@securecoms/agent-bridge 0.6.0 → 0.8.0

package/connectors/hermes/tests/test_securecoms_transport.py

@@ -0,0 +1,608 @@
+# packages/connect-agent-bridge/connectors/hermes/tests/test_securecoms_transport.py
+#
+# TDD for securecoms_transport.py: contract resolution
+# (resolve_target/probe_and_gate), the echo guard, and the per-channel
+# ChannelStatusManager. Ported in spirit from ../../openclaw/openclaw-entry.js's
+# LoopbackChannel (the reference connector), not case-for-case like
+# test_securecoms_gate.py, since openclaw has no separate transport.js to port
+# from - the JS transport logic lives inline in openclaw-entry.js's
+# _resolveConnection/_probeAndGate/onMessage handler.
+
+import json
+import os
+
+import pytest
+
+from securecoms_transport import (
+    ChannelStatusManager,
+    ResolvedTarget,
+    probe_and_gate,
+    probe_and_gate_bound,
+    resolve_target,
+    should_drop_inbound,
+)
+
+_TRANSPORT_SRC_PATH = os.path.join(
+    os.path.dirname(os.path.dirname(__file__)), "securecoms_transport.py"
+)
+
+
+class TestNoGatewayImports:
+    def test_transport_source_has_zero_gateway_import_tokens(self):
+        # F7: a sys.modules census is process-global and flaky (another test
+        # module importing something gateway-shaped would poison it). The
+        # real proof is source-level: securecoms_transport.py must never
+        # import a gateway/plugin-registry abstraction - it is a plain daemon
+        # HTTP/WS client (see the module docstring). Read the ACTUAL file on
+        # disk, not the imported module's __file__ compiled bytecode.
+        with open(_TRANSPORT_SRC_PATH, "r", encoding="utf-8") as f:
+            source = f.read()
+        assert "import gateway" not in source
+        assert "from gateway" not in source
+
+BINDING_PATH = "/plugin/securecoms.binding.json"
+CONNECTIONS_DIR = "/home/.securecoms/connections"
+
+
+def make_fs(files: dict) -> callable:
+    """files: path -> str content (or an Exception instance to raise)."""
+
+    def read(path):
+        v = files.get(path)
+        if v is None:
+            raise FileNotFoundError(f"ENOENT: {path}")
+        if isinstance(v, Exception):
+            raise v
+        return v
+
+    return read
+
+
+def binding(identity_id="A"):
+    return json.dumps({"identity_id": identity_id})
+
+
+def conn_file(bridge_url="ws://127.0.0.1:9001/v1/ws", token_file="/tok/A", identity_id="A"):
+    return json.dumps(
+        {
+            "schema": "securecoms.connection/1",
+            "identity_id": identity_id,
+            "bridge_url": bridge_url,
+            "token_file": token_file,
+            "instance_id": "inst-1",
+            "slug": identity_id,
+            "label": identity_id,
+            "written_at": "2026-07-22T00:00:00Z",
+        }
+    )
+
+
+class FakeResponse:
+    def __init__(self, payload):
+        self._payload = payload
+
+    async def json(self):
+        return self._payload
+
+
+class FakeSession:
+    """Records every call so tests can assert exactly what securecoms_transport.py
+    did (and, crucially, did NOT do - e.g. no ws_connect on gate refusal)."""
+
+    def __init__(self, healthz_by_url=None):
+        self.get_calls = []
+        self.ws_calls = []
+        self._healthz_by_url = healthz_by_url or {}
+
+    async def get(self, url):
+        self.get_calls.append(url)
+        if url not in self._healthz_by_url:
+            raise ConnectionError(f"connection refused: {url}")
+        return FakeResponse(self._healthz_by_url[url])
+
+    async def ws_connect(self, *a, **kw):  # pragma: no cover - must never be hit
+        self.ws_calls.append((a, kw))
+        raise AssertionError("probe_and_gate must never open a websocket")
+
+
+# ---------------------------------------------------------------------------
+# resolve_target: holds (returns None) on any absence/partial/unreadable input
+# ---------------------------------------------------------------------------
+
+
+class TestResolveTargetHolds:
+    def test_none_when_binding_missing(self):
+        read = make_fs({CONNECTIONS_DIR + "/A.json": conn_file()})
+        result = resolve_target({}, read, BINDING_PATH, CONNECTIONS_DIR)
+        assert result is None
+
+    def test_none_when_connection_file_missing(self):
+        read = make_fs({BINDING_PATH: binding("A")})
+        result = resolve_target({}, read, BINDING_PATH, CONNECTIONS_DIR)
+        assert result is None
+
+    def test_none_when_bridge_url_blank(self):
+        read = make_fs(
+            {
+                BINDING_PATH: binding("A"),
+                CONNECTIONS_DIR + "/A.json": conn_file(bridge_url=""),
+            }
+        )
+        result = resolve_target({}, read, BINDING_PATH, CONNECTIONS_DIR)
+        assert result is None
+
+    def test_none_when_token_file_field_blank(self):
+        read = make_fs(
+            {
+                BINDING_PATH: binding("A"),
+                CONNECTIONS_DIR + "/A.json": conn_file(token_file=""),
+            }
+        )
+        result = resolve_target({}, read, BINDING_PATH, CONNECTIONS_DIR)
+        assert result is None
+
+    def test_none_when_token_unreadable(self):
+        read = make_fs(
+            {
+                BINDING_PATH: binding("A"),
+                CONNECTIONS_DIR + "/A.json": conn_file(token_file="/tok/A"),
+                # /tok/A intentionally absent -> read raises
+            }
+        )
+        result = resolve_target({}, read, BINDING_PATH, CONNECTIONS_DIR)
+        assert result is None
+
+    def test_none_when_connection_file_unparseable(self):
+        read = make_fs(
+            {
+                BINDING_PATH: binding("A"),
+                CONNECTIONS_DIR + "/A.json": "{not json",
+            }
+        )
+        result = resolve_target({}, read, BINDING_PATH, CONNECTIONS_DIR)
+        assert result is None
+
+    def test_resolve_target_never_raises_on_hostile_input(self):
+        read = make_fs({BINDING_PATH: binding("A"), CONNECTIONS_DIR + "/A.json": conn_file(token_file="")})
+        # Must return None, not raise, even for a connection file present but blank.
+        assert resolve_target({}, read, BINDING_PATH, CONNECTIONS_DIR) is None
+
+
+class TestResolveTargetSuccess:
+    def test_resolves_bridge_url_ws_url_token_identity(self):
+        read = make_fs(
+            {
+                BINDING_PATH: binding("A"),
+                CONNECTIONS_DIR + "/A.json": conn_file(
+                    bridge_url="ws://127.0.0.1:9001/v1/ws", token_file="/tok/A", identity_id="A"
+                ),
+                "/tok/A": "secret-token-1\n",
+            }
+        )
+        result = resolve_target({}, read, BINDING_PATH, CONNECTIONS_DIR)
+        assert result == ResolvedTarget(
+            bridge_url="http://127.0.0.1:9001",
+            ws_url="ws://127.0.0.1:9001/v1/ws",
+            token="secret-token-1",
+            identity_id="A",
+        )
+
+    def test_env_identity_overrides_binding_identity(self):
+        # SECURECOMS_CONNECTION_FILE only supplies the BOUND IDENTITY (same
+        # role as binding_path - see gate.resolve_bound_identity); the actual
+        # bridge_url/token_file always come from connections_dir/<identity>.json,
+        # keyed by whichever identity wins (env > binding).
+        read = make_fs(
+            {
+                "/conn/env.json": binding("C"),
+                BINDING_PATH: binding("Z"),  # ignored: env wins
+                CONNECTIONS_DIR + "/C.json": conn_file(
+                    bridge_url="ws://127.0.0.1:9002/v1/ws", token_file="/tok/C", identity_id="C"
+                ),
+                "/tok/C": "secret-token-2",
+            }
+        )
+        result = resolve_target(
+            {"SECURECOMS_CONNECTION_FILE": "/conn/env.json"}, read, BINDING_PATH, CONNECTIONS_DIR
+        )
+        assert result.identity_id == "C"
+        assert result.bridge_url == "http://127.0.0.1:9002"
+        assert result.token == "secret-token-2"
+
+
+# ---------------------------------------------------------------------------
+# per-attempt re-resolution: nothing cached between probe_and_gate calls
+# ---------------------------------------------------------------------------
+
+
+class TestPerAttemptReResolution:
+    @pytest.mark.asyncio
+    async def test_port_move_and_token_rotation_pick_up_new_values(self):
+        files = {
+            BINDING_PATH: binding("A"),
+            CONNECTIONS_DIR + "/A.json": conn_file(
+                bridge_url="ws://127.0.0.1:9001/v1/ws", token_file="/tok/A", identity_id="A"
+            ),
+            "/tok/A": "token-v1",
+        }
+        read = make_fs(files)
+        session = FakeSession(
+            healthz_by_url={"http://127.0.0.1:9001/healthz": {"identity_id": "A"}}
+        )
+
+        target1, reason1 = await probe_and_gate(session, {}, read, BINDING_PATH, CONNECTIONS_DIR)
+        assert reason1 == ""
+        assert target1.bridge_url == "http://127.0.0.1:9001"
+        assert target1.token == "token-v1"
+
+        # Daemon restarted on a new port with a rotated token - rewrite the
+        # connection file + token file content the fake fs serves.
+        files[CONNECTIONS_DIR + "/A.json"] = conn_file(
+            bridge_url="ws://127.0.0.1:9077/v1/ws", token_file="/tok/A", identity_id="A"
+        )
+        files["/tok/A"] = "token-v2"
+        session._healthz_by_url["http://127.0.0.1:9077/healthz"] = {"identity_id": "A"}
+
+        target2, reason2 = await probe_and_gate(session, {}, read, BINDING_PATH, CONNECTIONS_DIR)
+        assert reason2 == ""
+        assert target2.bridge_url == "http://127.0.0.1:9077"
+        assert target2.token == "token-v2"
+        # Proves nothing was cached: the second call actually hit the new URL.
+        assert session.get_calls == [
+            "http://127.0.0.1:9001/healthz",
+            "http://127.0.0.1:9077/healthz",
+        ]
+
+
+# ---------------------------------------------------------------------------
+# probe_and_gate: hold / refuse paths never touch a websocket
+# ---------------------------------------------------------------------------
+
+
+class TestProbeAndGate:
+    @pytest.mark.asyncio
+    async def test_holds_none_reason_when_not_resolvable(self):
+        read = make_fs({})  # nothing present at all
+        session = FakeSession()
+        target, reason = await probe_and_gate(session, {}, read, BINDING_PATH, CONNECTIONS_DIR)
+        assert target is None
+        assert reason != ""
+        assert session.get_calls == []
+        assert session.ws_calls == []
+
+    @pytest.mark.asyncio
+    async def test_holds_when_daemon_unreachable(self):
+        read = make_fs(
+            {
+                BINDING_PATH: binding("A"),
+                CONNECTIONS_DIR + "/A.json": conn_file(),
+                "/tok/A": "tok",
+            }
+        )
+        session = FakeSession(healthz_by_url={})  # every GET raises ConnectionError
+        target, reason = await probe_and_gate(session, {}, read, BINDING_PATH, CONNECTIONS_DIR)
+        assert target is None
+        assert reason != ""
+        assert session.ws_calls == []
+
+    @pytest.mark.asyncio
+    async def test_refuses_on_gate_mismatch_and_never_opens_ws(self):
+        read = make_fs(
+            {
+                BINDING_PATH: binding("A"),
+                CONNECTIONS_DIR + "/A.json": conn_file(identity_id="A"),
+                "/tok/A": "tok",
+            }
+        )
+        # Daemon reports a DIFFERENT identity than the file -> check 1 fails.
+        session = FakeSession(
+            healthz_by_url={"http://127.0.0.1:9001/healthz": {"identity_id": "B"}}
+        )
+        target, reason = await probe_and_gate(session, {}, read, BINDING_PATH, CONNECTIONS_DIR)
+        assert target is None
+        assert reason == "check 1 failed: file identity != daemon identity (stale port reuse)"
+        assert session.ws_calls == []
+
+    @pytest.mark.asyncio
+    async def test_passes_and_returns_target_on_full_agreement(self):
+        read = make_fs(
+            {
+                BINDING_PATH: binding("A"),
+                CONNECTIONS_DIR + "/A.json": conn_file(identity_id="A"),
+                "/tok/A": "tok",
+            }
+        )
+        session = FakeSession(
+            healthz_by_url={"http://127.0.0.1:9001/healthz": {"identity_id": "A"}}
+        )
+        target, reason = await probe_and_gate(session, {}, read, BINDING_PATH, CONNECTIONS_DIR)
+        assert reason == ""
+        assert target is not None
+        assert target.identity_id == "A"
+        assert session.ws_calls == []
+
+
+# ---------------------------------------------------------------------------
+# probe_and_gate_bound: FIXED bound_identity, never re-derived from
+# env/binding_path (BINDING-STABILITY fold, task-3 review)
+# ---------------------------------------------------------------------------
+
+
+class TestProbeAndGateBound:
+    @pytest.mark.asyncio
+    async def test_holds_with_reason_when_bound_identity_blank(self):
+        # No env/binding_path args exist on this entrypoint at all - a blank
+        # bound_identity must hold, not raise or fall back to a census.
+        session = FakeSession()
+        target, reason = await probe_and_gate_bound(session, None, make_fs({}), CONNECTIONS_DIR)
+        assert target is None
+        assert reason == "unwired: no binding (refusing to guess)"
+        assert session.get_calls == []
+        assert session.ws_calls == []
+
+    @pytest.mark.asyncio
+    async def test_holds_when_connection_file_absent_for_bound_identity(self):
+        read = make_fs({})  # connections_dir/A.json intentionally absent
+        session = FakeSession()
+        target, reason = await probe_and_gate_bound(session, "A", read, CONNECTIONS_DIR)
+        assert target is None
+        assert reason != ""
+        assert session.get_calls == []
+
+    @pytest.mark.asyncio
+    async def test_passes_and_returns_target_on_full_agreement(self):
+        read = make_fs(
+            {
+                CONNECTIONS_DIR + "/A.json": conn_file(identity_id="A"),
+                "/tok/A": "tok",
+            }
+        )
+        session = FakeSession(
+            healthz_by_url={"http://127.0.0.1:9001/healthz": {"identity_id": "A"}}
+        )
+        target, reason = await probe_and_gate_bound(session, "A", read, CONNECTIONS_DIR)
+        assert reason == ""
+        assert target is not None
+        assert target.identity_id == "A"
+        assert session.ws_calls == []
+
+    @pytest.mark.asyncio
+    async def test_refuses_on_gate_mismatch_and_never_opens_ws(self):
+        read = make_fs(
+            {
+                CONNECTIONS_DIR + "/A.json": conn_file(identity_id="A"),
+                "/tok/A": "tok",
+            }
+        )
+        session = FakeSession(
+            healthz_by_url={"http://127.0.0.1:9001/healthz": {"identity_id": "B"}}
+        )
+        target, reason = await probe_and_gate_bound(session, "A", read, CONNECTIONS_DIR)
+        assert target is None
+        assert reason == "check 1 failed: file identity != daemon identity (stale port reuse)"
+        assert session.ws_calls == []
+
+    @pytest.mark.asyncio
+    async def test_never_re_derives_bound_identity_from_a_rewritten_binding(self):
+        # The whole point of this entrypoint: it takes NO binding_path/env
+        # argument, so there is nothing here that could re-read a rewritten
+        # binding file even if one existed. A caller that fixes
+        # bound_identity="A" once and keeps calling this function with that
+        # same value stays anchored to A no matter what a binding.json
+        # elsewhere on disk now says - proven by the fact this test never
+        # constructs a binding file at all, yet resolution still succeeds
+        # for the fixed identity across repeated calls.
+        files = {
+            CONNECTIONS_DIR + "/A.json": conn_file(identity_id="A"),
+            "/tok/A": "tok",
+        }
+        read = make_fs(files)
+        session = FakeSession(
+            healthz_by_url={"http://127.0.0.1:9001/healthz": {"identity_id": "A"}}
+        )
+        for _ in range(3):
+            target, reason = await probe_and_gate_bound(session, "A", read, CONNECTIONS_DIR)
+            assert reason == ""
+            assert target.identity_id == "A"
+
+    @pytest.mark.asyncio
+    async def test_port_move_and_token_rotation_pick_up_new_values_for_fixed_identity(self):
+        # Per-attempt re-resolution survives the refactor: a fixed
+        # bound_identity still re-reads the connection file and token file
+        # from scratch on every call.
+        files = {
+            CONNECTIONS_DIR + "/A.json": conn_file(
+                bridge_url="ws://127.0.0.1:9001/v1/ws", token_file="/tok/A", identity_id="A"
+            ),
+            "/tok/A": "token-v1",
+        }
+        read = make_fs(files)
+        session = FakeSession(
+            healthz_by_url={"http://127.0.0.1:9001/healthz": {"identity_id": "A"}}
+        )
+
+        target1, reason1 = await probe_and_gate_bound(session, "A", read, CONNECTIONS_DIR)
+        assert reason1 == ""
+        assert target1.bridge_url == "http://127.0.0.1:9001"
+        assert target1.token == "token-v1"
+
+        files[CONNECTIONS_DIR + "/A.json"] = conn_file(
+            bridge_url="ws://127.0.0.1:9077/v1/ws", token_file="/tok/A", identity_id="A"
+        )
+        files["/tok/A"] = "token-v2"
+        session._healthz_by_url["http://127.0.0.1:9077/healthz"] = {"identity_id": "A"}
+
+        target2, reason2 = await probe_and_gate_bound(session, "A", read, CONNECTIONS_DIR)
+        assert reason2 == ""
+        assert target2.bridge_url == "http://127.0.0.1:9077"
+        assert target2.token == "token-v2"
+
+
+# ---------------------------------------------------------------------------
+# should_drop_inbound: echo guard
+# ---------------------------------------------------------------------------
+
+
+class TestShouldDropInbound:
+    def test_drops_own_sender(self):
+        assert should_drop_inbound({"sender_id": "A", "text": "hi"}, "A") is True
+
+    def test_keeps_other_sender(self):
+        assert should_drop_inbound({"sender_id": "B", "text": "hi"}, "A") is False
+
+    def test_keeps_when_sender_id_missing(self):
+        assert should_drop_inbound({"text": "hi"}, "A") is False
+
+    def test_keeps_when_bound_identity_blank(self):
+        assert should_drop_inbound({"sender_id": "A", "text": "hi"}, "") is False
+
+    def test_keeps_when_sender_id_blank(self):
+        assert should_drop_inbound({"sender_id": "", "text": "hi"}, "A") is False
+
+
+# ---------------------------------------------------------------------------
+# ChannelStatusManager
+# ---------------------------------------------------------------------------
+
+
+class FakeClock:
+    def __init__(self, t=0.0):
+        self.t = t
+
+    def __call__(self):
+        return self.t
+
+    def advance(self, dt):
+        self.t += dt
+
+
+class Recorder:
+    def __init__(self):
+        self.frames = []
+
+    async def __call__(self, frame):
+        self.frames.append(frame)
+
+
+class TestChannelStatusManager:
+    @pytest.mark.asyncio
+    async def test_first_on_typing_emits_working(self):
+        clock = FakeClock()
+        send = Recorder()
+        mgr = ChannelStatusManager(send, now=clock)
+        await mgr.on_typing("ch1")
+        assert send.frames == [{"type": "status", "channel_id": "ch1", "state": "working"}]
+
+    @pytest.mark.asyncio
+    async def test_repeated_on_typing_within_refresh_window_does_not_reemit(self):
+        clock = FakeClock()
+        send = Recorder()
+        mgr = ChannelStatusManager(send, refresh_s=10.0, idle_after_s=20.0, now=clock)
+        await mgr.on_typing("ch1")
+        clock.advance(5.0)
+        await mgr.on_typing("ch1")
+        clock.advance(4.9)
+        await mgr.on_typing("ch1")
+        assert send.frames == [{"type": "status", "channel_id": "ch1", "state": "working"}]
+
+    @pytest.mark.asyncio
+    async def test_on_typing_reemits_working_after_refresh_window(self):
+        clock = FakeClock()
+        send = Recorder()
+        mgr = ChannelStatusManager(send, refresh_s=10.0, idle_after_s=20.0, now=clock)
+        await mgr.on_typing("ch1")
+        clock.advance(10.0)
+        await mgr.on_typing("ch1")
+        assert send.frames == [
+            {"type": "status", "channel_id": "ch1", "state": "working"},
+            {"type": "status", "channel_id": "ch1", "state": "working"},
+        ]
+
+    @pytest.mark.asyncio
+    async def test_on_reply_posted_emits_idle_and_clears_state(self):
+        clock = FakeClock()
+        send = Recorder()
+        mgr = ChannelStatusManager(send, now=clock)
+        await mgr.on_typing("ch1")
+        await mgr.on_reply_posted("ch1")
+        assert send.frames[-1] == {"type": "status", "channel_id": "ch1", "state": "idle"}
+        # State is cleared: a subsequent on_typing must emit "working" again
+        # immediately, not treat this as a within-window refresh no-op.
+        send.frames.clear()
+        await mgr.on_typing("ch1")
+        assert send.frames == [{"type": "status", "channel_id": "ch1", "state": "working"}]
+
+    @pytest.mark.asyncio
+    async def test_tick_emits_idle_after_silence_deadline(self):
+        clock = FakeClock()
+        send = Recorder()
+        mgr = ChannelStatusManager(send, refresh_s=10.0, idle_after_s=20.0, now=clock)
+        await mgr.on_typing("ch1")
+        clock.advance(19.9)
+        await mgr.tick()
+        assert send.frames == [{"type": "status", "channel_id": "ch1", "state": "working"}]  # no idle yet
+        clock.advance(0.2)
+        await mgr.tick()
+        assert send.frames[-1] == {"type": "status", "channel_id": "ch1", "state": "idle"}
+
+    @pytest.mark.asyncio
+    async def test_tick_is_a_no_op_when_channel_never_started_typing(self):
+        clock = FakeClock()
+        send = Recorder()
+        mgr = ChannelStatusManager(send, now=clock)
+        await mgr.tick()
+        assert send.frames == []
+
+    @pytest.mark.asyncio
+    async def test_typing_resets_the_idle_deadline(self):
+        clock = FakeClock()
+        send = Recorder()
+        mgr = ChannelStatusManager(send, refresh_s=10.0, idle_after_s=20.0, now=clock)
+        await mgr.on_typing("ch1")
+        clock.advance(15.0)
+        await mgr.on_typing("ch1")  # refreshes the 20s deadline (and re-emits: 15s >= 10s window)
+        clock.advance(15.0)  # 15s since last typing < 20s idle_after_s -> should still be "working"
+        await mgr.tick()
+        assert all(f["state"] != "idle" for f in send.frames)
+
+    @pytest.mark.asyncio
+    async def test_per_channel_independence_interleaved(self):
+        clock = FakeClock()
+        send = Recorder()
+        mgr = ChannelStatusManager(send, refresh_s=10.0, idle_after_s=20.0, now=clock)
+        await mgr.on_typing("ch1")
+        clock.advance(5.0)
+        await mgr.on_typing("ch2")
+        clock.advance(16.0)  # ch1 at t=21 (>20s since t=0) -> idle; ch2 at t=21 (16s since t=5) -> still working
+        await mgr.tick()
+        ch1_frames = [f for f in send.frames if f["channel_id"] == "ch1"]
+        ch2_frames = [f for f in send.frames if f["channel_id"] == "ch2"]
+        assert ch1_frames[-1]["state"] == "idle"
+        assert all(f["state"] == "working" for f in ch2_frames)
+
+    @pytest.mark.asyncio
+    async def test_states_are_limited_to_idle_or_working(self):
+        clock = FakeClock()
+        send = Recorder()
+        mgr = ChannelStatusManager(send, refresh_s=1.0, idle_after_s=2.0, now=clock)
+        await mgr.on_typing("ch1")
+        clock.advance(1.0)
+        await mgr.on_typing("ch1")
+        await mgr.on_reply_posted("ch1")
+        await mgr.on_typing("ch1")
+        clock.advance(3.0)
+        await mgr.tick()
+        assert all(f["state"] in ("idle", "working") for f in send.frames)
+
+    @pytest.mark.asyncio
+    async def test_on_typing_never_emits_idle_strip_flash(self):
+        # Task-2 brief mutation #3: an implementation that (incorrectly) emits
+        # idle-then-working inside on_typing for a "fresh" channel would flash
+        # the UI strip. on_typing must NEVER emit "idle", ever.
+        clock = FakeClock()
+        send = Recorder()
+        mgr = ChannelStatusManager(send, now=clock)
+        await mgr.on_typing("ch1")
+        clock.advance(100.0)
+        await mgr.on_typing("ch1")
+        assert all(f["state"] != "idle" for f in send.frames)

package/dist/bin.d.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { type ResolveNodeDeps } from "./service/resolve-node.js";
+import { type Harness } from "./service/wire.js";
 export declare function nodeMajorOk(version: string): boolean;
 /**
  * P0b (daemon-stability): a redacted fingerprint of a bearer token for logs —
@@ -14,3 +15,4 @@ export declare function tokenFingerprint(token: string): string;
 export declare function parseVerb(argv: string[]): "install" | "uninstall" | "status" | "wire" | "unwire" | null;
 export declare function slugFromCredentialPath(credentialPath: string): string;
 export declare function chooseInstallExecPath(runningExecPath: string, override: string | undefined, deps: ResolveNodeDeps): string;
+export declare function realCopyConnector(srcDir: string, dstDir: string, harness: Harness): void;