@0xmaxma/claude-gateway 1.7.9 → 1.8.0

package/dist/cli/commands/channels.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PAIRING_CHANNELS = void 0;
+exports.runChannels = runChannels;
+const http_client_1 = require("../http-client");
+const output_1 = require("../output");
+/**
+ * `channels pending|approve|deny` — manage incoming Telegram/Discord pairing
+ * requests for an agent (replaces `make pair agent=X code=Y channel=Z`).
+ *
+ * Scoped to the channels that actually expose a code-based pairing queue
+ * today (GET .../pending, POST .../approve, POST .../deny — see
+ * src/api/router.ts). LINE and Slack use a different model (a "recently
+ * dropped senders" list you allowlist directly, no approval code) so they
+ * aren't part of this command. Adding a future channel with the same
+ * approve/deny-by-code shape only requires adding it to PAIRING_CHANNELS below
+ * — no other code here is channel-specific.
+ */
+exports.PAIRING_CHANNELS = ['telegram', 'discord'];
+function isPairingChannel(v) {
+    return !!v && exports.PAIRING_CHANNELS.includes(v);
+}
+async function runChannels(positionals, flags, config) {
+    const verb = positionals[0];
+    if (!verb || flags.help === true) {
+        // An explicit `--help` succeeds; a missing verb is a usage error.
+        printHelp(flags.help === true);
+        return flags.help === true ? 0 : 1;
+    }
+    const agentId = typeof flags.agent === 'string' ? flags.agent : undefined;
+    if (!agentId) {
+        process.stderr.write('Missing required flag: --agent <id>\n\n');
+        printHelp(false);
+        return 1;
+    }
+    const channelFlag = typeof flags.channel === 'string' ? flags.channel : undefined;
+    if (channelFlag !== undefined && !isPairingChannel(channelFlag)) {
+        process.stderr.write(`Invalid --channel '${channelFlag}'. Expected one of: ${exports.PAIRING_CHANNELS.join(', ')}\n`);
+        return 1;
+    }
+    const baseUrl = await (0, http_client_1.resolveReachableUrl)((0, http_client_1.resolveUrlPlan)({ flagUrl: strFlag(flags.url), env: process.env, config }));
+    const key = (0, http_client_1.resolveKey)({ flagKey: strFlag(flags.key), env: process.env, config });
+    const compact = flags.json === true;
+    switch (verb) {
+        case 'pending': {
+            const channels = channelFlag ? [channelFlag] : exports.PAIRING_CHANNELS;
+            const byChannel = {};
+            for (const channel of channels) {
+                const result = await (0, http_client_1.request)({ method: 'GET', path: `/v1/agents/${encodeURIComponent(agentId)}/${channel}/pending`, baseUrl, key });
+                byChannel[channel] = result.data?.pending ?? [];
+            }
+            (0, output_1.printResult)(byChannel, compact);
+            return 0;
+        }
+        case 'approve':
+        case 'deny': {
+            if (!channelFlag) {
+                process.stderr.write(`Missing required flag: --channel <${exports.PAIRING_CHANNELS.join('|')}>\n\n`);
+                printHelp(false);
+                return 1;
+            }
+            const code = typeof flags.code === 'string' ? flags.code : undefined;
+            if (!code) {
+                process.stderr.write('Missing required flag: --code <code>\n\n');
+                printHelp(false);
+                return 1;
+            }
+            const result = await (0, http_client_1.request)({
+                method: 'POST',
+                path: `/v1/agents/${encodeURIComponent(agentId)}/${channelFlag}/${verb}`,
+                baseUrl,
+                key,
+                body: { code },
+            });
+            (0, output_1.printResult)(result.data, compact);
+            return 0;
+        }
+        default:
+            process.stderr.write(`Unknown: channels ${verb} (expected pending|approve|deny)\n\n`);
+            printHelp(false);
+            return 1;
+    }
+}
+function strFlag(v) {
+    return typeof v === 'string' ? v : undefined;
+}
+function printHelp(requested) {
+    const ch = exports.PAIRING_CHANNELS.join('|');
+    // The channel list is interpolated, so the gap cannot be hand-counted — the
+    // rows drifted out of alignment as soon as a channel was added. Pad to the
+    // widest usage instead.
+    const rows = [
+        [`channels pending --agent <id> [--channel ${ch}]`, 'List pending requests (both channels if omitted)'],
+        [`channels approve --agent <id> --channel <${ch}> --code <code>`, 'Approve a pending request'],
+        [`channels deny    --agent <id> --channel <${ch}> --code <code>`, 'Deny and remove a pending request'],
+    ];
+    const width = Math.max(...rows.map(([usage]) => usage.length)) + 2;
+    const lines = rows.map(([usage, desc]) => `  ${usage.padEnd(width)}${desc}`);
+    (0, output_1.writeCommandHelp)(requested, 'channels', 'manage incoming Telegram/Discord pairing requests', 'claude-gateway channels <pending|approve|deny> --agent <id> [--flags]', lines);
+}
+//# sourceMappingURL=channels.js.map

package/dist/cli/commands/channels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channels.js","sourceRoot":"","sources":["../../../src/cli/commands/channels.ts"],"names":[],"mappings":";;;AAsBA,kCAsEC;AA5FD,gDAAyG;AACzG,sCAA0D;AAE1D;;;;;;;;;;;GAWG;AACU,QAAA,gBAAgB,GAAG,CAAC,UAAU,EAAE,SAAS,CAAU,CAAC;AAGjE,SAAS,gBAAgB,CAAC,CAAqB;IAC7C,OAAO,CAAC,CAAC,CAAC,IAAK,wBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAEM,KAAK,UAAU,WAAW,CAC/B,WAAqB,EACrB,KAAuC,EACvC,MAAqB;IAErB,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACjC,kEAAkE;QAClE,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAChE,SAAS,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,WAAW,uBAAuB,wBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9G,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAmB,EACvC,IAAA,4BAAc,EAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAC1E,CAAC;IACF,MAAM,GAAG,GAAG,IAAA,wBAAU,EAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;IAEpC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,wBAAgB,CAAC;YAChE,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAO,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,kBAAkB,CAAC,OAAO,CAAC,IAAI,OAAO,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpI,SAAS,CAAC,OAAO,CAAC,GAAI,MAAM,CAAC,IAAgC,EAAE,OAAO,IAAI,EAAE,CAAC;YAC/E,CAAC;YACD,IAAA,oBAAW,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAChC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,SAAS,CAAC;QACf,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,wBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC7F,SAAS,CAAC,KAAK,CAAC,CAAC;gBACjB,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACrE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBACjE,SAAS,CAAC,KAAK,CAAC,CAAC;gBACjB,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAO,EAAC;gBAC3B,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,cAAc,kBAAkB,CAAC,OAAO,CAAC,IAAI,WAAW,IAAI,IAAI,EAAE;gBACxE,OAAO;gBACP,GAAG;gBACH,IAAI,EAAE,EAAE,IAAI,EAAE;aACf,CAAC,CAAC;YACH,IAAA,oBAAW,EAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAClC,OAAO,CAAC,CAAC;QACX,CAAC;QACD;YACE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,sCAAsC,CAAC,CAAC;YACtF,SAAS,CAAC,KAAK,CAAC,CAAC;YACjB,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,CAA+B;IAC9C,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAID,SAAS,SAAS,CAAC,SAAkB;IACnC,MAAM,EAAE,GAAG,wBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,4EAA4E;IAC5E,2EAA2E;IAC3E,wBAAwB;IACxB,MAAM,IAAI,GAA4B;QACpC,CAAC,4CAA4C,EAAE,GAAG,EAAE,kDAAkD,CAAC;QACvG,CAAC,4CAA4C,EAAE,iBAAiB,EAAE,2BAA2B,CAAC;QAC9F,CAAC,4CAA4C,EAAE,iBAAiB,EAAE,mCAAmC,CAAC;KACvG,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC7E,IAAA,yBAAgB,EACd,SAAS,EACT,UAAU,EACV,mDAAmD,EACnD,uEAAuE,EACvE,KAAK,CACN,CAAC;AACJ,CAAC"}

package/dist/cli/commands/debug-bundle.d.ts

@@ -0,0 +1,6 @@
+/** Pure: pick the diagnostic lines (warn/error/submit-diag) from a log's text,
+ *  redact them, cap each line's length, and keep at most `maxLines` (from the
+ *  tail — most recent). */
+export declare function selectDiagnosticLines(content: string, maxLines?: number, maxLineLength?: number): string[];
+export declare function runDebugBundle(flags: Record<string, string | boolean>): Promise<number>;
+//# sourceMappingURL=debug-bundle.d.ts.map

package/dist/cli/commands/debug-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-bundle.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/debug-bundle.ts"],"names":[],"mappings":"AA8BA;;2BAE2B;AAC3B,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAiB,EAAE,aAAa,SAAkB,GAAG,MAAM,EAAE,CAQ3H;AAgFD,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAyE7F"}

package/dist/cli/commands/debug-bundle.js

@@ -0,0 +1,220 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.selectDiagnosticLines = selectDiagnosticLines;
+exports.runDebugBundle = runDebugBundle;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const http_client_1 = require("../http-client");
+const redact_1 = require("../redact");
+const output_1 = require("../output");
+/**
+ * `debug-bundle` — collect a small, redacted diagnostics bundle for a session
+ * that went silent, so a user can attach ONE file to an issue/Telegram instead
+ * of a multi-MB raw log (which may contain prompts/secrets).
+ *
+ * Reads the log directory directly, so it works even when the gateway is wedged
+ * or dead. Includes only warn/error and submit-diag lines, redacted, plus an
+ * environment header.
+ */
+const MAX_DIAG_LINES = 4000;
+/** Cap on a single kept line's length. Guards against one giant serialized
+ *  object/stack trace blowing past the "small bundle" goal, and limits how much
+ *  of any one line's content (which redaction cannot fully guarantee is clean —
+ *  see the banner below) ends up in the file. */
+const MAX_LINE_LENGTH = 2000;
+function truncateLine(line, maxLength) {
+    if (line.length <= maxLength)
+        return line;
+    return `${line.slice(0, maxLength)} …[truncated, ${line.length - maxLength} more chars]`;
+}
+/** Pure: pick the diagnostic lines (warn/error/submit-diag) from a log's text,
+ *  redact them, cap each line's length, and keep at most `maxLines` (from the
+ *  tail — most recent). */
+function selectDiagnosticLines(content, maxLines = MAX_DIAG_LINES, maxLineLength = MAX_LINE_LENGTH) {
+    const picked = [];
+    for (const line of content.split('\n')) {
+        if (/\bWARN\b|\bERROR\b|submit-diag/i.test(line)) {
+            picked.push(truncateLine((0, redact_1.redactLine)(line), maxLineLength));
+        }
+    }
+    return picked.length > maxLines ? picked.slice(picked.length - maxLines) : picked;
+}
+/** The config file stores `logDir` exactly as written, and the shipped template
+ *  writes `~/.claude-gateway/logs`. The server expands that itself on boot, so
+ *  the literal tilde survives on disk and only bites a reader that forgets to
+ *  expand it — `readdirSync('~/...')` throws ENOENT and looks like "no logs". */
+function resolveLogDir(flags) {
+    if (typeof flags.logDir === 'string')
+        return (0, http_client_1.expandHome)(flags.logDir);
+    const cfg = (0, http_client_1.loadCliConfig)(typeof flags.config === 'string' ? flags.config : undefined);
+    if (cfg.logDir)
+        return (0, http_client_1.expandHome)(cfg.logDir);
+    return path.join(os.homedir(), '.claude-gateway', 'logs');
+}
+/**
+ * Session logs in `dir`, or the reason the directory could not be read.
+ *
+ * The read used to be wrapped in a bare `catch { return [] }`, which reported
+ * every failure as "no session logs found". That is how the unexpanded `~`
+ * stayed invisible: an ENOENT on a path that was never resolved looked exactly
+ * like an empty directory, and a permission problem still would. The caller
+ * needs the errno to say anything useful, so it is returned rather than eaten.
+ */
+function listSessionLogs(dir) {
+    let names;
+    try {
+        names = fs.readdirSync(dir);
+    }
+    catch (err) {
+        const e = err;
+        if (e.code === 'ENOENT')
+            return { logs: [], error: `${dir} does not exist` };
+        if (e.code === 'ENOTDIR')
+            return { logs: [], error: `${dir} is not a directory` };
+        return { logs: [], error: `${dir} could not be read (${e.code ?? e.message})` };
+    }
+    const logs = names
+        .filter((n) => n.endsWith('.log') && /session/i.test(n))
+        .map((n) => {
+        const file = path.join(dir, n);
+        let mtimeMs = 0;
+        try {
+            mtimeMs = fs.statSync(file).mtimeMs;
+        }
+        catch {
+            /* ignore */
+        }
+        return { file, mtimeMs };
+    });
+    return { logs };
+}
+function claudeCodeVersion() {
+    try {
+        return (0, child_process_1.execSync)('claude --version', { stdio: ['ignore', 'pipe', 'ignore'], timeout: 3000 }).toString().trim();
+    }
+    catch {
+        return 'unknown';
+    }
+}
+function gatewayVersion() {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        return require(path.join(__dirname, '..', '..', '..', 'package.json')).version;
+    }
+    catch {
+        return 'unknown';
+    }
+}
+function printHelp() {
+    (0, output_1.writeCommandHelp)(true, 'debug-bundle', 'write a small redacted diagnostics bundle', 'claude-gateway debug-bundle [--session <id>] [--logDir <path>] [--config <path>]', [
+        '  --session <id>   Bundle this session instead of the most recent one',
+        '  --logDir <path>  Read logs from here instead of the configured directory',
+        '  --config <path>  Read logDir from this config file',
+        '',
+        '  Writes debug-bundle-<stamp>.txt into the current directory.',
+    ]);
+}
+async function runDebugBundle(flags) {
+    // `--help` must stay read-only: every other command prints and returns, and
+    // this one writes a file into the working directory as its side effect.
+    if (flags.help === true) {
+        printHelp();
+        return 0;
+    }
+    const logDir = resolveLogDir(flags);
+    const sessionFilter = typeof flags.session === 'string' ? flags.session : undefined;
+    const found = listSessionLogs(logDir);
+    // A directory that could not be read is a different answer from one holding
+    // no logs, and only one of them is the operator's to fix.
+    if (found.error) {
+        process.stderr.write(`Cannot read session logs: ${found.error}\n`);
+        return 1;
+    }
+    let logs = found.logs;
+    if (sessionFilter) {
+        logs = logs.filter((l) => path.basename(l.file).includes(sessionFilter));
+        if (!logs.length) {
+            process.stderr.write(`No session log matching "${sessionFilter}" in ${logDir}\n`);
+            return 1;
+        }
+    }
+    else {
+        // Most recently modified session log.
+        logs.sort((a, b) => b.mtimeMs - a.mtimeMs);
+        logs = logs.slice(0, 1);
+        if (!logs.length) {
+            process.stderr.write(`No session logs found in ${logDir}\n`);
+            return 1;
+        }
+    }
+    const sections = [];
+    sections.push('=== claude-gateway debug bundle ===');
+    sections.push('⚠ Please skim this file before sharing it. Redaction masks common secret ' +
+        'patterns (bearer tokens, api-key/secret/password assignments, provider-style ' +
+        'keys, long opaque tokens) but cannot guarantee removal of arbitrary free-form ' +
+        'text that happened to land in a WARN/ERROR log line.');
+    sections.push(`generatedAt: ${new Date().toISOString()}`);
+    sections.push(`gatewayVersion: ${gatewayVersion()}`);
+    sections.push(`claudeCodeVersion: ${claudeCodeVersion()}`);
+    sections.push(`node: ${process.version}`);
+    sections.push(`os: ${os.platform()} ${os.release()} (${os.arch()})`);
+    sections.push(`logDir: ${logDir}`);
+    sections.push('');
+    for (const { file } of logs) {
+        let content = '';
+        try {
+            content = fs.readFileSync(file, 'utf8');
+        }
+        catch (err) {
+            sections.push(`--- ${path.basename(file)} (unreadable: ${err.message}) ---`);
+            continue;
+        }
+        const lines = selectDiagnosticLines(content);
+        sections.push(`--- ${path.basename(file)} (${lines.length} diagnostic lines) ---`);
+        sections.push(lines.join('\n'));
+        sections.push('');
+    }
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const outFile = path.join(process.cwd(), `debug-bundle-${stamp}.txt`);
+    fs.writeFileSync(outFile, sections.join('\n'));
+    process.stdout.write(`${outFile}\n`);
+    process.stderr.write(`Wrote debug bundle: ${outFile}\n` +
+        'Redaction covers common secret patterns, not all free-form text — please skim it before attaching to a GitHub issue or sending it to the team.\n');
+    return 0;
+}
+//# sourceMappingURL=debug-bundle.js.map

package/dist/cli/commands/debug-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-bundle.js","sourceRoot":"","sources":["../../../src/cli/commands/debug-bundle.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,sDAQC;AAgFD,wCAyEC;AAlMD,iDAAyC;AACzC,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,gDAA2D;AAC3D,sCAAuC;AACvC,sCAA6C;AAE7C;;;;;;;;GAQG;AAEH,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B;;;iDAGiD;AACjD,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,iBAAiB,IAAI,CAAC,MAAM,GAAG,SAAS,cAAc,CAAC;AAC3F,CAAC;AAED;;2BAE2B;AAC3B,SAAgB,qBAAqB,CAAC,OAAe,EAAE,QAAQ,GAAG,cAAc,EAAE,aAAa,GAAG,eAAe;IAC/G,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAA,mBAAU,EAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACpF,CAAC;AAED;;;iFAGiF;AACjF,SAAS,aAAa,CAAC,KAAuC;IAC5D,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAA,wBAAU,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,IAAA,2BAAa,EAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvF,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,IAAA,wBAAU,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAA4B,CAAC;QACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,GAAG,iBAAiB,EAAE,CAAC;QAC7E,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,GAAG,qBAAqB,EAAE,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,GAAG,uBAAuB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK;SACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SACvD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IACL,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,OAAO,IAAA,wBAAQ,EAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;IAChH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,8DAA8D;QAC9D,OAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAyB,CAAC,OAAO,CAAC;IAC1G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,IAAA,yBAAgB,EACd,IAAI,EACJ,cAAc,EACd,2CAA2C,EAC3C,kFAAkF,EAClF;QACE,uEAAuE;QACvE,4EAA4E;QAC5E,sDAAsD;QACtD,EAAE;QACF,+DAA+D;KAChE,CACF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,KAAuC;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACxB,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,aAAa,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpF,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,4EAA4E;IAC5E,0DAA0D;IAC1D,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACtB,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,aAAa,QAAQ,MAAM,IAAI,CAAC,CAAC;YAClF,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;SAAM,CAAC;QACN,sCAAsC;QACtC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,IAAI,CAAC,CAAC;YAC7D,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACrD,QAAQ,CAAC,IAAI,CACX,2EAA2E;QACzE,+EAA+E;QAC/E,gFAAgF;QAChF,sDAAsD,CACzD,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,IAAI,CAAC,mBAAmB,cAAc,EAAE,EAAE,CAAC,CAAC;IACrD,QAAQ,CAAC,IAAI,CAAC,sBAAsB,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC3D,QAAQ,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1C,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrE,QAAQ,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAElB,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAkB,GAAa,CAAC,OAAO,OAAO,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,wBAAwB,CAAC,CAAC;QACnF,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,gBAAgB,KAAK,MAAM,CAAC,CAAC;IACtE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uBAAuB,OAAO,IAAI;QAChC,kJAAkJ,CACrJ,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/commands/doctor.d.ts

@@ -0,0 +1,3 @@
+import { CliConfigView } from '../http-client';
+export declare function runDoctor(flags: Record<string, string | boolean>, config: CliConfigView): Promise<number>;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/cli/commands/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA2C,MAAM,gBAAgB,CAAC;AAmCxF,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAwG/G"}

package/dist/cli/commands/doctor.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDoctor = runDoctor;
+const http_client_1 = require("../http-client");
+const health_1 = require("../health");
+const manager_1 = require("../manager");
+const output_1 = require("../output");
+const colors_1 = require("../colors");
+function printHelp() {
+    const c = (0, colors_1.paletteFor)((0, output_1.helpStream)(true));
+    (0, output_1.writeCommandHelp)(true, 'doctor', 'check config, key resolution, manager and connectivity', 'claude-gateway doctor [--url <url>] [--key <key>] [--config <path>] [--json]', [
+        `  Exits 0 when every check passes. Rows marked ${c.dim('[--]')} are informational and`,
+        '  never fail the command. The key itself is never printed.',
+    ]);
+}
+async function runDoctor(flags, config) {
+    if (flags.help === true) {
+        printHelp();
+        return 0;
+    }
+    const checks = [];
+    const hasKeys = !!(config.keys && config.keys.length);
+    checks.push({ name: 'config', ok: hasKeys, detail: hasKeys ? `${config.keys.length} api key(s)` : 'no config / no api keys found' });
+    const key = (0, http_client_1.resolveKey)({ flagKey: typeof flags.key === 'string' ? flags.key : undefined, env: process.env, config });
+    checks.push({ name: 'apiKey', ok: !!key, detail: key ? 'resolved (hidden)' : 'none resolved (set --key or $CLAUDE_GATEWAY_API_KEY)' });
+    const flagUrl = typeof flags.url === 'string' ? flags.url : undefined;
+    // The URL the CLI's own API calls will use — that is what `doctor` diagnoses,
+    // so `health` reports on this one and only this one decides the exit code.
+    const baseUrl = (0, http_client_1.resolveUrl)({ flagUrl, env: process.env, config });
+    checks.push({ name: 'url', ok: true, detail: baseUrl });
+    // Resolved once and shared with the alt-address block below: both ask the
+    // same question ("where does the gateway on this host listen?") and reading
+    // the pidfile twice could answer it two different ways mid-command.
+    const localUrl = (0, http_client_1.resolveLocalUrl)({ env: process.env, config });
+    const manager = (0, manager_1.detectManager)();
+    // How the gateway on THIS host is supervised is a verdict only while this
+    // host is what is being diagnosed. Pointed at another gateway (--url or
+    // $CLAUDE_GATEWAY_URL), a laptop with no local install reports `unknown` and
+    // used to fail the whole command even though config, key, url and health all
+    // passed — the same false verdict this command already avoids for the
+    // publicHealth row.
+    const diagnosingThisHost = baseUrl === localUrl;
+    checks.push({
+        name: 'manager',
+        ok: manager !== 'unknown',
+        detail: diagnosingThisHost ? manager : `${manager} (local; not the target of this check)`,
+        info: !diagnosingThisHost,
+    });
+    const health = await (0, health_1.probeHealth)(baseUrl);
+    checks.push({ name: 'health', ok: health.ok, detail: health.detail });
+    // A gateway fronted by a reverse proxy has two addresses for one process.
+    // Probe the one the CLI is *not* using as well: without it, the most
+    // confusing states — proxy down while the gateway is healthy, or the reverse
+    // — appear as a single contradictory line with nothing to explain it. The
+    // second probe is informational: the CLI does not use that address, so its
+    // state must not decide this command's exit code.
+    // Deliberately resolved without `flagUrl`: this is the address of the gateway
+    // *on this host*, which is the useful context when the CLI has been pointed
+    // somewhere else. Passing the flag through would make it echo the target back
+    // as its own alternative, and then offer this host's publicUrl as context for
+    // a question about another host entirely.
+    const publicUrl = (config.publicUrl ?? '').replace(/\/+$/, '');
+    const alt = baseUrl === localUrl
+        ? publicUrl && publicUrl !== baseUrl
+            ? { urlName: 'publicUrl', healthName: 'publicHealth', url: publicUrl }
+            : undefined
+        : manager !== 'unknown'
+            ? { urlName: 'localUrl', healthName: 'localHealth', url: localUrl }
+            : undefined;
+    let altHealth;
+    if (alt) {
+        checks.push({ name: alt.urlName, ok: true, detail: alt.url, info: true });
+        altHealth = await (0, health_1.probeHealth)(alt.url);
+        checks.push({ name: alt.healthName, ok: altHealth.ok, detail: altHealth.detail, info: true });
+    }
+    const allOk = checks.every((c) => c.info || c.ok);
+    const c = (0, colors_1.paletteFor)(process.stderr);
+    // Pad before colouring so escape codes never count toward the column width.
+    const lines = checks.map((chk) => {
+        // `info` is checked first: an advisory row is marked `[--]` whether it
+        // passed or not, so the reader can tell the verdict rows from the context.
+        const mark = chk.info ? c.dim('[--]') : chk.ok ? c.green('[ok]') : c.red('[!!]');
+        return `  ${mark} ${c.bold(chk.name.padEnd(12))} ${chk.detail}`;
+    });
+    // Name the right component. A public URL that answered with a status is not
+    // an unreachable proxy, it is a reachable one rejecting the request — and a
+    // proxy that requires its own credentials is doing its job, not failing.
+    if (alt && altHealth) {
+        if (alt.urlName === 'publicUrl' && health.ok && !altHealth.ok) {
+            lines.push(`  ${c.yellow(altHealth.answered
+                ? `note: the CLI is using the local address; the public URL answered HTTP ${altHealth.status}, so the proxy in front of the gateway rejected an unauthenticated request. External clients are unaffected if they authenticate with the proxy.`
+                : 'note: the CLI is using the local address; the public URL did not answer at all — external clients would not reach the gateway.')}`);
+        }
+        else if (alt.urlName === 'localUrl' && altHealth.ok && !health.ok) {
+            lines.push(`  ${c.yellow(health.answered
+                ? `note: the gateway is up locally, but the URL the CLI was told to use answered HTTP ${health.status} — the proxy in front of it rejected this request. Drop --url / $CLAUDE_GATEWAY_URL to use ${localUrl} instead.`
+                : `note: the gateway is up locally but the URL the CLI was told to use did not answer. Drop --url / $CLAUDE_GATEWAY_URL to use ${localUrl} instead.`)}`);
+        }
+    }
+    process.stderr.write([`${c.bold('claude-gateway doctor')}`, ...lines, ''].join('\n'));
+    (0, output_1.printJson)({ ok: allOk, checks }, flags);
+    return allOk ? 0 : 1;
+}
+//# sourceMappingURL=doctor.js.map

package/dist/cli/commands/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":";;AAmCA,8BAwGC;AA3ID,gDAAwF;AACxF,sCAAqD;AACrD,wCAA2C;AAC3C,sCAAoE;AACpE,sCAAuC;AAiBvC,SAAS,SAAS;IAChB,MAAM,CAAC,GAAG,IAAA,mBAAU,EAAC,IAAA,mBAAU,EAAC,IAAI,CAAC,CAAC,CAAC;IACvC,IAAA,yBAAgB,EACd,IAAI,EACJ,QAAQ,EACR,wDAAwD,EACxD,8EAA8E,EAC9E;QACE,kDAAkD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,wBAAwB;QACvF,4DAA4D;KAC7D,CACF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,KAAuC,EAAE,MAAqB;IAC5F,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACxB,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAK,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,+BAA+B,EAAE,CAAC,CAAC;IAEtI,MAAM,GAAG,GAAG,IAAA,wBAAU,EAAC,EAAE,OAAO,EAAE,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACrH,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sDAAsD,EAAE,CAAC,CAAC;IAEvI,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,OAAO,GAAG,IAAA,wBAAU,EAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAExD,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,QAAQ,GAAG,IAAA,6BAAe,EAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAE/D,MAAM,OAAO,GAAG,IAAA,uBAAa,GAAE,CAAC;IAChC,0EAA0E;IAC1E,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,oBAAoB;IACpB,MAAM,kBAAkB,GAAG,OAAO,KAAK,QAAQ,CAAC;IAChD,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,OAAO,KAAK,SAAS;QACzB,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,wCAAwC;QACzF,IAAI,EAAE,CAAC,kBAAkB;KAC1B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAEtE,0EAA0E;IAC1E,qEAAqE;IACrE,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,kDAAkD;IAClD,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,0CAA0C;IAC1C,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,GAAG,GACP,OAAO,KAAK,QAAQ;QAClB,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,OAAO;YAClC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,EAAE,SAAS,EAAE;YACtE,CAAC,CAAC,SAAS;QACb,CAAC,CAAC,OAAO,KAAK,SAAS;YACrB,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,EAAE;YACnE,CAAC,CAAC,SAAS,CAAC;IAElB,IAAI,SAAkC,CAAC;IACvC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,SAAS,GAAG,MAAM,IAAA,oBAAW,EAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,IAAA,mBAAU,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,4EAA4E;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC/B,uEAAuE;QACvE,2EAA2E;QAC3E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjF,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;IAClE,CAAC,CAAC,CAAC;IACH,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,OAAO,KAAK,WAAW,IAAI,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAC9D,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,CAAC,MAAM,CACX,SAAS,CAAC,QAAQ;gBAChB,CAAC,CAAC,0EAA0E,SAAS,CAAC,MAAM,kJAAkJ;gBAC9O,CAAC,CAAC,gIAAgI,CACrI,EAAE,CACJ,CAAC;QACJ,CAAC;aAAM,IAAI,GAAG,CAAC,OAAO,KAAK,UAAU,IAAI,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACpE,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,CAAC,MAAM,CACX,MAAM,CAAC,QAAQ;gBACb,CAAC,CAAC,sFAAsF,MAAM,CAAC,MAAM,8FAA8F,QAAQ,WAAW;gBACtN,CAAC,CAAC,+HAA+H,QAAQ,WAAW,CACvJ,EAAE,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACtF,IAAA,kBAAS,EAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC"}

package/dist/cli/commands/gateway.d.ts

@@ -0,0 +1,12 @@
+import { CliConfigView } from '../http-client';
+/**
+ * `gateway start|status|restart|stop` — whole-process lifecycle.
+ *
+ * `start` is handled by the boot entry point (src/index.ts), which recognises
+ * it before the CLI is ever imported; it is listed here only so the usage text
+ * and an unknown-verb error stay honest. Restart/stop must be performed by
+ * whatever manager owns the process (it has to stop the very process serving
+ * HTTP), so detection resolves the manager and the action is delegated to it.
+ */
+export declare function runGatewayLifecycle(positionals: string[], flags: Record<string, string | boolean>, config: CliConfigView): Promise<number>;
+//# sourceMappingURL=gateway.d.ts.map

package/dist/cli/commands/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/gateway.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAmB,MAAM,gBAAgB,CAAC;AAMhE;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EAAE,EACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,MAAM,CAAC,CA8BjB"}

package/dist/cli/commands/gateway.js

@@ -0,0 +1,145 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runGatewayLifecycle = runGatewayLifecycle;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const http_client_1 = require("../http-client");
+const health_1 = require("../health");
+const manager_1 = require("../manager");
+const output_1 = require("../output");
+const output_2 = require("../output");
+/**
+ * `gateway start|status|restart|stop` — whole-process lifecycle.
+ *
+ * `start` is handled by the boot entry point (src/index.ts), which recognises
+ * it before the CLI is ever imported; it is listed here only so the usage text
+ * and an unknown-verb error stay honest. Restart/stop must be performed by
+ * whatever manager owns the process (it has to stop the very process serving
+ * HTTP), so detection resolves the manager and the action is delegated to it.
+ */
+async function runGatewayLifecycle(positionals, flags, config) {
+    const verb = positionals[0];
+    if (!verb) {
+        // `gateway --help` is a help request (0); a bare `gateway` is a usage error (1).
+        (0, output_2.writeCommandHelp)(flags.help === true, 'gateway', 'manage the gateway process on this host', 'claude-gateway gateway <start|status|restart|stop>', ['  start is the only command that boots a server; the rest are manager-aware.']);
+        return flags.help === true ? 0 : 1;
+    }
+    switch (verb) {
+        case 'start':
+            // Only reachable when runCli() is called directly (tests, embedding) —
+            // the installed binary routes `gateway start` straight into the server.
+            process.stderr.write('`gateway start` is handled by the claude-gateway entry point, not the CLI runner.\n');
+            return 1;
+        case 'status':
+            return gatewayStatus(flags, config);
+        case 'restart':
+            return gatewayAction('restart');
+        case 'stop':
+            return gatewayAction('stop');
+        default:
+            process.stderr.write(`Unknown: gateway ${verb} (expected start|status|restart|stop)\n`);
+            return 1;
+    }
+}
+async function gatewayStatus(flags, config) {
+    const manager = (0, manager_1.detectManager)();
+    // `manager` describes the process on this host, so `health` must too:
+    // probing config.publicUrl would report a reverse proxy (possibly fronting a
+    // different instance) rather than the gateway this command just detected.
+    const baseUrl = (0, http_client_1.resolveLocalUrl)({ flagUrl: typeof flags.url === 'string' ? flags.url : undefined, env: process.env, config });
+    // `detail` carries what `health` cannot: an address answering 401 or 500 is
+    // not the same failure as one answering nothing, and collapsing both into
+    // "down" throws away the only clue about which one it is.
+    const probe = await (0, health_1.probeHealth)(baseUrl);
+    (0, output_1.printJson)({ manager, url: baseUrl, health: probe.ok ? 'up' : 'down', detail: probe.detail }, flags);
+    return probe.ok ? 0 : 1;
+}
+function gatewayAction(action) {
+    const manager = (0, manager_1.detectManager)();
+    try {
+        switch (manager) {
+            case 'systemd-user':
+                (0, child_process_1.execFileSync)('systemctl', ['--user', action, 'claude-gateway.service'], { stdio: 'inherit' });
+                return Promise.resolve(0);
+            case 'systemd-system': {
+                // A system-scoped unit needs root; announce the escalation instead of
+                // silently invoking sudo, and skip it entirely when already root.
+                const needsSudo = typeof process.getuid === 'function' && process.getuid() !== 0;
+                if (needsSudo) {
+                    process.stderr.write(`Using the system service (may require sudo): systemctl ${action} claude-gateway.service\n`);
+                    (0, child_process_1.execFileSync)('sudo', ['systemctl', action, 'claude-gateway.service'], { stdio: 'inherit' });
+                }
+                else {
+                    (0, child_process_1.execFileSync)('systemctl', [action, 'claude-gateway.service'], { stdio: 'inherit' });
+                }
+                return Promise.resolve(0);
+            }
+            case 'pm2':
+                (0, child_process_1.execFileSync)('pm2', [action, 'gateway'], { stdio: 'inherit' });
+                return Promise.resolve(0);
+            case 'foreground': {
+                const pid = parseInt(fs.readFileSync((0, manager_1.defaultPidfilePath)(), 'utf8').trim(), 10);
+                // The pidfile only proves some process holds this pid. A gateway lost
+                // to SIGKILL or the OOM killer leaves the file behind, and once the pid
+                // is recycled this branch would SIGTERM an unrelated process and report
+                // success. Confirm it is a gateway before signalling it.
+                if (!(0, manager_1.pidLooksLikeGateway)(pid)) {
+                    process.stderr.write(`Pidfile names pid ${pid}, but that process does not look like a gateway — refusing to signal it. ` +
+                        `The gateway likely died without cleaning up; remove ${(0, manager_1.defaultPidfilePath)()} if it is stale.\n`);
+                    return Promise.resolve(1);
+                }
+                process.kill(pid, 'SIGTERM');
+                if (action === 'restart') {
+                    process.stderr.write('Stopped the foreground gateway (SIGTERM) but a bare foreground process has no supervisor to respawn it — ' +
+                        'start it again with `claude-gateway gateway start`, or install a service with `claude-gateway service install`.\n');
+                    // Only the "stop" half of restart happened — a caller/script checking
+                    // the exit code should see this as incomplete, not a successful restart.
+                    return Promise.resolve(1);
+                }
+                process.stderr.write(`Sent SIGTERM to gateway (pid ${pid}).\n`);
+                return Promise.resolve(0);
+            }
+            default:
+                process.stderr.write('Could not detect how the gateway is running (systemd-user/systemd-system/pm2/foreground). Nothing done.\n');
+                return Promise.resolve(1);
+        }
+    }
+    catch (err) {
+        process.stderr.write(`gateway ${action} failed: ${err.message}\n`);
+        return Promise.resolve(1);
+    }
+}
+//# sourceMappingURL=gateway.js.map