codeep 2.13.0 → 2.13.1

package/README.md

@@ -1340,7 +1340,15 @@ Apache 2.0
 
 ## Contributing
 
-Contributions are welcome! Please open an issue or submit a pull request on [GitHub](https://github.com/VladoIvankovic/Codeep).
+Contributions are welcome! Before opening a PR, please read the
+[**Contributing guide**](./CONTRIBUTING.md) — it covers the development setup
+(npm is the canonical package manager), the test/build loop, code style, and
+how to propose a change. For provider integrations specifically, the guide
+walks through the files you need to touch.
+
+Quick version: `npm install` → `npm test` → `npx tsc --noEmit` clean → open a
+PR against `main`. To report a security issue, see
+[**Security policy**](./SECURITY.md).
 
 ## Support
 

package/dist/acp/server.d.ts

@@ -1 +1,42 @@
+import { SessionModeState, SessionConfigOption } from './protocol.js';
+export declare const AGENT_MODES: SessionModeState;
+/**
+ * Format a tool call's parameters into a human-readable object for the
+ * permission dialog. Truncates long content fields so the dialog stays readable.
+ *
+ * Exported for unit testing (see server.test.ts).
+ */
+export declare function formatToolInputForPermission(tool: string, params: Record<string, unknown>): Record<string, string>;
+/**
+ * Resolve a `file://` (or absolute path) URI to a local filesystem path.
+ * Returns null for unsupported schemes (http/https/git/etc.) — we only embed
+ * local content for safety/privacy.
+ *
+ * Exported for unit testing (see server.test.ts).
+ */
+export declare function resolveLocalPath(uri: string): string | null;
+/**
+ * Walk the prompt's ContentBlock[] looking for ResourceLink and Resource
+ * blocks. ResourceLink → read file from disk. Resource → use embedded text.
+ * Returns a markdown-fenced snippet block ready to prepend to the prompt,
+ * or empty string if there are no embedded contexts.
+ *
+ * Exported for unit testing (see server.test.ts).
+ */
+export declare function collectEmbeddedContext(blocks: import('./protocol.js').ContentBlock[]): Promise<string>;
+/** Check if a provider has an API key stored (synchronous; relies on the cache
+ *  loaded at startup via loadAllApiKeys and the non-secret configuredProviderIds
+ *  index — never reads plaintext key material).
+ *
+ *  Exported for unit testing (see server.test.ts).
+ */
+export declare function providerHasKey(providerId: string): boolean;
+/**
+ * Build the list of session-level config options advertised to the ACP client
+ * (provider/model picker, language, per-tool confirmation toggles).
+ *
+ * Reads the global config + provider table; pure of transport/session state.
+ * Exported for unit testing (see server.test.ts).
+ */
+export declare function buildConfigOptions(): SessionConfigOption[];
 export declare function startAcpServer(): Promise<void>;

package/dist/acp/server.js

@@ -7,12 +7,13 @@ import { fileURLToPath } from 'url';
 import { StdioTransport } from './transport.js';
 import { runAgentSession } from './session.js';
 import { loadCustomCommands } from '../utils/customCommands.js';
-import { registerSessionServers, disposeSession as disposeMcpSession, disposeAllSessions as disposeAllMcpSessions } from '../utils/mcpRegistry.js';
+import { registerSessionServers, disposeAllSessions as disposeAllMcpSessions } from '../utils/mcpRegistry.js';
 import { loadMcpServerConfig, mergeMcpServers } from '../utils/mcpConfig.js';
 import { handleMcpSamplingRequest } from '../utils/mcpSamplingBridge.js';
 import { executeCommandAsync } from '../utils/shell.js';
 import { initWorkspace, loadWorkspace, handleCommand } from './commands.js';
-import { autoSaveSession, config, setProvider, setApiKey, getApiKey, getConfiguredProviders, listSessionsWithInfo, deleteSession as deleteSessionFile } from '../config/index.js';
+import { handleSetMode as handleSetModeExternal, handleSetConfigOption as handleSetConfigOptionExternal, handleSessionList as handleSessionListExternal, handleSessionDelete as handleSessionDeleteExternal, handleListProviders as handleListProvidersExternal, } from './serverHandlers.js';
+import { autoSaveSession, config, getApiKey, getConfiguredProviders } from '../config/index.js';
 import { ApiError } from '../api/index.js';
 import { PROVIDERS } from '../config/providers.js';
 import { getCurrentVersion } from '../utils/update.js';
@@ -87,7 +88,8 @@ const AVAILABLE_COMMANDS = [
     { name: 'deploy', description: 'Deploy the project' },
 ];
 // ─── Mode definitions ─────────────────────────────────────────────────────────
-const AGENT_MODES = {
+// Exported for unit testing + reference from serverHandlers modules.
+export const AGENT_MODES = {
     currentModeId: 'auto',
     availableModes: [
         { id: 'auto', name: 'Auto', description: 'Agent runs automatically without confirmation' },
@@ -112,8 +114,10 @@ const LANGUAGE_OPTIONS = [
 /**
  * Format a tool call's parameters into a human-readable object for the
  * permission dialog. Truncates long content fields so the dialog stays readable.
+ *
+ * Exported for unit testing (see server.test.ts).
  */
-function formatToolInputForPermission(tool, params) {
+export function formatToolInputForPermission(tool, params) {
     const MAX_LEN = 120;
     // Bigger budget for diff/content fields so clients can render an actual preview
     // before the user clicks Allow. Truncated with a visible marker so users know
@@ -167,8 +171,10 @@ function formatToolInputForPermission(tool, params) {
  * Resolve a `file://` (or absolute path) URI to a local filesystem path.
  * Returns null for unsupported schemes (http/https/git/etc.) — we only embed
  * local content for safety/privacy.
+ *
+ * Exported for unit testing (see server.test.ts).
  */
-function resolveLocalPath(uri) {
+export function resolveLocalPath(uri) {
     if (!uri)
         return null;
     if (uri.startsWith('file://')) {
@@ -189,8 +195,10 @@ function resolveLocalPath(uri) {
  * blocks. ResourceLink → read file from disk. Resource → use embedded text.
  * Returns a markdown-fenced snippet block ready to prepend to the prompt,
  * or empty string if there are no embedded contexts.
+ *
+ * Exported for unit testing (see server.test.ts).
  */
-async function collectEmbeddedContext(blocks) {
+export async function collectEmbeddedContext(blocks) {
     const MAX_BYTES_PER_FILE = 200_000; // ~200 KB cap per resource
     const snippets = [];
     for (const block of blocks) {
@@ -243,8 +251,11 @@ async function collectEmbeddedContext(blocks) {
 }
 /** Check if a provider has an API key stored (synchronous; relies on the cache
  *  loaded at startup via loadAllApiKeys and the non-secret configuredProviderIds
- *  index — never reads plaintext key material). */
-function providerHasKey(providerId) {
+ *  index — never reads plaintext key material).
+ *
+ *  Exported for unit testing (see server.test.ts).
+ */
+export function providerHasKey(providerId) {
     // Check environment variable first
     const envKey = PROVIDERS[providerId]?.envKey;
     if (envKey && process.env[envKey])
@@ -255,7 +266,14 @@ function providerHasKey(providerId) {
     // Non-secret index of providers that have a key in secure storage
     return getConfiguredProviders().some(p => p.id === providerId);
 }
-function buildConfigOptions() {
+/**
+ * Build the list of session-level config options advertised to the ACP client
+ * (provider/model picker, language, per-tool confirmation toggles).
+ *
+ * Reads the global config + provider table; pure of transport/session state.
+ * Exported for unit testing (see server.test.ts).
+ */
+export function buildConfigOptions() {
     const currentModel = config.get('model') ?? '';
     const currentProviderId = config.get('provider') ?? '';
     // Only show providers that have an API key configured
@@ -345,6 +363,10 @@ export function startAcpServer() {
     const transport = new StdioTransport();
     // ACP sessionId → full AcpSession (includes history + codeep session tracking)
     const sessions = new Map();
+    // Shared deps object for the extracted handlers in serverHandlers.ts.
+    // Handlers read transport + sessions off this; stubbing both in a test
+    // (see serverHandlers.test.ts) is what makes them unit-testable.
+    const handlerDeps = { transport, sessions };
     // Tear down all MCP child processes when the CLI dies. Without this,
     // killing `codeep acp` with Ctrl+C orphans any servers we spawned —
     // they keep running until the user hunts them down with `ps`.
@@ -720,143 +742,19 @@ export function startAcpServer() {
     }
     // ── session/set_mode ────────────────────────────────────────────────────────
     function handleSetMode(msg) {
-        const { sessionId, modeId } = msg.params;
-        const session = sessions.get(sessionId);
-        if (!session) {
-            transport.error(msg.id, -32602, `Unknown sessionId: ${sessionId}`);
-            return;
-        }
-        const validMode = AGENT_MODES.availableModes.find(m => m.id === modeId);
-        if (!validMode) {
-            transport.error(msg.id, -32602, `Unknown modeId: ${modeId}`);
-            return;
-        }
-        session.currentModeId = modeId;
-        // Do NOT persist the global `agentConfirmation` config here. The ACP
-        // permission gate is driven per-session by `session.currentModeId` (see the
-        // onRequestPermission wiring in handleSessionPrompt). Writing it globally
-        // would leak this session's mode into other processes — e.g. switching ACP
-        // to 'auto' would silently disarm the TUI's confirmation gate. Mode stays
-        // on the in-memory session object only.
-        transport.respond(msg.id, {});
-        // Notify Zed of the mode change
-        transport.notify('session/update', {
-            sessionId,
-            update: {
-                sessionUpdate: 'current_mode_update',
-                currentModeId: modeId,
-            },
-        });
+        handleSetModeExternal(msg, handlerDeps);
     }
     // ── session/set_config_option ───────────────────────────────────────────────
     function handleSetConfigOption(msg) {
-        const { sessionId, configId, value } = msg.params;
-        const session = sessions.get(sessionId);
-        if (!session) {
-            transport.error(msg.id, -32602, `Unknown sessionId: ${sessionId}`);
-            return;
-        }
-        if (configId === 'model' && typeof value === 'string') {
-            // value is "providerId/modelId" — split and switch both
-            const slashIdx = value.indexOf('/');
-            if (slashIdx !== -1) {
-                const providerId = value.slice(0, slashIdx);
-                const modelId = value.slice(slashIdx + 1);
-                setProvider(providerId); // sets provider + defaultModel + protocol
-                config.set('model', modelId);
-            }
-            else {
-                config.set('model', value);
-            }
-        }
-        else if (configId === 'provider' && typeof value === 'string') {
-            // Switch provider without specifying a model — picks the provider's
-            // default model + protocol. Used by editor clients that pin a provider
-            // in their settings (e.g. the VS Code `codeep.provider` setting).
-            setProvider(value);
-        }
-        else if (configId === 'customBaseUrl' && typeof value === 'string') {
-            // Base URL for the `custom` (OpenAI-compatible) provider — lets editor
-            // clients point Codeep at a self-hosted endpoint (vLLM/LiteLLM/LM Studio)
-            // without hand-editing ~/.codeep/config.json.
-            config.set('customBaseUrl', value);
-        }
-        else if (configId === 'language' && typeof value === 'string') {
-            config.set('language', value);
-        }
-        else if (configId === 'agentConfirmDeleteFile' ||
-            configId === 'agentConfirmExecuteCommand' ||
-            configId === 'agentConfirmWriteFile' ||
-            configId === 'userProfile' ||
-            configId === 'autoLearnProfile') {
-            // Accept boolean or "true"/"false" string from Zed/VSCode
-            const bool = value === true || value === 'true';
-            config.set(configId, bool);
-        }
-        else if (configId === 'login' && typeof value === 'string') {
-            // value is "providerId:apiKey"
-            const colonIdx = value.indexOf(':');
-            if (colonIdx !== -1) {
-                const providerId = value.slice(0, colonIdx);
-                const apiKey = value.slice(colonIdx + 1);
-                if (providerId && apiKey) {
-                    setProvider(providerId);
-                    // Cache is updated synchronously inside setApiKey; the keychain write
-                    // resolves while the long-lived server runs. Swallow a persistence
-                    // failure here (secondary path) so it can't become an unhandled
-                    // rejection — the key still works for this session via the cache.
-                    setApiKey(apiKey, providerId).catch(() => { });
-                }
-            }
-        }
-        transport.respond(msg.id, {});
-        // Confirm the new value back to Zed so its UI state stays in sync
-        transport.notify('session/update', {
-            sessionId,
-            update: {
-                sessionUpdate: 'config_option_update',
-                configOptions: buildConfigOptions(),
-            },
-        });
+        handleSetConfigOptionExternal(msg, handlerDeps);
     }
     // ── session/list ─────────────────────────────────────────────────────────────
     function handleSessionList(msg) {
-        const params = (msg.params ?? {});
-        // Collect local (project-scoped) sessions and global sessions, deduplicated by name
-        const seen = new Set();
-        const merged = [
-            ...listSessionsWithInfo(params.cwd), // project-local first
-            ...listSessionsWithInfo(), // global fallback
-        ].filter(s => {
-            if (seen.has(s.name))
-                return false;
-            seen.add(s.name);
-            return true;
-        });
-        // Sort newest first
-        merged.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
-        const acpSessions = merged.map(s => ({
-            sessionId: s.name,
-            cwd: params.cwd ?? '',
-            title: s.title,
-            updatedAt: s.createdAt,
-        }));
-        const result = { sessions: acpSessions };
-        transport.respond(msg.id, result);
+        handleSessionListExternal(msg, handlerDeps);
     }
     // ── session/delete ───────────────────────────────────────────────────────────
     function handleSessionDelete(msg) {
-        const { sessionId, cwd } = (msg.params ?? {});
-        // Remove from in-memory sessions map if present
-        sessions.delete(sessionId);
-        // Tear down any MCP server processes attached to this session — leaks
-        // children otherwise. Fire-and-forget; client doesn't wait on stop().
-        disposeMcpSession(sessionId).catch(() => { });
-        // Try project dir first, then global
-        const deleted = deleteSessionFile(sessionId, cwd || undefined);
-        if (!deleted && cwd)
-            deleteSessionFile(sessionId);
-        transport.respond(msg.id, {});
+        handleSessionDeleteExternal(msg, handlerDeps);
     }
     // ── session/list_providers ──────────────────────────────────────────────────
     // Canonical provider list for ACP clients (Codeep VS Code extension etc.).
@@ -864,24 +762,7 @@ export function startAcpServer() {
     // source instead of carrying its own hardcoded copy. Keep this stable —
     // adding new fields is fine, removing/renaming would break existing clients.
     function handleListProviders(msg) {
-        const providers = Object.entries(PROVIDERS).map(([id, p]) => ({
-            id,
-            name: p.name,
-            description: p.description,
-            groupLabel: p.groupLabel ?? p.name,
-            hint: p.hint ?? p.description,
-            requiresKey: !p.noApiKey,
-            subscribeUrl: p.subscribeUrl,
-            // Model metadata so ACP clients (e.g. the VS Code model picker) can
-            // offer a provider → model selector without hardcoding a catalog.
-            // `dynamicModels` flags providers whose model list is open-ended
-            // (OpenRouter, Ollama, custom endpoints) — clients should let the
-            // user type a model id rather than only pick from `models`.
-            models: p.models.map((m) => ({ id: m.id, name: m.name })),
-            defaultModel: p.defaultModel,
-            dynamicModels: p.dynamicModels ?? false,
-        }));
-        transport.respond(msg.id, { providers });
+        handleListProvidersExternal(msg, handlerDeps);
     }
     // ── session/prompt ──────────────────────────────────────────────────────────
     async function handleSessionPrompt(msg) {

package/dist/acp/serverHandlers.d.ts

@@ -0,0 +1,88 @@
+import type { JsonRpcRequest } from './protocol.js';
+import type { AcpSession } from './commands.js';
+/** Session record held by the running server. Lives in server.ts; re-exposed
+ *  here so handler signatures can name it without re-declaring the shape. */
+export interface AcpServerSession extends AcpSession {
+    abortController: AbortController | null;
+    currentModeId: string;
+    titleSent: boolean;
+    hadHistory: boolean;
+}
+/** Sessions map the server owns. */
+export type SessionMap = Map<string, AcpServerSession>;
+/** The transport surface handlers actually use. Mirrors `StdioTransport`'s
+ *  public methods — stub this in tests. */
+export interface AcpTransport {
+    respond(id: string | number, result: unknown): void;
+    error(id: string | number, code: number, message: string): void;
+    notify(method: string, params: unknown): void;
+}
+/** Everything a handler needs. Constructed once in `startAcpServer()` and
+ *  passed to every handler call. */
+export interface AcpHandlerDeps {
+    transport: AcpTransport;
+    sessions: SessionMap;
+}
+/**
+ * Switch the agent confirmation mode for a session (auto = no prompts,
+ * manual = prompt before destructive tools). Per-session only — the global
+ * `agentConfirmation` config is deliberately NOT mutated, see the comment
+ * in the body.
+ */
+export declare function handleSetMode(msg: JsonRpcRequest, deps: AcpHandlerDeps): void;
+/**
+ * Apply a session-level config change coming from the ACP client (model picker,
+ * language dropdown, confirmation toggles, login field). Mutates the global
+ * config (these ARE meant to persist across sessions, unlike mode) and pushes
+ * the refreshed config-option list back to the client.
+ */
+export declare function handleSetConfigOption(msg: JsonRpcRequest, deps: AcpHandlerDeps): void;
+/**
+ * Pure-ish: apply a single config-option update to the global config.
+ * Split out from the handler so it can be tested without a transport.
+ *
+ * - `model` / `provider`: switch the active provider + model.
+ * - `customBaseUrl`: point the `custom` OpenAI-compatible provider at a
+ *   self-hosted endpoint.
+ * - `language`: response language code.
+ * - `agentConfirm*` / `userProfile` / `autoLearnProfile`: boolean toggles,
+ *   accept `true`/`false` or the strings `"true"`/`"false"` (Zed sends strings).
+ * - `login`: special-case `"providerId:apiKey"` — sets the provider and writes
+ *   the key to the keychain. The keychain write is async and fire-and-forget;
+ *   a persistence failure only means the key isn't durable, it's still usable
+ *   in-process via the cache.
+ */
+export declare function applyConfigOption(configId: string, value: unknown): void;
+/**
+ * List saved sessions (project-scoped first, then global fallback), deduped
+ * by name and sorted newest-first.
+ */
+export declare function handleSessionList(msg: JsonRpcRequest, deps: AcpHandlerDeps): void;
+/**
+ * Remove a session: drop it from the in-memory map, tear down any MCP child
+ * processes attached to it, then delete the on-disk session file (project dir
+ * first, global fallback).
+ */
+export declare function handleSessionDelete(msg: JsonRpcRequest, deps: AcpHandlerDeps): void;
+/**
+ * Pure shape: map the PROVIDERS table into the serialisable form ACP clients
+ * expect (id/name/groupLabel/models/dynamicModels/…). No transport side-effect.
+ * Exported so the handler is a one-liner and the shape can be unit-tested.
+ */
+export declare function buildProviderList(): {
+    id: string;
+    name: string;
+    description: string;
+    groupLabel: string;
+    hint: string;
+    requiresKey: boolean;
+    subscribeUrl: string | undefined;
+    models: {
+        id: string;
+        name: string;
+    }[];
+    defaultModel: string;
+    dynamicModels: boolean;
+}[];
+/** session/list_providers handler — delegate to the pure builder + respond. */
+export declare function handleListProviders(msg: JsonRpcRequest, deps: AcpHandlerDeps): void;

package/dist/acp/serverHandlers.js

@@ -0,0 +1,237 @@
+// src/acp/serverHandlers.ts
+//
+// Session-lifecycle handlers for the ACP server, extracted from the
+// `startAcpServer()` closure in `server.ts` into a factory so they can be
+// unit-tested with a stub transport + sessions map.
+//
+// Each handler is a pure function of (msg, deps) → side-effect on deps.
+// `deps` carries the transport (for respond/error/notify), the sessions map,
+// and a handful of module-scope helpers (buildConfigOptions, AGENT_MODES).
+// No handler reads process-level singletons directly — everything comes in
+// through deps, which is what makes them testable.
+//
+// Not all handlers from server.ts live here yet. The big async ones
+// (`handleSessionPrompt`) reach into MCP spawning, vision APIs, and the agent
+// loop — those stay inside the closure until their dependencies are also
+// lifted. The handlers in this file are the synchronous ones whose contract
+// is "look up the session, mutate config or session state, acknowledge".
+import { AGENT_MODES, buildConfigOptions } from './server.js';
+import { config, setProvider, setApiKey, listSessionsWithInfo, deleteSession as deleteSessionFile, } from '../config/index.js';
+import { disposeSession as disposeMcpSession } from '../utils/mcpRegistry.js';
+// ─── session/set_mode ─────────────────────────────────────────────────────────
+/**
+ * Switch the agent confirmation mode for a session (auto = no prompts,
+ * manual = prompt before destructive tools). Per-session only — the global
+ * `agentConfirmation` config is deliberately NOT mutated, see the comment
+ * in the body.
+ */
+export function handleSetMode(msg, deps) {
+    const { transport, sessions } = deps;
+    const { sessionId, modeId } = msg.params;
+    const session = sessions.get(sessionId);
+    if (!session) {
+        transport.error(msg.id, -32602, `Unknown sessionId: ${sessionId}`);
+        return;
+    }
+    const validMode = AGENT_MODES.availableModes.find(m => m.id === modeId);
+    if (!validMode) {
+        transport.error(msg.id, -32602, `Unknown modeId: ${modeId}`);
+        return;
+    }
+    session.currentModeId = modeId;
+    // Do NOT persist the global `agentConfirmation` config here. The ACP
+    // permission gate is driven per-session by `session.currentModeId` (see the
+    // onRequestPermission wiring in handleSessionPrompt). Writing it globally
+    // would leak this session's mode into other processes — e.g. switching ACP
+    // to 'auto' would silently disarm the TUI's confirmation gate. Mode stays
+    // on the in-memory session object only.
+    transport.respond(msg.id, {});
+    // Notify Zed of the mode change
+    transport.notify('session/update', {
+        sessionId,
+        update: {
+            sessionUpdate: 'current_mode_update',
+            currentModeId: modeId,
+        },
+    });
+}
+// ─── session/set_config_option ────────────────────────────────────────────────
+/**
+ * Apply a session-level config change coming from the ACP client (model picker,
+ * language dropdown, confirmation toggles, login field). Mutates the global
+ * config (these ARE meant to persist across sessions, unlike mode) and pushes
+ * the refreshed config-option list back to the client.
+ */
+export function handleSetConfigOption(msg, deps) {
+    const { transport, sessions } = deps;
+    const { sessionId, configId, value } = msg.params;
+    const session = sessions.get(sessionId);
+    if (!session) {
+        transport.error(msg.id, -32602, `Unknown sessionId: ${sessionId}`);
+        return;
+    }
+    applyConfigOption(configId, value);
+    transport.respond(msg.id, {});
+    // Confirm the new value back to Zed so its UI state stays in sync
+    transport.notify('session/update', {
+        sessionId,
+        update: {
+            sessionUpdate: 'config_option_update',
+            configOptions: buildConfigOptions(),
+        },
+    });
+}
+/**
+ * Pure-ish: apply a single config-option update to the global config.
+ * Split out from the handler so it can be tested without a transport.
+ *
+ * - `model` / `provider`: switch the active provider + model.
+ * - `customBaseUrl`: point the `custom` OpenAI-compatible provider at a
+ *   self-hosted endpoint.
+ * - `language`: response language code.
+ * - `agentConfirm*` / `userProfile` / `autoLearnProfile`: boolean toggles,
+ *   accept `true`/`false` or the strings `"true"`/`"false"` (Zed sends strings).
+ * - `login`: special-case `"providerId:apiKey"` — sets the provider and writes
+ *   the key to the keychain. The keychain write is async and fire-and-forget;
+ *   a persistence failure only means the key isn't durable, it's still usable
+ *   in-process via the cache.
+ */
+export function applyConfigOption(configId, value) {
+    if (configId === 'model' && typeof value === 'string') {
+        // value is "providerId/modelId" — split and switch both
+        const slashIdx = value.indexOf('/');
+        if (slashIdx !== -1) {
+            const providerId = value.slice(0, slashIdx);
+            const modelId = value.slice(slashIdx + 1);
+            setProvider(providerId); // sets provider + defaultModel + protocol
+            config.set('model', modelId);
+        }
+        else {
+            config.set('model', value);
+        }
+    }
+    else if (configId === 'provider' && typeof value === 'string') {
+        // Switch provider without specifying a model — picks the provider's
+        // default model + protocol. Used by editor clients that pin a provider
+        // in their settings (e.g. the VS Code `codeep.provider` setting).
+        setProvider(value);
+    }
+    else if (configId === 'customBaseUrl' && typeof value === 'string') {
+        // Base URL for the `custom` (OpenAI-compatible) provider — lets editor
+        // clients point Codeep at a self-hosted endpoint (vLLM/LiteLLM/LM Studio)
+        // without hand-editing ~/.codeep/config.json.
+        config.set('customBaseUrl', value);
+    }
+    else if (configId === 'language' && typeof value === 'string') {
+        config.set('language', value);
+    }
+    else if (configId === 'agentConfirmDeleteFile' ||
+        configId === 'agentConfirmExecuteCommand' ||
+        configId === 'agentConfirmWriteFile' ||
+        configId === 'userProfile' ||
+        configId === 'autoLearnProfile') {
+        // Accept boolean or "true"/"false" string from Zed/VSCode
+        const bool = value === true || value === 'true';
+        config.set(configId, bool);
+    }
+    else if (configId === 'login' && typeof value === 'string') {
+        // value is "providerId:apiKey"
+        const colonIdx = value.indexOf(':');
+        if (colonIdx !== -1) {
+            const providerId = value.slice(0, colonIdx);
+            const apiKey = value.slice(colonIdx + 1);
+            if (providerId && apiKey) {
+                setProvider(providerId);
+                // Cache is updated synchronously inside setApiKey; the keychain write
+                // resolves while the long-lived server runs. Swallow a persistence
+                // failure here (secondary path) so it can't become an unhandled
+                // rejection — the key still works for this session via the cache.
+                setApiKey(apiKey, providerId).catch(() => { });
+            }
+        }
+    }
+}
+// ─── session/list ─────────────────────────────────────────────────────────────
+/**
+ * List saved sessions (project-scoped first, then global fallback), deduped
+ * by name and sorted newest-first.
+ */
+export function handleSessionList(msg, deps) {
+    const { transport } = deps;
+    const params = (msg.params ?? {});
+    // Collect local (project-scoped) sessions and global sessions, deduplicated by name
+    const seen = new Set();
+    const merged = [
+        ...listSessionsWithInfo(params.cwd), // project-local first
+        ...listSessionsWithInfo(), // global fallback
+    ].filter(s => {
+        if (seen.has(s.name))
+            return false;
+        seen.add(s.name);
+        return true;
+    });
+    // Sort newest first
+    merged.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
+    const acpSessions = merged.map(s => ({
+        sessionId: s.name,
+        cwd: params.cwd ?? '',
+        title: s.title,
+        updatedAt: s.createdAt,
+    }));
+    const result = { sessions: acpSessions };
+    transport.respond(msg.id, result);
+}
+// ─── session/delete ───────────────────────────────────────────────────────────
+/**
+ * Remove a session: drop it from the in-memory map, tear down any MCP child
+ * processes attached to it, then delete the on-disk session file (project dir
+ * first, global fallback).
+ */
+export function handleSessionDelete(msg, deps) {
+    const { transport, sessions } = deps;
+    const { sessionId, cwd } = (msg.params ?? {});
+    // Remove from in-memory sessions map if present
+    sessions.delete(sessionId);
+    // Tear down any MCP server processes attached to this session — leaks
+    // children otherwise. Fire-and-forget; client doesn't wait on stop().
+    disposeMcpSession(sessionId).catch(() => { });
+    // Try project dir first, then global
+    const deleted = deleteSessionFile(sessionId, cwd || undefined);
+    if (!deleted && cwd)
+        deleteSessionFile(sessionId);
+    transport.respond(msg.id, {});
+}
+// ─── session/list_providers ───────────────────────────────────────────────────
+// Canonical provider list for ACP clients (Codeep VS Code extension etc.).
+// Lets the client populate its API-key dropdowns and group labels from one
+// source instead of carrying its own hardcoded copy. Keep this stable —
+// adding new fields is fine, removing/renaming would break existing clients.
+import { PROVIDERS } from '../config/providers.js';
+/**
+ * Pure shape: map the PROVIDERS table into the serialisable form ACP clients
+ * expect (id/name/groupLabel/models/dynamicModels/…). No transport side-effect.
+ * Exported so the handler is a one-liner and the shape can be unit-tested.
+ */
+export function buildProviderList() {
+    return Object.entries(PROVIDERS).map(([id, p]) => ({
+        id,
+        name: p.name,
+        description: p.description,
+        groupLabel: p.groupLabel ?? p.name,
+        hint: p.hint ?? p.description,
+        requiresKey: !p.noApiKey,
+        subscribeUrl: p.subscribeUrl,
+        // Model metadata so ACP clients (e.g. the VS Code model picker) can
+        // offer a provider → model selector without hardcoding a catalog.
+        // `dynamicModels` flags providers whose model list is open-ended
+        // (OpenRouter, Ollama, custom endpoints) — clients should let the
+        // user type a model id rather than only pick from `models`.
+        models: p.models.map((m) => ({ id: m.id, name: m.name })),
+        defaultModel: p.defaultModel,
+        dynamicModels: p.dynamicModels ?? false,
+    }));
+}
+/** session/list_providers handler — delegate to the pure builder + respond. */
+export function handleListProviders(msg, deps) {
+    deps.transport.respond(msg.id, { providers: buildProviderList() });
+}