qlogicagent 2.13.3 → 2.13.5

package/dist/runtime/infra/project-skill-manifest.test.js

@@ -0,0 +1,42 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { readEnabledSkills, enableSkill, disableSkill, readProjectScopedSkills, markProjectScoped, unmarkProjectScoped, } from "./project-skill-manifest.js";
+function tmp(prefix) {
+    return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+}
+describe("project-skill-manifest", () => {
+    let project;
+    beforeEach(() => {
+        vi.stubEnv("QLOGICAGENT_HOME", tmp("qlogic-manifest-home-"));
+        project = tmp("qlogic-manifest-proj-");
+    });
+    afterEach(() => vi.unstubAllEnvs());
+    it("per-project enable/disable is idempotent and persisted", () => {
+        expect(readEnabledSkills(project).size).toBe(0);
+        expect(enableSkill(project, "a")).toBe(true);
+        expect(enableSkill(project, "a")).toBe(false); // idempotent
+        expect(readEnabledSkills(project).has("a")).toBe(true);
+        expect(disableSkill(project, "a")).toBe(true);
+        expect(disableSkill(project, "a")).toBe(false);
+        expect(readEnabledSkills(project).has("a")).toBe(false);
+    });
+    it("the global project-scoped registry is idempotent and persisted", () => {
+        expect(readProjectScopedSkills().size).toBe(0);
+        expect(markProjectScoped("s")).toBe(true);
+        expect(markProjectScoped("s")).toBe(false);
+        expect(readProjectScopedSkills().has("s")).toBe(true);
+        expect(unmarkProjectScoped("s")).toBe(true);
+        expect(unmarkProjectScoped("s")).toBe(false);
+        expect(readProjectScopedSkills().has("s")).toBe(false);
+    });
+    it("tolerates a malformed manifest file", () => {
+        const p = path.join(project, ".qlogicagent", "skills-enabled.json");
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, "{ not json", "utf8");
+        expect(readEnabledSkills(project).size).toBe(0);
+        expect(enableSkill(project, "x")).toBe(true);
+        expect(readEnabledSkills(project).has("x")).toBe(true);
+    });
+});

package/dist/runtime/infra/project-store.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Local Project Store — persists project metadata to ~/.qlogicagent/projects.json.
+ *
+ * This is the Agent-side (runtime authority) project registry.
+ * Hub maintains a mirror copy via EventBus → HubSubscriber → hub.persistProject.
+ *
+ * Direction A: Agent is the source of truth for project state.
+ */
+import type { ProjectInfo, ProjectType } from "../../protocol/methods.js";
+export declare function createProject(params: {
+    name: string;
+    workspaceDir: string;
+    type?: ProjectType;
+    groupId?: string;
+    skipAutoSwitch?: boolean;
+}): ProjectInfo;
+export declare function listProjects(): ProjectInfo[];
+/**
+ * True when another project (active OR archived) still references this workspaceDir. Solo/Product
+ * plan projects deliberately share their host project's workspaceDir — the run executes inside the
+ * user's real workspace, isolated per-agent via git worktrees — so deleting one plan project must
+ * never rmSync the shared directory: that would wipe the host project and every sibling plan. Pass
+ * excludeProjectId to ignore a project that's still in the store at check time.
+ */
+export declare function isWorkspaceDirShared(workspaceDir: string, excludeProjectId?: string): boolean;
+export declare function getActiveProject(): ProjectInfo | null;
+export declare function getDefaultProject(): ProjectInfo | null;
+export declare function getProjectById(projectId: string): ProjectInfo | null;
+export declare function updateProject(projectId: string, patch: Partial<Pick<ProjectInfo, "planStatus" | "planAgents" | "planWinnerId" | "leaderSessionId" | "primaryWorkflowId">>): boolean;
+export declare function switchProject(projectId: string): ProjectInfo | null;
+export declare function deleteProject(projectId: string): {
+    deleted: boolean;
+    switchedTo?: ProjectInfo;
+};
+export declare function getOrCreateDefaultProject(defaultWorkspaceDir: string): ProjectInfo;
+export declare function renameProject(projectId: string, newName: string): ProjectInfo | null;
+export declare function updateProjectWorkspaceDir(projectId: string, newDir: string): boolean;
+export declare function archiveProject(projectId: string): {
+    archived: boolean;
+    switchedTo?: ProjectInfo;
+};
+export declare function unarchiveProject(projectId: string): ProjectInfo | null;
+export declare function findByGroupId(groupId: string): ProjectInfo | null;
+export declare function archiveByGroupId(groupId: string): {
+    archived: boolean;
+    projectId?: string;
+    switchedTo?: ProjectInfo;
+};

package/dist/runtime/infra/project-store.js

@@ -0,0 +1,284 @@
+/**
+ * Local Project Store — persists project metadata to ~/.qlogicagent/projects.json.
+ *
+ * This is the Agent-side (runtime authority) project registry.
+ * Hub maintains a mirror copy via EventBus → HubSubscriber → hub.persistProject.
+ *
+ * Direction A: Agent is the source of truth for project state.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { randomUUID } from "node:crypto";
+import { getOwnerProfileDir } from "./agent-paths.js";
+import { migrateProjectSkills } from "./migrate-project-skills.js";
+// ── Persistence ─────────────────────────────────────────────
+function getProjectsFilePath() {
+    return join(getOwnerProfileDir(), "projects.json");
+}
+function readProjectsFile() {
+    const filePath = getProjectsFilePath();
+    if (!existsSync(filePath)) {
+        return { activeProjectId: null, projects: [] };
+    }
+    try {
+        const raw = readFileSync(filePath, "utf-8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return { activeProjectId: null, projects: [] };
+    }
+}
+function writeProjectsFile(content) {
+    const filePath = getProjectsFilePath();
+    const dir = dirname(filePath);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+    writeFileSync(filePath, JSON.stringify(content, null, 2), "utf-8");
+}
+// ── Public API ──────────────────────────────────────────────
+export function createProject(params) {
+    const data = readProjectsFile();
+    const now = new Date().toISOString();
+    const project = {
+        id: randomUUID(),
+        name: params.name,
+        workspaceDir: params.workspaceDir,
+        type: params.type ?? "personal",
+        status: "active",
+        groupId: params.groupId,
+        createdAt: now,
+        updatedAt: now,
+    };
+    data.projects.push(project);
+    // Auto-switch to the new project (unless skipAutoSwitch, e.g. Solo/Product)
+    if (!params.skipAutoSwitch) {
+        data.activeProjectId = project.id;
+    }
+    writeProjectsFile(data);
+    return project;
+}
+export function listProjects() {
+    const data = readProjectsFile();
+    return data.projects.filter(p => p.status === "active");
+}
+/**
+ * True when another project (active OR archived) still references this workspaceDir. Solo/Product
+ * plan projects deliberately share their host project's workspaceDir — the run executes inside the
+ * user's real workspace, isolated per-agent via git worktrees — so deleting one plan project must
+ * never rmSync the shared directory: that would wipe the host project and every sibling plan. Pass
+ * excludeProjectId to ignore a project that's still in the store at check time.
+ */
+export function isWorkspaceDirShared(workspaceDir, excludeProjectId) {
+    const data = readProjectsFile();
+    const target = resolve(workspaceDir);
+    return data.projects.some(p => p.id !== excludeProjectId && resolve(p.workspaceDir) === target);
+}
+export function getActiveProject() {
+    const data = readProjectsFile();
+    if (!data.activeProjectId)
+        return null;
+    const project = data.projects.find(p => p.id === data.activeProjectId) ?? null;
+    // Only return active (non-archived) projects as the active project
+    if (project && project.status !== "active")
+        return null;
+    return project;
+}
+export function getDefaultProject() {
+    const data = readProjectsFile();
+    return data.projects.find(p => p.type === "default" && p.status === "active") ?? null;
+}
+export function getProjectById(projectId) {
+    const data = readProjectsFile();
+    return data.projects.find(p => p.id === projectId) ?? null;
+}
+export function updateProject(projectId, patch) {
+    const data = readProjectsFile();
+    const project = data.projects.find(p => p.id === projectId);
+    if (!project)
+        return false;
+    if ("planStatus" in patch)
+        project.planStatus = patch.planStatus;
+    if ("planAgents" in patch)
+        project.planAgents = patch.planAgents;
+    if ("planWinnerId" in patch)
+        project.planWinnerId = patch.planWinnerId;
+    if ("leaderSessionId" in patch)
+        project.leaderSessionId = patch.leaderSessionId;
+    if ("primaryWorkflowId" in patch)
+        project.primaryWorkflowId = patch.primaryWorkflowId;
+    project.updatedAt = new Date().toISOString();
+    writeProjectsFile(data);
+    return true;
+}
+export function switchProject(projectId) {
+    const data = readProjectsFile();
+    const project = data.projects.find(p => p.id === projectId && p.status === "active");
+    if (!project)
+        return null;
+    data.activeProjectId = project.id;
+    writeProjectsFile(data);
+    // Fold any legacy project-local skills into the global store on activation.
+    try {
+        migrateProjectSkills(project.workspaceDir);
+    }
+    catch { /* best-effort */ }
+    return project;
+}
+export function deleteProject(projectId) {
+    const data = readProjectsFile();
+    const idx = data.projects.findIndex(p => p.id === projectId);
+    if (idx === -1)
+        return { deleted: false };
+    const project = data.projects[idx];
+    // Cannot delete the default project
+    if (project.type === "default") {
+        return { deleted: false };
+    }
+    // Hard delete: remove from projects array entirely
+    data.projects.splice(idx, 1);
+    let switchedTo;
+    // If deleting the active project, switch to default
+    if (data.activeProjectId === projectId) {
+        const defaultProject = data.projects.find(p => p.type === "default" && p.status === "active");
+        if (defaultProject) {
+            data.activeProjectId = defaultProject.id;
+            switchedTo = defaultProject;
+        }
+        else {
+            // Fall back to any active project
+            const fallback = data.projects.find(p => p.status === "active" && p.id !== projectId);
+            data.activeProjectId = fallback?.id ?? null;
+            switchedTo = fallback;
+        }
+    }
+    writeProjectsFile(data);
+    return { deleted: true, switchedTo };
+}
+export function getOrCreateDefaultProject(defaultWorkspaceDir) {
+    const data = readProjectsFile();
+    const existing = data.projects.find(p => p.type === "default" && p.status === "active");
+    if (existing) {
+        try {
+            migrateProjectSkills(existing.workspaceDir);
+        }
+        catch { /* best-effort */ }
+        return existing;
+    }
+    // Create default project
+    const now = new Date().toISOString();
+    const project = {
+        id: randomUUID(),
+        name: "默认项目",
+        workspaceDir: defaultWorkspaceDir,
+        type: "default",
+        status: "active",
+        createdAt: now,
+        updatedAt: now,
+    };
+    data.projects.push(project);
+    if (!data.activeProjectId) {
+        data.activeProjectId = project.id;
+    }
+    writeProjectsFile(data);
+    try {
+        migrateProjectSkills(project.workspaceDir);
+    }
+    catch { /* best-effort */ }
+    return project;
+}
+export function renameProject(projectId, newName) {
+    const data = readProjectsFile();
+    const project = data.projects.find(p => p.id === projectId && p.status === "active");
+    if (!project)
+        return null;
+    // Cannot rename the default project
+    if (project.type === "default")
+        return null;
+    // Check for name collision
+    const duplicate = data.projects.find(p => p.name === newName && p.status === "active" && p.id !== projectId);
+    if (duplicate)
+        return null;
+    project.name = newName;
+    project.updatedAt = new Date().toISOString();
+    writeProjectsFile(data);
+    return project;
+}
+export function updateProjectWorkspaceDir(projectId, newDir) {
+    const data = readProjectsFile();
+    const project = data.projects.find(p => p.id === projectId);
+    if (!project)
+        return false;
+    project.workspaceDir = newDir;
+    project.updatedAt = new Date().toISOString();
+    writeProjectsFile(data);
+    return true;
+}
+export function archiveProject(projectId) {
+    const data = readProjectsFile();
+    const project = data.projects.find(p => p.id === projectId);
+    if (!project)
+        return { archived: false }; // genuinely not found
+    // Cannot archive the default project
+    if (project.type === "default")
+        return { archived: false };
+    // Idempotent: already archived → success no-op (avoids a 500 when a stale list re-archives it).
+    if (project.status === "archived")
+        return { archived: true };
+    project.status = "archived";
+    project.updatedAt = new Date().toISOString();
+    let switchedTo;
+    if (data.activeProjectId === projectId) {
+        const defaultProject = data.projects.find(p => p.type === "default" && p.status === "active");
+        if (defaultProject) {
+            data.activeProjectId = defaultProject.id;
+            switchedTo = defaultProject;
+        }
+        else {
+            const fallback = data.projects.find(p => p.status === "active" && p.id !== projectId);
+            data.activeProjectId = fallback?.id ?? null;
+            switchedTo = fallback;
+        }
+    }
+    writeProjectsFile(data);
+    return { archived: true, switchedTo };
+}
+export function unarchiveProject(projectId) {
+    const data = readProjectsFile();
+    const project = data.projects.find(p => p.id === projectId);
+    if (!project)
+        return null; // genuinely not found
+    if (project.status === "active")
+        return project; // idempotent: already active
+    project.status = "active";
+    project.updatedAt = new Date().toISOString();
+    writeProjectsFile(data);
+    return project;
+}
+export function findByGroupId(groupId) {
+    const data = readProjectsFile();
+    return data.projects.find(p => p.groupId === groupId && p.status === "active") ?? null;
+}
+export function archiveByGroupId(groupId) {
+    const data = readProjectsFile();
+    const project = data.projects.find(p => p.groupId === groupId && p.status === "active");
+    if (!project)
+        return { archived: false };
+    project.status = "archived";
+    project.updatedAt = new Date().toISOString();
+    let switchedTo;
+    if (data.activeProjectId === project.id) {
+        const defaultProject = data.projects.find(p => p.type === "default" && p.status === "active");
+        if (defaultProject) {
+            data.activeProjectId = defaultProject.id;
+            switchedTo = defaultProject;
+        }
+        else {
+            const fallback = data.projects.find(p => p.status === "active" && p.id !== project.id);
+            data.activeProjectId = fallback?.id ?? null;
+            switchedTo = fallback;
+        }
+    }
+    writeProjectsFile(data);
+    return { archived: true, projectId: project.id, switchedTo };
+}

package/dist/runtime/infra/secure-storage.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Secure Storage — CC secureStorage parity.
+ *
+ * Platform-aware credential persistence abstraction:
+ *   - Interface: get/set/delete with typed data
+ *   - Implementation: file-based JSON with 0o600 permissions (CC plainTextStorage parity)
+ *   - macOS Keychain / Windows Credential Manager can be added as plugins
+ *
+ * Storage layout:
+ *   ~/.qlogicagent/.credentials.json  — API keys, OAuth tokens
+ *
+ * Reference: claude-code-haha/src/utils/secureStorage/
+ */
+export interface SecureStorageData {
+    /** Primary API key (user-set) */
+    apiKey?: string;
+    /** OAuth tokens (if using OAuth flow) */
+    oauth?: {
+        accessToken: string;
+        refreshToken: string;
+        expiresAt: number;
+    };
+    /** Arbitrary key-value pairs for extensibility */
+    [key: string]: unknown;
+}
+/**
+ * CC SecureStorage interface parity.
+ *
+ * Implementations may use OS keychain, encrypted file, or plain-text file.
+ * Callers should not assume any specific storage backend.
+ */
+export interface SecureStorage {
+    readonly name: string;
+    get(): Promise<SecureStorageData | null>;
+    set(data: SecureStorageData): Promise<{
+        success: boolean;
+        warning?: string;
+    }>;
+    delete(): Promise<boolean>;
+}
+/**
+ * File-based secure storage with restrictive permissions.
+ *
+ * On Unix: file created with 0o600 (owner-only read/write).
+ * On Windows: ACLs are not set (relies on user profile permissions).
+ *
+ * This matches CC's plainTextStorage.ts behavior — it's the default
+ * on Linux/Windows, and the fallback on macOS.
+ */
+export declare class FileSecureStorage implements SecureStorage {
+    readonly name = "file";
+    get(): Promise<SecureStorageData | null>;
+    set(data: SecureStorageData): Promise<{
+        success: boolean;
+        warning?: string;
+    }>;
+    delete(): Promise<boolean>;
+}
+/**
+ * Get the platform-appropriate secure storage instance.
+ *
+ * Currently returns FileSecureStorage on all platforms.
+ * macOS Keychain integration can be added by checking platform
+ * and returning a KeychainSecureStorage wrapper.
+ */
+export declare function getSecureStorage(): SecureStorage;
+/**
+ * Save an API key to secure storage.
+ */
+export declare function saveApiKey(apiKey: string): Promise<{
+    success: boolean;
+    warning?: string;
+}>;
+/**
+ * Load the stored API key (returns null if none saved).
+ */
+export declare function loadApiKey(): Promise<string | null>;
+/**
+ * Delete the stored API key.
+ */
+export declare function deleteApiKey(): Promise<boolean>;

package/dist/runtime/infra/secure-storage.js

@@ -0,0 +1,117 @@
+/**
+ * Secure Storage — CC secureStorage parity.
+ *
+ * Platform-aware credential persistence abstraction:
+ *   - Interface: get/set/delete with typed data
+ *   - Implementation: file-based JSON with 0o600 permissions (CC plainTextStorage parity)
+ *   - macOS Keychain / Windows Credential Manager can be added as plugins
+ *
+ * Storage layout:
+ *   ~/.qlogicagent/.credentials.json  — API keys, OAuth tokens
+ *
+ * Reference: claude-code-haha/src/utils/secureStorage/
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { getUserCredentialsPath } from "./agent-paths.js";
+// ── File-based implementation (CC plainTextStorage parity) ──
+function getCredentialsPath() {
+    return getUserCredentialsPath();
+}
+/**
+ * File-based secure storage with restrictive permissions.
+ *
+ * On Unix: file created with 0o600 (owner-only read/write).
+ * On Windows: ACLs are not set (relies on user profile permissions).
+ *
+ * This matches CC's plainTextStorage.ts behavior — it's the default
+ * on Linux/Windows, and the fallback on macOS.
+ */
+export class FileSecureStorage {
+    name = "file";
+    async get() {
+        const filePath = getCredentialsPath();
+        try {
+            const raw = await fs.promises.readFile(filePath, "utf8");
+            return JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+    }
+    async set(data) {
+        const filePath = getCredentialsPath();
+        const dir = path.dirname(filePath);
+        await fs.promises.mkdir(dir, { recursive: true });
+        const tmpPath = filePath + ".tmp";
+        await fs.promises.writeFile(tmpPath, JSON.stringify(data, null, 2), {
+            encoding: "utf8",
+            mode: 0o600,
+        });
+        await fs.promises.rename(tmpPath, filePath);
+        // Try to restrict permissions on existing file (Unix only)
+        try {
+            await fs.promises.chmod(filePath, 0o600);
+        }
+        catch {
+            // Windows doesn't support chmod — acceptable
+        }
+        return { success: true };
+    }
+    async delete() {
+        try {
+            await fs.promises.unlink(getCredentialsPath());
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+// ── Factory ─────────────────────────────────────────────────
+let _instance = null;
+/**
+ * Get the platform-appropriate secure storage instance.
+ *
+ * Currently returns FileSecureStorage on all platforms.
+ * macOS Keychain integration can be added by checking platform
+ * and returning a KeychainSecureStorage wrapper.
+ */
+export function getSecureStorage() {
+    if (!_instance) {
+        _instance = new FileSecureStorage();
+    }
+    return _instance;
+}
+// ── Convenience helpers ─────────────────────────────────────
+/**
+ * Save an API key to secure storage.
+ */
+export async function saveApiKey(apiKey) {
+    const storage = getSecureStorage();
+    const existing = await storage.get();
+    return storage.set({ ...existing, apiKey });
+}
+/**
+ * Load the stored API key (returns null if none saved).
+ */
+export async function loadApiKey() {
+    const storage = getSecureStorage();
+    const data = await storage.get();
+    return data?.apiKey ?? null;
+}
+/**
+ * Delete the stored API key.
+ */
+export async function deleteApiKey() {
+    const storage = getSecureStorage();
+    const data = await storage.get();
+    if (!data)
+        return true;
+    const { apiKey: _, ...rest } = data;
+    if (Object.keys(rest).length === 0) {
+        return storage.delete();
+    }
+    const result = await storage.set(rest);
+    return result.success;
+}

package/dist/runtime/infra/skill-injector.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Skill Injector — shares qlogicagent skills with external ACP agents.
+ *
+ * Two injection methods:
+ *
+ * 1. **Native skill directory sync**: For agents that support a `skillsDirs`
+ *    convention (e.g. `.claude/skills/`), create symlinks or copies of
+ *    qlogicagent's optional skills into the agent's native directory.
+ *
+ * 2. **First-message prompt injection**: For agents without native skill
+ *    directory support, prepend skill instructions text to the first prompt.
+ *    Subject to a token budget to prevent context bloat.
+ */
+import type { AgentCapabilities } from "../../protocol/wire/acp-agent-management.js";
+import { SKILL_INJECTION_MAX_CHARS, SKILL_INJECTION_MAX_COUNT } from "../config/tunable-defaults.js";
+export { SKILL_INJECTION_MAX_CHARS, SKILL_INJECTION_MAX_COUNT };
+export declare function isSystemGeneratedSkillName(name: string): boolean;
+export declare class SkillInjector {
+    /**
+     * Synchronize skills to an agent's native skill directory.
+     * Creates symlinks where possible; falls back to file copy.
+     *
+     * @param targetDir - Agent's native skill directory (e.g. `<cwd>/.claude/skills/`)
+     * @param cwd - Project working directory (for project-level skills)
+     */
+    syncSkillsToDir(targetDir: string, cwd?: string): void;
+    /**
+     * Build a skill description block to prepend to the first message
+     * for agents that don't support native skill directories.
+     *
+     * Respects SKILL_INJECTION_MAX_CHARS and SKILL_INJECTION_MAX_COUNT
+     * to prevent token bloat.
+     *
+     * @param cwd - Project working directory (for project-level skills)
+     * @returns Markdown text with skill instructions, or empty string if no skills.
+     */
+    buildPromptWithSkills(cwd?: string): string;
+    /**
+     * Determine the injection method for an agent.
+     *
+     * @param capabilities - Agent's discovered capabilities
+     * @returns "native" if agent has skillsDirs, "prompt" otherwise
+     */
+    getInjectionMethod(capabilities?: AgentCapabilities): "native" | "prompt";
+    /**
+     * Apply skills to an agent based on its capabilities.
+     *
+     * @param capabilities - Agent's discovered capabilities
+     * @param cwd - Project working directory
+     * @returns Skill prompt text (for "prompt" method) or empty string (for "native" method)
+     */
+    applySkills(capabilities?: AgentCapabilities, cwd?: string): string;
+    /**
+     * Collect all skill file paths from project-level and user-level dirs.
+     * Skills are stored as `<dir>/<skillName>/SKILL.md`.
+     * Priority: project > global (project listed first for budget-constrained injection).
+     */
+    private collectSkillPaths;
+}