@pwrdrvr/agent-acp 0.16.1 → 0.17.0

package/dist/index.js

@@ -1,3 +1,36 @@
+import {
+  ACP_REGISTRY_URL,
+  AcpAgentAllowlist,
+  AcpRegistryService,
+  BANNED_ACP_REGISTRY_IDS,
+  DEFAULT_ACP_AGENT_ALLOWLIST,
+  DEFAULT_ACP_PROBE_TIMEOUT_MS,
+  defaultAcpAgentAllowlist,
+  discoverLocalAcpAgentInstances,
+  discoverLocalAcpAgents,
+  evaluateAcpDistributionPolicy,
+  isBannedAcpRegistryId,
+  normalizeRegistry,
+  wellKnownAgentBinDirs
+} from "./chunk-GCWY5T5H.js";
+import {
+  BUILT_IN_ACP_STRATEGIES,
+  buildAcpBackendId,
+  buildStrategyTable,
+  defaultQuirks,
+  geminiStrategy,
+  grokStrategy,
+  kimiStrategy,
+  qwenStrategy,
+  strategyByBackendId,
+  strategyById
+} from "./chunk-OFMIS7W6.js";
+import {
+  normalizeAcpMcpServerConfig,
+  normalizeAcpMcpServerConfigs,
+  redactAcpMcpCredentials
+} from "./chunk-64RRSPSB.js";
+
 // src/acp-connection.ts
 import { spawn } from "child_process";
 import { Readable, Writable } from "stream";
@@ -265,9 +298,9 @@ function readFirstLocationPath(record) {
     return void 0;
   }
   for (const location of locations) {
-    const path5 = readString(asRecord(location), "path");
-    if (path5 && path5.trim()) {
-      return path5;
+    const path = readString(asRecord(location), "path");
+    if (path && path.trim()) {
+      return path;
     }
   }
   return void 0;
@@ -303,7 +336,7 @@ function normalizeStatus(status) {
       return void 0;
   }
 }
-function toolKindFor(acpKind, command, path5, label) {
+function toolKindFor(acpKind, command, path, label) {
   switch (acpKind) {
     case "edit":
     case "write":
@@ -324,18 +357,18 @@ function toolKindFor(acpKind, command, path5, label) {
   if (command) return "command";
   const inferred = inferToolKind(label);
   if (inferred !== "other") return inferred;
-  return path5 ? "read" : "other";
+  return path ? "read" : "other";
 }
 function toolCallFromUpdate(update, kind, sessionId) {
   const id = readToolCallId(update, kind, sessionId);
   const label = readString(update, "title") ?? readString(update, "name") ?? readString(update, "kind") ?? kind.replaceAll("_", " ");
   const acpKind = readString(update, "kind");
-  const path5 = readString(update, "path") ?? readFirstLocationPath(update);
+  const path = readString(update, "path") ?? readFirstLocationPath(update);
   const command = readString(update, "command");
   const output = readToolOutput(update);
   const exitCode = readNumber(update, "exitCode") ?? readNumber(update, "exit_code");
   const status = normalizeStatus(readString(update, "status"));
-  const toolKind = toolKindFor(acpKind, command, path5, label);
+  const toolKind = toolKindFor(acpKind, command, path, label);
   const call = {
     id,
     name: readString(update, "name") ?? acpKind ?? label,
@@ -369,9 +402,9 @@ function readToolLocations(update) {
   const out = [];
   for (const item of raw) {
     const record = asRecord(item);
-    const path5 = record ? readString(record, "path") : void 0;
-    if (path5 === void 0) continue;
-    const location = { path: path5 };
+    const path = record ? readString(record, "path") : void 0;
+    if (path === void 0) continue;
+    const location = { path };
     const line = record ? readNumber(record, "line") : void 0;
     if (line !== void 0) location.line = line;
     out.push(location);
@@ -950,51 +983,6 @@ function readAgentInfo(value) {
   return Object.keys(agentInfo).length > 0 ? agentInfo : void 0;
 }
 
-// src/mcp-server-config.ts
-function isKeyValueArray(collection) {
-  return Array.isArray(collection);
-}
-function normalizeKeyValues(collection) {
-  if (collection === void 0) return [];
-  if (isKeyValueArray(collection)) {
-    return collection.map(({ name, value }) => ({ name, value }));
-  }
-  return Object.entries(collection).map(([name, value]) => ({ name, value }));
-}
-function normalizeAcpMcpServerConfig(server) {
-  if ("type" in server) {
-    return {
-      name: server.name,
-      type: server.type,
-      url: server.url,
-      headers: normalizeKeyValues(server.headers)
-    };
-  }
-  return {
-    name: server.name,
-    command: server.command,
-    args: [...server.args ?? []],
-    env: normalizeKeyValues(server.env)
-  };
-}
-function normalizeAcpMcpServerConfigs(servers) {
-  return servers.map(normalizeAcpMcpServerConfig);
-}
-function redactAcpMcpCredentials(message, servers) {
-  const secrets = /* @__PURE__ */ new Set();
-  for (const server of servers) {
-    const values = "type" in server ? [server.url, ...normalizeKeyValues(server.headers).map(({ value }) => value)] : normalizeKeyValues(server.env).map(({ value }) => value);
-    for (const value of values) {
-      if (value.length > 0) secrets.add(value);
-    }
-  }
-  let redacted = message;
-  for (const secret of [...secrets].sort((a, b) => b.length - a.length)) {
-    redacted = redacted.split(secret).join("[REDACTED]");
-  }
-  return redacted;
-}
-
 // src/acp-client.ts
 var ACP_PROTOCOL_VERSION = 1;
 var ACP_PROMPT_REQUEST_TIMEOUT_MS = 60 * 6e4;
@@ -2078,10 +2066,10 @@ function describeUsageShape(result) {
   const paths = [];
   const walk = (record, prefix, depth) => {
     for (const [key, value] of Object.entries(record)) {
-      const path5 = prefix ? `${prefix}.${key}` : key;
-      if (/token|usage|quota/i.test(key)) paths.push(path5);
+      const path = prefix ? `${prefix}.${key}` : key;
+      if (/token|usage|quota/i.test(key)) paths.push(path);
       const child = asRecord2(value);
-      if (child && depth < 3) walk(child, path5, depth + 1);
+      if (child && depth < 3) walk(child, path, depth + 1);
     }
   };
   walk(root, "", 0);
@@ -2293,810 +2281,6 @@ var AcpOneShotClient = class {
     await this.client.close();
   }
 };
-
-// src/strategies/strategy-types.ts
-function buildAcpBackendId(registryId) {
-  return `acp:${registryId}`;
-}
-var DEFAULT_QUIRKS = {
-  surfaceThoughts: true,
-  titleFrom: "topic-update"
-};
-function defaultQuirks(overrides = {}) {
-  return { ...DEFAULT_QUIRKS, ...overrides };
-}
-
-// src/strategies/gemini.ts
-var geminiStrategy = {
-  id: "gemini",
-  backendId: buildAcpBackendId("gemini"),
-  displayName: "Gemini CLI",
-  authors: ["Google"],
-  discoveryProbe: {
-    command: "gemini",
-    versionArgs: ["--version"],
-    helpArgs: ["--help"],
-    helpMatches: /(^|\s)--acp(\s|,|$)/
-  },
-  spawn: {
-    command: "gemini",
-    args: ["--acp"],
-    // Gemini refuses to operate without workspace trust; matching PwrAgnt's
-    // launch-descriptor normalization, append --skip-trust + set the env flag.
-    ensureArgs: ["--skip-trust"],
-    env: { GEMINI_CLI_TRUST_WORKSPACE: "true" }
-  },
-  quirks: defaultQuirks({ surfaceThoughts: true, titleFrom: "topic-update" })
-};
-
-// src/strategies/grok.ts
-import { homedir } from "os";
-import path from "path";
-var grokStrategy = {
-  id: "grok",
-  backendId: buildAcpBackendId("grok"),
-  displayName: "Grok",
-  authors: ["xAI"],
-  discoveryProbe: {
-    command: "grok",
-    versionArgs: ["--version"],
-    helpArgs: ["agent", "stdio", "--help"],
-    helpMatches: /Run the agent over stdio/i,
-    fallbackCommands: [
-      path.join(homedir(), ".grok", "bin", "grok"),
-      "/opt/homebrew/bin/grok",
-      "/usr/local/bin/grok"
-    ]
-  },
-  spawn: {
-    command: "grok",
-    args: ["agent", "stdio"]
-  },
-  // Grok auto-generates the thread title via its vendor notification
-  // `_x.ai/session_notification` carrying `session_summary_generated`.
-  quirks: defaultQuirks({
-    surfaceThoughts: true,
-    titleFrom: "session-summary",
-    vendorNotificationMethods: ["_x.ai/session_notification"]
-  })
-};
-
-// src/strategies/kimi.ts
-import { homedir as homedir2 } from "os";
-import path2 from "path";
-var kimiStrategy = {
-  id: "kimi",
-  backendId: buildAcpBackendId("kimi"),
-  displayName: "Kimi Code CLI",
-  authors: ["Moonshot AI"],
-  discoveryProbe: {
-    command: "kimi",
-    versionArgs: ["--version"],
-    // Capability signal is the EXIT CODE of `kimi acp --help`, NOT its prose.
-    // kimi's commander CLI exits non-zero for an unknown subcommand, so a
-    // zero-exit proves the `acp` subcommand exists. No `helpMatches`: the help
-    // wording has already drifted across kimi versions (0.11.0 prints "Agent
-    // Client Protocol (ACP) server over stdio"), so matching it is fragile.
-    helpArgs: ["acp", "--help"],
-    // The official Kimi Code installer drops a standalone binary at
-    // ~/.kimi-code/bin/kimi and does NOT add it to PATH — so a Finder-launched
-    // app misses it without this fallback (mirrors grok/qwen).
-    fallbackCommands: [
-      path2.join(homedir2(), ".kimi-code", "bin", "kimi"),
-      "/opt/homebrew/bin/kimi",
-      "/usr/local/bin/kimi"
-    ]
-  },
-  spawn: {
-    command: "kimi",
-    args: ["acp"]
-  },
-  quirks: defaultQuirks({ surfaceThoughts: true, titleFrom: "topic-update" })
-};
-
-// src/strategies/qwen.ts
-import { homedir as homedir3 } from "os";
-import path3 from "path";
-var qwenStrategy = {
-  id: "qwen",
-  backendId: buildAcpBackendId("qwen"),
-  displayName: "Qwen Code",
-  authors: ["Qwen Team"],
-  license: "Apache-2.0",
-  repositoryUrl: "https://github.com/QwenLM/qwen-code",
-  discoveryProbe: {
-    command: "qwen",
-    versionArgs: ["--version"],
-    helpArgs: ["--help"],
-    helpMatches: /(^|\s)--acp(\s|,|$)/,
-    fallbackCommands: [
-      path3.join(homedir3(), ".qwen", "bin", "qwen"),
-      "/opt/homebrew/bin/qwen",
-      "/usr/local/bin/qwen"
-    ]
-  },
-  spawn: {
-    command: "qwen",
-    args: ["--acp"]
-  },
-  // Qwen's thought chunks are noisy internal scaffolding — suppress them.
-  quirks: defaultQuirks({ surfaceThoughts: false, titleFrom: "topic-update" })
-};
-
-// src/strategies/index.ts
-var BUILT_IN_ACP_STRATEGIES = [
-  geminiStrategy,
-  kimiStrategy,
-  grokStrategy,
-  qwenStrategy
-];
-function buildStrategyTable(strategies = BUILT_IN_ACP_STRATEGIES) {
-  const table = /* @__PURE__ */ new Map();
-  for (const strategy of strategies) {
-    table.set(strategy.id, strategy);
-  }
-  return table;
-}
-function strategyById(id, table = buildStrategyTable()) {
-  return table.get(id);
-}
-function strategyByBackendId(backendId, strategies = BUILT_IN_ACP_STRATEGIES) {
-  return strategies.find((strategy) => strategy.backendId === backendId);
-}
-
-// src/discovery/acp-local-discovery.ts
-import { execFile as execFileCallback } from "child_process";
-import { readdirSync, realpathSync, statSync } from "fs";
-import { homedir as homedir4 } from "os";
-import path4 from "path";
-import { promisify } from "util";
-import {
-  createCommandInvocation as createCommandInvocation2,
-  prependCommandDirToPath as prependCommandDirToPath2
-} from "@pwrdrvr/agent-transport";
-var execFile = promisify(execFileCallback);
-var DEFAULT_ACP_PROBE_TIMEOUT_MS = 5e3;
-async function discoverLocalAcpAgentInstances(options = {}) {
-  const strategies = options.strategies ?? BUILT_IN_ACP_STRATEGIES;
-  const env = options.env ?? process.env;
-  const probe = options.probe ?? makeDefaultProbe(env);
-  const listExecutables = options.listExecutables ?? defaultListExecutables;
-  const now = options.now ?? Date.now;
-  const probeOptions = {
-    timeoutMs: options.probeTimeoutMs ?? DEFAULT_ACP_PROBE_TIMEOUT_MS,
-    signal: options.signal
-  };
-  const groups = await Promise.all(
-    strategies.map(
-      (strategy) => discoverStrategyInstances(
-        strategy,
-        probe,
-        now,
-        env,
-        listExecutables,
-        options.overrides?.[strategy.id],
-        options.includeRejectedCandidates === true,
-        probeOptions
-      )
-    )
-  );
-  return groups.filter((group) => group !== void 0);
-}
-async function discoverLocalAcpAgents(options = {}) {
-  const groups = await discoverLocalAcpAgentInstances(options);
-  return groups.flatMap((group) => {
-    const first = group.instances[0];
-    if (first === void 0) return [];
-    const agent = {
-      strategyId: group.strategyId,
-      backendId: group.backendId,
-      name: group.name,
-      command: first.command,
-      args: group.args,
-      env: group.env,
-      discoveredAt: group.discoveredAt
-    };
-    if (first.version !== void 0) agent.version = first.version;
-    return [agent];
-  });
-}
-async function discoverStrategyInstances(strategy, probe, now, env, listExecutables, override, includeRejectedCandidates = false, probeOptions = {}) {
-  const candidates = candidateCommands(strategy, env, listExecutables, override);
-  const instances = [];
-  const rejectedInstances = [];
-  for (const candidate of candidates) {
-    if (probeOptions.signal?.aborted) break;
-    const [versionAttempt, helpAttempt] = await Promise.all([
-      runProbe(probe, candidate.command, strategy.discoveryProbe.versionArgs, probeOptions),
-      runProbe(probe, candidate.command, strategy.discoveryProbe.helpArgs, probeOptions)
-    ]);
-    if (probeOptions.signal?.aborted) break;
-    const versionResult = versionAttempt.ok ? versionAttempt.result : void 0;
-    const helpResult = helpAttempt.ok ? helpAttempt.result : void 0;
-    const version = versionResult ? parseCliVersion(resultText(versionResult)) : void 0;
-    if (!versionResult || !helpResult) {
-      const timedOut = !versionAttempt.ok && versionAttempt.timedOut || !helpAttempt.ok && helpAttempt.timedOut;
-      if (candidate.detected && (timedOut || includeRejectedCandidates)) {
-        const rejected = {
-          command: candidate.command,
-          source: candidate.source,
-          reason: timedOut ? "probe-timed-out" : versionResult ? "acp-probe-failed" : "version-probe-failed"
-        };
-        if (version !== void 0) rejected.version = version;
-        rejectedInstances.push(rejected);
-      }
-      continue;
-    }
-    if (strategy.discoveryProbe.helpMatches !== void 0 && !strategy.discoveryProbe.helpMatches.test(resultText(helpResult))) {
-      if (includeRejectedCandidates && candidate.detected) {
-        const rejected = {
-          command: candidate.command,
-          source: candidate.source,
-          reason: "acp-help-mismatch"
-        };
-        if (version !== void 0) rejected.version = version;
-        rejectedInstances.push(rejected);
-      }
-      continue;
-    }
-    const instance = {
-      command: candidate.command,
-      source: candidate.source
-    };
-    if (version !== void 0) instance.version = version;
-    instances.push(instance);
-  }
-  if (instances.length === 0 && rejectedInstances.length === 0) {
-    return void 0;
-  }
-  return {
-    strategyId: strategy.id,
-    backendId: strategy.backendId,
-    name: strategy.displayName,
-    args: ensureArgs(strategy.spawn.args, strategy.spawn.ensureArgs),
-    env: strategy.spawn.env ?? {},
-    instances,
-    ...rejectedInstances.length > 0 ? { rejectedInstances } : {},
-    discoveredAt: now()
-  };
-}
-function candidateCommands(strategy, env, listExecutables, override) {
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  const push = (command, source, detected) => {
-    const trimmed = command.trim();
-    if (trimmed.length === 0) return;
-    const key = canonicalize(trimmed);
-    if (seen.has(key)) return;
-    seen.add(key);
-    out.push({ command: trimmed, source, detected });
-  };
-  if (override && override.trim().length > 0) {
-    push(override, "override", isExecutableFile(override));
-  }
-  const pathMatches = listExecutables(strategy.discoveryProbe.command, env);
-  if (pathMatches.length > 0) {
-    for (const match of pathMatches) push(match, "path", true);
-  } else {
-    push(strategy.discoveryProbe.command, "path", false);
-  }
-  for (const fallback of strategy.discoveryProbe.fallbackCommands ?? []) {
-    push(fallback, "fallback", isExecutableFile(fallback));
-  }
-  return out;
-}
-function isExecutableFile(command) {
-  try {
-    const stat = statSync(command);
-    return stat.isFile() && (process.platform === "win32" || (stat.mode & 73) !== 0);
-  } catch {
-    return false;
-  }
-}
-function canonicalize(command) {
-  if (!path4.isAbsolute(command)) {
-    return process.platform === "win32" ? command.toLowerCase() : command;
-  }
-  try {
-    const canonical = realpathSync(command);
-    return process.platform === "win32" ? canonical.toLowerCase() : canonical;
-  } catch {
-    return process.platform === "win32" ? command.toLowerCase() : command;
-  }
-}
-function defaultListExecutables(command, env) {
-  if (command.includes("/") || command.includes("\\")) return [];
-  const found = [];
-  const seenDir = /* @__PURE__ */ new Set();
-  for (const dir of discoveryDirs(env)) {
-    const normalizedDir = normalizePathEntry(dir);
-    const dirKey = process.platform === "win32" ? normalizedDir.toLowerCase() : normalizedDir;
-    if (normalizedDir.length === 0 || seenDir.has(dirKey)) continue;
-    seenDir.add(dirKey);
-    for (const commandName of executableCommandNames(command, env)) {
-      const candidate = path4.join(normalizedDir, commandName);
-      try {
-        const stat = statSync(candidate);
-        if (stat.isFile() && (process.platform === "win32" || (stat.mode & 73) !== 0)) {
-          found.push(candidate);
-        }
-      } catch {
-      }
-    }
-  }
-  return found;
-}
-function executableCommandNames(command, env) {
-  if (process.platform !== "win32") return [command];
-  const extensions = (readWindowsEnv(env, "PATHEXT")?.trim() || ".COM;.EXE;.BAT;.CMD").split(";").map((extension) => extension.trim()).filter(Boolean).map((extension) => extension.startsWith(".") ? extension : `.${extension}`);
-  const commandExtension = path4.win32.extname(command);
-  if (commandExtension.length > 0 && extensions.some((extension) => extension.toLowerCase() === commandExtension.toLowerCase())) {
-    return [command];
-  }
-  return extensions.map((extension) => `${command}${extension}`);
-}
-function readWindowsEnv(env, name) {
-  const key = Object.keys(env).find((candidate) => candidate.toLowerCase() === name.toLowerCase());
-  return key ? env[key] : void 0;
-}
-function normalizePathEntry(entry) {
-  const trimmed = entry.trim();
-  const quoted = trimmed.match(/^"(.*)"$/);
-  return quoted?.[1] ?? trimmed;
-}
-function discoveryDirs(env) {
-  const pathValue = process.platform === "win32" ? readWindowsEnv(env, "PATH") ?? "" : env.PATH ?? "";
-  const pathDirs = pathValue.split(path4.delimiter);
-  return process.platform === "win32" ? pathDirs : [...pathDirs, ...wellKnownAgentBinDirs(homedir4())];
-}
-function wellKnownAgentBinDirs(home = homedir4()) {
-  return [
-    // Every installed nvm node version's bin (the agent may be under any one).
-    ...nvmNodeBinDirs(home),
-    // Other version / package managers.
-    path4.join(home, ".volta", "bin"),
-    path4.join(home, ".bun", "bin"),
-    path4.join(home, ".asdf", "shims"),
-    path4.join(home, ".deno", "bin"),
-    path4.join(home, ".local", "bin"),
-    path4.join(home, ".npm-global", "bin"),
-    // Common system install prefixes.
-    "/opt/homebrew/bin",
-    "/usr/local/bin"
-  ];
-}
-function nvmNodeBinDirs(home) {
-  const base = path4.join(home, ".nvm", "versions", "node");
-  try {
-    return readdirSync(base).sort().reverse().map((version) => path4.join(base, version, "bin"));
-  } catch {
-    return [];
-  }
-}
-function ensureArgs(args, ensure) {
-  if (!ensure || ensure.length === 0) {
-    return args;
-  }
-  const result = [...args];
-  for (const arg of ensure) {
-    if (!result.includes(arg)) result.push(arg);
-  }
-  return result;
-}
-var AcpProbeTimeoutError = class extends Error {
-  constructor(command, timeoutMs) {
-    super(`acp probe did not answer within ${timeoutMs}ms: ${command}`);
-    this.name = "AcpProbeTimeoutError";
-  }
-};
-function isProbeTimeout(error) {
-  if (error instanceof AcpProbeTimeoutError) return true;
-  const name = error?.name;
-  return error?.killed === true || name === "AbortError" || name === "TimeoutError";
-}
-function normalizeProbeTimeoutMs(timeoutMs) {
-  if (timeoutMs === void 0 || !Number.isFinite(timeoutMs)) {
-    return DEFAULT_ACP_PROBE_TIMEOUT_MS;
-  }
-  return Math.max(1, Math.floor(timeoutMs));
-}
-function makeDefaultProbe(env) {
-  return async (command, args, options = {}) => {
-    const timeoutMs = normalizeProbeTimeoutMs(options.timeoutMs);
-    const launchEnv = prependCommandDirToPath2(command, env);
-    const invocation = createCommandInvocation2({ command, args, env: launchEnv });
-    const controller = new AbortController();
-    let timedOut = false;
-    const onAbort = () => controller.abort();
-    options.signal?.addEventListener("abort", onAbort, { once: true });
-    const timer = setTimeout(() => {
-      timedOut = true;
-      controller.abort();
-    }, timeoutMs);
-    const expired = new Promise((resolve) => {
-      controller.signal.addEventListener("abort", () => resolve("expired"), {
-        once: true
-      });
-    });
-    try {
-      const execution = execFile(invocation.command, invocation.args, {
-        timeout: timeoutMs,
-        signal: controller.signal,
-        maxBuffer: 1024 * 1024,
-        // A Windows `.cmd` shim runs through `cmd.exe`; without this every
-        // discovery pass flashes console windows over the host app.
-        windowsHide: true,
-        // Prepend the candidate's own dir so a node-script CLI (e.g. an nvm-
-        // installed `qwen`) finds its sibling `node` during the probe.
-        env: launchEnv,
-        windowsVerbatimArguments: invocation.windowsVerbatimArguments
-      }).then(
-        (result) => ({ ok: true, result }),
-        (error) => ({ ok: false, error })
-      );
-      const settled = await Promise.race([execution, expired]);
-      if (settled === "expired") {
-        if (timedOut) throw new AcpProbeTimeoutError(command, timeoutMs);
-        throw new Error(`acp probe aborted: ${command}`);
-      }
-      if (!settled.ok) {
-        if (timedOut) throw new AcpProbeTimeoutError(command, timeoutMs);
-        throw settled.error;
-      }
-      return settled.result;
-    } finally {
-      clearTimeout(timer);
-      options.signal?.removeEventListener("abort", onAbort);
-    }
-  };
-}
-async function runProbe(probe, command, args, options) {
-  try {
-    return { ok: true, result: await probe(command, args, options) };
-  } catch (error) {
-    return { ok: false, timedOut: isProbeTimeout(error) };
-  }
-}
-function resultText(result) {
-  return [result.stdout, result.stderr].flatMap((value) => value === void 0 ? [] : [value]).map((value) => Buffer.isBuffer(value) ? value.toString("utf8") : value).join("\n");
-}
-function parseCliVersion(output) {
-  const trimmed = output.trim();
-  if (!trimmed) {
-    return void 0;
-  }
-  return trimmed.match(/\d+\.\d+\.\d+(?:[-+][\w.-]+)?/)?.[0] ?? trimmed;
-}
-
-// src/discovery/acp-agent-allowlist.ts
-var BANNED_ACP_REGISTRY_IDS = /* @__PURE__ */ new Set(["codex-acp"]);
-var DEFAULT_ACP_AGENT_ALLOWLIST = [
-  { id: "local-grok-cli", registryId: "grok", distributionKinds: ["local"] },
-  { id: "local-qwen-code-cli", registryId: "qwen", distributionKinds: ["local"] }
-];
-var AcpAgentAllowlist = class {
-  constructor(rules) {
-    this.rules = rules;
-  }
-  rules;
-  evaluate(agent) {
-    if (isBannedAcpRegistryId(agent.id)) {
-      return { allowed: false, reason: "banned" };
-    }
-    const matchingRules = this.rules.filter((rule) => rule.registryId === agent.id);
-    if (matchingRules.length === 0) {
-      return { allowed: false, reason: "not-allowlisted" };
-    }
-    for (const rule of matchingRules) {
-      const denial = evaluateRule(rule, agent);
-      if (!denial) {
-        return {
-          allowed: true,
-          ruleId: rule.id,
-          unverifiedBinaryAllowed: rule.allowUnverifiedBinary === true
-        };
-      }
-    }
-    return { allowed: false, reason: "allowlist-rule-mismatch" };
-  }
-  evaluateDistribution(agent, distribution) {
-    if (isBannedAcpRegistryId(agent.id)) {
-      return { allowed: false, reason: "banned" };
-    }
-    const matchingRules = this.rules.filter((rule) => rule.registryId === agent.id);
-    if (matchingRules.length === 0) {
-      return { allowed: false, reason: "not-allowlisted" };
-    }
-    for (const rule of matchingRules) {
-      const denial = evaluateDistributionRule(rule, agent, distribution);
-      if (!denial) {
-        return {
-          allowed: true,
-          ruleId: rule.id,
-          unverifiedBinaryAllowed: rule.allowUnverifiedBinary === true
-        };
-      }
-    }
-    return { allowed: false, reason: "allowlist-rule-mismatch" };
-  }
-};
-var defaultAcpAgentAllowlist = new AcpAgentAllowlist(
-  DEFAULT_ACP_AGENT_ALLOWLIST
-);
-function isBannedAcpRegistryId(registryId) {
-  return BANNED_ACP_REGISTRY_IDS.has(registryId);
-}
-function evaluateRule(rule, agent) {
-  if (rule.versions && (!agent.version || !rule.versions.includes(agent.version))) {
-    return "version-not-allowed";
-  }
-  if (isGplFamilyLicense(agent.license) && !rule.allowGplFamilyLicense) {
-    return "license-not-allowed";
-  }
-  let distributionDeniedBySource = false;
-  for (const distribution of agent.distributions) {
-    const denial = evaluateDistributionRule(rule, agent, distribution, {
-      skipAgentChecks: true
-    });
-    if (!denial) {
-      return void 0;
-    }
-    if (denial === "distribution-source-not-allowed") {
-      distributionDeniedBySource = true;
-    }
-  }
-  return distributionDeniedBySource ? "distribution-source-not-allowed" : "distribution-not-allowed";
-}
-function evaluateDistributionRule(rule, agent, distribution, options = {}) {
-  if (!options.skipAgentChecks && rule.versions && (!agent.version || !rule.versions.includes(agent.version))) {
-    return "version-not-allowed";
-  }
-  if (!options.skipAgentChecks && isGplFamilyLicense(agent.license) && !rule.allowGplFamilyLicense) {
-    return "license-not-allowed";
-  }
-  if (!distributionAllowedByKind(rule, distribution)) {
-    return "distribution-not-allowed";
-  }
-  if (!distributionSourceAllowed(rule, distribution)) {
-    return "distribution-source-not-allowed";
-  }
-  return void 0;
-}
-function distributionAllowedByKind(rule, distribution) {
-  return !rule.distributionKinds || rule.distributionKinds.includes(distribution.kind);
-}
-function distributionSourceAllowed(rule, distribution) {
-  if (distribution.kind === "npx" || distribution.kind === "uvx") {
-    return !rule.allowedPackageNames || rule.allowedPackageNames.includes(distribution.packageName);
-  }
-  if (distribution.kind !== "binary") {
-    return false;
-  }
-  if (!rule.allowedArchiveHosts) {
-    return true;
-  }
-  try {
-    return rule.allowedArchiveHosts.includes(new URL(distribution.archiveUrl).host);
-  } catch {
-    return false;
-  }
-}
-function isGplFamilyLicense(license) {
-  return /\b(?:GPL|AGPL|LGPL)\b/i.test(license ?? "");
-}
-
-// src/discovery/acp-registry-types.ts
-var ACP_REGISTRY_URL = "https://cdn.agentclientprotocol.com/registry/v1/latest/registry.json";
-
-// src/discovery/acp-registry-service.ts
-var AcpRegistryService = class {
-  allowlist;
-  fetcher;
-  now;
-  registryUrl;
-  constructor(options = {}) {
-    this.allowlist = options.allowlist ?? defaultAcpAgentAllowlist;
-    this.fetcher = options.fetch ?? (async (input, init) => {
-      const response = await globalThis.fetch(input, init);
-      return {
-        ok: response.ok,
-        status: response.status,
-        statusText: response.statusText,
-        json: () => response.json()
-      };
-    });
-    this.now = options.now ?? Date.now;
-    this.registryUrl = options.registryUrl ?? ACP_REGISTRY_URL;
-  }
-  async fetchRegistry() {
-    const response = await this.fetcher(this.registryUrl, {
-      headers: { accept: "application/json" }
-    });
-    if (!response.ok) {
-      throw new Error(
-        `ACP registry request failed: ${response.status} ${response.statusText}`
-      );
-    }
-    const raw = await response.json();
-    return { fetchedAt: this.now(), agents: normalizeRegistry(raw), raw };
-  }
-  applyAllowlist(snapshot) {
-    return snapshot.agents.map((agent) => {
-      const allowlist = this.allowlist.evaluate(agent);
-      const distributionPolicies = agent.distributions.map(
-        (distribution) => this.evaluateDistribution(agent, distribution)
-      );
-      const installablePolicy = distributionPolicies.find((policy) => policy.installable);
-      const firstBlockedAllowedPolicy = distributionPolicies.find(
-        (policy) => policy.allowlist.allowed
-      );
-      const installable = Boolean(installablePolicy);
-      const result = {
-        ...agent,
-        allowlist,
-        installable,
-        verificationStatus: installablePolicy?.verificationStatus ?? firstBlockedAllowedPolicy?.verificationStatus ?? "not-applicable"
-      };
-      const unavailableReason = installable ? void 0 : firstBlockedAllowedPolicy?.unavailableReason ?? (allowlist.allowed ? "distribution-not-installable" : allowlist.reason);
-      if (unavailableReason !== void 0) result.unavailableReason = unavailableReason;
-      return result;
-    });
-  }
-  evaluateDistribution(agent, distribution) {
-    const allowlist = this.allowlist.evaluateDistribution(agent, distribution);
-    return evaluateAcpDistributionPolicy(distribution, allowlist);
-  }
-};
-function evaluateAcpDistributionPolicy(distribution, allowlist) {
-  if (!allowlist.allowed) {
-    return {
-      allowlist,
-      installable: false,
-      verificationStatus: "not-applicable",
-      unavailableReason: allowlist.reason
-    };
-  }
-  if (distribution.kind !== "binary") {
-    return { allowlist, installable: true, verificationStatus: "not-applicable" };
-  }
-  if (distribution.checksum) {
-    return { allowlist, installable: true, verificationStatus: "verified" };
-  }
-  return {
-    allowlist,
-    installable: allowlist.unverifiedBinaryAllowed,
-    verificationStatus: allowlist.unverifiedBinaryAllowed ? "unverified-allowed" : "unverified-blocked",
-    ...allowlist.unverifiedBinaryAllowed ? {} : { unavailableReason: "binary-integrity-metadata-missing" }
-  };
-}
-function normalizeRegistry(raw) {
-  const record = asRecord3(raw);
-  const rawAgents = Array.isArray(record?.agents) ? record.agents : [];
-  return rawAgents.flatMap((item) => {
-    const agent = normalizeAgent(item);
-    return agent ? [agent] : [];
-  });
-}
-function normalizeAgent(raw) {
-  const record = asRecord3(raw);
-  if (!record || typeof record.id !== "string" || typeof record.name !== "string") {
-    return void 0;
-  }
-  const distributions = normalizeDistributions(record.distribution);
-  if (distributions.length === 0) {
-    return void 0;
-  }
-  const agent = {
-    id: record.id,
-    backendId: buildAcpBackendId(record.id),
-    name: record.name,
-    authors: Array.isArray(record.authors) ? record.authors.filter((author) => typeof author === "string") : [],
-    distributions,
-    distributionKinds: [...new Set(distributions.map((d) => d.kind))],
-    auth: normalizeAuth(record.auth),
-    raw
-  };
-  const version = stringValue(record.version);
-  if (version !== void 0) agent.version = version;
-  const description = stringValue(record.description);
-  if (description !== void 0) agent.description = description;
-  const license = stringValue(record.license);
-  if (license !== void 0) agent.license = license;
-  const repositoryUrl = stringValue(record.repository);
-  if (repositoryUrl !== void 0) agent.repositoryUrl = repositoryUrl;
-  const websiteUrl = stringValue(record.website);
-  if (websiteUrl !== void 0) agent.websiteUrl = websiteUrl;
-  const iconUrl = stringValue(record.icon);
-  if (iconUrl !== void 0) agent.iconUrl = iconUrl;
-  return agent;
-}
-function normalizeDistributions(raw) {
-  const record = asRecord3(raw);
-  if (!record) {
-    return [];
-  }
-  const distributions = [];
-  const npx = normalizePackageDistribution("npx", record.npx);
-  if (npx) distributions.push(npx);
-  const uvx = normalizePackageDistribution("uvx", record.uvx);
-  if (uvx) distributions.push(uvx);
-  const binaryRecord = asRecord3(record.binary);
-  if (binaryRecord) {
-    for (const [platform, value] of Object.entries(binaryRecord)) {
-      const binary = normalizeBinaryDistribution(platform, value);
-      if (binary) distributions.push(binary);
-    }
-  }
-  return distributions;
-}
-function normalizePackageDistribution(kind, raw) {
-  const record = asRecord3(raw);
-  if (!record || typeof record.package !== "string") {
-    return void 0;
-  }
-  return {
-    kind,
-    packageName: record.package,
-    args: stringArray(record.args),
-    env: stringRecord(record.env)
-  };
-}
-function normalizeBinaryDistribution(platform, raw) {
-  const record = asRecord3(raw);
-  if (!record || typeof record.archive !== "string" || typeof record.cmd !== "string") {
-    return void 0;
-  }
-  const distribution = {
-    kind: "binary",
-    platform,
-    archiveUrl: record.archive,
-    command: record.cmd,
-    args: stringArray(record.args),
-    env: stringRecord(record.env)
-  };
-  const checksum = stringValue(record.checksum) ?? stringValue(record.sha256);
-  if (checksum !== void 0) distribution.checksum = checksum;
-  const signatureUrl = stringValue(record.signature) ?? stringValue(record.signatureUrl);
-  if (signatureUrl !== void 0) distribution.signatureUrl = signatureUrl;
-  return distribution;
-}
-function normalizeAuth(raw) {
-  if (!raw) {
-    return { required: false, methods: [] };
-  }
-  const record = asRecord3(raw);
-  if (!record) {
-    return { required: true, methods: ["unknown"], raw };
-  }
-  const methods = stringArray(record.methods).map(
-    (method) => method === "agent-managed" || method === "terminal" ? method : "unknown"
-  );
-  return {
-    required: record.required === false ? false : true,
-    methods: methods.length > 0 ? [...new Set(methods)] : ["unknown"],
-    raw
-  };
-}
-function asRecord3(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-}
-function stringValue(value) {
-  return typeof value === "string" && value.trim() ? value : void 0;
-}
-function stringArray(value) {
-  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
-}
-function stringRecord(value) {
-  const record = asRecord3(value);
-  if (!record) {
-    return {};
-  }
-  return Object.fromEntries(
-    Object.entries(record).filter(
-      (entry) => typeof entry[1] === "string"
-    )
-  );
-}
 export {
   ACP_REGISTRY_URL,
   ACP_REQUEST_TIMEOUT_MESSAGE_PREFIX,