't happen — pure map op — but keeps the invariant tight).
@@ -427,6 +440,63 @@ async function provisionAgent(
   };
 }
 
+function upsertManagedRouteForCredentials(
+  credentials: StoredBotCordCredentials,
+  cfg: DaemonConfig,
+  gateway: Gateway,
+): void {
+  const synthRoute: import("./gateway/index.js").GatewayRoute = {
+    match: { accountId: credentials.agentId },
+    runtime: credentials.runtime ?? cfg.defaultRoute.adapter,
+    cwd: credentials.cwd ?? agentWorkspaceDir(credentials.agentId),
+  };
+  if (synthRoute.runtime === "openclaw-acp") {
+    const profile = (cfg.openclawGateways ?? []).find(
+      (g) => g.name === credentials.openclawGateway,
+    );
+    if (profile) {
+      const prepared = prepareGatewayProfile(profile);
+      synthRoute.gateway = {
+        name: prepared.name,
+        url: prepared.url,
+        ...(prepared.resolvedToken ? { token: prepared.resolvedToken } : {}),
+        ...(credentials.openclawAgent
+          ? { openclawAgent: credentials.openclawAgent }
+          : prepared.defaultAgent
+            ? { openclawAgent: prepared.defaultAgent }
+            : {}),
+      };
+    }
+  }
+  gateway.upsertManagedRoute(credentials.agentId, synthRoute);
+}
+
+async function installExistingOpenclawBinding(
+  agentId: string,
+  ctx: ProvisionCtx,
+): Promise<ProvisionedAgent> {
+  const credentialsFile = defaultCredentialsFile(agentId);
+  const credentials = loadStoredCredentials(credentialsFile);
+  const cfg = loadConfig();
+  const updated = addAgentToConfig(cfg, credentials.agentId);
+  if (updated) saveConfig(updated);
+  const snap = ctx.gateway.snapshot();
+  if (!snap.channels[credentials.agentId]) {
+    await ctx.gateway.addChannel({
+      id: credentials.agentId,
+      type: BOTCORD_CHANNEL_TYPE,
+      accountId: credentials.agentId,
+      agentId: credentials.agentId,
+    });
+  }
+  upsertManagedRouteForCredentials(credentials, cfg, ctx.gateway);
+  return {
+    agentId: credentials.agentId,
+    hubUrl: credentials.hubUrl,
+    credentialsFile,
+  };
+}
+
 async function materializeCredentials(
   params: ProvisionAgentParams,
   cfg: DaemonConfig,
@@ -537,6 +607,140 @@ function pickOpenclawSelection(
   return out;
 }
 
+async function withOpenclawProvisionLock<T>(
+  gateway: string,
+  agent: string,
+  fn: () => Promise<T>,
+): Promise<T> {
+  const key = `${gateway}\0${agent}`;
+  const prev = openclawProvisionLocks.get(key) ?? Promise.resolve();
+  let release!: () => void;
+  const current = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  const chain = prev.then(() => current);
+  openclawProvisionLocks.set(key, chain);
+  await prev.catch(() => undefined);
+  try {
+    return await fn();
+  } finally {
+    release();
+    if (openclawProvisionLocks.get(key) === chain) {
+      openclawProvisionLocks.delete(key);
+    }
+  }
+}
+
+function findCredentialsByOpenclaw(
+  gateway: string,
+  openclawAgent: string,
+): { agentId: string; credentialsFile: string } | null {
+  const discovered = discoverAgentCredentials({
+    credentialsDir: path.join(homedir(), ".botcord", "credentials"),
+  });
+  for (const a of discovered.agents) {
+    if (a.openclawGateway === gateway && a.openclawAgent === openclawAgent) {
+      return { agentId: a.agentId, credentialsFile: a.credentialsFile };
+    }
+  }
+  return null;
+}
+
+export interface AdoptDiscoveredOpenclawAgentsResult {
+  adopted: string[];
+  skipped: Array<{ gateway: string; openclawAgent?: string; reason: string }>;
+  failed: Array<{ gateway: string; openclawAgent?: string; error: string }>;
+}
+
+export async function adoptDiscoveredOpenclawAgents(ctx: {
+  gateway: Gateway;
+  register?: typeof BotCordClient.register;
+  cfg?: DaemonConfig;
+  timeoutMs?: number;
+  probe?: WsEndpointProbeFn;
+}): Promise<AdoptDiscoveredOpenclawAgentsResult> {
+  const register = ctx.register ?? BotCordClient.register;
+  const cfg = ctx.cfg ?? loadConfig();
+  const result: AdoptDiscoveredOpenclawAgentsResult = {
+    adopted: [],
+    skipped: [],
+    failed: [],
+  };
+  for (const gw of cfg.openclawGateways ?? []) {
+    let probeResult: Awaited<ReturnType<typeof probeOpenclawAgents>>;
+    try {
+      probeResult = await probeOpenclawAgents(gw, {
+        timeoutMs: ctx.timeoutMs,
+        probe: ctx.probe,
+      });
+    } catch (err) {
+      result.failed.push({
+        gateway: gw.name,
+        error: err instanceof Error ? err.message : String(err),
+      });
+      continue;
+    }
+    if (!probeResult.ok) {
+      result.skipped.push({
+        gateway: gw.name,
+        reason: probeResult.error ?? "gateway_unreachable",
+      });
+      continue;
+    }
+    for (const oc of probeResult.agents ?? []) {
+      await withOpenclawProvisionLock(gw.name, oc.id, async () => {
+        const existing = findCredentialsByOpenclaw(gw.name, oc.id);
+        if (existing) {
+          result.skipped.push({
+            gateway: gw.name,
+            openclawAgent: oc.id,
+            reason: "already_bound",
+          });
+          return;
+        }
+        const freshCfg = loadConfig();
+        if (!inferHubUrl(freshCfg)) {
+          result.skipped.push({
+            gateway: gw.name,
+            openclawAgent: oc.id,
+            reason: "missing_hub_url",
+          });
+          daemonLog.warn("openclaw adopt skipped: no known hubUrl", {
+            gateway: gw.name,
+            openclawAgent: oc.id,
+          });
+          return;
+        }
+        try {
+          const params: ProvisionAgentParams = {
+            runtime: "openclaw-acp",
+            name: oc.name ?? `openclaw-${oc.id}`,
+            openclaw: { gateway: gw.name, agent: oc.id },
+          };
+          const credentials = await materializeCredentials(params, freshCfg, {
+            gateway: ctx.gateway,
+            register,
+          }, undefined);
+          const installed = await installLocalAgent(credentials, {
+            gateway: ctx.gateway,
+            register,
+            cfg: freshCfg,
+            source: "adopted-openclaw",
+          });
+          result.adopted.push(installed.agentId);
+        } catch (err) {
+          result.failed.push({
+            gateway: gw.name,
+            openclawAgent: oc.id,
+            error: err instanceof Error ? err.message : String(err),
+          });
+        }
+      });
+    }
+  }
+  return result;
+}
+
 async function revokeAgent(
   params: RevokeAgentParams,
   ctx: { gateway: Gateway },
@@ -753,16 +957,22 @@ export type WsEndpointProbeFn = (args: {
 }>;
 
 /**
- * Default L2 + L3 probe — opens a WS handshake against the OpenClaw gateway
- * and, when the connection is up, issues a JSON-RPC `agents.list` request to
- * enumerate configured agent profiles. Best-effort: a successful WS open with
- * a failed `agents.list` still reports `ok: true` (just without `agents`),
- * matching the RFC's "agents populated only when listing succeeded" rule.
+ * Default L2 + L3 probe — speaks OpenClaw's WS frame protocol against the
+ * gateway and enumerates agent profiles via `agents.list`.
+ *
+ * Wire flow (see `~/claws/openclaw/src/gateway/server/ws-connection/message-handler.ts`
+ * and `~/claws/openclaw/src/gateway/protocol/schema/frames.ts`):
+ *   1. WS upgrade (no auth required at the HTTP layer).
+ *   2. Server emits `{type:"event", event:"connect.challenge", payload:{nonce}}`.
+ *   3. Client sends `{type:"req", id, method:"connect", params:{minProtocol, maxProtocol,
+ *      client:{id:"openclaw-probe", mode:"probe", ...}, auth:{token}}}`.
+ *   4. Server responds `{type:"res", id, ok:true, payload:{type:"hello-ok", server:{version}, ...}}`.
+ *   5. Client sends `{type:"req", id, method:"agents.list", params:{}}`.
+ *   6. Server responds with `{payload: { defaultId, mainKey, scope, agents:[{id, name?, workspace?, model?}] }}`.
  *
- * Method name and result shape follow OpenClaw:
- *   `~/claws/openclaw/src/gateway/server-methods/agents.ts:416` and
- *   `~/claws/openclaw/src/gateway/session-utils.ts:783` —
- *   `{ defaultId, mainKey, scope, agents: [{ id, name?, identity?, workspace, model? }] }`.
+ * Best-effort: a successful WS open with a failed handshake / `agents.list`
+ * still reports `ok: true` (just without `agents`), matching the RFC's
+ * "agents populated only when listing succeeded" rule.
  */
 async function defaultWsProbe(args: {
   url: string;
@@ -796,6 +1006,9 @@ async function defaultWsProbe(args: {
     let settled = false;
     let ws: any;
     let timer: ReturnType<typeof setTimeout> | undefined;
+    let serverVersion: string | undefined;
+    const CONNECT_ID = "probe-connect";
+    let connectSent = false;
     const settle = (v: ProbeResult): void => {
       if (settled) return;
       settled = true;
@@ -809,6 +1022,8 @@ async function defaultWsProbe(args: {
     };
     try {
       const headers: Record<string, string> = {};
+      // Some deployments gate the WS upgrade on Authorization too; harmless
+      // when not enforced — auth is also re-asserted in the connect frame.
       if (args.token) headers["Authorization"] = `Bearer ${args.token}`;
       ws = new WebSocket(args.url, { headers });
     } catch (err) {
@@ -816,62 +1031,165 @@ async function defaultWsProbe(args: {
       return;
     }
     timer = setTimeout(() => settle({ ok: false, error: "timeout" }), args.timeoutMs);
-    const requestId = "probe-agents-list";
-    ws.on("open", () => {
-      // L3: enumerate agent profiles. We don't fail the L2 result if this
-      // call fails — the gateway is reachable either way.
+
+    const sendConnect = (): void => {
+      if (connectSent) return;
+      connectSent = true;
+      const params: any = {
+        minProtocol: 3,
+        maxProtocol: 3,
+        client: {
+          id: "openclaw-probe",
+          version: "0.1.0",
+          platform: process.platform || "node",
+          mode: "probe",
+        },
+        role: "operator",
+        scopes: ["operator.read"],
+      };
+      if (args.token) params.auth = { token: args.token };
       try {
-        ws.send(
-          JSON.stringify({
-            jsonrpc: "2.0",
-            id: requestId,
-            method: "agents.list",
-            params: {},
-          }),
-        );
+        ws.send(JSON.stringify({ type: "req", id: CONNECT_ID, method: "connect", params }));
       } catch (err) {
-        settle({ ok: true, error: `agents.list send failed: ${(err as Error).message}` });
+        settle({ ok: true, error: `connect send failed: ${(err as Error).message}` });
       }
+    };
+
+    ws.on("open", () => {
+      // Some servers send `connect.challenge` before the socket is fully
+      // wired; if it never arrives we still try a best-effort connect after
+      // a short delay so the probe doesn't stall on legacy gateways.
+      setTimeout(() => {
+        if (!connectSent && !settled) sendConnect();
+      }, 250);
     });
     ws.on("message", (raw: Buffer | string) => {
+      let msg: any;
       try {
-        const msg = JSON.parse(typeof raw === "string" ? raw : raw.toString("utf8"));
-        if (msg?.id !== requestId) return; // ignore unrelated frames
-        if (msg.error) {
-          settle({ ok: true, error: String(msg.error?.message ?? "agents.list error") });
+        msg = JSON.parse(typeof raw === "string" ? raw : raw.toString("utf8"));
+      } catch {
+        return;
+      }
+      if (!msg || typeof msg !== "object") return;
+      if (msg.type === "event" && msg.event === "connect.challenge") {
+        // Nonce only matters for device-pairing flows; token-only auth ignores it.
+        sendConnect();
+        return;
+      }
+      if (msg.type !== "res" || typeof msg.id !== "string") return;
+      if (msg.id === CONNECT_ID) {
+        if (!msg.ok) {
+          const errMsg = msg.error?.message ? String(msg.error.message) : "connect rejected";
+          settle({ ok: true, error: errMsg });
           return;
         }
-        const list = Array.isArray(msg.result?.agents) ? msg.result.agents : [];
-        const agents: AgentRow[] = [];
-        for (const a of list) {
-          if (!a || typeof a.id !== "string" || a.id.length === 0) continue;
-          const row: AgentRow = { id: a.id };
-          if (typeof a.name === "string") row.name = a.name;
-          if (typeof a.workspace === "string") row.workspace = a.workspace;
-          if (a.model && typeof a.model === "object") {
-            const model: { name?: string; provider?: string } = {};
-            if (typeof a.model.name === "string") model.name = a.model.name;
-            if (typeof a.model.provider === "string") model.provider = a.model.provider;
-            if (model.name || model.provider) row.model = model;
-          }
-          agents.push(row);
-        }
-        settle({ ok: true, agents });
-      } catch (err) {
-        settle({ ok: true, error: `agents.list parse failed: ${(err as Error).message}` });
+        const v = msg.payload?.server?.version;
+        if (typeof v === "string" && v) serverVersion = v;
+        // We don't fetch agents.list over the wire: it requires `operator.read`
+        // which the gateway only grants to clients that present a paired device
+        // identity (see message-handler.ts:478 — self-declared scopes are
+        // cleared without device pairing). For local OpenClaw the agent list
+        // is sourced directly from disk by `probeOpenclawAgents`.
+        settle({ ok: true, version: serverVersion });
       }
     });
     ws.on("error", (err: Error) => {
       settle({ ok: false, error: err.message });
     });
     ws.on("close", () => {
-      // If the socket closes before `agents.list` resolved we still treat
-      // L2 as ok (open fired) and emit no agents.
-      settle({ ok: true });
+      // If the socket closes before we got our agents.list response, treat
+      // L2 as ok (the upgrade succeeded) and emit no agents.
+      settle({ ok: true, version: serverVersion });
     });
   });
 }
 
+export async function probeOpenclawAgents(
+  profile: { url: string; token?: string; tokenFile?: string },
+  opts: { timeoutMs?: number; probe?: WsEndpointProbeFn } = {},
+): Promise<{
+  ok: boolean;
+  version?: string;
+  agents?: Array<{
+    id: string;
+    name?: string;
+    workspace?: string;
+    model?: { name?: string; provider?: string };
+  }>;
+  error?: string;
+}> {
+  const probe = opts.probe ?? defaultWsProbe;
+  const prepared = prepareGatewayProfile({
+    name: "probe",
+    url: profile.url,
+    ...(profile.token ? { token: profile.token } : {}),
+    ...(profile.tokenFile ? { tokenFile: profile.tokenFile } : {}),
+  });
+  const result = await probe({
+    url: profile.url,
+    token: prepared.resolvedToken,
+    timeoutMs: opts.timeoutMs ?? 3000,
+  });
+  // For loopback gateways the agent roster lives in `~/.openclaw/openclaw.json`
+  // and is the source of truth — listing it over the wire would require a
+  // paired device identity (operator.read scope). When the WS probe is the
+  // default (i.e. no test injection) we enrich the result from disk.
+  if (result.ok && !result.agents && !opts.probe && isLoopbackUrl(profile.url)) {
+    const local = readLocalOpenclawAgents();
+    if (local && local.length > 0) result.agents = local;
+  }
+  return result;
+}
+
+function isLoopbackUrl(raw: string): boolean {
+  try {
+    const u = new URL(raw);
+    return u.hostname === "127.0.0.1" || u.hostname === "::1" || u.hostname === "localhost";
+  } catch {
+    return false;
+  }
+}
+
+function readLocalOpenclawAgents(): Array<{
+  id: string;
+  name?: string;
+  workspace?: string;
+  model?: { name?: string; provider?: string };
+}> | null {
+  try {
+    const file = path.join(homedir(), ".openclaw", "openclaw.json");
+    if (!existsSync(file)) return null;
+    const cfg = JSON.parse(readFileSync(file, "utf8")) as any;
+    const list = Array.isArray(cfg?.agents?.list) ? cfg.agents.list : [];
+    const defaultId = typeof cfg?.agents?.defaults?.id === "string" ? cfg.agents.defaults.id : "default";
+    const seen = new Set<string>();
+    const out: Array<{ id: string; name?: string; workspace?: string; model?: { name?: string; provider?: string } }> = [];
+    const push = (raw: any, fallbackId?: string): void => {
+      const id = typeof raw?.id === "string" && raw.id ? raw.id : fallbackId;
+      if (!id || seen.has(id)) return;
+      seen.add(id);
+      const row: { id: string; name?: string; workspace?: string; model?: { name?: string; provider?: string } } = { id };
+      if (typeof raw?.name === "string") row.name = raw.name;
+      if (typeof raw?.workspace === "string") row.workspace = raw.workspace;
+      const m = raw?.model;
+      if (m && typeof m === "object") {
+        const model: { name?: string; provider?: string } = {};
+        if (typeof m.primary === "string") model.name = m.primary;
+        else if (typeof m.name === "string") model.name = m.name;
+        if (typeof m.provider === "string") model.provider = m.provider;
+        if (model.name || model.provider) row.model = model;
+      }
+      out.push(row);
+    };
+    // Default agent first so it surfaces at the top of the dropdown.
+    push({ id: defaultId, workspace: cfg?.agents?.defaults?.workspace, model: cfg?.agents?.defaults?.model }, defaultId);
+    for (const entry of list) push(entry);
+    return out;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Async variant that includes L2 (gateway reachability) and L3 (agent listing)
  * probes for runtimes that talk to external services. Used by the production
@@ -889,7 +1207,6 @@ export async function collectRuntimeSnapshotAsync(opts: {
   const base = collectRuntimeSnapshot();
   const gateways = opts.cfg?.openclawGateways ?? [];
   if (gateways.length === 0) return base;
-  const probe = opts.wsProbe ?? defaultWsProbe;
   // Default daemon-side budget is 3s — it must stay below the Hub's
   // `list_runtimes` ack wait (5s, see backend/hub/routers/daemon_control.py)
   // so a single slow gateway can't blow the whole snapshot to a 504.
@@ -897,11 +1214,11 @@ export async function collectRuntimeSnapshotAsync(opts: {
   const capped = gateways.slice(0, RUNTIME_ENDPOINTS_CAP);
   const endpoints = await Promise.all(
     capped.map(async (g) => {
-      // Resolve `tokenFile` here so token-file-only profiles probe with auth
-      // and aren't falsely marked unreachable in the dashboard.
-      const prepared = prepareGatewayProfile(g);
       try {
-        const res = await probe({ url: g.url, token: prepared.resolvedToken, timeoutMs });
+        const res = await probeOpenclawAgents(g, {
+          probe: opts.wsProbe,
+          timeoutMs,
+        });
         const entry: any = { name: g.name, url: g.url, reachable: res.ok };
         if (res.version) entry.version = res.version;
         if (res.error) entry.error = res.error;
@@ -1301,5 +1618,13 @@ function inferHubUrl(cfg: DaemonConfig): string | null {
       // skip
     }
   }
+  if (ids.length === 0) {
+    const discovered = discoverAgentCredentials({
+      credentialsDir: path.join(homedir(), ".botcord", "credentials"),
+    });
+    for (const a of discovered.agents) {
+      if (a.hubUrl) return a.hubUrl;
+    }
+  }
   return null;
 }