@gaunt-sloth/agent 2.0.0-alpha.9 → 2.0.0-beta.0

package/dist/utils/mcpAuthError.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @packageDocumentation
+ * EXT-31 — classify and format MCP integration connect/tool-load failures so an expired or invalid
+ * credential is SURFACED (named + actionable) instead of silently dropping the integration's tools.
+ *
+ * The `@langchain/mcp-adapters` client only tags a bare HTTP 401 as an authentication error; a 403
+ * (forbidden / expired scope) otherwise falls through as a generic "Failed to connect". This module
+ * classifies auth failures independently (401/403 + credential keywords) so a stale token is not
+ * mistaken for "this integration was never configured" or an unrelated transient error.
+ *
+ * Pure + side-effect free: callers do the surfacing (`displayWarning`) with the returned message.
+ */
+/** Coarse classification of an MCP connect/tool-load failure. */
+export type McpConnectErrorKind = 'auth' | 'other';
+/** Options that tune the suggested fix path in the surfaced message. */
+export interface McpConnectFailureOptions {
+    /** The server uses OAuth (`authProvider: 'OAuth'`) — suggest re-running the OAuth login. */
+    oauth?: boolean;
+}
+/**
+ * Classify an MCP connect/tool-load failure as a credential problem (`auth`) or anything else
+ * (`other`). Detection is independent of the adapter (which only tags 401), so a 403 or an
+ * "expired token" surfaced by the upstream server is still recognised as auth.
+ */
+export declare function classifyMcpConnectError(error: unknown): McpConnectErrorKind;
+/**
+ * Build the user-facing message for a failed MCP integration. For `auth` failures it names the
+ * integration, states the credential is expired/invalid, and points at the concrete fix path
+ * (OAuth login or the API token / authorization header, plus the `mcpServers` entry in gth config).
+ * For `other` failures it surfaces the failure plainly and explicitly says it is NOT an auth error,
+ * so an unrelated transient never triggers a spurious "re-authenticate" nudge.
+ *
+ * Either way the caller degrades gracefully AFTER surfacing this — the integration's tools are
+ * dropped for the session, but the user (and the log) now knows why.
+ */
+export declare function formatMcpConnectFailureMessage(serverName: string | undefined, error: unknown, options?: McpConnectFailureOptions): string;

package/dist/utils/mcpAuthError.js

@@ -0,0 +1,89 @@
+/**
+ * @packageDocumentation
+ * EXT-31 — classify and format MCP integration connect/tool-load failures so an expired or invalid
+ * credential is SURFACED (named + actionable) instead of silently dropping the integration's tools.
+ *
+ * The `@langchain/mcp-adapters` client only tags a bare HTTP 401 as an authentication error; a 403
+ * (forbidden / expired scope) otherwise falls through as a generic "Failed to connect". This module
+ * classifies auth failures independently (401/403 + credential keywords) so a stale token is not
+ * mistaken for "this integration was never configured" or an unrelated transient error.
+ *
+ * Pure + side-effect free: callers do the surfacing (`displayWarning`) with the returned message.
+ */
+/** Extract a readable message from an unknown thrown value. */
+function errorMessage(error) {
+    if (error instanceof Error)
+        return error.message;
+    if (typeof error === 'string')
+        return error;
+    try {
+        return String(error?.message ?? error);
+    }
+    catch {
+        return String(error);
+    }
+}
+/** Read a numeric HTTP status from an error object or a `(HTTP NNN)` / `HTTP NNN` / `status NNN` message. */
+function httpStatusOf(error, message) {
+    const code = error?.code;
+    if (typeof code === 'number')
+        return code;
+    if (typeof code === 'string' && /^\d{3}$/.test(code))
+        return parseInt(code, 10);
+    // Only treat 4xx/5xx numbers as a status when they carry HTTP/status context — never a bare "401"
+    // substring (which could be a port, a byte count, an id, …) to avoid misclassifying transient errors.
+    const m = message.match(/\b(?:HTTP|status(?:\s*code)?)[\s:]*\(?(\d{3})\)?/i);
+    return m ? parseInt(m[1], 10) : undefined;
+}
+// Credential-failure phrasing across MCP adapter wrapping, transports, and common upstream servers.
+// Includes the canonical OAuth error codes (`invalid_grant` = expired/revoked refresh token,
+// `invalid_token`, `unauthorized_client`) and generic `oauth …` credential phrasing, so a keyword-
+// bearing OAuth failure is classified as auth even when it does NOT arrive via the OAuth catch site.
+const AUTH_KEYWORDS = /\b(unauthorized|forbidden|authentication failed|authenti[sc]ation (?:error|required)|authorization (?:error|failed|required)|invalid (?:token|credentials?|api[\s-]?key|authorization)|invalid_grant|invalid_token|unauthorized_client|oauth[\s_-]?(?:error|failed|failure|denied|token|authorization|handshake|login)|(?:token|credentials?|session|api[\s-]?key)s? (?:has |have )?(?:expired|is expired|are expired)|expired (?:token|credentials?|session)|access denied|401 unauthorized|403 forbidden)\b/i;
+/**
+ * Classify an MCP connect/tool-load failure as a credential problem (`auth`) or anything else
+ * (`other`). Detection is independent of the adapter (which only tags 401), so a 403 or an
+ * "expired token" surfaced by the upstream server is still recognised as auth.
+ */
+export function classifyMcpConnectError(error) {
+    const message = errorMessage(error);
+    const status = httpStatusOf(error, message);
+    if (status === 401 || status === 403)
+        return 'auth';
+    if (AUTH_KEYWORDS.test(message))
+        return 'auth';
+    return 'other';
+}
+/**
+ * Build the user-facing message for a failed MCP integration. For `auth` failures it names the
+ * integration, states the credential is expired/invalid, and points at the concrete fix path
+ * (OAuth login or the API token / authorization header, plus the `mcpServers` entry in gth config).
+ * For `other` failures it surfaces the failure plainly and explicitly says it is NOT an auth error,
+ * so an unrelated transient never triggers a spurious "re-authenticate" nudge.
+ *
+ * Either way the caller degrades gracefully AFTER surfacing this — the integration's tools are
+ * dropped for the session, but the user (and the log) now knows why.
+ */
+export function formatMcpConnectFailureMessage(serverName, error, options = {}) {
+    // Reaching the OAuth surfacing site means createAuthProviderAndAuthenticate() threw, i.e. the
+    // OAuth handshake/refresh itself failed — that is inherently an auth failure regardless of the
+    // message text (e.g. a keyword-less `invalid_grant`). Force `auth` here rather than inferring it
+    // from keywords, so an OAuth credential failure never mis-surfaces as "not an authentication error".
+    const kind = options.oauth ? 'auth' : classifyMcpConnectError(error);
+    const name = serverName ? `"${serverName}"` : 'an MCP server';
+    const configHint = serverName
+        ? `check the ${name} entry under mcpServers in your gth config`
+        : 'check the mcpServers entries in your gth config';
+    if (kind === 'auth') {
+        const reAuth = options.oauth
+            ? 'complete the OAuth login flow again (clear the stored token first if needed)'
+            : 'refresh its API token or key (the apiKeyEnvironmentVariable or authorization header it uses)';
+        return (`Integration ${name} authentication failed: its credentials appear expired or invalid ` +
+            `(the MCP server rejected the connection with an authorization error). Its tools are ` +
+            `unavailable for this session. To restore them, re-authenticate this integration: ` +
+            `${reAuth} and ${configHint}, then restart.`);
+    }
+    return (`Integration ${name} could not connect to its MCP server (this is not an authentication ` +
+        `error). Its tools are unavailable for this session. Underlying error: ${errorMessage(error)}`);
+}
+//# sourceMappingURL=mcpAuthError.js.map

package/dist/utils/mcpAuthError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpAuthError.js","sourceRoot":"","sources":["../../src/utils/mcpAuthError.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH,+DAA+D;AAC/D,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,CAAE,KAA+B,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,SAAS,YAAY,CAAC,KAAc,EAAE,OAAe;IACnD,MAAM,IAAI,GAAI,KAA4B,EAAE,IAAI,CAAC;IACjD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChF,kGAAkG;IAClG,sGAAsG;IACtG,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC7E,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,oGAAoG;AACpG,6FAA6F;AAC7F,mGAAmG;AACnG,qGAAqG;AACrG,MAAM,aAAa,GACjB,gfAAgf,CAAC;AAEnf;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC;IACpD,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAC5C,UAA8B,EAC9B,KAAc,EACd,OAAO,GAA6B,EAAE;IAEtC,8FAA8F;IAC9F,+FAA+F;IAC/F,iGAAiG;IACjG,qGAAqG;IACrG,MAAM,IAAI,GAAwB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;IAC9D,MAAM,UAAU,GAAG,UAAU;QAC3B,CAAC,CAAC,aAAa,IAAI,4CAA4C;QAC/D,CAAC,CAAC,iDAAiD,CAAC;IAEtD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK;YAC1B,CAAC,CAAC,8EAA8E;YAChF,CAAC,CAAC,8FAA8F,CAAC;QACnG,OAAO,CACL,eAAe,IAAI,oEAAoE;YACvF,sFAAsF;YACtF,mFAAmF;YACnF,GAAG,MAAM,QAAQ,UAAU,iBAAiB,CAC7C,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAe,IAAI,sEAAsE;QACzF,yEAAyE,YAAY,CAAC,KAAK,CAAC,EAAE,CAC/F,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gaunt-sloth/agent",
-  "version": "2.0.0-alpha.9",
-  "description": "Deep agent runtime for Gaunt Sloth: tools, middleware, MCP/A2A clients and the AG-UI server",
+  "version": "2.0.0-beta.0",
+  "description": "Agent runtime for Gaunt Sloth: tools, middleware, MCP/A2A clients and the AG-UI server",
   "license": "MIT",
   "author": "Andrew Kondratev",
   "repository": {
@@ -38,21 +38,21 @@
     "#src/*.js": "./dist/*.js"
   },
   "dependencies": {
-    "@a2a-js/sdk": "^0.3.13",
+    "@a2a-js/sdk": "^1.0.1",
     "@ag-ui/core": "^0.0.57",
     "@ag-ui/encoder": "^0.0.57",
-    "@langchain/core": "^1.2.1",
-    "@langchain/langgraph": "^1.4.7",
+    "@agentclientprotocol/sdk": "1.3.0",
+    "@langchain/core": "^1.2.5",
+    "@langchain/langgraph": "^1.4.9",
     "@langchain/mcp-adapters": "^1.1.3",
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "deepagents": "^1.10.5",
-    "deepagents-acp": "^0.1.15",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "diff": "^9.0.0",
     "express": "^5.2.1",
-    "langchain": "^1.5.2",
-    "uuid": ">=11.1.1",
-    "zod": "^4.0.0",
-    "@gaunt-sloth/core": "2.0.0-alpha.9"
+    "langchain": "^1.5.5",
+    "undici": "^8.10.0",
+    "uuid": "^14.0.1",
+    "zod": "^4.4.3",
+    "@gaunt-sloth/core": "2.0.0-beta.0"
   },
   "files": [
     "./dist/*",
@@ -60,7 +60,7 @@
     "cli-acp.js"
   ],
   "publishConfig": {
-    "tag": "alpha"
+    "tag": "beta"
   },
   "scripts": {
     "build": "tsc"

package/dist/core/GthDeepAgent.d.ts

@@ -1,181 +0,0 @@
-import type { GthConfig } from '@gaunt-sloth/core/config.js';
-import { GthAbstractAgent } from '@gaunt-sloth/core/core/GthAbstractAgent.js';
-import { type GthCommand } from '@gaunt-sloth/core/core/types.js';
-import type { StructuredToolInterface } from '@langchain/core/tools';
-import type { BaseCheckpointSaver } from '@langchain/langgraph';
-import { type InterruptOnConfig } from 'langchain';
-import { type FilesystemPermission } from '#src/core/deepAgentPermissions.js';
-import type { DebugCapture, DebugRequestExtras } from '#src/core/debugCapture.js';
-/**
- * The subset of `createDeepAgent` params that are independent of the transport
- * (the local runner vs. the ACP server). Both {@link GthDeepAgent.init} (which adds the
- * console-bound tool-call-status middleware + a virtual {@link FilesystemBackend} +
- * checkpointer and calls `createDeepAgent`) and the ACP entry (deepagents-acp
- * `startServer`, which supplies its own ACP-proxying backend, checkpointer and tool-call
- * reporting) consume these.
- *
- * `middleware` here deliberately EXCLUDES the tool-call-status middleware: that one writes
- * to stdout, which on the ACP path is the JSON-RPC channel and must stay clean. The runner
- * path appends it in {@link GthDeepAgent.init}.
- */
-export interface GthDeepAgentParams {
-    model: any;
-    tools: StructuredToolInterface[];
-    permissions: FilesystemPermission[];
-    middleware: any[];
-    /**
-     * gsloth's composed system prompt (backstory + guidelines + per-command mode prompt +
-     * system prompt). Passed to `createDeepAgent({ systemPrompt })`, where deepagents combines
-     * it ADDITIVELY with its own base + filesystem prompts into ONE system message. This replaces
-     * the previous per-turn `SystemMessage` injection by the runner/AG-UI callers — two system
-     * messages (deepagents' own + gsloth's, not first) are rejected by Anthropic. `undefined` when
-     * no prompt content is composed (lets deepagents use only its base prompt).
-     */
-    systemPrompt: string | undefined;
-    /**
-     * Per-tool human-in-the-loop configuration passed straight to
-     * `createDeepAgent({ interruptOn })` (deepagents installs LangChain's
-     * `humanInTheLoopMiddleware` for it). A matching tool call suspends the graph with a
-     * `__interrupt__` (a `HITLRequest`) so a consumer can approve/reject before the tool runs;
-     * resume with `new Command({ resume: { decisions: [...] } })` on the same `thread_id`.
-     *
-     * gsloth currently sets this only for the opt-in `run_shell_command` tool (when its
-     * `devTools.shell` is enabled and `devTools.shellYolo` is NOT). Left `undefined` otherwise —
-     * including under yolo — so no tool is gated and runs never suspend for approval.
-     */
-    interruptOn?: Record<string, boolean | InterruptOnConfig>;
-}
-/**
- * Deep agent: builds a `createDeepAgent` graph (deepagents). All run/stream/event
- * plumbing lives in {@link GthAbstractAgent}; this class only knows how to construct
- * the graph in {@link init}.
- *
- * Differences from the lean {@link GthLangChainAgent}:
- * - deepagents provides the filesystem tools (`read_file`/`write_file`/`edit_file`/
- *   `ls`/`glob`/`grep`/`execute`) via its own middleware, backed by a
- *   {@link FilesystemBackend}. gsloth's `.aiignore` + `filesystem` config are mapped
- *   onto deepagents `permissions` (see {@link buildPermissions}). Any resolved tool
- *   that reuses a deepagents filesystem-tool name is therefore superseded and dropped
- *   (`createDeepAgent` would otherwise throw on the collision). EXT-14: the
- *   `FilesystemBackend` itself is wrapped with {@link guardFilesystemBackend} before it
- *   reaches `createDeepAgent`, adding a realpath (symlink-resolved) containment check the
- *   permission globs alone can't provide.
- * - todos / subagents / summarization come from deepagents' standard middleware.
- *
- * The transport-agnostic param assembly lives in {@link buildDeepAgentParams} so the ACP
- * entry (`deepagents-acp`) can reuse the exact same tool resolution, permission mapping and
- * middleware hardening without re-running `createDeepAgent` locally.
- */
-export declare class GthDeepAgent extends GthAbstractAgent {
-    /**
-     * Opt-in debug sink for the TUI `/debug` panel. Set AFTER {@link init} via
-     * `runner.getAgent()`; read lazily inside the `wrapModelCall` middleware so that when it
-     * is `undefined` (the normal path) the middleware is a transparent pass-through. Never
-     * touched by the lean agent or the AG-UI server, so those contracts are unchanged.
-     */
-    debugCapture: DebugCapture | undefined;
-    init(command: GthCommand | undefined, configIn: GthConfig, checkpointer?: BaseCheckpointSaver | undefined): Promise<void>;
-    /**
-     * Assemble the transport-agnostic {@link GthDeepAgentParams}: resolve tools (with the
-     * filesystem disabled so deepagents owns fs access), apply the allowedTools allow-list and
-     * the deepagents fs-name supersession safety-net, map `.aiignore` + filesystem mode onto
-     * deepagents permissions, and build the fs-denial-softening middleware. Shared by the local
-     * runner ({@link init}) and the `deepagents-acp` ACP entry.
-     */
-    buildDeepAgentParams(command: GthCommand | undefined, configIn: GthConfig): Promise<GthDeepAgentParams>;
-    /**
-     * Resolve the {@link GthDevToolsConfig} that applies to the active command, mirroring the
-     * per-command selection in `builtInToolsConfig.getDefaultTools` (which is what actually emits
-     * the dev tools): `exec` → `commands.exec.devTools`, `ask --write` → `commands.ask.devTools`,
-     * otherwise (`code`) → `commands.code.devTools`. Returns `undefined` for any other command,
-     * matching the toolkit being inert there. Kept private and side-effect-free so the interrupt
-     * wiring above and the tool emission stay in lockstep.
-     */
-    private getEffectiveDevToolsConfig;
-}
-/**
- * EXT-22: shared virtualMode path-namespace guidance — ONE source of truth used by BOTH the S2
- * early-framing note ({@link appendVirtualCwdNote}, injected into gsloth's composed systemPrompt =
- * block 0) and the S1 last-word correction middleware
- * ({@link createPathNamespaceCorrectionMiddleware}, appended after deepagents' `/`-rooted line).
- *
- * In a virtualMode `code` session (EXT-16, e.g. Windows) the deepagents filesystem tools use a
- * VIRTUAL `/` root (= the working dir) while `run_shell_command` uses REAL native OS paths; the
- * model conflates the two forms. This text draws the distinction and steers toward cwd-relative
- * paths (the one form both tool families read alike).
- *
- * It deliberately does NOT equate the virtual root with a specific real path (no "`/` = D:\\work"):
- * virtualMode withholds the real cwd on purpose (see the systemPrompt gate in {@link
- * GthDeepAgent.init}), so the guidance is about the DISTINCTION between the two namespaces and the
- * safety of relative paths, not a mapping between them.
- */
-export declare const PATH_NAMESPACE_GUIDANCE: string;
-/**
- * EXT-22 (S2): virtualMode variant of {@link appendCwdNote}. On the `code` path when the fs
- * backend runs in virtualMode (EXT-16), inject the shared path-namespace guidance EARLY in
- * gsloth's composed systemPrompt (block 0) so the model is framed before deepagents' own prompt.
- *
- * This is early framing only: deepagents' hardcoded `/`-rooted line lands in a LATER block and can
- * partially override block 0, so the authoritative last word is delivered by the S1 middleware
- * ({@link createPathNamespaceCorrectionMiddleware}); see handoff/spike-systemmessage-ordering.md.
- * Returns the note alone when there is no base prompt.
- */
-export declare function appendVirtualCwdNote(systemPrompt: string | undefined): string;
-/**
- * EXT-22 (S1): the load-bearing path-namespace correction. A gsloth `wrapModelCall` middleware
- * runs INNERMOST (inside deepagents' filesystem middleware), so appending a trailing block to
- * `request.systemMessage` lands AFTER deepagents' hardcoded "All file paths must start with a /."
- * line — giving gsloth the last word on path semantics (empirically verified; see
- * handoff/spike-systemmessage-ordering.md). It APPENDS via `request.systemMessage.concat(...)`
- * (mirroring how deepagents appends its own fs prompt), never string-splices, and returns a NEW
- * request so it never mutates persisted state (no compounding across turns).
- *
- * `appendCorrection` gates it to `code` + virtualMode: only there do the fs virtual `/` root and
- * the shell's real-OS paths diverge. On POSIX real-path mode deepagents' "start with /" is
- * literally true, so the middleware is a transparent pass-through (like the debug-capture
- * middleware when no sink is attached).
- */
-export declare function createPathNamespaceCorrectionMiddleware(appendCorrection: boolean): import("langchain").AgentMiddleware<undefined, undefined, unknown, readonly (import("@langchain/core/tools").ClientTool | import("@langchain/core/tools").ServerTool)[], readonly []>;
-/**
- * EXT-13 (part b): append a real-cwd / path-model note to the composed code-mode system prompt.
- *
- * The default code-mode backend runs in REAL-path mode (no virtualMode), so the deepagents fs
- * tools and `run_shell_command` share one real-absolute-path namespace rooted at `cwd`. Neither
- * deepagents' base prompt nor `.gsloth.code.md` states the actual cwd, so without this the model
- * assumes `/` is cwd and hands `/`-rooted paths to the real-fs shell. The cwd is injected
- * dynamically (never baked into the .md). Returns the note alone when there is no base prompt.
- */
-export declare function appendCwdNote(systemPrompt: string | undefined, cwd: string): string;
-/**
- * EXT-26: the platform-agnostic tail shared by both {@link appendOsShellNote} branches.
- *
- * The recurring failure mode on non-POSIX hosts is not just wrong command NAMES but shell
- * REDIRECTION quoting: a grouped/multi-line `echo` redirect on cmd.exe reported success yet wrote
- * a 0-byte file. So on every platform we steer file creation/mutation to the deepagents built-in
- * `write_file`/`edit_file` tools (which never touch the shell's quoting) and keep each shell
- * command a single line. Kept short — this is prompt text an LLM reads, not documentation.
- */
-export declare const OS_SHELL_GUIDANCE: string;
-/**
- * EXT-26: append an OS + shell-dialect note to the composed code-mode system prompt.
- *
- * The deep-agent model was never told its host OS or which shell `run_shell_command` uses, so on
- * non-POSIX hosts it defaulted to POSIX idioms that fail (ran `ls` where cmd.exe has `dir`, a
- * multi-line echo-redirect that wrote 0 bytes, a PowerShell here-string, `python -c` multi-line).
- * This is ORTHOGONAL to the EXT-13/16/22 path-namespace notes: those say WHERE the model is (path
- * form); this says WHAT shell it speaks (dialect).
- *
- * The shell is derived from the SAME rule Node's `spawn(command, { shell: true })` uses — exactly
- * how `run_shell_command` spawns (GthDevToolkit spawn) — so on `win32` it is cmd.exe (via
- * `%ComSpec%`) and on POSIX it is `/bin/sh` (POSIX sh, NOT guaranteed bash). Computed from
- * `process.platform` at call time so the text is correct per host. Returns the note alone when
- * there is no base prompt. A single injection is authoritative (nothing in deepagents' base prompt
- * contradicts shell dialect), so unlike EXT-22 no correction middleware is needed.
- */
-export declare function appendOsShellNote(systemPrompt: string | undefined): string;
-/**
- * Assemble the non-message request parts ({@link DebugRequestExtras}) for the `/debug`
- * panel from a `wrapModelCall` request, defensively and key-free. Never throws (the caller
- * already guards, but a debug sink must never break a run) and never dumps the raw model.
- */
-export declare function extractDebugRequestExtras(request: unknown): DebugRequestExtras | undefined;