qlogicagent 2.13.3 → 2.13.5

package/dist/cli/cli-acp-request-handler.js

@@ -0,0 +1,61 @@
+import * as acpExtended from "./acp-extended-handlers.js";
+import * as acpSession from "./acp-session-handlers.js";
+import { buildAvailableCommands } from "./acp-commands.js";
+export function createCliAcpRequestHandler(host, packageVersion, extendedHost = host) {
+    return {
+        handleAcpInitialize: (params) => acpSession.handleAcpInitialize(host, params, packageVersion),
+        handleAcpSessionNew: (params) => acpSession.handleAcpSessionNew(host, params),
+        handleAcpSessionPrompt: (params) => acpSession.handleAcpSessionPrompt(host, params),
+        handleAcpSessionClose: (params) => acpSession.handleAcpSessionClose(host, params),
+        handleAcpSessionSetConfig: (params) => acpSession.handleAcpSessionSetConfig(host, params),
+        handleAcpSessionSetModel: (sessionId, model) => acpSession.handleAcpSessionSetModel(host, sessionId, model),
+        handleAcpSessionSetMode: (sessionId, mode) => acpSession.handleAcpSessionSetMode(host, sessionId, mode),
+        handleAcpSessionLoad: (params) => acpSession.handleAcpSessionLoad(host, params),
+        buildAvailableCommands: () => buildAvailableCommands(host),
+        tryDispatchCommand: (params) => acpSession.tryDispatchCommand(host, params),
+        handleAcpPermissionResponse: (permissionId, optionId) => {
+            host.log(`[acp] permission response: ${permissionId} -> ${optionId}`);
+            host.permissionChecker?.resolveApproval({
+                approvalId: permissionId,
+                decision: optionId === "allow" ? "allow" : "deny",
+            });
+        },
+        handleAcpAbort: async (params) => {
+            // Seam 2 (abort): key the cancel by turnId. A cancel naming a turn other than the
+            // one currently running is stale (the target already ended) — ignore it so we don't
+            // abort the wrong turn. With no turnId, cancel whatever turn is active.
+            if (params.turnId && host.currentTurnId && params.turnId !== host.currentTurnId) {
+                host.log(`[acp] cancel ignored: turn ${params.turnId} is not the active turn (${host.currentTurnId})`);
+                return;
+            }
+            host.log(`[acp] cancel: session=${params.sessionId}${params.turnId ? ` turn=${params.turnId}` : ""}`);
+            if (host.activeTurn) {
+                host.activeTurn.abort();
+                host.activeTurn = null;
+            }
+        },
+        handleAcpDream: (params) => acpExtended.handleAcpDream(extendedHost, params),
+        handleAcpAgentsList: () => acpExtended.handleAcpAgentsList(extendedHost),
+        handleAcpSoloStart: (params) => acpExtended.handleAcpSoloStart(extendedHost, params),
+        handleAcpSoloStatus: (params) => acpExtended.handleAcpSoloStatus(extendedHost, params),
+        handleAcpSoloSelect: (params) => acpExtended.handleAcpSoloSelect(extendedHost, params),
+        handleAcpSoloCancel: (params) => acpExtended.handleAcpSoloCancel(extendedHost, params),
+        handleAcpSoloSubscribe: (params) => acpExtended.handleAcpSoloSubscribe(extendedHost, params),
+        handleAcpSoloMessage: (params) => acpExtended.handleAcpSoloMessage(extendedHost, params),
+        handleAcpSoloEvaluate: (params) => acpExtended.handleAcpSoloEvaluate(extendedHost, params),
+        handleAcpSoloSpecChat: (params) => acpExtended.handleAcpSoloSpecChat(extendedHost, params),
+        handleAcpWorkflowChat: (params) => acpExtended.handleAcpWorkflowChat(extendedHost, params),
+        handleAcpWorkflowMatchIntent: (params) => acpExtended.handleAcpWorkflowMatchIntent(extendedHost, params),
+        handleAcpSoloSpecJudge: (params) => acpExtended.handleAcpSoloSpecJudge(extendedHost, params),
+        handleAcpProductCreate: (params) => acpExtended.handleAcpProductCreate(extendedHost, params),
+        handleAcpProductPlan: (params) => acpExtended.handleAcpProductPlan(extendedHost, params),
+        handleAcpProductConfirm: (params) => acpExtended.handleAcpProductConfirm(extendedHost, params),
+        handleAcpProductMessage: (params) => acpExtended.handleAcpProductMessage(extendedHost, params),
+        handleAcpProductPause: (params) => acpExtended.handleAcpProductPause(extendedHost, params),
+        handleAcpProductResume: (params) => acpExtended.handleAcpProductResume(extendedHost, params),
+        handleAcpProductCancel: (params) => acpExtended.handleAcpProductCancel(extendedHost, params),
+        handleAcpProductRollback: (params) => acpExtended.handleAcpProductRollback(extendedHost, params),
+        handleAcpProductStatus: (params) => acpExtended.handleAcpProductStatus(extendedHost, params),
+        handleAcpProductSubscribe: (params) => acpExtended.handleAcpProductSubscribe(extendedHost, params),
+    };
+}

package/dist/cli/cli-acp-request-handler.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/cli-acp-request-handler.test.js

@@ -0,0 +1,58 @@
+import { describe, expect, it } from "vitest";
+import { createCliAcpRequestHandler } from "./cli-acp-request-handler.js";
+describe("createCliAcpRequestHandler", () => {
+    it.each(["allow", "allow" + "Always", "deny"])("normalizes ACP %s permission response to allow/deny", (optionId) => {
+        const approvals = [];
+        const host = {
+            activeTurn: null,
+            log: () => { },
+            permissionChecker: {
+                resolveApproval: (response) => {
+                    approvals.push(response);
+                },
+            },
+        };
+        const handler = createCliAcpRequestHandler(host, "0.0.0");
+        handler.handleAcpPermissionResponse("approval-1", optionId);
+        expect(approvals).toEqual([{ approvalId: "approval-1", decision: optionId === "allow" ? "allow" : "deny" }]);
+    });
+    it("routes extended ACP handlers through the supplied extended host", async () => {
+        const sessions = [{ soloId: "solo-1", state: "running" }];
+        const host = {
+            activeTurn: null,
+            log: () => { },
+        };
+        const extendedHost = {
+            log: () => { },
+            soloEvaluator: {
+                listSessions: () => sessions,
+            },
+        };
+        const handler = createCliAcpRequestHandler(host, "0.0.0", extendedHost);
+        await expect(handler.handleAcpSoloStatus({})).resolves.toBe(sessions);
+    });
+    it.each([undefined, "turn-1"])("cancels the active turn when turnId is %s (matches or omitted)", async (turnId) => {
+        let aborted = false;
+        const host = {
+            activeTurn: { abort: () => { aborted = true; } },
+            currentTurnId: "turn-1",
+            log: () => { },
+        };
+        const handler = createCliAcpRequestHandler(host, "0.0.0");
+        await handler.handleAcpAbort({ sessionId: "s1", turnId });
+        expect(aborted).toBe(true);
+        expect(host.activeTurn).toBeNull();
+    });
+    it("ignores a stale cancel that names a non-active turn", async () => {
+        let aborted = false;
+        const host = {
+            activeTurn: { abort: () => { aborted = true; } },
+            currentTurnId: "turn-2",
+            log: () => { },
+        };
+        const handler = createCliAcpRequestHandler(host, "0.0.0");
+        await handler.handleAcpAbort({ sessionId: "s1", turnId: "turn-1" });
+        expect(aborted).toBe(false);
+        expect(host.activeTurn).not.toBeNull();
+    });
+});

package/dist/cli/cli-agent-builder.d.ts

@@ -0,0 +1,35 @@
+import { Agent } from "../agent/agent.js";
+import type { AgentLogger, ToolInvoker } from "../agent/types.js";
+import type { HookRegistry } from "../contracts/hooks.js";
+import { type LLMTransport, type ProviderRegistry } from "./provider-core-facade.js";
+import { type ResolvedTextGenerationConfig } from "./model-client-resolver.js";
+export interface BuildCliAgentDeps {
+    client: CliAgentClient;
+    toolInvoker: ToolInvoker;
+    log: AgentLogger;
+    hooks: HookRegistry;
+    maxRounds?: number;
+    verbose: boolean;
+    projectRoot: string;
+}
+export interface CliAgentClient {
+    transport: LLMTransport;
+    apiKey: string;
+    model: string;
+    provider: string;
+    baseUrl: string;
+}
+export interface BuiltCliAgent {
+    agent: Agent;
+    transport: LLMTransport;
+    apiKey: string;
+    model: string;
+    provider: string;
+    baseUrl: string;
+}
+export declare function createCliAgentClient(deps: {
+    resolvedConfig: ResolvedTextGenerationConfig;
+    providerRegistry: ProviderRegistry;
+    sessionId: string;
+}): CliAgentClient;
+export declare function buildCliAgent(deps: BuildCliAgentDeps): BuiltCliAgent;

package/dist/cli/cli-agent-builder.js

@@ -0,0 +1,33 @@
+import { Agent } from "../agent/agent.js";
+import { createLLMClient, wrapDebugTransportIfEnabled, } from "./provider-core-facade.js";
+import { takeTextGenerationKeyHandleProvider, wrapTransportWithKeyHandleProvider, } from "./model-client-resolver.js";
+import { createCliAgentRuntimePorts } from "./agent-runtime-ports-adapter.js";
+export function createCliAgentClient(deps) {
+    const { provider, model, apiKey, baseUrl } = deps.resolvedConfig;
+    const client = createLLMClient({ provider, model, apiKey, baseUrl }, deps.providerRegistry);
+    client.transport = wrapDebugTransportIfEnabled(client.transport, deps.sessionId || "default");
+    client.transport = wrapTransportWithKeyHandleProvider(client.transport, takeTextGenerationKeyHandleProvider(deps.resolvedConfig));
+    return {
+        transport: client.transport,
+        apiKey,
+        model,
+        provider,
+        baseUrl: baseUrl ?? "",
+    };
+}
+export function buildCliAgent(deps) {
+    return {
+        agent: new Agent({
+            llmTransport: deps.client.transport,
+            apiKey: deps.client.apiKey,
+            toolInvoker: deps.toolInvoker,
+            log: deps.log,
+            hooks: deps.hooks,
+            maxRounds: deps.maxRounds,
+            verbose: deps.verbose,
+            projectRoot: deps.projectRoot,
+            runtimePorts: createCliAgentRuntimePorts(),
+        }),
+        ...deps.client,
+    };
+}

package/dist/cli/community-resource-installer.d.ts

@@ -0,0 +1,30 @@
+import type { CommunityInstallResolution } from "../runtime/community/community-consent-client.js";
+import { type InstalledCommunityPetResource } from "../runtime/pet/pet-community-assets.js";
+import { type CommunityInstalledResource, type InstallCommunitySkillOptions } from "./community-skill-installer.js";
+import { type CommunityWorkflowBundlePayload } from "./community-workflow-installer.js";
+export type CommunityInstalledAnyResource = CommunityInstalledResource | InstalledCommunityPetResource | CommunityWorkflowBundlePayload;
+export interface CommunityMcpInstallPreview {
+    kind: "mcp";
+    mode: "preview";
+    resourceId: string;
+    version: string;
+    sourceTier: string;
+    perUseConsentRequired: true;
+    declaredPermissions: string[];
+    manifest: unknown;
+}
+export interface CommunityExecutableLauncherGate {
+    kind: "executable";
+    mode: "launcher-required" | "manual-review-required";
+    resourceId: string;
+    version: string;
+    resourceType: string;
+    sourceTier: string;
+    riskTier: string;
+    artifactDigest: string;
+    launcherRequired: true;
+    manualReviewRequired: boolean;
+    autoRunBlocked: true;
+    manifest: unknown;
+}
+export declare function installCommunityResource(install: CommunityInstallResolution, options?: InstallCommunitySkillOptions): Promise<CommunityInstalledAnyResource | CommunityMcpInstallPreview | CommunityExecutableLauncherGate>;

package/dist/cli/community-resource-installer.js

@@ -0,0 +1,66 @@
+import { installCommunityPetResource } from "../runtime/pet/pet-community-assets.js";
+import { installCommunitySkillResource } from "./community-skill-installer.js";
+import { installCommunityWorkflowResource } from "./community-workflow-installer.js";
+export async function installCommunityResource(install, options = {}) {
+    if (install.type === "skill" && install.kind === "inert") {
+        return installCommunitySkillResource(install, options);
+    }
+    if (install.type === "pet" && install.kind === "asset") {
+        return installCommunityPetResource(install);
+    }
+    // Workflow bundles are declarative graphs (no code) — fetched+verified+parsed only;
+    // applying goes through workflow.import (NOT the executable launcher gate below).
+    if (install.type === "workflow") {
+        return installCommunityWorkflowResource(install, options);
+    }
+    if (isExecutableResourceInstall(install)) {
+        return executableLauncherGate(install);
+    }
+    if (install.type === "mcp") {
+        return previewMcpInstall(install);
+    }
+    throw new Error(`Unsupported community resource install type: ${install.type}/${install.kind}.`);
+}
+function previewMcpInstall(install) {
+    if (install.sourceTier !== "official") {
+        throw new Error("Community remote MCP endpoints are not supported for local install.");
+    }
+    return {
+        kind: "mcp",
+        mode: "preview",
+        resourceId: install.id,
+        version: install.version,
+        sourceTier: install.sourceTier,
+        perUseConsentRequired: true,
+        declaredPermissions: readDeclaredPermissions(install.manifest),
+        manifest: install.manifest,
+    };
+}
+function readDeclaredPermissions(manifest) {
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest))
+        return [];
+    const value = manifest.declaredPermissions;
+    return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+const EXECUTABLE_RESOURCE_TYPES = new Set(["mcp", "plugin", "cron", "hook", "workflow", "executable"]);
+function isExecutableResourceInstall(install) {
+    return EXECUTABLE_RESOURCE_TYPES.has(install.type)
+        && (install.kind === "local-executable" || install.kind === "executable");
+}
+function executableLauncherGate(install) {
+    const manualReviewRequired = install.sourceTier !== "official";
+    return {
+        kind: "executable",
+        mode: manualReviewRequired ? "manual-review-required" : "launcher-required",
+        resourceId: install.id,
+        version: install.version,
+        resourceType: install.type,
+        sourceTier: install.sourceTier,
+        riskTier: install.effectiveRiskTier,
+        artifactDigest: `sha256:${install.checksum}`,
+        launcherRequired: true,
+        manualReviewRequired,
+        autoRunBlocked: true,
+        manifest: install.manifest,
+    };
+}

package/dist/cli/community-resource-installer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/community-resource-installer.test.js

@@ -0,0 +1,175 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { installCommunityResource } from "./community-resource-installer.js";
+describe("community resource installer facade", () => {
+    const previousHome = process.env.QLOGICAGENT_HOME;
+    afterEach(() => {
+        if (previousHome === undefined) {
+            delete process.env.QLOGICAGENT_HOME;
+        }
+        else {
+            process.env.QLOGICAGENT_HOME = previousHome;
+        }
+    });
+    it("returns preview-only for official MCP endpoint and marks per-use consent required", async () => {
+        await expect(installCommunityResource(officialMcpResolution())).resolves.toMatchObject({
+            kind: "mcp",
+            mode: "preview",
+            resourceId: "crm-mcp",
+            perUseConsentRequired: true,
+            declaredPermissions: ["crm.read"],
+        });
+    });
+    it("refuses community remote MCP endpoints", async () => {
+        await expect(installCommunityResource({
+            ...officialMcpResolution(),
+            sourceTier: "community",
+        })).rejects.toThrow(/remote MCP/i);
+    });
+    it.each(["mcp", "plugin", "cron", "hook", "executable"])("keeps community %s executable resources behind launcher and manual review gate", async (type) => {
+        await expect(installCommunityResource(executableResolution({
+            id: `community-${type}`,
+            type,
+            sourceTier: "community",
+        }))).resolves.toMatchObject({
+            kind: "executable",
+            mode: "manual-review-required",
+            resourceId: `community-${type}`,
+            sourceTier: "community",
+            riskTier: "R3",
+            launcherRequired: true,
+            manualReviewRequired: true,
+            artifactDigest: "sha256:" + "c".repeat(64),
+            autoRunBlocked: true,
+        });
+    });
+    // IT-5 (D35): workflow packages are declarative bundles (no code), so they take the
+    // dedicated download→verify→parse path instead of the executable launcher gate. A bad
+    // package (wrong checksum, here: nothing serving the URL) still fails loud.
+    it("routes community workflow resources to the bundle installer, not the launcher gate", async () => {
+        await expect(installCommunityResource(executableResolution({
+            id: "community-workflow",
+            type: "workflow",
+            sourceTier: "community",
+        }))).rejects.toThrow(/workflow package download failed/i);
+    });
+    it("hands official executable resources to the launcher path without community manual review", async () => {
+        await expect(installCommunityResource(executableResolution({
+            id: "official-plugin",
+            type: "plugin",
+            sourceTier: "official",
+        }))).resolves.toMatchObject({
+            kind: "executable",
+            mode: "launcher-required",
+            resourceId: "official-plugin",
+            sourceTier: "official",
+            riskTier: "R3",
+            launcherRequired: true,
+            manualReviewRequired: false,
+            artifactDigest: "sha256:" + "c".repeat(64),
+            autoRunBlocked: true,
+        });
+    });
+    it("installs approved pet assets under owner profile after checksum and boundary scan", async () => {
+        const home = fs.mkdtempSync(path.join(os.tmpdir(), "qlogic-pet-install-"));
+        process.env.QLOGICAGENT_HOME = home;
+        const installed = await installCommunityResource(petAssetResolution());
+        expect(installed).toMatchObject({
+            kind: "pet",
+            status: "installed",
+            resourceId: "neko-pet",
+            sanitized: false,
+        });
+        expect(fs.existsSync(path.join(home, "profiles", "oc_local", "pets", "community", "neko-pet", "manifest.json"))).toBe(true);
+    });
+    it("rejects pet manifests with unsafe paths or agent instruction fields", async () => {
+        await expect(installCommunityResource(petAssetResolution({
+            assets: [{ kind: "sprite", path: "../escape.png" }],
+        }))).rejects.toThrow(/unsafe pet asset path/i);
+        await expect(installCommunityResource(petAssetResolution({
+            agentInstructions: "run tools",
+        }))).rejects.toThrow(/agent instruction fields/i);
+    });
+});
+function officialMcpResolution() {
+    return {
+        id: "crm-mcp",
+        type: "mcp",
+        kind: "endpoint",
+        sourceTier: "official",
+        trustStage: "trusted",
+        reviewStatus: "approved",
+        resourceRiskTier: "R3",
+        effectiveRiskTier: "R3",
+        requires: [],
+        dependencies: [],
+        version: "1.0.0",
+        checksum: "a".repeat(64),
+        sizeBytes: 10,
+        downloadUrl: "https://example.com/crm-mcp.tar.gz",
+        manifest: {
+            schema_version: 15,
+            kind: "endpoint",
+            name: "CRM MCP",
+            summary: "CRM connector",
+            description: "Official CRM endpoint.",
+            endpointUrl: "https://mcp.example.com",
+            declaredPermissions: ["crm.read"],
+        },
+    };
+}
+function petAssetResolution(overrides = {}) {
+    return {
+        id: "neko-pet",
+        type: "pet",
+        kind: "asset",
+        sourceTier: "community",
+        trustStage: "trusted",
+        reviewStatus: "approved",
+        resourceRiskTier: "R0",
+        effectiveRiskTier: "R0",
+        requires: [],
+        dependencies: [],
+        version: "1.0.0",
+        checksum: "b".repeat(64),
+        sizeBytes: 10,
+        downloadUrl: "https://example.com/neko-pet.tar.gz",
+        manifest: {
+            schema_version: 15,
+            kind: "asset",
+            name: "Neko",
+            summary: "A calm companion",
+            persona: "Quiet, friendly, display-only.",
+            traits: ["gentle"],
+            assets: [{ kind: "sprite", path: "neko.png" }],
+            ...overrides,
+        },
+    };
+}
+function executableResolution(input) {
+    return {
+        id: input.id,
+        type: input.type,
+        kind: "local-executable",
+        sourceTier: input.sourceTier,
+        trustStage: input.sourceTier === "official" ? "trusted" : "trial",
+        reviewStatus: input.sourceTier === "official" ? "approved" : "pending",
+        resourceRiskTier: "R3",
+        effectiveRiskTier: "R3",
+        requires: ["l0-launcher"],
+        dependencies: [],
+        version: "2.0.0",
+        checksum: "c".repeat(64),
+        sizeBytes: 256,
+        downloadUrl: "https://example.com/plugin.tar.gz",
+        manifest: {
+            schema_version: 15,
+            kind: "local-executable",
+            name: input.id,
+            autoRun: true,
+            entry: "run.js",
+        },
+    };
+}

package/dist/cli/community-skill-installer.d.ts

@@ -0,0 +1,12 @@
+import type { CommunityInstallResolution } from "../runtime/community/community-consent-client.js";
+export interface CommunityInstalledResource {
+    resourceId: string;
+    version: string;
+    skillName: string;
+    installDir: string;
+    checksum: string;
+}
+export interface InstallCommunitySkillOptions {
+    fetchFn?: typeof fetch;
+}
+export declare function installCommunitySkillResource(install: CommunityInstallResolution, options?: InstallCommunitySkillOptions): Promise<CommunityInstalledResource>;