copilot-hub 0.1.13 → 0.1.16

package/apps/control-plane/dist/test/hub-model-utils.test.js

@@ -0,0 +1,170 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+const BOT_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+let utilsPromise = null;
+async function loadUtils() {
+    if (!utilsPromise) {
+        const specifier = ["..", "channels", "hub-model-utils.js"].join("/");
+        utilsPromise = import(specifier);
+    }
+    return utilsPromise;
+}
+test("parseSetModelCommand accepts explicit model and auto keyword", async () => {
+    const { parseSetModelCommand } = await loadUtils();
+    const modelResult = parseSetModelCommand("/set_model agent_a gpt-5.3-codex", BOT_ID_PATTERN);
+    assert.equal(modelResult.ok, true);
+    assert.equal(modelResult.botId, "agent_a");
+    assert.equal(modelResult.model, "gpt-5.3-codex");
+    const autoResult = parseSetModelCommand("/set_model agent_a auto", BOT_ID_PATTERN);
+    assert.equal(autoResult.ok, true);
+    assert.equal(autoResult.botId, "agent_a");
+    assert.equal(autoResult.model, null);
+});
+test("parseSetModelAllCommand accepts explicit model and auto keyword", async () => {
+    const { parseSetModelAllCommand } = await loadUtils();
+    const modelResult = parseSetModelAllCommand("/set_model_all gpt-5.3-codex");
+    assert.equal(modelResult.ok, true);
+    assert.equal(modelResult.model, "gpt-5.3-codex");
+    const autoResult = parseSetModelAllCommand("/set_model_all auto");
+    assert.equal(autoResult.ok, true);
+    assert.equal(autoResult.model, null);
+});
+test("parseSetModelCommand rejects invalid command input", async () => {
+    const { parseSetModelAllCommand, parseSetModelCommand } = await loadUtils();
+    const invalidId = parseSetModelCommand("/set_model bad*id gpt-5", BOT_ID_PATTERN);
+    assert.equal(invalidId.ok, false);
+    const invalidModel = parseSetModelCommand("/set_model agent_a bad/model", BOT_ID_PATTERN);
+    assert.equal(invalidModel.ok, false);
+    const missingModel = parseSetModelAllCommand("/set_model_all");
+    assert.equal(missingModel.ok, false);
+    const invalidGlobalModel = parseSetModelAllCommand("/set_model_all bad/model");
+    assert.equal(invalidGlobalModel.ok, false);
+});
+test("buildSessionModelOptions de-duplicates and marks selected model", async () => {
+    const { buildSessionModelOptions } = await loadUtils();
+    const options = buildSessionModelOptions({
+        currentModel: "gpt-5",
+        catalog: [
+            { model: "gpt-4.1", displayName: "GPT-4.1" },
+            { model: "gpt-5", displayName: "GPT-5" },
+            { model: "gpt-5", displayName: "GPT-5 duplicate" },
+        ],
+        inlineMax: 10,
+    });
+    assert.equal(options.length, 2);
+    assert.equal(options[0].model, "gpt-5");
+    assert.equal(options[0].selected, true);
+    assert.equal(options[1].model, "gpt-4.1");
+    assert.equal(options[1].selected, false);
+});
+test("resolveModelSelectionFromAction resolves auto and keyed entries", async () => {
+    const { resolveModelSelectionFromAction } = await loadUtils();
+    const session = {
+        modelOptions: [
+            { key: "k0", model: "gpt-5", label: "GPT-5" },
+            { key: "k1", model: "gpt-4.1", label: "GPT-4.1" },
+        ],
+    };
+    const autoSelection = resolveModelSelectionFromAction({ session, profileId: "auto" });
+    assert.equal(autoSelection.ok, true);
+    assert.equal(autoSelection.model, null);
+    const explicitSelection = resolveModelSelectionFromAction({ session, profileId: "k1" });
+    assert.equal(explicitSelection.ok, true);
+    assert.equal(explicitSelection.model, "gpt-4.1");
+    assert.equal(explicitSelection.label, "GPT-4.1");
+});
+test("fetchCodexModelOptions normalizes model catalog from API", async () => {
+    const { fetchCodexModelOptions } = await loadUtils();
+    const result = await fetchCodexModelOptions(async () => ({
+        models: [
+            { id: "model-a", model: "gpt-5", displayName: "GPT-5", isDefault: true },
+            { id: "model-b", model: "gpt-5", displayName: "Duplicate" },
+            { id: "model-c", model: "gpt-4.1", displayName: "GPT-4.1" },
+        ],
+    }));
+    assert.equal(result.available, true);
+    assert.equal(result.models.length, 2);
+    assert.deepEqual(result.models[0], {
+        model: "gpt-5",
+        displayName: "GPT-5",
+        isDefault: true,
+    });
+});
+test("policy resolvers keep safe defaults", async () => {
+    const { applyBotModelPolicy, applyModelPolicyToBots, getBotPolicyState, resolveApprovalPolicy, resolveSandboxMode, } = await loadUtils();
+    assert.equal(resolveSandboxMode("read-only"), "read-only");
+    assert.equal(resolveSandboxMode("invalid"), "danger-full-access");
+    assert.equal(resolveApprovalPolicy("on-request"), "on-request");
+    assert.equal(resolveApprovalPolicy("invalid"), "never");
+    assert.deepEqual(getBotPolicyState({
+        provider: {
+            options: {
+                sandboxMode: "workspace-write",
+                approvalPolicy: "on-failure",
+            },
+        },
+    }), {
+        sandboxMode: "workspace-write",
+        approvalPolicy: "on-failure",
+    });
+    let capturedPath = "";
+    let capturedPayload = null;
+    await applyBotModelPolicy({
+        apiPost: async (path, payload) => {
+            capturedPath = path;
+            capturedPayload = payload;
+            return { ok: true };
+        },
+        botId: "worker-a",
+        botState: {
+            provider: {
+                options: {
+                    sandboxMode: "read-only",
+                    approvalPolicy: "on-request",
+                },
+            },
+        },
+        model: "gpt-5",
+    });
+    assert.equal(capturedPath, "/api/bots/worker-a/policy");
+    assert.deepEqual(capturedPayload, {
+        sandboxMode: "read-only",
+        approvalPolicy: "on-request",
+        model: "gpt-5",
+    });
+    const posted = [];
+    const batchResult = await applyModelPolicyToBots({
+        apiPost: async (path, payload) => {
+            posted.push({ path, payload });
+            if (path.endsWith("/worker-b/policy")) {
+                throw new Error("restart failed");
+            }
+            return { ok: true };
+        },
+        bots: [
+            {
+                id: "worker-a",
+                provider: {
+                    options: {
+                        sandboxMode: "read-only",
+                        approvalPolicy: "on-request",
+                    },
+                },
+            },
+            {
+                id: "worker-b",
+                provider: {
+                    options: {
+                        sandboxMode: "workspace-write",
+                        approvalPolicy: "on-failure",
+                    },
+                },
+            },
+        ],
+        model: null,
+    });
+    assert.deepEqual(batchResult.updatedBotIds, ["worker-a"]);
+    assert.equal(batchResult.failures.length, 1);
+    assert.equal(batchResult.failures[0].botId, "worker-b");
+    assert.equal(posted.length, 2);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilot-hub",
-  "version": "0.1.13",
+  "version": "0.1.16",
   "description": "Copilot Hub CLI and runtime bundle",
   "license": "MIT",
   "repository": {
@@ -48,7 +48,8 @@
     "packages/*"
   ],
   "scripts": {
-    "build": "npm run build:scripts && npm run build --workspaces --if-present",
+    "build": "npm run build:scripts && npm run build:workspaces",
+    "build:workspaces": "npm run build --workspace @copilot-hub/contracts --if-present && npm run build --workspace @copilot-hub/core --if-present && npm run build --workspace @copilot-hub/agent-engine --if-present && npm run build --workspace @copilot-hub/control-plane --if-present",
     "build:scripts": "tsc -p scripts/tsconfig.json",
     "prepare:shared": "npm run build:scripts --silent && node scripts/dist/ensure-shared-build.mjs",
     "start": "npm run build:scripts --silent && node scripts/dist/cli.mjs start",
@@ -79,6 +80,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.22.0",
+    "@types/express": "^5.0.6",
     "@types/node": "^22.13.10",
     "eslint": "^9.22.0",
     "globals": "^16.0.0",

package/packages/core/dist/agent-supervisor.d.ts

@@ -1,39 +1,120 @@
+import { type ChildProcess } from "node:child_process";
+type BotConfig = {
+    id: string;
+    name: string;
+    enabled?: boolean;
+    autoStart?: boolean;
+    threadMode?: string;
+    sharedThreadId?: string;
+    workspaceRoot: string;
+    dataDir: string;
+    provider?: {
+        kind?: string;
+        options?: Record<string, unknown>;
+    };
+    kernelAccess?: {
+        enabled?: boolean;
+        allowedActions?: unknown;
+        allowedChatIds?: unknown;
+    };
+    capabilities?: unknown[];
+} & Record<string, unknown>;
+type ProviderDefaults = Record<string, unknown>;
+type KernelActionHandler = (payload: {
+    actorBotId: string;
+    action: unknown;
+    payload: Record<string, unknown>;
+    context: Record<string, unknown>;
+}) => Promise<unknown> | unknown;
+type WorkerStatusBase = {
+    id: string;
+    name: string;
+    enabled: boolean;
+    autoStart: boolean;
+    threadMode: string;
+    sharedThreadId: string;
+    providerKind: string;
+    kernelVersion: string | null;
+    webThreadId: string | null;
+    running: boolean;
+    telegramRunning: boolean;
+    telegramError: string | null;
+    workspaceRoot: string;
+    dataDir: string;
+    kernelAccess: {
+        enabled: boolean;
+        allowedActions: string[];
+        allowedChatIds: string[];
+    };
+    capabilities: unknown[];
+    channels: unknown[];
+};
+type SupervisorStatus = WorkerStatusBase & {
+    lastHeartbeatAt: string | null;
+    lastHeartbeatError: string | null;
+};
+type PendingRequest = {
+    resolve: (value: unknown) => void;
+    reject: (error: Error) => void;
+    timer: NodeJS.Timeout;
+};
 export declare class AgentSupervisor {
     #private;
+    botConfig: BotConfig;
+    providerDefaults: ProviderDefaults;
+    turnActivityTimeoutMs: number;
+    maxMessages: number;
+    webPublicBaseUrl: string;
+    workerScriptPath: string;
+    onKernelAction: KernelActionHandler | null;
+    child: ChildProcess | null;
+    startingPromise: Promise<void> | null;
+    shutdownRequested: boolean;
+    restartTimer: NodeJS.Timeout | null;
+    restartAttempt: number;
+    nextRequestId: number;
+    pendingRequests: Map<string, PendingRequest>;
+    desiredChannelsRunning: boolean;
+    heartbeatInFlight: Promise<SupervisorStatus> | null;
+    recoveryPromise: Promise<void> | null;
+    lastHeartbeatAt: string | null;
+    lastHeartbeatError: string | null;
+    statusCache: WorkerStatusBase;
     constructor({ botConfig, providerDefaults, turnActivityTimeoutMs, maxMessages, webPublicBaseUrl, workerScriptPath, onKernelAction, }: {
-        botConfig: any;
-        providerDefaults: any;
-        turnActivityTimeoutMs: any;
-        maxMessages: any;
-        webPublicBaseUrl: any;
-        workerScriptPath: any;
-        onKernelAction?: null | undefined;
+        botConfig: BotConfig;
+        providerDefaults: ProviderDefaults;
+        turnActivityTimeoutMs: number;
+        maxMessages: number;
+        webPublicBaseUrl: string;
+        workerScriptPath: string;
+        onKernelAction?: KernelActionHandler | null;
     });
     get id(): string;
-    get config(): any;
-    getStatus(): any;
-    setWebPublicBaseUrl(value: any): void;
+    get config(): BotConfig;
+    getStatus(): SupervisorStatus;
+    setWebPublicBaseUrl(value: string): void;
     boot(): Promise<void>;
     ensureWorker(): Promise<void>;
-    startChannels(): Promise<any>;
-    stopChannels(): Promise<any>;
+    startChannels(): Promise<SupervisorStatus>;
+    stopChannels(): Promise<SupervisorStatus>;
     resetWebThread(): Promise<unknown>;
-    listPendingApprovals(threadId: any): Promise<unknown>;
-    resolvePendingApproval({ threadId, approvalId, decision }: {
-        threadId: any;
-        approvalId: any;
-        decision: any;
+    listPendingApprovals(threadId?: string): Promise<unknown>;
+    resolvePendingApproval({ threadId, approvalId, decision, }: {
+        threadId: string;
+        approvalId: string;
+        decision: string;
     }): Promise<unknown>;
-    listCapabilities(): Promise<any>;
-    setCapabilities(nextCapabilities: any): void;
-    setProviderOptions(nextOptions: any): Promise<any>;
-    reloadCapabilities(nextCapabilities?: null): Promise<any>;
-    setProjectRoot(projectRoot: any): Promise<any>;
-    refreshStatus(timeoutMs?: number): Promise<any>;
-    heartbeat({ timeoutMs }?: {
-        timeoutMs?: number | undefined;
-    }): Promise<any>;
-    forceRestart(reason?: string): Promise<any>;
+    listCapabilities(): Promise<unknown[]>;
+    setCapabilities(nextCapabilities: unknown): void;
+    setProviderOptions(nextOptions: Record<string, unknown>): Promise<SupervisorStatus>;
+    reloadCapabilities(nextCapabilities?: unknown): Promise<SupervisorStatus>;
+    setProjectRoot(projectRoot: string): Promise<SupervisorStatus>;
+    refreshStatus(timeoutMs?: number): Promise<SupervisorStatus>;
+    heartbeat({ timeoutMs, }?: {
+        timeoutMs?: number;
+    }): Promise<SupervisorStatus>;
+    forceRestart(reason?: string): Promise<SupervisorStatus>;
     shutdown(): Promise<void>;
-    request(action: any, payload?: null, timeoutMs?: number): Promise<unknown>;
+    request(action: string, payload?: unknown, timeoutMs?: number): Promise<unknown>;
 }
+export {};

package/packages/core/dist/agent-supervisor.js

@@ -1,4 +1,3 @@
-// @ts-nocheck
 import { fork } from "node:child_process";
 const REQUEST_TIMEOUT_MS = 15000;
 const HEARTBEAT_TIMEOUT_MS = 4000;
@@ -8,6 +7,26 @@ const WORKER_READY_POLL_INTERVAL_MS = 150;
 const WORKER_RECOVERY_TIMEOUT_MS = 20000;
 const WORKER_RECOVERY_POLL_INTERVAL_MS = 250;
 export class AgentSupervisor {
+    botConfig;
+    providerDefaults;
+    turnActivityTimeoutMs;
+    maxMessages;
+    webPublicBaseUrl;
+    workerScriptPath;
+    onKernelAction;
+    child;
+    startingPromise;
+    shutdownRequested;
+    restartTimer;
+    restartAttempt;
+    nextRequestId;
+    pendingRequests;
+    desiredChannelsRunning;
+    heartbeatInFlight;
+    recoveryPromise;
+    lastHeartbeatAt;
+    lastHeartbeatError;
+    statusCache;
     constructor({ botConfig, providerDefaults, turnActivityTimeoutMs, maxMessages, webPublicBaseUrl, workerScriptPath, onKernelAction = null, }) {
         this.botConfig = botConfig;
         this.providerDefaults = providerDefaults;
@@ -102,7 +121,7 @@ export class AgentSupervisor {
         await this.ensureWorker();
         return this.request("listPendingApprovals", { threadId });
     }
-    async resolvePendingApproval({ threadId, approvalId, decision }) {
+    async resolvePendingApproval({ threadId, approvalId, decision, }) {
         await this.ensureWorker();
         return this.request("resolvePendingApproval", {
             threadId,
@@ -136,6 +155,15 @@ export class AgentSupervisor {
         if (typeof nextOptions?.approvalPolicy === "string" && nextOptions.approvalPolicy.trim()) {
             mergedOptions.approvalPolicy = nextOptions.approvalPolicy.trim();
         }
+        if (Object.prototype.hasOwnProperty.call(nextOptions ?? {}, "model")) {
+            const normalizedModel = String(nextOptions?.model ?? "").trim();
+            if (normalizedModel) {
+                mergedOptions.model = normalizedModel;
+            }
+            else {
+                delete mergedOptions.model;
+            }
+        }
         this.botConfig = {
             ...previousConfig,
             provider: {
@@ -145,7 +173,7 @@ export class AgentSupervisor {
             },
         };
         try {
-            const status = await this.forceRestart("provider policy updated");
+            const status = await this.forceRestart("provider options updated");
             this.#updateStatus(status);
             return this.getStatus();
         }
@@ -159,7 +187,7 @@ export class AgentSupervisor {
             }
             this.botConfig = previousConfig;
             try {
-                await this.forceRestart("provider policy rollback");
+                await this.forceRestart("provider options rollback");
             }
             catch {
                 // Best effort rollback only.
@@ -172,9 +200,11 @@ export class AgentSupervisor {
             this.setCapabilities(nextCapabilities);
         }
         await this.ensureWorker();
-        const status = await this.request("reloadCapabilities", {
-            capabilityDefinitions: Array.isArray(nextCapabilities) ? nextCapabilities : undefined,
-        });
+        const payload = {};
+        if (Array.isArray(nextCapabilities)) {
+            payload.capabilityDefinitions = nextCapabilities;
+        }
+        const status = await this.request("reloadCapabilities", payload);
         this.#updateStatus(status);
         return this.getStatus();
     }
@@ -190,7 +220,7 @@ export class AgentSupervisor {
         this.#updateStatus(status);
         return this.getStatus();
     }
-    async heartbeat({ timeoutMs = HEARTBEAT_TIMEOUT_MS } = {}) {
+    async heartbeat({ timeoutMs = HEARTBEAT_TIMEOUT_MS, } = {}) {
         if (this.shutdownRequested) {
             return this.getStatus();
         }
@@ -274,7 +304,7 @@ export class AgentSupervisor {
         const child = this.child;
         this.child = null;
         try {
-            child.kill("SIGTERM");
+            child?.kill("SIGTERM");
         }
         catch {
             // Ignore.
@@ -282,7 +312,8 @@ export class AgentSupervisor {
         this.#setOfflineStatus();
     }
     request(action, payload = null, timeoutMs = REQUEST_TIMEOUT_MS) {
-        if (!this.child || !this.child.connected) {
+        const child = this.child;
+        if (!child || !child.connected) {
             return Promise.reject(new Error(`Worker '${this.id}' is not running.`));
         }
         const requestId = `${this.id}_${Date.now()}_${this.nextRequestId++}`;
@@ -297,7 +328,7 @@ export class AgentSupervisor {
                 timer,
             });
             try {
-                this.child.send({
+                child.send({
                     type: "request",
                     requestId,
                     action,
@@ -307,7 +338,7 @@ export class AgentSupervisor {
             catch (error) {
                 clearTimeout(timer);
                 this.pendingRequests.delete(requestId);
-                reject(error);
+                reject(toError(error));
             }
         });
     }
@@ -317,6 +348,7 @@ export class AgentSupervisor {
             clearTimeout(this.restartTimer);
             this.restartTimer = null;
         }
+        const windowsForkOptions = process.platform === "win32" ? { windowsHide: true } : {};
         const child = fork(this.workerScriptPath, [], {
             cwd: process.cwd(),
             env: {
@@ -328,8 +360,8 @@ export class AgentSupervisor {
                 AGENT_WEB_PUBLIC_BASE_URL: this.webPublicBaseUrl,
                 AGENT_KERNEL_REQUEST_TIMEOUT_MS: String(REQUEST_TIMEOUT_MS),
             },
+            ...windowsForkOptions,
             stdio: ["ignore", "pipe", "pipe", "ipc"],
-            windowsHide: true,
         });
         this.child = child;
         child.stdout?.on("data", (chunk) => {
@@ -356,32 +388,35 @@ export class AgentSupervisor {
         await this.refreshStatus();
     }
     #handleWorkerMessage(message) {
-        if (!message || typeof message !== "object") {
+        const record = asRecord(message);
+        if (!record.type) {
             return;
         }
-        if (message.type === "response") {
-            const requestId = String(message.requestId ?? "");
+        if (record.type === "response") {
+            const response = record;
+            const requestId = String(response.requestId ?? "");
             const pending = this.pendingRequests.get(requestId);
             if (!pending) {
                 return;
             }
             this.pendingRequests.delete(requestId);
             clearTimeout(pending.timer);
-            if (message.ok) {
-                pending.resolve(message.result);
+            if (response.ok) {
+                pending.resolve(response.result);
             }
             else {
-                pending.reject(new Error(String(message.error ?? "Unknown worker error.")));
+                pending.reject(new Error(String(response.error ?? "Unknown worker error.")));
             }
             return;
         }
-        if (message.type === "event") {
-            if (message.event === "workerReady") {
+        if (record.type === "event") {
+            const event = record;
+            if (event.event === "workerReady") {
                 return;
             }
         }
-        if (message.type === "kernelRequest") {
-            void this.#handleKernelRequest(message);
+        if (record.type === "kernelRequest") {
+            void this.#handleKernelRequest(record);
         }
     }
     async #handleKernelRequest(message) {
@@ -401,8 +436,8 @@ export class AgentSupervisor {
             const result = await this.onKernelAction({
                 actorBotId: this.id,
                 action: message?.action,
-                payload: message?.payload ?? {},
-                context: message?.context ?? {},
+                payload: asRecord(message?.payload),
+                context: asRecord(message?.context),
             });
             this.#sendKernelResponse({
                 requestId,
@@ -418,7 +453,7 @@ export class AgentSupervisor {
             });
         }
     }
-    #sendKernelResponse({ requestId, ok, result = null, error = null }) {
+    #sendKernelResponse({ requestId, ok, result = null, error = null, }) {
         if (!this.child || !this.child.connected) {
             return;
         }
@@ -435,7 +470,7 @@ export class AgentSupervisor {
             // Ignore response send errors.
         }
     }
-    #handleWorkerExit({ code, signal }) {
+    #handleWorkerExit({ code, signal, }) {
         if (this.child) {
             this.child = null;
         }
@@ -454,20 +489,23 @@ export class AgentSupervisor {
         }, delayMs);
     }
     #rejectAllPending(error) {
+        const normalized = toError(error);
         for (const pending of this.pendingRequests.values()) {
             clearTimeout(pending.timer);
-            pending.reject(error);
+            pending.reject(normalized);
         }
         this.pendingRequests.clear();
     }
     #updateStatus(status) {
-        if (!status || typeof status !== "object") {
+        const statusRecord = asRecord(status);
+        if (Object.keys(statusRecord).length === 0) {
             return;
         }
+        const running = typeof statusRecord.running === "boolean" ? statusRecord.running : this.statusCache.running;
         this.statusCache = {
             ...this.statusCache,
-            ...status,
-            running: status.running ?? this.statusCache.running,
+            ...statusRecord,
+            running,
         };
         if (this.statusCache.running) {
             this.restartAttempt = 0;
@@ -499,29 +537,27 @@ async function waitForWorkerReady(supervisor, child) {
     throw new Error(`Worker '${supervisor.id}' did not become ready within ${timeoutMs}ms.`);
 }
 function createInitialStatus(botConfig) {
+    const provider = asRecord(botConfig.provider);
+    const kernelAccess = asRecord(botConfig.kernelAccess);
     return {
-        id: botConfig.id,
-        name: botConfig.name,
+        id: String(botConfig.id),
+        name: String(botConfig.name),
         enabled: botConfig.enabled !== false,
         autoStart: Boolean(botConfig.autoStart),
-        threadMode: botConfig.threadMode,
-        sharedThreadId: botConfig.sharedThreadId,
-        providerKind: botConfig.provider?.kind ?? "codex",
+        threadMode: String(botConfig.threadMode ?? "single"),
+        sharedThreadId: String(botConfig.sharedThreadId ?? ""),
+        providerKind: String(provider.kind ?? "codex"),
         kernelVersion: null,
         webThreadId: null,
         running: false,
         telegramRunning: false,
         telegramError: null,
-        workspaceRoot: botConfig.workspaceRoot,
-        dataDir: botConfig.dataDir,
+        workspaceRoot: String(botConfig.workspaceRoot),
+        dataDir: String(botConfig.dataDir),
         kernelAccess: {
-            enabled: botConfig.kernelAccess?.enabled === true,
-            allowedActions: Array.isArray(botConfig.kernelAccess?.allowedActions)
-                ? [...botConfig.kernelAccess.allowedActions]
-                : [],
-            allowedChatIds: Array.isArray(botConfig.kernelAccess?.allowedChatIds)
-                ? [...botConfig.kernelAccess.allowedChatIds]
-                : [],
+            enabled: kernelAccess.enabled === true,
+            allowedActions: normalizeStringList(kernelAccess.allowedActions),
+            allowedChatIds: normalizeStringList(kernelAccess.allowedChatIds),
         },
         capabilities: [],
         channels: [],
@@ -584,4 +620,22 @@ function sanitizeError(error) {
     const raw = error instanceof Error ? error.message : String(error);
     return raw.split(/\r?\n/).slice(0, 12).join("\n");
 }
+function asRecord(value) {
+    return value && typeof value === "object" ? value : {};
+}
+function toError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}
+function normalizeStringList(value) {
+    if (Array.isArray(value)) {
+        return value.map((entry) => String(entry ?? "").trim()).filter(Boolean);
+    }
+    if (typeof value === "string") {
+        return value
+            .split(",")
+            .map((entry) => entry.trim())
+            .filter(Boolean);
+    }
+    return [];
+}
 //# sourceMappingURL=agent-supervisor.js.map