qlogicagent 2.13.3 → 2.13.5

package/dist/cli/credential-vault.test.js

@@ -0,0 +1,130 @@
+/**
+ * IT-7 / D29-D30: credential vault encryption-at-rest + execution-time header injection through a
+ * REAL workflow run against a REAL local HTTP server, plus the per-workflow unattended grant
+ * feeding the permission gate.
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createServer } from "node:http";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { CredentialVault, credentialToHeaders } from "./credential-vault.js";
+import { WorkflowRuntime } from "../orchestration/workflow/workflow-runtime.js";
+import { defaultRuntimeFactory } from "../orchestration/workflow/workflow-controller.js";
+import { createQlaExecutorHost } from "../orchestration/workflow/qla-executor-host.js";
+import { NodeRegistry } from "../orchestration/workflow/node-registry.js";
+import { hostExecutors } from "../orchestration/workflow/host-executors.js";
+const tmpDirs = [];
+const servers = [];
+function makeTempDir() {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "vault-"));
+    tmpDirs.push(dir);
+    return dir;
+}
+afterEach(async () => {
+    vi.unstubAllEnvs();
+    for (const s of servers.splice(0))
+        await new Promise((r) => s.close(r));
+    for (const dir of tmpDirs.splice(0))
+        fs.rmSync(dir, { recursive: true, force: true });
+});
+describe("CredentialVault (D29)", () => {
+    it("round-trips secrets and never stores plaintext on disk", () => {
+        const home = makeTempDir();
+        const vault = new CredentialVault(home);
+        const created = vault.create({ type: "bearer", label: "测试令牌", data: { token: "s3cret-token-xyz" } });
+        // list() is secret-free
+        const listed = vault.list();
+        expect(listed).toHaveLength(1);
+        expect(JSON.stringify(listed)).not.toContain("s3cret-token-xyz");
+        // get() decrypts
+        expect(vault.get(created.id).data.token).toBe("s3cret-token-xyz");
+        // At rest: no plaintext anywhere under the credentials dir
+        const dir = path.join(home, "credentials");
+        for (const f of fs.readdirSync(dir)) {
+            expect(fs.readFileSync(path.join(dir, f), "utf-8")).not.toContain("s3cret-token-xyz");
+        }
+        // delete
+        expect(vault.delete(created.id)).toBe(true);
+        expect(vault.list()).toHaveLength(0);
+    });
+    it("materializes headers per type and rejects malformed payloads", () => {
+        expect(credentialToHeaders("apiKey", { headerName: "X-Api-Key", value: "k1" })).toEqual({ "X-Api-Key": "k1" });
+        expect(credentialToHeaders("basic", { username: "u", password: "p" }).Authorization).toMatch(/^Basic /);
+        expect(() => credentialToHeaders("oauth2", {})).toThrow(/accessToken/);
+        const vault = new CredentialVault(makeTempDir());
+        expect(() => vault.create({ type: "apiKey", label: "x", data: {} })).toThrow(/headerName/);
+    });
+});
+describe("execution-time injection (D29) — real run, real HTTP server", () => {
+    it("http node with credentialId sends the vault credential as Authorization", async () => {
+        const home = makeTempDir();
+        const vault = new CredentialVault(home);
+        const cred = vault.create({ type: "bearer", label: "api", data: { token: "tok-12345" } });
+        let seenAuth;
+        const server = createServer((req, res) => {
+            seenAuth = req.headers.authorization;
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: true }));
+        });
+        servers.push(server);
+        await new Promise((r) => server.listen(0, "127.0.0.1", r));
+        const port = server.address().port;
+        const registry = new NodeRegistry();
+        for (const [kind, exec] of Object.entries(hostExecutors))
+            registry.register(kind, exec);
+        const host = createQlaExecutorHost({
+            findTool: () => undefined,
+            runAgent: async () => "",
+            invokeMcp: async () => ({}),
+            resolveCredentialHeaders: (id) => {
+                const { summary, data } = vault.get(id);
+                return credentialToHeaders(summary.type, data);
+            },
+        });
+        const def = {
+            id: "wf-cred",
+            nodes: [
+                { id: "t", kind: "trigger" },
+                { id: "call", kind: "http", params: { url: `http://127.0.0.1:${port}/x`, credentialId: cred.id } },
+            ],
+            edges: [{ from: "t", to: "call" }],
+        };
+        const rt = new WorkflowRuntime(def, { registry, host });
+        const result = await rt.run();
+        expect(result.status).toBe("completed");
+        expect(seenAuth).toBe("Bearer tok-12345");
+        // The credential value never leaks into node outputs.
+        expect(JSON.stringify(result.outputs)).not.toContain("tok-12345");
+    });
+    it("credentialId without a wired vault fails loud (never silently unauthenticated)", async () => {
+        const host = createQlaExecutorHost({ findTool: () => undefined, runAgent: async () => "", invokeMcp: async () => ({}) });
+        await expect(host.httpRequest({ method: "GET", url: "http://127.0.0.1:1/x", credentialId: "cred_x" }))
+            .rejects.toThrow(/no credential vault/);
+    });
+});
+describe("unattended grant feeds the gate (D30)", () => {
+    function factoryFor(allow) {
+        const registry = new NodeRegistry();
+        registry.register("noop", async () => ({ outputs: { default: [{ json: {} }] } }));
+        // "tool" is SENSITIVE — use a stub executor so a permitted run completes without real work.
+        registry.register("tool", async () => ({ outputs: { default: [{ json: { ran: true } }] } }));
+        return defaultRuntimeFactory({ registry, budget: { maxNodeExecutions: 10 } })({
+            id: "wf-scope",
+            nodes: [{ id: "t", kind: "trigger" }, { id: "s", kind: "tool", params: {} }],
+            edges: [{ from: "t", to: "s" }],
+        }, {
+            workflowId: "wf-scope",
+            runId: "r1",
+            type: "schedule",
+            ...(allow ? { permissionScope: { allowUnattendedKinds: allow, grantedAt: "now" } } : {}),
+        });
+    }
+    it("denies a sensitive kind under an unattended trigger without a grant", async () => {
+        await expect(factoryFor(undefined).run()).rejects.toThrow(/Permission denied/);
+    });
+    it("the owner's per-workflow grant admits exactly the listed kinds", async () => {
+        const result = await factoryFor(["tool"]).run();
+        expect(result.status).toBe("completed");
+    });
+});

package/dist/cli/default-project-bootstrap.d.ts

@@ -0,0 +1,8 @@
+import type { NotificationMethodMap } from "../protocol/notifications.js";
+import type { PathService, ProjectMemoryStore, ProjectMemoryStoreFactory } from "../runtime/ports/index.js";
+export interface DefaultProjectBootstrapDeps {
+    pathService: PathService;
+    projectMemoryStoreFactory: ProjectMemoryStoreFactory;
+    sendNotification<M extends keyof NotificationMethodMap>(method: M, params: NotificationMethodMap[M]): void;
+}
+export declare function ensureDefaultProjectBootstrap(deps: DefaultProjectBootstrapDeps): ProjectMemoryStore;

package/dist/cli/default-project-bootstrap.js

@@ -0,0 +1,39 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { getUserAgentHome } from "../runtime/infra/agent-paths.js";
+import * as projectStore from "../runtime/infra/project-store.js";
+import { seedProjectFromGlobalTemplates } from "./project-template-seeder.js";
+export function ensureDefaultProjectBootstrap(deps) {
+    const existingActive = projectStore.getActiveProject();
+    if (!existingActive) {
+        const defaultDir = path.join(getUserAgentHome(), "workspaces", "default");
+        if (!fs.existsSync(defaultDir)) {
+            fs.mkdirSync(defaultDir, { recursive: true });
+        }
+        const defaultProject = projectStore.getOrCreateDefaultProject(defaultDir);
+        seedProjectFromGlobalTemplates(defaultDir);
+        deps.pathService.setActiveWorkdir(defaultDir);
+        deps.sendNotification("project.created", {
+            id: defaultProject.id,
+            name: defaultProject.name,
+            workspaceDir: defaultProject.workspaceDir,
+            type: defaultProject.type,
+        });
+    }
+    else if (existingActive.workspaceDir) {
+        deps.pathService.setActiveWorkdir(existingActive.workspaceDir);
+    }
+    ensureDefaultProjectDir();
+    const memdir = deps.projectMemoryStoreFactory.create(deps.pathService.getActiveProjectRoot());
+    memdir.ensureInitialized();
+    return memdir;
+}
+function ensureDefaultProjectDir() {
+    const allProjects = projectStore.listProjects();
+    const defaultProject = allProjects.find(p => p.type === "default" && p.status === "active");
+    if (!defaultProject)
+        return;
+    if (!fs.existsSync(defaultProject.workspaceDir)) {
+        fs.mkdirSync(defaultProject.workspaceDir, { recursive: true });
+    }
+}

package/dist/cli/dev-tool-bootstrap.d.ts

@@ -0,0 +1,8 @@
+import type { PathService, ToolCatalog } from "../runtime/ports/index.js";
+export interface DevToolBootstrapDeps {
+    config: Record<string, unknown>;
+    pathService?: PathService;
+    toolCatalog: ToolCatalog;
+}
+export declare const devToolRegistrationModule: import("../runtime/ports/tool-contracts.js").ToolRegistrationModule<DevToolBootstrapDeps>;
+export declare function configureDevToolBootstrap(deps: DevToolBootstrapDeps): void;

package/dist/cli/dev-tool-bootstrap.js

@@ -0,0 +1,19 @@
+import { defineToolRegistrationModule } from "../runtime/ports/index.js";
+import { registerDevTools } from "./dev-tools/dev-tool-bootstrap-service.js";
+export const devToolRegistrationModule = defineToolRegistrationModule({
+    id: "dev-tools",
+    kind: "dev",
+    register: configureDevToolBootstrapInternal,
+});
+export function configureDevToolBootstrap(deps) {
+    devToolRegistrationModule.register(deps);
+}
+function configureDevToolBootstrapInternal(deps) {
+    const workdir = typeof deps.config.workdir === "string"
+        ? deps.config.workdir
+        : deps.pathService?.getActiveProjectRoot();
+    if (!workdir) {
+        throw new Error("Dev tool bootstrap requires a workdir or PathService active project root.");
+    }
+    registerDevTools({ workdir, toolCatalog: deps.toolCatalog });
+}

package/dist/cli/dev-tools/dev-tool-bootstrap-service.d.ts

@@ -0,0 +1,6 @@
+import type { ToolCatalog } from "../../runtime/ports/index.js";
+export interface DevToolBootstrapServiceDeps {
+    workdir: string;
+    toolCatalog: ToolCatalog;
+}
+export declare function registerDevTools(deps: DevToolBootstrapServiceDeps): void;

package/dist/cli/dev-tools/dev-tool-bootstrap-service.js

@@ -0,0 +1,6 @@
+import { buildDevTools } from "./dev-tool-registry.js";
+export function registerDevTools(deps) {
+    for (const tool of buildDevTools({ workdir: deps.workdir })) {
+        deps.toolCatalog.addTool(tool);
+    }
+}

package/dist/cli/dev-tools/dev-tool-registry.d.ts

@@ -0,0 +1,6 @@
+import { createLspTool } from "../../skills/tools/lsp-tool.js";
+export interface DevToolRegistryOptions {
+    workdir: string;
+}
+export type DevTool = ReturnType<typeof createLspTool>;
+export declare function buildDevTools(options: DevToolRegistryOptions): DevTool[];

package/dist/cli/dev-tools/dev-tool-registry.js

@@ -0,0 +1,7 @@
+import { createLspTool } from "../../skills/tools/lsp-tool.js";
+import { createLspToolDeps } from "./lsp-tool-service.js";
+export function buildDevTools(options) {
+    return [
+        createLspTool(createLspToolDeps({ workdir: options.workdir })),
+    ];
+}

package/dist/cli/dev-tools/lsp-tool-service.d.ts

@@ -0,0 +1,5 @@
+import type { LspToolDeps } from "../../skills/tools/lsp-tool.js";
+export interface LspToolServiceOptions {
+    workdir: string;
+}
+export declare function createLspToolDeps(options: LspToolServiceOptions): LspToolDeps;

package/dist/cli/dev-tools/lsp-tool-service.js

@@ -0,0 +1,30 @@
+import * as path from "node:path";
+export function createLspToolDeps(options) {
+    const lspWorkdir = options.workdir;
+    return {
+        executeOperation: async (params) => {
+            switch (params.operation) {
+                case "goToDefinition":
+                case "findReferences":
+                    return { type: "locations", locations: [] };
+                case "hover":
+                    return { type: "hover", hover: null };
+                case "documentSymbol":
+                    return { type: "symbols", symbols: [] };
+                case "diagnostics":
+                    return { type: "diagnostics", diagnostics: [] };
+                case "completion":
+                    return { type: "completions", completions: [] };
+                case "signatureHelp":
+                    return { type: "signatureHelp", signatures: [] };
+                case "rename":
+                    return { type: "rename", edits: [] };
+                case "codeAction":
+                    return { type: "codeActions", actions: [] };
+                default:
+                    return { type: "locations", locations: [] };
+            }
+        },
+        resolvePath: (filePath) => path.isAbsolute(filePath) ? filePath : path.resolve(lspWorkdir, filePath),
+    };
+}

package/dist/cli/dev-tools/lsp-tool-service.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/dev-tools/lsp-tool-service.test.js

@@ -0,0 +1,14 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { describe, expect, it } from "vitest";
+import { createLspToolDeps } from "./lsp-tool-service.js";
+describe("lsp tool service", () => {
+    it("creates LSP deps that resolve paths under the configured workdir", async () => {
+        const workdir = fs.mkdtempSync(path.join(os.tmpdir(), "qlogicagent-lsp-"));
+        const deps = createLspToolDeps({ workdir });
+        expect(deps.resolvePath("src/index.ts")).toBe(path.resolve(workdir, "src/index.ts"));
+        await expect(deps.executeOperation({ operation: "diagnostics", filePath: "src/index.ts" }))
+            .resolves.toEqual({ type: "diagnostics", diagnostics: [] });
+    });
+});

package/dist/cli/dream-host-adapter.d.ts

@@ -0,0 +1,23 @@
+import type { TurnConfig } from "../agent/types.js";
+import type { AgentRpcError } from "../protocol/wire/index.js";
+import type { DreamHandlerHost } from "./handlers/dream-handler.js";
+export interface DreamHostAdapterDeps {
+    getActiveTurn(): AbortController | null;
+    setActiveTurn(value: AbortController | null): void;
+    getCurrentTransport(): DreamHandlerHost["currentTransport"];
+    getCurrentApiKey(): string;
+    getCurrentModel(): string;
+    getCurrentHooks(): DreamHandlerHost["currentHooks"];
+    getMemoryProvider(): DreamHandlerHost["memoryProvider"];
+    getMemoryUserId(): string;
+    getToolCatalog(): DreamHandlerHost["toolCatalog"];
+    getTaskStore(): DreamHandlerHost["taskStore"];
+    getVerbose(): boolean;
+    log(message: string): void;
+    resolveMemoryRoot(): string;
+    resolveTranscriptDir(): string;
+    resolveAgent(config: TurnConfig): unknown | null;
+    sendNotification(method: string, params: Record<string, unknown>): void;
+    sendResponse(id: string | number, result?: unknown, error?: AgentRpcError): void;
+}
+export declare function createDreamHostAdapter(deps: DreamHostAdapterDeps): DreamHandlerHost;

package/dist/cli/dream-host-adapter.js

@@ -0,0 +1,33 @@
+export function createDreamHostAdapter(deps) {
+    return {
+        get activeTurn() { return deps.getActiveTurn(); },
+        set activeTurn(value) { deps.setActiveTurn(value ?? null); },
+        get currentTransport() { return deps.getCurrentTransport(); },
+        get currentApiKey() { return deps.getCurrentApiKey(); },
+        get currentModel() { return deps.getCurrentModel(); },
+        get currentHooks() { return deps.getCurrentHooks(); },
+        get memoryProvider() { return deps.getMemoryProvider(); },
+        get memoryUserId() { return deps.getMemoryUserId(); },
+        get toolCatalog() { return deps.getToolCatalog(); },
+        get taskStore() { return deps.getTaskStore(); },
+        get verbose() { return deps.getVerbose(); },
+        log(message) {
+            deps.log(message);
+        },
+        resolveMemoryRoot() {
+            return deps.resolveMemoryRoot();
+        },
+        resolveTranscriptDir() {
+            return deps.resolveTranscriptDir();
+        },
+        resolveAgent(config) {
+            return deps.resolveAgent(config);
+        },
+        sendNotification(method, params) {
+            deps.sendNotification(method, params);
+        },
+        sendResponse(id, result, error) {
+            deps.sendResponse(id, result, error);
+        },
+    };
+}

package/dist/cli/gateway-rpc-connection.d.ts

@@ -0,0 +1,50 @@
+/**
+ * GatewayRpcConnection — the JSON-RPC request lifecycle for the gateway contract.
+ *
+ * Owns the per-request bookkeeping: the gateway contract (dedup/settle/expire), the
+ * in-flight request ledger (id → meta), and the deadline timers; plus the wire-side
+ * response builders. Extracted from StdioServer to separate its "protocol routing"
+ * concern from its "runtime state container" concern — StdioServer keeps the
+ * transport, message dispatch, and ACP routing, and delegates the request-lifecycle
+ * mechanics here through thin sendResponse/sendError methods.
+ *
+ * It does NOT own the transport: the raw frame writer is injected via `write`, so the
+ * server stays in charge of transport ownership / start / close / ACP routing.
+ *
+ * Covered by stdio-server.contract.test.ts (contract gate, dedup, deadline expiry,
+ * late-response drop).
+ */
+import { GatewayRpcContract, type AgentRpcError, type AgentRpcRequest } from "../protocol/wire/index.js";
+export interface GatewayRpcConnectionDeps {
+    /** Raw transport send — writes one JSON-RPC frame to the wire. */
+    write: (msg: unknown) => void;
+    log: (message: string) => void;
+}
+export declare class GatewayRpcConnection {
+    private readonly contract;
+    private readonly inflight;
+    private readonly deadlineTimers;
+    private readonly write;
+    private readonly log;
+    constructor(deps: GatewayRpcConnectionDeps);
+    /** The gateway contract — exposed for control-handler metrics/cancel. */
+    get rpcContract(): GatewayRpcContract;
+    /** True while a request id is in flight (no response settled yet). */
+    hasInFlight(id: string | number): boolean;
+    /**
+     * Run the gateway contract gate for an inbound request (caller guarantees the
+     * id is present and the method is not meta-optional). Returns true if the caller
+     * should dispatch; false if the request was rejected/deduped — in which case a
+     * response has already been written.
+     */
+    begin(id: string | number, msg: AgentRpcRequest): boolean;
+    sendResponse(id: string | number, result?: unknown, error?: AgentRpcError): void;
+    /** Convenience over sendResponse for handlers that build the error inline. */
+    sendError(id: string | number, code: AgentRpcError["code"], message: string, data?: unknown): void;
+    /** Clear the in-flight ledger + deadline timers (server shutdown). */
+    dispose(): void;
+    private clearLifecycle;
+    private sendContractError;
+    private sendContractErrorOrResult;
+    private scheduleDeadline;
+}

package/dist/cli/gateway-rpc-connection.js

@@ -0,0 +1,133 @@
+/**
+ * GatewayRpcConnection — the JSON-RPC request lifecycle for the gateway contract.
+ *
+ * Owns the per-request bookkeeping: the gateway contract (dedup/settle/expire), the
+ * in-flight request ledger (id → meta), and the deadline timers; plus the wire-side
+ * response builders. Extracted from StdioServer to separate its "protocol routing"
+ * concern from its "runtime state container" concern — StdioServer keeps the
+ * transport, message dispatch, and ACP routing, and delegates the request-lifecycle
+ * mechanics here through thin sendResponse/sendError methods.
+ *
+ * It does NOT own the transport: the raw frame writer is injected via `write`, so the
+ * server stays in charge of transport ownership / start / close / ACP routing.
+ *
+ * Covered by stdio-server.contract.test.ts (contract gate, dedup, deadline expiry,
+ * late-response drop).
+ */
+import { AGENT_RPC_ERROR_CODES, GatewayRpcContract, requireGatewayRpcMeta, } from "../protocol/wire/index.js";
+export class GatewayRpcConnection {
+    contract = new GatewayRpcContract();
+    inflight = new Map();
+    deadlineTimers = new Map();
+    write;
+    log;
+    constructor(deps) {
+        this.write = deps.write;
+        this.log = deps.log;
+    }
+    /** The gateway contract — exposed for control-handler metrics/cancel. */
+    get rpcContract() {
+        return this.contract;
+    }
+    /** True while a request id is in flight (no response settled yet). */
+    hasInFlight(id) {
+        return this.inflight.has(id);
+    }
+    /**
+     * Run the gateway contract gate for an inbound request (caller guarantees the
+     * id is present and the method is not meta-optional). Returns true if the caller
+     * should dispatch; false if the request was rejected/deduped — in which case a
+     * response has already been written.
+     */
+    begin(id, msg) {
+        const metaResult = requireGatewayRpcMeta(msg);
+        if (!metaResult.ok) {
+            this.sendContractError(id, metaResult.error);
+            return false;
+        }
+        const begun = this.contract.begin(msg.method, metaResult.meta);
+        if (begun.status === "rejected") {
+            this.sendContractError(id, begun.error);
+            return false;
+        }
+        if (begun.status === "deduped") {
+            this.sendContractErrorOrResult(id, begun.result, begun.error);
+            return false;
+        }
+        this.inflight.set(id, metaResult.meta);
+        this.scheduleDeadline(id, msg.method, metaResult.meta);
+        return true;
+    }
+    sendResponse(id, result, error) {
+        const meta = this.inflight.get(id);
+        if (meta) {
+            const settled = this.contract.settle(meta.requestId, result, error);
+            this.clearLifecycle(id);
+            if (!settled.accepted) {
+                this.log(`[rpc] dropped late response id=${String(id)} requestId=${meta.requestId} reason=${settled.reason}`);
+                return;
+            }
+        }
+        const msg = { jsonrpc: "2.0", id };
+        if (error)
+            msg.error = error;
+        else
+            msg.result = result;
+        this.write(msg);
+    }
+    /** Convenience over sendResponse for handlers that build the error inline. */
+    sendError(id, code, message, data) {
+        const error = { code, message };
+        if (data !== undefined)
+            error.data = data;
+        this.sendResponse(id, undefined, error);
+    }
+    /** Clear the in-flight ledger + deadline timers (server shutdown). */
+    dispose() {
+        for (const timer of this.deadlineTimers.values())
+            clearTimeout(timer);
+        this.deadlineTimers.clear();
+        this.inflight.clear();
+    }
+    clearLifecycle(id) {
+        const timer = this.deadlineTimers.get(id);
+        if (timer)
+            clearTimeout(timer);
+        this.deadlineTimers.delete(id);
+        this.inflight.delete(id);
+    }
+    sendContractError(id, error) {
+        const msg = { jsonrpc: "2.0", id, error };
+        this.write(msg);
+    }
+    sendContractErrorOrResult(id, result, error) {
+        if (error) {
+            this.sendContractError(id, error);
+            return;
+        }
+        const msg = { jsonrpc: "2.0", id, result };
+        this.write(msg);
+    }
+    scheduleDeadline(id, method, meta) {
+        const timeoutMs = Math.max(0, meta.deadlineAt - Date.now());
+        const timer = setTimeout(() => {
+            if (!this.inflight.has(id))
+                return;
+            const expired = this.contract.expire(meta.requestId);
+            this.clearLifecycle(id);
+            if (!expired)
+                return;
+            this.log(`[rpc] deadline exceeded method=${method} id=${String(id)} requestId=${meta.requestId}`);
+            this.write({
+                jsonrpc: "2.0",
+                id,
+                error: {
+                    code: AGENT_RPC_ERROR_CODES.REQUEST_DEADLINE_EXCEEDED,
+                    message: `RPC request deadline exceeded: ${method}.`,
+                },
+            });
+        }, timeoutMs);
+        timer.unref?.();
+        this.deadlineTimers.set(id, timer);
+    }
+}

package/dist/cli/handlers/agents-handler.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Agents scan/config/gateway/processes/kill handlers — extracted from StdioServer.
+ * Handles: agents.scan, agents.list, agents.config, agents.setConfig, agents.getConfig,
+ *          agents.removeConfig, agents.setGateway, agents.getGateway, agents.processes,
+ *          agents.kill, agents.listConfigured, agents.getLog, agents.testConnection
+ */
+import { type AgentRpcError, type AgentRpcRequest } from "../../protocol/wire/index.js";
+import { AgentProcessManager } from "../../runtime/infra/agent-process.js";
+import type { AgentConfigStore } from "../../runtime/infra/agent-config-store.js";
+import { type AcpDetector } from "../../runtime/infra/acp-detector.js";
+export interface AgentsHandlerHost {
+    acpDetector: AcpDetector;
+    soloProcessManager: AgentProcessManager | null;
+    productProcessManager: AgentProcessManager | null;
+    ensureAgentConfigStore(): Promise<AgentConfigStore>;
+    getActiveProjectRoot?(): string;
+    handleMcpToolCall?(memberId: string, tool: string, args: Record<string, unknown>): Promise<unknown>;
+    log?(message: string): void;
+    sendResponse(id: string | number, result?: unknown, error?: AgentRpcError): void;
+    sendNotification?(method: string, params: Record<string, unknown>): void;
+}
+/** Resolve a pending external-agent approval with the user's decision (delivered by the gateway). */
+export declare function handleAgentsApprovalResponse(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;
+export declare function handleAgentsScan(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;
+export declare function handleAgentsList(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;
+/**
+ * Curated Discover-Agent catalog (12 agents) merged with live install status, for the
+ * discover grid. Status comes from the detector; install carries the official command
+ * summary + source for the confirm dialog (no secrets).
+ */
+export declare function handleAgentsCatalog(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;
+/**
+ * One-click install a catalog agent by id. Runs ONLY the official command from the
+ * catalog manifest (never a free-form command), streaming progress via the
+ * agent.install.progress notification, then refreshes detection. Returns the outcome.
+ */
+export declare function handleAgentsInstall(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;
+export declare function handleAgentsConfig(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;
+export declare function handleAgentsSetConfig(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;
+export declare function handleAgentsGetConfig(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;
+export declare function handleAgentsRemoveConfig(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;
+export declare function handleAgentsSetGateway(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;
+export declare function handleAgentsGetGateway(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;
+export declare function handleAgentsListConfigured(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;
+export declare function handleAgentsProcesses(this: AgentsHandlerHost, msg: AgentRpcRequest): void;
+export declare function handleAgentsKill(this: AgentsHandlerHost, msg: AgentRpcRequest): void;
+export declare function handleAgentsGetLog(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;
+export declare function handleAgentsTestConnection(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;
+/** Pre-warm an external agent's process (on agent-select) so the first message skips the cold start. */
+export declare function handleAgentsWarm(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;
+export declare function handleAgentsPrompt(this: AgentsHandlerHost, msg: AgentRpcRequest): Promise<void>;