@0xmaxma/claude-gateway 1.7.9 → 1.8.0

package/dist/cli/output.d.ts

@@ -0,0 +1,49 @@
+/**
+ * stdout is the CLI's result channel and carries JSON only — help, prompts,
+ * progress and errors all go to stderr, so a caller can pipe stdout straight
+ * into `jq` from any command.
+ *
+ * `compact` (the global `--json` flag) prints one minified line for scripts;
+ * the default is pretty-printed for humans. Either way the output is valid
+ * JSON. Shared so every command formats its result identically.
+ */
+export declare function printResult(data: unknown, compact: boolean): void;
+/** `printResult` driven straight from a parsed flag bag. */
+export declare function printJson(data: unknown, flags: Record<string, string | boolean>): void;
+/**
+ * Wait for stdout/stderr to reach the OS, then exit with `code`.
+ *
+ * When stdout is a pipe Node's writes are asynchronous, so `process.exit()`
+ * discards whatever is still buffered — a large `--json` payload piped into
+ * `jq` arrives truncated at the pipe buffer (64 KiB on Linux) and the pipeline
+ * fails on invalid JSON. Draining first is what makes `printResult` safe to
+ * pipe from any command.
+ *
+ * `process.exitCode` alone is not enough: a stray handle (an interval, a
+ * lingering socket) would keep the CLI alive after its output is done, so the
+ * exit is still explicit. `timeoutMs` bounds the wait — a reader that goes
+ * away mid-write must not hang the CLI.
+ */
+export declare function exitAfterFlush(code: number, timeoutMs?: number): Promise<never>;
+/**
+ * Where a help listing goes.
+ *
+ * An explicitly requested `--help` exits 0: it *is* the command's result, so it
+ * belongs on stdout, where it can be paged, grepped or redirected like any
+ * other output. The same listing printed because the invocation was wrong is
+ * diagnostic and stays on stderr, so stdout still carries results only. Both
+ * cases previously went to stderr, which left `claude-gateway --help | less`
+ * showing an empty screen.
+ */
+export declare function helpStream(requested: boolean): NodeJS.WriteStream;
+/**
+ * The shared shape of a command's help: a bold `claude-gateway <command>`
+ * banner naming what it does, then its usage line, then anything specific.
+ *
+ * Every command renders through this so the surface reads as one program —
+ * `doctor` and `agents` grew a banner while `gateway` and `update` printed a
+ * bare `Usage:` line, which is the kind of drift a shared renderer prevents.
+ * The brand tone stays reserved for the general help banner.
+ */
+export declare function writeCommandHelp(requested: boolean, command: string, summary: string, usage: string, extra?: string[]): void;
+//# sourceMappingURL=output.d.ts.map

package/dist/cli/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/cli/output.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAMjE;AAED,4DAA4D;AAC5D,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,CAEtF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAuBnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC,WAAW,CAEjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,MAAM,EAAO,GACnB,IAAI,CAUN"}

package/dist/cli/output.js

@@ -0,0 +1,101 @@
+"use strict";
+/**
+ * stdout is the CLI's result channel and carries JSON only — help, prompts,
+ * progress and errors all go to stderr, so a caller can pipe stdout straight
+ * into `jq` from any command.
+ *
+ * `compact` (the global `--json` flag) prints one minified line for scripts;
+ * the default is pretty-printed for humans. Either way the output is valid
+ * JSON. Shared so every command formats its result identically.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printResult = printResult;
+exports.printJson = printJson;
+exports.exitAfterFlush = exitAfterFlush;
+exports.helpStream = helpStream;
+exports.writeCommandHelp = writeCommandHelp;
+const colors_1 = require("./colors");
+function printResult(data, compact) {
+    if (typeof data === 'string') {
+        process.stdout.write(data + '\n');
+        return;
+    }
+    process.stdout.write((compact ? JSON.stringify(data) : JSON.stringify(data, null, 2)) + '\n');
+}
+/** `printResult` driven straight from a parsed flag bag. */
+function printJson(data, flags) {
+    printResult(data, flags.json === true);
+}
+/**
+ * Wait for stdout/stderr to reach the OS, then exit with `code`.
+ *
+ * When stdout is a pipe Node's writes are asynchronous, so `process.exit()`
+ * discards whatever is still buffered — a large `--json` payload piped into
+ * `jq` arrives truncated at the pipe buffer (64 KiB on Linux) and the pipeline
+ * fails on invalid JSON. Draining first is what makes `printResult` safe to
+ * pipe from any command.
+ *
+ * `process.exitCode` alone is not enough: a stray handle (an interval, a
+ * lingering socket) would keep the CLI alive after its output is done, so the
+ * exit is still explicit. `timeoutMs` bounds the wait — a reader that goes
+ * away mid-write must not hang the CLI.
+ */
+async function exitAfterFlush(code, timeoutMs = 2000) {
+    process.exitCode = code;
+    const drain = (s) => new Promise((resolve) => {
+        if (s.writableLength === 0 || s.destroyed || s.writableEnded) {
+            resolve();
+            return;
+        }
+        // An empty write's callback runs after every pending chunk has flushed.
+        s.write('', () => resolve());
+        s.once('error', () => resolve());
+    });
+    let timer;
+    const deadline = new Promise((resolve) => {
+        timer = setTimeout(resolve, timeoutMs);
+        timer.unref?.();
+    });
+    try {
+        await Promise.race([Promise.all([drain(process.stdout), drain(process.stderr)]), deadline]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+    process.exit(code);
+}
+/**
+ * Where a help listing goes.
+ *
+ * An explicitly requested `--help` exits 0: it *is* the command's result, so it
+ * belongs on stdout, where it can be paged, grepped or redirected like any
+ * other output. The same listing printed because the invocation was wrong is
+ * diagnostic and stays on stderr, so stdout still carries results only. Both
+ * cases previously went to stderr, which left `claude-gateway --help | less`
+ * showing an empty screen.
+ */
+function helpStream(requested) {
+    return requested ? process.stdout : process.stderr;
+}
+/**
+ * The shared shape of a command's help: a bold `claude-gateway <command>`
+ * banner naming what it does, then its usage line, then anything specific.
+ *
+ * Every command renders through this so the surface reads as one program —
+ * `doctor` and `agents` grew a banner while `gateway` and `update` printed a
+ * bare `Usage:` line, which is the kind of drift a shared renderer prevents.
+ * The brand tone stays reserved for the general help banner.
+ */
+function writeCommandHelp(requested, command, summary, usage, extra = []) {
+    const stream = helpStream(requested);
+    const c = (0, colors_1.paletteFor)(stream);
+    const lines = [
+        `${c.bold(`claude-gateway ${command}`)} — ${summary}`,
+        '',
+        `${c.bold('Usage:')} ${usage}`,
+        ...(extra.length ? ['', ...extra] : []),
+    ];
+    stream.write(lines.join('\n') + '\n');
+}
+//# sourceMappingURL=output.js.map

package/dist/cli/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/cli/output.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAGH,kCAMC;AAGD,8BAEC;AAgBD,wCAuBC;AAYD,gCAEC;AAWD,4CAgBC;AA5FD,qCAAsC;AACtC,SAAgB,WAAW,CAAC,IAAa,EAAE,OAAgB;IACzD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAChG,CAAC;AAED,4DAA4D;AAC5D,SAAgB,SAAS,CAAC,IAAa,EAAE,KAAuC;IAC9E,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,SAAS,GAAG,IAAI;IACjE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAiB,EAAE,CACrD,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5B,IAAI,CAAC,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;YAC7D,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,wEAAwE;QACxE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IACL,IAAI,KAAiC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC7C,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACvC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9F,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,UAAU,CAAC,SAAkB;IAC3C,OAAO,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAC9B,SAAkB,EAClB,OAAe,EACf,OAAe,EACf,KAAa,EACb,QAAkB,EAAE;IAEpB,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,OAAO,EAAE,CAAC,MAAM,OAAO,EAAE;QACrD,EAAE;QACF,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE;QAC9B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AACxC,CAAC"}

package/dist/cli/prompt.d.ts

@@ -0,0 +1,29 @@
+import * as readline from 'readline';
+/**
+ * Small interactive-prompt helpers shared by CLI wizards (`agents create`,
+ * `agents update`). Deliberately minimal — plain readline, no raw-mode
+ * arrow-key UI — so it works over any TTY without extra terminal handling.
+ */
+export declare function createRl(): readline.Interface;
+export declare function ask(rl: readline.Interface, question: string): Promise<string>;
+/** Reads lines until a blank line (after at least one non-blank line). */
+export declare function askMultiline(rl: readline.Interface, intro: string): Promise<string>;
+/** `write` defaults to stdout via console.log (the wizards' channel). Commands
+ *  that reserve stdout for JSON results pass a stderr writer instead. */
+export declare function printFilePreview(filename: string, content: string, write?: (line: string) => void): void;
+/**
+ * Open $VISUAL/$EDITOR/vim/vi/nano on a temp copy of `content`; returns the
+ * edited text, or null if no editor could be launched.
+ *
+ * The scratch file lives in a fresh `mkdtemp` directory (mode 0700) rather than
+ * at a fixed path under the shared temp directory. A predictable name such as
+ * `/tmp/claude-gateway-AGENTS.md` can be pre-created by another local user as a
+ * symlink: the write then lands on whatever the link points at, and the
+ * read-back feeds that user's content into the file the wizard uploads.
+ */
+export declare function editInEditor(content: string, tmpName: string): string | null;
+/** Preview each file and let the user accept / edit / skip it. Required files
+ *  (not in `optional`) cannot be skipped. Returns the accepted map in the same
+ *  order as `files`. */
+export declare function previewAndAccept(rl: readline.Interface, files: Map<string, string>, optional: ReadonlySet<string>): Promise<Map<string, string>>;
+//# sourceMappingURL=prompt.d.ts.map

package/dist/cli/prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../../src/cli/prompt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAGrC;;;;GAIG;AAEH,wBAAgB,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAE7C;AAED,wBAAgB,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7E;AAED,0EAA0E;AAC1E,wBAAsB,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASzF;AAID;yEACyE;AACzE,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAkC,GAC1D,IAAI,CAMN;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsB5E;AAED;;wBAEwB;AACxB,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,QAAQ,CAAC,SAAS,EACtB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,GAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiC9B"}

package/dist/cli/prompt.js

@@ -0,0 +1,154 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRl = createRl;
+exports.ask = ask;
+exports.askMultiline = askMultiline;
+exports.printFilePreview = printFilePreview;
+exports.editInEditor = editInEditor;
+exports.previewAndAccept = previewAndAccept;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const readline = __importStar(require("readline"));
+const child_process_1 = require("child_process");
+/**
+ * Small interactive-prompt helpers shared by CLI wizards (`agents create`,
+ * `agents update`). Deliberately minimal — plain readline, no raw-mode
+ * arrow-key UI — so it works over any TTY without extra terminal handling.
+ */
+function createRl() {
+    return readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+}
+function ask(rl, question) {
+    return new Promise((resolve) => rl.question(question, (answer) => resolve(answer)));
+}
+/** Reads lines until a blank line (after at least one non-blank line). */
+async function askMultiline(rl, intro) {
+    console.log(intro);
+    const lines = [];
+    while (true) {
+        const line = await ask(rl, '');
+        if (line.trim() === '' && lines.length > 0)
+            break;
+        if (line.trim() !== '')
+            lines.push(line);
+    }
+    return lines.join('\n');
+}
+const SEPARATOR_WIDTH = 42;
+/** `write` defaults to stdout via console.log (the wizards' channel). Commands
+ *  that reserve stdout for JSON results pass a stderr writer instead. */
+function printFilePreview(filename, content, write = (line) => console.log(line)) {
+    const label = `─── ${filename} `;
+    const padding = Math.max(0, SEPARATOR_WIDTH - label.length);
+    write('\n' + label + '─'.repeat(padding));
+    write(content);
+    write('─'.repeat(SEPARATOR_WIDTH));
+}
+/**
+ * Open $VISUAL/$EDITOR/vim/vi/nano on a temp copy of `content`; returns the
+ * edited text, or null if no editor could be launched.
+ *
+ * The scratch file lives in a fresh `mkdtemp` directory (mode 0700) rather than
+ * at a fixed path under the shared temp directory. A predictable name such as
+ * `/tmp/claude-gateway-AGENTS.md` can be pre-created by another local user as a
+ * symlink: the write then lands on whatever the link points at, and the
+ * read-back feeds that user's content into the file the wizard uploads.
+ */
+function editInEditor(content, tmpName) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'claude-gateway-'));
+    // `basename` so a caller's key can never escape the scratch directory.
+    const tmpFile = path.join(dir, path.basename(tmpName) || 'draft');
+    const cleanup = () => {
+        try {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+        catch {
+            /* best effort — the directory is per-invocation and 0700 */
+        }
+    };
+    try {
+        fs.writeFileSync(tmpFile, content, 'utf8');
+        const candidates = [process.env['VISUAL'], process.env['EDITOR'], 'vim', 'vi', 'nano'].filter(Boolean);
+        for (const candidate of candidates) {
+            const result = (0, child_process_1.spawnSync)(candidate, [tmpFile], { stdio: 'inherit' });
+            if (!result.error)
+                return fs.readFileSync(tmpFile, 'utf8');
+        }
+        return null;
+    }
+    finally {
+        cleanup();
+    }
+}
+/** Preview each file and let the user accept / edit / skip it. Required files
+ *  (not in `optional`) cannot be skipped. Returns the accepted map in the same
+ *  order as `files`. */
+async function previewAndAccept(rl, files, optional) {
+    const accepted = new Map();
+    for (const [filename, content] of files) {
+        printFilePreview(filename, content);
+        while (true) {
+            const answer = (await ask(rl, 'Accept? (y/edit/skip) [y]: ')).trim().toLowerCase() || 'y';
+            if (answer === 'y' || answer === 'yes') {
+                accepted.set(filename, content);
+                break;
+            }
+            if (answer === 'edit') {
+                const edited = editInEditor(content, filename);
+                if (edited === null) {
+                    console.log('  Could not open an editor (set $EDITOR and try again, or choose y/skip).');
+                    continue;
+                }
+                printFilePreview(filename, edited);
+                console.log('  (edited, accepted)');
+                accepted.set(filename, edited);
+                break;
+            }
+            if (answer === 'skip') {
+                if (optional.has(filename)) {
+                    console.log(`  Skipping ${filename}`);
+                    break;
+                }
+                console.log(`  Cannot skip ${filename} — it is required.`);
+                continue;
+            }
+            console.log('  Please enter y, edit, or skip.');
+        }
+    }
+    return accepted;
+}
+//# sourceMappingURL=prompt.js.map

package/dist/cli/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../../src/cli/prompt.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,4BAEC;AAED,kBAEC;AAGD,oCASC;AAMD,4CAUC;AAYD,oCAsBC;AAKD,4CAqCC;AA1HD,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,mDAAqC;AACrC,iDAA0C;AAE1C;;;;GAIG;AAEH,SAAgB,QAAQ;IACtB,OAAO,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,SAAgB,GAAG,CAAC,EAAsB,EAAE,QAAgB;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,0EAA0E;AACnE,KAAK,UAAU,YAAY,CAAC,EAAsB,EAAE,KAAa;IACtE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM;QAClD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;yEACyE;AACzE,SAAgB,gBAAgB,CAC9B,QAAgB,EAChB,OAAe,EACf,QAAgC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAE3D,MAAM,KAAK,GAAG,OAAO,QAAQ,GAAG,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,GAAG,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;IACf,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,YAAY,CAAC,OAAe,EAAE,OAAe;IAC3D,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtE,uEAAuE;IACvE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC;QACnH,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,MAAM,CAAC,KAAK;gBAAE,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;wBAEwB;AACjB,KAAK,UAAU,gBAAgB,CACpC,EAAsB,EACtB,KAA0B,EAC1B,QAA6B;IAE7B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACxC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpC,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC;YAC1F,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACvC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAChC,MAAM;YACR,CAAC;YACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC/C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;oBACpB,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;oBACzF,SAAS;gBACX,CAAC;gBACD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;gBACpC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC/B,MAAM;YACR,CAAC;YACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC3B,OAAO,CAAC,GAAG,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC;oBACtC,MAAM;gBACR,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,oBAAoB,CAAC,CAAC;gBAC3D,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/cli/redact.d.ts

@@ -0,0 +1,3 @@
+export declare function redactLine(line: string): string;
+export declare function redactLines(lines: string[]): string[];
+//# sourceMappingURL=redact.d.ts.map

package/dist/cli/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/cli/redact.ts"],"names":[],"mappings":"AAoBA,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAErD"}

package/dist/cli/redact.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactLine = redactLine;
+exports.redactLines = redactLines;
+/**
+ * Redaction for the debug bundle. A gateway session log can contain arbitrary
+ * text; before any of it is put into a shareable bundle, mask the things that
+ * must never leave the machine — bearer tokens, API-key/secret assignments, and
+ * long opaque token-like strings. submit-diag lines are already redacted at the
+ * source (length + hash), so this is defense in depth.
+ *
+ * Pure and deterministic so it can be unit-tested.
+ */
+const RULES = [
+    // Authorization: Bearer <token>  /  "Bearer xxxxx"
+    [/\bBearer\s+[A-Za-z0-9._\-]+/gi, 'Bearer «redacted»'],
+    // key/token/secret/password : "value"  or  = value  (json/env/prose)
+    [/\b(api[_-]?key|apikey|token|secret|password|passwd|authorization)\b(["']?\s*[:=]\s*["']?)([^\s"',}]+)/gi, '$1$2«redacted»'],
+    // OpenAI/Anthropic-style keys
+    [/\b(sk|pk|ak)-[A-Za-z0-9]{8,}/g, '«redacted-key»'],
+    // Long opaque tokens (>=32 chars of key-ish alphabet) not already handled
+    [/\b[A-Za-z0-9_\-]{32,}\b/g, '«redacted-token»'],
+];
+function redactLine(line) {
+    let out = line;
+    for (const [re, repl] of RULES)
+        out = out.replace(re, repl);
+    return out;
+}
+function redactLines(lines) {
+    return lines.map(redactLine);
+}
+//# sourceMappingURL=redact.js.map

package/dist/cli/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/cli/redact.ts"],"names":[],"mappings":";;AAoBA,gCAIC;AAED,kCAEC;AA5BD;;;;;;;;GAQG;AACH,MAAM,KAAK,GAA4B;IACrC,mDAAmD;IACnD,CAAC,+BAA+B,EAAE,mBAAmB,CAAC;IACtD,qEAAqE;IACrE,CAAC,yGAAyG,EAAE,gBAAgB,CAAC;IAC7H,8BAA8B;IAC9B,CAAC,+BAA+B,EAAE,gBAAgB,CAAC;IACnD,0EAA0E;IAC1E,CAAC,0BAA0B,EAAE,kBAAkB,CAAC;CACjD,CAAC;AAEF,SAAgB,UAAU,CAAC,IAAY;IACrC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,KAAK;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,WAAW,CAAC,KAAe;IACzC,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAC/B,CAAC"}

package/dist/cli/types.d.ts

@@ -0,0 +1,22 @@
+/** Types shared between the CLI runtime and the generated command table. */
+export interface GeneratedFlag {
+    name: string;
+    in: 'query' | 'body';
+    boolean?: boolean;
+    required?: boolean;
+    description?: string;
+}
+/** One friendly `<noun> <verb>` command, derived from a route's CLI mapping. */
+export interface GeneratedCommand {
+    noun: string;
+    verb: string;
+    method: string;
+    /** API path with `:param` placeholders (mounted under /api server-side). */
+    path: string;
+    /** Positional argument names, in order, filling the path params. */
+    args: string[];
+    flags: GeneratedFlag[];
+    summary: string;
+    auth: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/cli/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/cli/types.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,GAAG,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd"}

package/dist/cli/types.js

@@ -0,0 +1,4 @@
+"use strict";
+/** Types shared between the CLI runtime and the generated command table. */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/cli/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/cli/types.ts"],"names":[],"mappings":";AAAA,4EAA4E"}

package/dist/config/bootstrap.d.ts

@@ -0,0 +1,33 @@
+export interface BootstrapResult {
+    created: boolean;
+    /** Present only when `created` is true — the generated admin key is not recoverable afterward. */
+    adminKey?: string;
+}
+/**
+ * Create config.json from the template with a fresh random admin API key when
+ * no config file exists yet (genuine first run). Never touches an existing file.
+ *
+ * Reuses the same template-cleaning path as migration (`loadCleanTemplate` +
+ * `stripIgnoredPaths`) so a fresh install starts on the current `configVersion`
+ * with the same defaults migration would otherwise converge it to — the only
+ * addition is a real `gateway.api.keys` admin entry, since `_migration.ignorePaths`
+ * strips that block out (it normally holds unresolved `${VAR}` placeholders that
+ * would leak into the file with no matching env var).
+ */
+export declare function ensureConfigExists(configPath: string, templatePath: string): BootstrapResult;
+/**
+ * The lines printed once, after a config has been generated on first run.
+ *
+ * The admin key is deliberately absent. config.json is written 0600 precisely
+ * to keep it away from other local users; echoing it to stdout hands it to the
+ * journal under a service unit — or to `docker logs` — where it persists with
+ * weaker protection than the file it was just written to, and outlives the
+ * process that printed it. The last four characters are enough to tell two keys
+ * apart when checking which one a client is using, and not enough to
+ * authenticate with.
+ *
+ * Pure, so the "never prints the key" property is testable rather than a
+ * property of a console.log nobody exercises.
+ */
+export declare function firstRunNotice(configPath: string, adminKey: string): string[];
+//# sourceMappingURL=bootstrap.d.ts.map

package/dist/config/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/config/bootstrap.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,eAAe,CA2C5F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ7E"}

package/dist/config/bootstrap.js

@@ -0,0 +1,117 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureConfigExists = ensureConfigExists;
+exports.firstRunNotice = firstRunNotice;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto_1 = require("crypto");
+const migrator_1 = require("./migrator");
+/**
+ * Create config.json from the template with a fresh random admin API key when
+ * no config file exists yet (genuine first run). Never touches an existing file.
+ *
+ * Reuses the same template-cleaning path as migration (`loadCleanTemplate` +
+ * `stripIgnoredPaths`) so a fresh install starts on the current `configVersion`
+ * with the same defaults migration would otherwise converge it to — the only
+ * addition is a real `gateway.api.keys` admin entry, since `_migration.ignorePaths`
+ * strips that block out (it normally holds unresolved `${VAR}` placeholders that
+ * would leak into the file with no matching env var).
+ */
+function ensureConfigExists(configPath, templatePath) {
+    if (fs.existsSync(configPath)) {
+        return { created: false };
+    }
+    let config;
+    try {
+        const { template, ignorePaths } = (0, migrator_1.loadCleanTemplate)(templatePath);
+        (0, migrator_1.stripIgnoredPaths)(template, ignorePaths);
+        config = template;
+    }
+    catch {
+        config = { gateway: { logDir: '~/.claude-gateway/logs', timezone: 'UTC' } };
+    }
+    config.agents = [];
+    const adminKey = (0, crypto_1.randomBytes)(24).toString('hex');
+    const gateway = (config.gateway ?? (config.gateway = {}));
+    gateway.api = {
+        keys: [
+            { key: adminKey, description: 'Admin (auto-generated on first run)', agents: '*', admin: true },
+        ],
+    };
+    fs.mkdirSync(path.dirname(configPath), { recursive: true });
+    try {
+        // 'wx' fails with EEXIST instead of overwriting if another process won a
+        // concurrent first-boot race; mode 0o600 keeps the embedded admin key
+        // from being readable by other local users (matches installer.ts's
+        // convention for secret-bearing files).
+        fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n', {
+            encoding: 'utf-8',
+            mode: 0o600,
+            flag: 'wx',
+        });
+    }
+    catch (err) {
+        if (err.code === 'EEXIST') {
+            return { created: false };
+        }
+        throw err;
+    }
+    return { created: true, adminKey };
+}
+/**
+ * The lines printed once, after a config has been generated on first run.
+ *
+ * The admin key is deliberately absent. config.json is written 0600 precisely
+ * to keep it away from other local users; echoing it to stdout hands it to the
+ * journal under a service unit — or to `docker logs` — where it persists with
+ * weaker protection than the file it was just written to, and outlives the
+ * process that printed it. The last four characters are enough to tell two keys
+ * apart when checking which one a client is using, and not enough to
+ * authenticate with.
+ *
+ * Pure, so the "never prints the key" property is testable rather than a
+ * property of a console.log nobody exercises.
+ */
+function firstRunNotice(configPath, adminKey) {
+    const tail = adminKey.slice(-4);
+    return [
+        `[gateway] No config found — created one at ${configPath}`,
+        `[gateway] A fresh admin API key was generated (ends …${tail}) and stored there, mode 0600.`,
+        `[gateway] The CLI (claude-gateway agents create, etc.) reads it from ${configPath} automatically;`,
+        `[gateway] for another machine, copy it out of that file rather than from this log.`,
+    ];
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/config/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/config/bootstrap.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,gDA2CC;AAgBD,wCAQC;AAzFD,uCAAyB;AACzB,2CAA6B;AAC7B,mCAAqC;AACrC,yCAAkE;AAQlE;;;;;;;;;;GAUG;AACH,SAAgB,kBAAkB,CAAC,UAAkB,EAAE,YAAoB;IACzE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAA,4BAAiB,EAAC,YAAY,CAAC,CAAC;QAClE,IAAA,4BAAiB,EAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACzC,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IAEnB,MAAM,QAAQ,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,KAAd,MAAM,CAAC,OAAO,GAAK,EAAE,EAA4B,CAAC;IACnE,OAAO,CAAC,GAAG,GAAG;QACZ,IAAI,EAAE;YACJ,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,qCAAqC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE;SAChG;KACF,CAAC;IAEF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,yEAAyE;QACzE,sEAAsE;QACtE,mEAAmE;QACnE,wCAAwC;QACxC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;YACnE,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,cAAc,CAAC,UAAkB,EAAE,QAAgB;IACjE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO;QACL,8CAA8C,UAAU,EAAE;QAC1D,wDAAwD,IAAI,gCAAgC;QAC5F,wEAAwE,UAAU,iBAAiB;QACnG,oFAAoF;KACrF,CAAC;AACJ,CAAC"}

package/dist/config/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,EAAE,EAAE,MAAM;CAIvB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAuED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,CA2I5D"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,EAAE,EAAE,MAAM;CAIvB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAuED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,CA+I5D"}

package/dist/config/loader.js

@@ -237,7 +237,11 @@ function loadConfig(configPath) {
             throw err;
         }
     }
-    if (interpolatedAgents.length === 0) {
+    // A genuinely empty "agents": [] is a valid bootstrap state (start the gateway,
+    // then use `claude-gateway agents create` to add the first one). Only error when
+    // agents WERE declared but every single one got filtered out — that's a real
+    // misconfiguration (e.g. a missing ${VAR}), not an intentional empty install.
+    if (interpolatedAgents.length === 0 && config.agents.length > 0) {
         const bakPath = configPath + '.bak';
         const migrationHint = fs.existsSync(bakPath)
             ? ` A migration backup exists at "${bakPath}" — this may be a migration issue where credential fields were incorrectly injected into your agents. Check the backup and restore if needed.`