@xenosystem/agent-interface-host 0.1.3

package/dist/acp/AcpAgentRegistryService.js

@@ -0,0 +1,754 @@
+import { execFileSync, spawnSync } from 'child_process';
+import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'fs';
+import { homedir } from 'os';
+import { basename, dirname, isAbsolute, join, resolve } from 'path';
+import { ACP_ENDPOINT_CERTIFICATION_PROMPT, resolveCommand } from '@xenosystem/acp-core';
+import { selectProviderExecutableCandidate } from '@xenosystem/acp-provider-manager';
+import { AcpProcessSupervisor } from './AcpProcessSupervisor.js';
+// Command-safety rules live in ./acpCommandSafety so admission and launch
+// cannot drift apart. See that module for the Linux blind spot they close.
+import { isAcpShellCommandLine, isAcpShellExecutable } from './acpCommandSafety.js';
+import { runAcpProviderModels } from './AcpProviderModelService.js';
+import { getAcpProviderVersionReadiness } from './AcpProviderVersionReadiness.js';
+import { acpSafeErrorMessage } from './acpErrors.js';
+import { redactAcpAgentConfig, redactAcpPath, redactAcpText } from './acpRedaction.js';
+const REGISTRY_VERSION = 1;
+const DEFAULT_TEST_TIMEOUT_MS = 5_000;
+export const ACP_REGISTRY_CERTIFICATION_PROMPT = ACP_ENDPOINT_CERTIFICATION_PROMPT;
+const TRUST_LEVELS = new Set(['restricted', 'workspace']);
+const CERTIFICATION_STATUSES = new Set(['not_certified', 'fixture_only', 'certified', 'authentication_required', 'blocked_by_environment', 'failed']);
+const LOCAL_PROVIDER_PRESETS = {
+    'codex-local': {
+        name: 'Codex CLI',
+        policyExample: 'codex-local.provider-policy.example.jsonc',
+    },
+    'claude-local': {
+        name: 'Claude CLI',
+        policyExample: 'claude-local.provider-policy.example.jsonc',
+    },
+    kimi: {
+        name: 'Kimi Code CLI',
+    },
+};
+export function defaultAcpRegistryRoot() {
+    return process.env.XENO_ACP_REGISTRY_ROOT || join(homedir(), '.xeno');
+}
+export function createFixtureAcpAgentConfig(rootDir, mode = 'normal', id = `fixture-${mode}`) {
+    const fixturePath = join(process.cwd(), 'tests', 'fixtures', 'acp', 'fixture-acp-agent.mjs');
+    const now = new Date().toISOString();
+    return {
+        id,
+        name: `Fixture ACP ${mode}`,
+        command: process.execPath,
+        args: [fixturePath, `--mode=${mode}`],
+        cwd: rootDir,
+        // Local fixture-only env values are supported; provider credentials stay in provider-owned auth.
+        env: { XENO_ACP_FIXTURE_MODE: mode },
+        enabled: true,
+        trustLevel: 'restricted',
+        createdAt: now,
+        updatedAt: now,
+    };
+}
+export function isAcpLocalProviderPresetId(value) {
+    return value === 'codex-local' || value === 'claude-local' || value === 'kimi';
+}
+export function normalizeAcpAgentConfig(input, now = new Date().toISOString()) {
+    if (!isRecord(input))
+        return null;
+    const id = cleanString(input.id);
+    const name = cleanString(input.name);
+    const command = cleanString(input.command);
+    if (!id || !name || !command)
+        return null;
+    const args = Array.isArray(input.args)
+        ? input.args.filter((arg) => typeof arg === 'string')
+        : [];
+    const cwd = typeof input.cwd === 'string' && input.cwd.trim() ? input.cwd.trim() : undefined;
+    const env = normalizeEnv(input.env);
+    const trustLevel = input.trustLevel === 'workspace' ? 'workspace' : 'restricted';
+    const certification = normalizeAcpAgentCertification(input.certification);
+    const createdAt = cleanString(input.createdAt) || now;
+    const updatedAt = cleanString(input.updatedAt) || now;
+    return {
+        id,
+        name,
+        command,
+        args,
+        cwd,
+        env,
+        enabled: typeof input.enabled === 'boolean' ? input.enabled : false,
+        trustLevel,
+        certification,
+        createdAt,
+        updatedAt,
+    };
+}
+export function normalizeAcpAgentCertification(input) {
+    if (!isRecord(input))
+        return undefined;
+    const status = typeof input.status === 'string' && CERTIFICATION_STATUSES.has(input.status)
+        ? input.status
+        : undefined;
+    if (!status)
+        return undefined;
+    return {
+        status,
+        certifiedAt: cleanString(input.certifiedAt),
+        certifiedBy: input.certifiedBy === 'harness' ? 'harness' : undefined,
+        protocolVersion: typeof input.protocolVersion === 'number' && Number.isFinite(input.protocolVersion) ? input.protocolVersion : undefined,
+        agentName: cleanString(input.agentName),
+        agentVersion: cleanString(input.agentVersion),
+        notes: cleanString(input.notes),
+    };
+}
+export function validateAcpAgentConfig(input, options = {}) {
+    const errors = [];
+    const config = normalizeAcpAgentConfig(input);
+    const raw = isRecord(input) ? input : {};
+    if (!config) {
+        errors.push('ACP agent id, name, and command are required.');
+        return { valid: false, errors };
+    }
+    if (!config.id)
+        errors.push('ACP agent id is required.');
+    if (!config.name)
+        errors.push('ACP agent name is required.');
+    validateCommand(config.command, errors);
+    if (!Array.isArray(raw.args) && raw.args !== undefined) {
+        errors.push('ACP agent args must be an array of strings.');
+    }
+    if (Array.isArray(raw.args) && raw.args.some((arg) => typeof arg !== 'string')) {
+        errors.push('ACP agent args must be an array of strings.');
+    }
+    if (config.cwd !== undefined && !isAbsolute(config.cwd)) {
+        errors.push('ACP agent cwd must be an absolute path.');
+    }
+    if (raw.env !== undefined) {
+        if (!isRecord(raw.env)) {
+            errors.push('ACP agent env must be an object of string values.');
+        }
+        else {
+            for (const [key, value] of Object.entries(raw.env)) {
+                if (typeof value !== 'string')
+                    errors.push(`ACP agent env value must be a string: ${key}`);
+                else if (isSecretEnvEntry(key, value))
+                    errors.push(`ACP agent env cannot store raw secret values: ${key}`);
+            }
+        }
+    }
+    if (raw.trustLevel !== undefined && !TRUST_LEVELS.has(String(raw.trustLevel))) {
+        errors.push('ACP agent trustLevel must be restricted or workspace.');
+    }
+    if (raw.shell === true)
+        errors.push('ACP agent shell launch is not supported.');
+    if (typeof raw.commandLine === 'string')
+        errors.push('ACP agent raw commandLine is not supported.');
+    const existing = new Set(options.existingIds || []);
+    if (!options.allowExistingId && existing.has(config.id)) {
+        errors.push(`ACP agent id already exists: ${config.id}`);
+    }
+    return { valid: errors.length === 0, errors };
+}
+export function isFixtureAcpAgentConfig(config) {
+    return config.command === process.execPath
+        && config.args.some((arg) => basename(arg) === 'fixture-acp-agent.mjs');
+}
+export class AcpAgentRegistryService {
+    rootDir;
+    registryPath;
+    requestTimeoutMs;
+    constructor(options = {}) {
+        this.rootDir = options.rootDir || defaultAcpRegistryRoot();
+        this.registryPath = options.registryPath || join(this.rootDir, 'acp-agents.json');
+        this.requestTimeoutMs = options.requestTimeoutMs || DEFAULT_TEST_TIMEOUT_MS;
+    }
+    listAgents(options = {}) {
+        const loaded = this.loadRegistry();
+        return {
+            success: true,
+            repaired: loaded.repaired,
+            result: loaded.registry.agents.map((agent) => this.toAgentView(agent, options.includeRuntimeStatus !== false)),
+        };
+    }
+    getAgent(id, options = {}) {
+        const agent = this.getAgentInternal(id);
+        if (!agent)
+            return { success: false, error: 'ACP agent not found.' };
+        return { success: true, result: this.toAgentView(agent, options.includeRuntimeStatus !== false) };
+    }
+    saveAgent(input, options = {}) {
+        const loaded = this.loadRegistry();
+        const existingIndex = loaded.registry.agents.findIndex((agent) => agent.id === input.id);
+        const now = new Date().toISOString();
+        const existing = existingIndex >= 0 ? loaded.registry.agents[existingIndex] : undefined;
+        const launchIdentityChanged = !!existing && ((input.command !== undefined && input.command !== existing.command)
+            || (input.args !== undefined && JSON.stringify(input.args) !== JSON.stringify(existing.args))
+            || (input.cwd !== undefined && input.cwd !== existing.cwd)
+            || (input.env !== undefined && JSON.stringify(input.env) !== JSON.stringify(existing.env)));
+        const candidate = normalizeAcpAgentConfig({
+            ...existing,
+            ...input,
+            command: input.command ?? existing?.command,
+            args: input.args ?? existing?.args ?? [],
+            cwd: input.cwd ?? existing?.cwd,
+            env: input.env ?? existing?.env,
+            enabled: input.enabled ?? existing?.enabled ?? false,
+            trustLevel: input.trustLevel ?? existing?.trustLevel ?? 'restricted',
+            certification: launchIdentityChanged ? undefined : existing?.certification,
+            createdAt: existing?.createdAt || input.createdAt || now,
+            updatedAt: now,
+        }, now);
+        const validation = validateAcpAgentConfig(candidate, {
+            existingIds: loaded.registry.agents.map((agent) => agent.id),
+            allowExistingId: existingIndex >= 0,
+        });
+        if (!candidate || !validation.valid) {
+            return { success: false, error: validation.errors.join(' ') || 'Invalid ACP agent config.' };
+        }
+        const nextAgents = [...loaded.registry.agents];
+        if (existingIndex >= 0)
+            nextAgents[existingIndex] = candidate;
+        else
+            nextAgents.push(candidate);
+        this.writeRegistry({ version: REGISTRY_VERSION, agents: nextAgents });
+        return {
+            success: true,
+            repaired: loaded.repaired,
+            result: this.toAgentView(candidate, options.includeRuntimeStatus !== false),
+        };
+    }
+    removeAgent(id) {
+        const loaded = this.loadRegistry();
+        const nextAgents = loaded.registry.agents.filter((agent) => agent.id !== id);
+        if (nextAgents.length === loaded.registry.agents.length) {
+            return { success: false, error: 'ACP agent not found.' };
+        }
+        this.writeRegistry({ version: REGISTRY_VERSION, agents: nextAgents });
+        return { success: true, result: { removed: true } };
+    }
+    setAgentEnabled(id, enabled) {
+        const loaded = this.loadRegistry();
+        const index = loaded.registry.agents.findIndex((agent) => agent.id === id);
+        if (index < 0)
+            return { success: false, error: 'ACP agent not found.' };
+        const agent = {
+            ...loaded.registry.agents[index],
+            enabled,
+            updatedAt: new Date().toISOString(),
+        };
+        const nextAgents = [...loaded.registry.agents];
+        nextAgents[index] = agent;
+        this.writeRegistry({ version: REGISTRY_VERSION, agents: nextAgents });
+        return { success: true, result: this.toAgentView(agent) };
+    }
+    setAgentsEnabled(updates) {
+        const loaded = this.loadRegistry();
+        const updateEntries = Object.entries(updates);
+        if (!updateEntries.length)
+            return { success: true, result: { updatedIds: [] } };
+        const knownIds = new Set(loaded.registry.agents.map((agent) => agent.id));
+        const unknownId = updateEntries.find(([id]) => !knownIds.has(id))?.[0];
+        if (unknownId)
+            return { success: false, error: `ACP agent not found: ${unknownId}` };
+        const now = new Date().toISOString();
+        const updatedIds = [];
+        const agents = loaded.registry.agents.map((agent) => {
+            const enabled = updates[agent.id];
+            if (typeof enabled !== 'boolean' || enabled === agent.enabled)
+                return agent;
+            updatedIds.push(agent.id);
+            return { ...agent, enabled, updatedAt: now };
+        });
+        if (updatedIds.length)
+            this.writeRegistry({ version: REGISTRY_VERSION, agents });
+        return { success: true, repaired: loaded.repaired, result: { updatedIds } };
+    }
+    setAgentCertification(id, certification, options = {}) {
+        const loaded = this.loadRegistry();
+        const index = loaded.registry.agents.findIndex((agent) => agent.id === id);
+        if (index < 0)
+            return { success: false, error: 'ACP agent not found.' };
+        const normalized = normalizeAcpAgentCertification(certification);
+        if (!normalized)
+            return { success: false, error: 'Invalid ACP certification metadata.' };
+        const agent = {
+            ...loaded.registry.agents[index],
+            certification: normalized,
+            updatedAt: new Date().toISOString(),
+        };
+        const nextAgents = [...loaded.registry.agents];
+        nextAgents[index] = agent;
+        this.writeRegistry({ version: REGISTRY_VERSION, agents: nextAgents });
+        return { success: true, result: this.toAgentView(agent, options.includeRuntimeStatus !== false) };
+    }
+    clearAgentCertification(id, options = {}) {
+        const loaded = this.loadRegistry();
+        const index = loaded.registry.agents.findIndex((agent) => agent.id === id);
+        if (index < 0)
+            return { success: false, error: 'ACP agent not found.' };
+        const agent = {
+            ...loaded.registry.agents[index],
+            certification: undefined,
+            updatedAt: new Date().toISOString(),
+        };
+        const nextAgents = [...loaded.registry.agents];
+        nextAgents[index] = agent;
+        this.writeRegistry({ version: REGISTRY_VERSION, agents: nextAgents });
+        return { success: true, result: this.toAgentView(agent, options.includeRuntimeStatus !== false) };
+    }
+    diagnostics(options = {}) {
+        const loaded = this.loadRegistry();
+        const includeRuntimeStatus = options.includeRuntimeStatus !== false;
+        return {
+            path: redactAcpPath(this.registryPath) || 'acp-agents.json',
+            exists: existsSync(this.registryPath),
+            version: loaded.registry.version,
+            agentCount: loaded.registry.agents.length,
+            enabledCount: loaded.registry.agents.filter((agent) => agent.enabled).length,
+            repaired: loaded.repaired,
+            backupPath: redactAcpPath(loaded.backupPath),
+            agents: loaded.registry.agents.map((agent) => ({
+                ...this.toAgentView(agent, includeRuntimeStatus),
+                providerVersionReadiness: includeRuntimeStatus ? getAcpProviderVersionReadiness(agent) : undefined,
+            })),
+        };
+    }
+    async testAgent(id, options = {}) {
+        const agent = this.getAgentInternal(id);
+        if (!agent) {
+            return { success: false, updateCount: 0, diagnostics: {}, error: 'ACP agent not found.' };
+        }
+        if (!agent.enabled && !options.allowDisabled) {
+            return {
+                success: false,
+                updateCount: 0,
+                diagnostics: { agentConfigId: agent.id },
+                error: 'ACP agent is disabled and cannot be tested.',
+            };
+        }
+        const canRunExternal = options.allowExternal || agent.certification?.status === 'certified';
+        if (!isFixtureAcpAgentConfig(agent) && !canRunExternal) {
+            return {
+                success: false,
+                updateCount: 0,
+                diagnostics: { agentConfigId: agent.id },
+                error: 'External ACP agent is not certified. Run AGENT-009E certification before testing this config.',
+            };
+        }
+        const supervisor = new AcpProcessSupervisor(agent, { requestTimeoutMs: this.requestTimeoutMs });
+        try {
+            const initialized = await supervisor.initialize();
+            const session = await supervisor.createSession({
+                cwd: agent.cwd || this.rootDir,
+                mcpServers: [],
+            });
+            const prompt = await supervisor.prompt(session.sessionId, ACP_REGISTRY_CERTIFICATION_PROMPT, { timeoutMs: this.requestTimeoutMs });
+            const diagnostics = supervisor.diagnostics();
+            diagnostics.lastStopReason = prompt.result.stopReason;
+            return {
+                success: prompt.result.stopReason === 'end_turn',
+                protocolVersion: initialized.protocolVersion,
+                agentInfo: initialized.agentInfo,
+                updateCount: prompt.updates.length,
+                stopReason: prompt.result.stopReason,
+                diagnostics,
+            };
+        }
+        catch (error) {
+            return {
+                success: false,
+                updateCount: 0,
+                diagnostics: supervisor.diagnostics(),
+                error: redactAcpText(acpSafeErrorMessage(error), 1000),
+            };
+        }
+        finally {
+            await supervisor.stop().catch(() => undefined);
+        }
+    }
+    async getProviderModels(id, providerId) {
+        const agent = this.getAgentInternal(id);
+        if (!agent) {
+            return {
+                success: false,
+                providerId: providerId || id,
+                commandBasename: '[redacted-command]',
+                argsCount: 0,
+                stdoutTail: [],
+                stderrTail: [],
+                error: 'ACP agent not found.',
+            };
+        }
+        return runAcpProviderModels(agent, { providerId });
+    }
+    createFixtureAgentConfig(rootDir, mode = 'normal', id) {
+        return createFixtureAcpAgentConfig(rootDir, mode, id);
+    }
+    createLocalProviderAgentConfig(providerId) {
+        const preset = LOCAL_PROVIDER_PRESETS[providerId];
+        if (providerId === 'kimi') {
+            const kimiPath = findExecutable('kimi');
+            if (!kimiPath) {
+                return {
+                    success: false,
+                    error: 'Kimi Code CLI executable not found on PATH. Install Kimi Code CLI, then run kimi login before adding it to Hub.',
+                };
+            }
+            return this.saveAgent({
+                id: providerId,
+                name: preset.name,
+                command: kimiPath,
+                args: ['acp'],
+                cwd: this.rootDir,
+                enabled: true,
+                trustLevel: 'restricted',
+            });
+        }
+        const xenoAcpRoot = findXenoAcpRoot();
+        if (!xenoAcpRoot) {
+            return {
+                success: false,
+                error: 'xeno-acp checkout not found. Set XENO_ACP_ROOT to the xeno-acp repository path and build xeno-acp first.',
+            };
+        }
+        const nodePath = findNodeExecutable();
+        if (!nodePath) {
+            return { success: false, error: 'Node.js executable not found on PATH. Install Node.js or add node to PATH before adding a local ACP provider.' };
+        }
+        const cliPath = xenoAcpAgentCliPath(xenoAcpRoot);
+        const policyPath = join(xenoAcpRoot, 'docs', 'examples', preset.policyExample);
+        if (!existsSync(cliPath)) {
+            return { success: false, error: `xeno-acp agent endpoint is not built: ${redactAcpPath(cliPath) || 'packages/agent/dist/cli.js'}.` };
+        }
+        if (!existsSync(policyPath)) {
+            return { success: false, error: `xeno-acp provider policy example is missing: ${redactAcpPath(policyPath) || preset.policyExample}.` };
+        }
+        return this.saveAgent({
+            id: providerId,
+            name: preset.name,
+            command: nodePath,
+            args: [
+                cliPath,
+                'agent',
+                '--provider',
+                providerId,
+                '--provider-policy',
+                policyPath,
+                '--provider-approvals',
+                join(this.rootDir, 'provider-approvals.json'),
+            ],
+            cwd: xenoAcpRoot,
+            enabled: true,
+            trustLevel: 'restricted',
+        });
+    }
+    getAgentInternal(id) {
+        return this.loadRegistry().registry.agents.find((agent) => agent.id === id);
+    }
+    loadRegistry() {
+        mkdirSync(dirname(this.registryPath), { recursive: true });
+        if (!existsSync(this.registryPath)) {
+            const registry = { version: REGISTRY_VERSION, agents: [] };
+            this.writeRegistry(registry);
+            return { registry, repaired: false };
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(this.registryPath, 'utf-8'));
+        }
+        catch {
+            const backupPath = this.backupRegistry();
+            const registry = { version: REGISTRY_VERSION, agents: [] };
+            this.writeRegistry(registry);
+            return { registry, repaired: true, backupPath };
+        }
+        const repair = this.repairRegistry(parsed);
+        if (repair.repaired) {
+            const backupPath = this.backupRegistry();
+            this.writeRegistry(repair.registry);
+            return { ...repair, backupPath };
+        }
+        return repair;
+    }
+    repairRegistry(value) {
+        const now = new Date().toISOString();
+        let repaired = false;
+        const rawAgents = isRecord(value) && Array.isArray(value.agents) ? value.agents : [];
+        if (!isRecord(value) || value.version !== REGISTRY_VERSION || !Array.isArray(value.agents))
+            repaired = true;
+        const ids = new Set();
+        const agents = [];
+        for (const rawAgent of rawAgents) {
+            const agent = normalizeAcpAgentConfig(rawAgent, now);
+            if (!agent) {
+                repaired = true;
+                continue;
+            }
+            const validation = validateAcpAgentConfig(agent, { existingIds: ids });
+            if (!validation.valid) {
+                repaired = true;
+                continue;
+            }
+            ids.add(agent.id);
+            agents.push(agent);
+            if (JSON.stringify(rawAgent) !== JSON.stringify(agent))
+                repaired = true;
+        }
+        return { registry: { version: REGISTRY_VERSION, agents }, repaired };
+    }
+    writeRegistry(registry) {
+        mkdirSync(dirname(this.registryPath), { recursive: true });
+        const tempPath = `${this.registryPath}.tmp-${process.pid}-${Date.now()}`;
+        writeFileSync(tempPath, `${JSON.stringify(registry, null, 2)}\n`, 'utf-8');
+        try {
+            renameSync(tempPath, this.registryPath);
+        }
+        catch (error) {
+            try {
+                unlinkSync(tempPath);
+            }
+            catch {
+                // Ignore temp cleanup failure; original write error is the important signal.
+            }
+            throw error;
+        }
+    }
+    backupRegistry() {
+        if (!existsSync(this.registryPath))
+            return undefined;
+        const backupPath = `${this.registryPath}.bak-${Date.now()}`;
+        copyFileSync(this.registryPath, backupPath);
+        return backupPath;
+    }
+    toAgentView(agent, includeRuntimeStatus = true) {
+        const providerCommand = buildAcpProviderReviewCommand(agent);
+        const providerReview = includeRuntimeStatus ? getAcpProviderReview(agent) : undefined;
+        return {
+            ...redactAcpAgentConfig(agent),
+            endpointKind: isNativeAcpAgentConfig(agent)
+                ? 'native-acp'
+                : providerCommand
+                    ? 'xeno-acp-provider'
+                    : 'custom-acp',
+            providerReview,
+            providerVersionReadiness: includeRuntimeStatus ? getAcpProviderVersionReadiness(agent) : undefined,
+        };
+    }
+}
+let sharedAcpAgentRegistryService;
+export function getAcpAgentRegistryService() {
+    if (!sharedAcpAgentRegistryService)
+        sharedAcpAgentRegistryService = new AcpAgentRegistryService();
+    return sharedAcpAgentRegistryService;
+}
+function cleanString(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+function normalizeEnv(value) {
+    if (!isRecord(value))
+        return undefined;
+    const env = {};
+    for (const [key, item] of Object.entries(value)) {
+        if (typeof item === 'string')
+            env[key] = item;
+    }
+    return Object.keys(env).length ? env : undefined;
+}
+function isSecretEnvEntry(key, value) {
+    return /(^|_)(TOKEN|SECRET|PASSWORD|COOKIE|AUTHORIZATION|API_?KEY|CREDENTIAL|BEARER)(_|$)/i.test(key)
+        || redactAcpText(value) !== value;
+}
+function validateCommand(command, errors) {
+    const trimmed = command.trim();
+    if (!trimmed) {
+        errors.push('ACP command must be a non-empty string.');
+        return;
+    }
+    if (!isAbsolute(trimmed)) {
+        errors.push('ACP command must be an absolute executable path.');
+    }
+    if (isAcpShellCommandLine(trimmed)) {
+        errors.push('ACP command must be an executable path, not a shell command line.');
+    }
+    if (isAcpShellExecutable(trimmed)) {
+        errors.push('ACP command cannot be a shell executable.');
+    }
+    if (resolve(trimmed) !== trimmed && trimmed !== process.execPath) {
+        // Keep the executable field boring and literal; args carry all dynamic behavior.
+        errors.push('ACP command path must be normalized before launch.');
+    }
+}
+function isRecord(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+function findNodeExecutable() {
+    const found = findExecutable('node');
+    if (found)
+        return found;
+    const current = basename(process.execPath).toLowerCase();
+    return current === 'node' || current === 'node.exe' ? process.execPath : null;
+}
+function findExecutable(name) {
+    const lookup = process.platform === 'win32' ? 'where.exe' : 'which';
+    try {
+        const output = execFileSync(lookup, [name], {
+            encoding: 'utf-8',
+            timeout: 3_000,
+            windowsHide: true,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const found = selectProviderExecutableCandidate(output.split(/\r?\n/), process.platform);
+        if (found)
+            return resolve(found);
+    }
+    catch {
+        // PATH lookup is best effort; the caller returns a safe setup error.
+    }
+    return null;
+}
+function findXenoAcpRoot() {
+    const executableDir = dirname(process.execPath);
+    const rawCandidates = [
+        process.env.XENO_ACP_ROOT,
+        resolve(process.cwd(), '..', 'xeno-acp'),
+        resolve(process.cwd(), 'xeno-acp'),
+        resolve(process.cwd(), '..', '..', 'xeno-acp'),
+        resolve(process.cwd(), '..', '..', '..', 'xeno-acp'),
+        resolve(executableDir, '..', '..', '..', 'xeno-acp'),
+    ];
+    const seen = new Set();
+    for (const candidate of rawCandidates) {
+        if (!candidate)
+            continue;
+        const resolved = resolve(candidate);
+        if (seen.has(resolved))
+            continue;
+        seen.add(resolved);
+        if (existsSync(xenoAcpAgentCliPath(resolved)))
+            return resolved;
+    }
+    return null;
+}
+function xenoAcpAgentCliPath(rootDir) {
+    return join(rootDir, 'packages', 'agent', 'dist', 'cli.js');
+}
+function isNativeAcpAgentConfig(config) {
+    const commandName = basename(config.command).toLowerCase().replace(/\.(exe|cmd|bat)$/i, '');
+    if (config.id.startsWith('registry-'))
+        return true;
+    if (config.id === 'kimi') {
+        return commandName === 'kimi'
+            && config.args.length === 1
+            && config.args[0].toLowerCase() === 'acp';
+    }
+    if (config.id === 'gemini')
+        return commandName === 'gemini' && config.args.some((arg) => arg.toLowerCase() === '--acp');
+    if (config.id === 'opencode')
+        return commandName === 'opencode' && config.args.some((arg) => arg.toLowerCase() === 'acp');
+    return false;
+}
+function getAcpProviderReview(config) {
+    const command = buildAcpProviderReviewCommand(config);
+    if (!command)
+        return undefined;
+    const resolved = resolveCommand(command.command, command.args);
+    const result = spawnSync(resolved.file, resolved.args, {
+        cwd: config.cwd,
+        env: {},
+        encoding: 'utf-8',
+        timeout: 5_000,
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    if (!result.stdout)
+        return undefined;
+    return normalizeProviderReview(result.stdout);
+}
+function buildAcpProviderReviewCommand(config) {
+    const agentIndex = config.args.findIndex((arg) => arg === 'agent');
+    if (agentIndex < 0)
+        return undefined;
+    const providerId = readFlag(config.args, '--provider');
+    const policyPath = readFlag(config.args, '--provider-policy');
+    const approvalsPath = readFlag(config.args, '--provider-approvals');
+    if (!providerId || !policyPath || !approvalsPath)
+        return undefined;
+    return {
+        command: config.command,
+        args: [
+            ...config.args.slice(0, agentIndex),
+            'providers',
+            'review',
+            '--provider',
+            providerId,
+            '--config',
+            policyPath,
+            '--store',
+            approvalsPath,
+        ],
+    };
+}
+function normalizeProviderReview(stdout) {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        return undefined;
+    }
+    const record = isRecord(parsed) ? parsed : {};
+    const providerId = cleanString(record.providerId);
+    if (!providerId)
+        return undefined;
+    const auth = isRecord(record.auth) ? record.auth : {};
+    const refs = Array.isArray(auth.secretRefs) ? auth.secretRefs.filter(isRecord) : [];
+    return {
+        providerId: redactAcpText(providerId, 120),
+        displayName: cleanString(record.displayName) ? redactAcpText(cleanString(record.displayName), 160) : undefined,
+        trustClass: cleanString(record.trustClass),
+        runnable: record.runnable === true,
+        approvalState: providerApprovalState(record),
+        runtimeEnvKeys: runtimeEnvKeys(record),
+        requiredAuthRefs: refs.filter((ref) => ref.required === true).map((ref) => redactAcpText(String(ref.id || ''), 120)).filter(Boolean),
+        optionalAuthRefs: refs.filter((ref) => ref.required !== true).map((ref) => redactAcpText(String(ref.id || ''), 120)).filter(Boolean),
+        enforcementClassification: {
+            network: 'network: not_enforced',
+            filesystem: 'filesystem: not_enforced_against_hostile_process',
+        },
+    };
+}
+function providerApprovalState(record) {
+    const status = cleanString(record.status);
+    const approval = isRecord(record.approval) ? record.approval : undefined;
+    if (approval?.current === true)
+        return 'approved';
+    if (approval && approval.current === false)
+        return 'stale';
+    if (status === 'requires_approval')
+        return 'missing';
+    if (status === 'stale_approval')
+        return 'stale';
+    if (status && status.startsWith('blocked'))
+        return 'blocked';
+    if (record.runnable === true)
+        return 'not_required';
+    return 'blocked';
+}
+function runtimeEnvKeys(record) {
+    const runtimeEnv = isRecord(record.runtimeEnv) ? record.runtimeEnv : {};
+    return Array.isArray(runtimeEnv.forwardedKeys)
+        ? runtimeEnv.forwardedKeys.map((key) => typeof key === 'string' ? redactAcpText(key, 120) : '').filter(Boolean)
+        : [];
+}
+function readFlag(args, flag) {
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === flag)
+            return cleanString(args[i + 1]);
+        if (arg.startsWith(`${flag}=`))
+            return cleanString(arg.slice(flag.length + 1));
+    }
+    return undefined;
+}
+//# sourceMappingURL=AcpAgentRegistryService.js.map