@abot-ai/runtime 1.3.1 → 1.5.0

package/dist/src/web-ui/local-runtime/conversation-file-native-request.js

@@ -0,0 +1,72 @@
+import { isIP } from "node:net";
+import { ConversationFileError } from "./conversation-file-format.js";
+function isLoopbackIp(value) {
+    if (!value)
+        return false;
+    const address = value.replace(/^\[|\]$/g, "");
+    const family = isIP(address);
+    if (family === 4)
+        return address.startsWith("127.");
+    if (family !== 6)
+        return false;
+    try {
+        const normalized = new URL("http://[" + address + "]").hostname;
+        if (normalized === "[::1]")
+            return true;
+        return /^\[::ffff:7f[0-9a-f]{2}:/.test(normalized);
+    }
+    catch {
+        // Scoped IPv6 addresses may pass isIP but are not URL hostnames.
+        return false;
+    }
+}
+function readLocalAuthority(request) {
+    if (!isLoopbackIp(request.socket.remoteAddress))
+        return undefined;
+    if (!isLoopbackIp(request.socket.localAddress))
+        return undefined;
+    const host = request.headers.host;
+    if (!host || /[\s,/\\?#@]/u.test(host))
+        return undefined;
+    const secure = "encrypted" in request.socket && request.socket.encrypted;
+    try {
+        const authority = new URL((secure ? "https://" : "http://") + host);
+        const hostname = authority.hostname.toLowerCase().replace(/\.$/, "");
+        if (hostname !== "localhost" && !isLoopbackIp(hostname))
+            return undefined;
+        const defaultPort = secure ? 443 : 80;
+        const port = authority.port ? Number(authority.port) : defaultPort;
+        if (port !== request.socket.localPort)
+            return undefined;
+        return authority;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Only a browser connected directly to this computer may offer native opening. */
+export function isLocalNativeFileRequest(request) {
+    if (request.headers["sec-fetch-site"] === "cross-site")
+        return false;
+    const authority = readLocalAuthority(request);
+    if (!authority)
+        return false;
+    const origin = request.headers.origin;
+    if (origin === undefined)
+        return true;
+    return origin === authority.origin;
+}
+function hasNativeOpenOrigin(request) {
+    if (!request.headers.origin)
+        return false;
+    return isLocalNativeFileRequest(request);
+}
+export function assertNativeFileOpenRequest(request, platform) {
+    if (platform !== "darwin")
+        throw new ConversationFileError("native_open_unavailable", 415, "Opening in an app is available on this Mac only.");
+    if (!hasNativeOpenOrigin(request))
+        throw new ConversationFileError("native_open_request_rejected", 403, "Open files from the Web UI on this computer.");
+    const contentType = request.headers["content-type"] ?? "";
+    if (contentType.split(";", 1)[0].trim().toLowerCase() !== "application/json")
+        throw new ConversationFileError("native_open_request_rejected", 415, "Opening a file requires a JSON request.");
+}

package/dist/src/web-ui/local-runtime/conversation-file-routes.d.ts

@@ -0,0 +1,11 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { RuntimeEnvironmentRegistry } from "./environment-registry.js";
+import type { LocalRequestExecution } from "./request-execution.js";
+import { type ConversationNativeOpenOptions } from "./conversation-file-native-open.js";
+/** A recorded tool completion is the only authority; no browser path is accepted. */
+export declare class ConversationFileRoutes {
+    private readonly nativeOpen;
+    private readonly access;
+    constructor(environments: Pick<RuntimeEnvironmentRegistry, "environmentConfig" | "setupRequirement" | "get">, requests: LocalRequestExecution, defaultEnvironmentId: () => string, nativeOpen?: ConversationNativeOpenOptions);
+    handle(route: string, request: IncomingMessage, response: ServerResponse): Promise<boolean>;
+}

package/dist/src/web-ui/local-runtime/conversation-file-routes.js

@@ -0,0 +1,105 @@
+import { ConversationFileAccess, readConversationFileReference, } from "./conversation-file-access.js";
+import { readConversationFile, } from "./conversation-file-content.js";
+import { ConversationFileError, conversationDownloadDisposition, } from "./conversation-file-format.js";
+import { assertNativeFileOpenRequest } from "./conversation-file-native-request.js";
+import { canOpenNativeConversationFile, openNativeConversationFile, } from "./conversation-file-native-open.js";
+import { withConversationFileTarget } from "./conversation-file-target.js";
+import { readBody, readJsonBody, sendJson } from "./http.js";
+function hasSameOrigin(request) {
+    if (request.headers["sec-fetch-site"] === "cross-site")
+        return false;
+    const origin = request.headers.origin;
+    if (!origin)
+        return true;
+    try {
+        const secure = "encrypted" in request.socket && request.socket.encrypted;
+        const expected = (secure ? "https://" : "http://") + request.headers.host;
+        return new URL(origin).origin === expected;
+    }
+    catch {
+        return false;
+    }
+}
+function assertFileRequestOrigin(request) {
+    if (hasSameOrigin(request))
+        return;
+    throw new ConversationFileError("file_request_rejected", 403, "Files can only be opened from this Web UI.");
+}
+function contentMode(url) {
+    if (url.searchParams.get("download") === "1")
+        return "download";
+    if (url.searchParams.get("content") === "1")
+        return "image";
+    return "preview";
+}
+async function assertEmptyNativeOpenBody(request) {
+    try {
+        const body = readJsonBody(await readBody(request, { maxBytes: 1024 }));
+        if (Object.keys(body).length === 0)
+            return;
+    }
+    catch {
+        // The only file authority is the conversation reference in the URL.
+    }
+    throw new ConversationFileError("file_reference_invalid", 400, "Open this file from the conversation preview.");
+}
+/** A recorded tool completion is the only authority; no browser path is accepted. */
+export class ConversationFileRoutes {
+    nativeOpen;
+    access;
+    constructor(environments, requests, defaultEnvironmentId, nativeOpen = {}) {
+        this.nativeOpen = nativeOpen;
+        this.access = new ConversationFileAccess(environments, requests, defaultEnvironmentId);
+    }
+    async handle(route, request, response) {
+        const isPreviewRead = route === "chat/files" && request.method === "GET";
+        const isNativeOpen = route === "chat/files/open" && request.method === "POST";
+        if (!isPreviewRead && !isNativeOpen)
+            return false;
+        response.setHeader("cache-control", "private, no-store");
+        response.setHeader("x-content-type-options", "nosniff");
+        response.setHeader("cross-origin-resource-policy", "same-origin");
+        response.setHeader("content-security-policy", "default-src 'none'; sandbox");
+        try {
+            assertFileRequestOrigin(request);
+            const platform = this.nativeOpen.platform ?? process.platform;
+            if (isNativeOpen) {
+                assertNativeFileOpenRequest(request, platform);
+                await assertEmptyNativeOpenBody(request);
+            }
+            const url = new URL(request.url || "/", "http://localhost");
+            const reference = readConversationFileReference(url);
+            const authority = await this.access.authorize(reference);
+            if (isNativeOpen) {
+                await withConversationFileTarget(authority.receipt, authority.paths, (file) => openNativeConversationFile(file, authority.assertCurrent, this.nativeOpen.launch));
+                sendJson(response, 200, { ok: true });
+                return true;
+            }
+            const mode = contentMode(url);
+            const result = await readConversationFile(authority.receipt, authority.paths, mode, (file) => canOpenNativeConversationFile(request, file, platform));
+            await authority.assertCurrent();
+            if (mode === "preview") {
+                sendJson(response, 200, { ok: true, file: result.file });
+                return true;
+            }
+            const bytes = result.bytes;
+            response.setHeader("content-length", String(bytes.byteLength));
+            response.setHeader("content-type", mode === "image" ? result.file.mimeType : "application/octet-stream");
+            if (mode === "download")
+                response.setHeader("content-disposition", conversationDownloadDisposition(result.file.name));
+            response.writeHead(200);
+            response.end(bytes);
+        }
+        catch (error) {
+            const failure = error instanceof ConversationFileError
+                ? error
+                : new ConversationFileError("conversation_file_unavailable", 404, "This file is no longer available in this conversation.");
+            sendJson(response, failure.statusCode, {
+                ok: false,
+                error: failure.code,
+                message: failure.message,
+            });
+        }
+        return true;
+    }
+}

package/dist/src/web-ui/local-runtime/conversation-file-target.d.ts

@@ -0,0 +1,14 @@
+import { type BigIntStats } from "node:fs";
+import { type FileHandle } from "node:fs/promises";
+import type { ToolFileOutputReceipt } from "../../capabilities/file-output-presentation.js";
+import type { ResolvedRuntimeToolPath } from "../../capabilities/tool-types.js";
+import type { RuntimePaths } from "../../runtime/ports.js";
+export type OpenedConversationFile = {
+    target: ResolvedRuntimeToolPath;
+    handle: FileHandle;
+    stats: BigIntStats;
+    assertCurrent: () => Promise<void>;
+    assertCurrentForNativeOpen: () => void;
+};
+/** Keeps the recorded file descriptor alive for the complete caller operation. */
+export declare function withConversationFileTarget<T>(receipt: ToolFileOutputReceipt, paths: RuntimePaths, action: (file: OpenedConversationFile) => Promise<T>): Promise<T>;

package/dist/src/web-ui/local-runtime/conversation-file-target.js

@@ -0,0 +1,158 @@
+import { constants, fstatSync, lstatSync, realpathSync, statSync, } from "node:fs";
+import { open, realpath, stat } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { createRuntimeToolPathResolver } from "../../runtime/capabilities/runtime-target-path.js";
+import { readFileOutputRootId } from "../../runtime/capabilities/file-output-root-identity.js";
+import { ConversationFileError } from "./conversation-file-format.js";
+function unavailable() {
+    throw new ConversationFileError("conversation_file_unavailable", 404, "This file is no longer available in its original location.");
+}
+function changedRoot() {
+    throw new ConversationFileError("conversation_file_root_changed", 409, "The configured location changed. This earlier file cannot be opened here.");
+}
+function changedFile() {
+    throw new ConversationFileError("conversation_file_changed", 409, "The file changed while it was being read. Open it again to see the current content.");
+}
+async function assertRecordedRootIdentity(receipt, canonicalRoot) {
+    let currentRootId;
+    try {
+        currentRootId = readFileOutputRootId(receipt.location, canonicalRoot);
+    }
+    catch {
+        return changedRoot();
+    }
+    if (currentRootId !== receipt.rootId)
+        changedRoot();
+}
+async function resolveRecordedFile(receipt, paths) {
+    const resolver = createRuntimeToolPathResolver(paths);
+    const options = { allowedLocations: [receipt.location], requirePath: true };
+    let root;
+    try {
+        root = resolver.resolve(receipt.location === "workspace" ? "workspace" : ".", options);
+    }
+    catch {
+        return changedRoot();
+    }
+    await assertRecordedRootIdentity(receipt, root.rootPath);
+    let target;
+    try {
+        target = resolver.resolve(resolve(root.rootPath, receipt.relativePath), options);
+    }
+    catch {
+        return unavailable();
+    }
+    if (target.location !== receipt.location)
+        unavailable();
+    if (target.relativePath !== receipt.relativePath)
+        unavailable();
+    if (target.logicalPath !== receipt.logicalPath)
+        unavailable();
+    if (target.rootPath !== root.rootPath)
+        changedRoot();
+    return target;
+}
+function isContainedFile(root, path) {
+    const value = relative(root, path);
+    if (!value || isAbsolute(value))
+        return false;
+    if (value === "..")
+        return false;
+    return !value.startsWith(".." + sep);
+}
+function sameFileIdentity(left, right) {
+    if (left.dev !== right.dev)
+        return false;
+    return left.ino === right.ino;
+}
+function sameFileVersion(left, right) {
+    if (!sameFileIdentity(left, right))
+        return false;
+    if (left.size !== right.size)
+        return false;
+    if (left.mtimeNs !== right.mtimeNs)
+        return false;
+    return left.ctimeNs === right.ctimeNs;
+}
+async function assertOpenedFileAuthority(target, opened, receipt) {
+    const root = await realpath(target.rootPath);
+    await assertRecordedRootIdentity(receipt, root);
+    const canonicalPath = await realpath(target.absolutePath);
+    if (!isContainedFile(root, canonicalPath))
+        unavailable();
+    const current = await stat(canonicalPath, { bigint: true });
+    if (!current.isFile())
+        unavailable();
+    if (!sameFileIdentity(opened, current))
+        changedFile();
+}
+/** Keeps the recorded file descriptor alive for the complete caller operation. */
+export async function withConversationFileTarget(receipt, paths, action) {
+    let handle;
+    try {
+        const target = await resolveRecordedFile(receipt, paths);
+        if (typeof constants.O_NOFOLLOW !== "number")
+            throw new ConversationFileError("conversation_file_platform_unsupported", 415, "This platform cannot safely open a file preview.");
+        handle = await open(target.absolutePath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const openedHandle = handle;
+        const before = await handle.stat({ bigint: true });
+        if (!before.isFile())
+            unavailable();
+        if (before.size > BigInt(Number.MAX_SAFE_INTEGER))
+            unavailable();
+        await assertOpenedFileAuthority(target, before, receipt);
+        return await action({
+            target,
+            handle,
+            stats: before,
+            assertCurrent: async () => {
+                const after = await openedHandle.stat({ bigint: true });
+                if (!sameFileVersion(before, after))
+                    changedFile();
+                const currentTarget = await resolveRecordedFile(receipt, paths);
+                if (currentTarget.absolutePath !== target.absolutePath)
+                    unavailable();
+                await assertOpenedFileAuthority(target, after, receipt);
+            },
+            assertCurrentForNativeOpen: () => {
+                assertNativeFileDispatchAuthority(target, openedHandle.fd, before, receipt, paths);
+            },
+        });
+    }
+    catch (error) {
+        if (error instanceof ConversationFileError)
+            throw error;
+        return unavailable();
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
+/** No await is allowed between this pathname check and native command dispatch. */
+function assertNativeFileDispatchAuthority(target, fd, before, receipt, paths) {
+    const resolver = createRuntimeToolPathResolver(paths);
+    const current = resolver.resolve(target.absolutePath, {
+        allowedLocations: [receipt.location],
+        requirePath: true,
+    });
+    if (current.rootPath !== target.rootPath)
+        changedRoot();
+    if (current.relativePath !== receipt.relativePath)
+        unavailable();
+    const root = realpathSync(current.rootPath);
+    if (readFileOutputRootId(receipt.location, root) !== receipt.rootId)
+        changedRoot();
+    const canonicalPath = realpathSync(current.absolutePath);
+    if (!isContainedFile(root, canonicalPath))
+        unavailable();
+    const opened = fstatSync(fd, { bigint: true });
+    if (!sameFileVersion(before, opened))
+        changedFile();
+    if (!lstatSync(current.absolutePath).isFile())
+        unavailable();
+    const currentFile = statSync(canonicalPath, { bigint: true });
+    if (!currentFile.isFile())
+        unavailable();
+    if (!sameFileVersion(opened, currentFile))
+        changedFile();
+}

package/dist/src/web-ui/local-runtime/environment-registry.d.ts

@@ -1,21 +1,37 @@
+import type { WebUiEnvironmentConfig } from "../environment-config.js";
+import type { RuntimeSetupActivation } from "./runtime-setup-input.js";
 import { type LocalRuntimeApplicationOptions } from "../../runtime/local-application.js";
 import type { LocalRuntimeBackendOptions, RuntimeEnvironment, RuntimeModelCatalogState, RuntimeSetupRequirement } from "./contracts.js";
+import type { LearningChangedEvent } from "../../runtime/passive-learning/contracts.js";
 export declare class RuntimeEnvironmentRegistry {
     private readonly options;
     private readonly schedulerBindings;
     private readonly environments;
     private stopped;
+    private readonly desiredEnvironmentIds;
+    private applying;
+    private setupActivationPending;
     private stopping;
+    private configuredEnvironments;
     constructor(options: LocalRuntimeBackendOptions, schedulerBindings?: {
         requestOptions?: LocalRuntimeApplicationOptions["scheduledRequestOptions"];
         publish?: (event: Record<string, unknown>) => void;
+        publishLearning?: (environmentId: string, event?: LearningChangedEvent) => void;
     });
+    environmentConfig(): WebUiEnvironmentConfig | undefined;
+    applyConfiguration(): Promise<RuntimeSetupActivation>;
+    private applySavedConfiguration;
+    private checkGatewayActivation;
+    configure(configPath: string): void;
     modelCatalog(environmentId: string): RuntimeModelCatalogState;
     setupRequirement(environmentId: string): RuntimeSetupRequirement | null;
     get(environmentId: string): RuntimeEnvironment;
+    private createEnvironment;
     start(environmentIds: readonly string[]): Promise<void>;
     private startEnvironment;
     stop(): Promise<void>;
+    private stopAfterConfigurationApplication;
+    private hasStartedEnvironment;
     private requireEnvironmentIntakeOpen;
     profileEnv(environmentId: string): Record<string, string | undefined>;
     private loadConfig;

package/dist/src/web-ui/local-runtime/environment-registry.js

@@ -1,25 +1,121 @@
+import { requiresConfiguredCredential } from "./runtime-setup-provider.js";
+import { applyRuntimeConfiguration } from "./configuration-activation.js";
+import { withConfigurationActivationSource, } from "./configuration-activation-source.js";
 import { createLocalRuntimeApplication, } from "../../runtime/local-application.js";
 import { loadRuntimeConfig } from "../../runtime/config.js";
 import { inspectRuntimeConfigFileWithMeta } from "../../runtime/config/loader.js";
 import { loadRuntimeModelCatalog } from "../../runtime/model/model-catalog.js";
 import { inspectRuntimeSetupRequirement } from "./runtime-availability.js";
+import { readSavedModelCatalog } from "./saved-model-catalog.js";
 export class RuntimeEnvironmentRegistry {
     options;
     schedulerBindings;
     environments = new Map();
     stopped = false;
+    desiredEnvironmentIds = new Set();
+    applying;
+    setupActivationPending = false;
     stopping;
+    configuredEnvironments;
     constructor(options, schedulerBindings = {}) {
         this.options = options;
         this.schedulerBindings = schedulerBindings;
+        this.configuredEnvironments = options.resolveEnvironmentConfig?.(options.configPath);
+    }
+    environmentConfig() {
+        return this.configuredEnvironments;
+    }
+    applyConfiguration() {
+        if (this.stopped)
+            return Promise.reject(new Error("web_runtime_stopped"));
+        if (this.applying)
+            return this.applying;
+        const configPath = inspectRuntimeConfigFileWithMeta(this.options.rootDir ?? process.cwd(), this.options.configPath ?? process.env.LLM_RUNTIME_CONFIG_FILE).path;
+        const apply = withConfigurationActivationSource(configPath, (prepare) => this.applySavedConfiguration(configPath, prepare));
+        this.applying = apply.finally(() => {
+            this.applying = undefined;
+        });
+        return this.applying;
+    }
+    applySavedConfiguration(configPath, preparation) {
+        const nextEnvironments = this.options.resolveEnvironmentConfig?.(configPath);
+        return applyRuntimeConfiguration({
+            environments: this.environments,
+            defaultEnvironmentId: nextEnvironments?.defaultEnvironmentId ??
+                this.options.defaultEnvironmentId,
+            environmentIds: nextEnvironments?.environments.map(({ id }) => id) ?? [
+                ...this.desiredEnvironmentIds,
+            ],
+            createEnvironment: (id) => this.createEnvironment(id, this.loadConfig(id, configPath)),
+            recreateEnvironment: (id, previous) => this.createEnvironment(id, previous.services.config),
+            createGatewayRestorePoint: this.options.createRuntimeSetupRestorePoint,
+            onRestorationFailure: () => {
+                this.setupActivationPending = true;
+            },
+            ...preparation,
+            checkGateway: () => this.checkGatewayActivation(configPath),
+            activateGateway: () => this.options.onRuntimeSetup?.(configPath) ??
+                Promise.resolve({ status: "ready" }),
+            canContinue: () => !this.stopped,
+        }).then((result) => {
+            if (result.status !== "ready")
+                return result;
+            this.setupActivationPending = false;
+            if (nextEnvironments) {
+                this.configuredEnvironments = nextEnvironments;
+                this.options.defaultEnvironmentId =
+                    nextEnvironments.defaultEnvironmentId;
+                this.desiredEnvironmentIds.clear();
+                for (const { id } of nextEnvironments.environments)
+                    this.desiredEnvironmentIds.add(id);
+            }
+            return result;
+        });
+    }
+    checkGatewayActivation(configPath) {
+        if (this.options.checkRuntimeSetupActivation)
+            return this.options.checkRuntimeSetupActivation(configPath);
+        if (this.options.onRuntimeSetup)
+            return Promise.resolve({ status: "ready" });
+        return Promise.resolve({
+            status: "restart_required",
+            message: "Connection saved. Restart the owning model gateway and Runtime to apply this configuration.",
+        });
+    }
+    configure(configPath) {
+        this.requireEnvironmentIntakeOpen();
+        this.options.configPath = configPath;
+        if (!this.hasStartedEnvironment())
+            this.setupActivationPending = true;
     }
     modelCatalog(environmentId) {
+        if (this.setupActivationPending) {
+            return this.emptyModelCatalog({
+                status: "setup_required",
+                code: "runtime_configuration_required",
+                message: "Your connection is saved. Apply the setup or restart its owning services before starting a conversation.",
+            });
+        }
+        const active = this.environments.get(environmentId || this.options.defaultEnvironmentId);
+        if (active?.getOwnership() !== undefined) {
+            return {
+                ...loadRuntimeModelCatalog(active.services.config),
+                availability: { status: "ready" },
+            };
+        }
         const source = inspectRuntimeConfigFileWithMeta(this.options.rootDir ?? process.cwd(), this.options.configPath ?? process.env.LLM_RUNTIME_CONFIG_FILE);
         const setupRequirement = inspectRuntimeSetupRequirement(source);
         if (setupRequirement) {
             return this.emptyModelCatalog(setupRequirement);
         }
-        const catalog = loadRuntimeModelCatalog(this.loadConfig(environmentId));
+        if (requiresConfiguredCredential(source, this.options.rootDir ?? process.cwd())) {
+            return this.emptyModelCatalog({
+                status: "setup_required",
+                code: "runtime_configuration_required",
+                message: "The configured OpenAI model needs an API key. Complete the connection in this Web UI.",
+            });
+        }
+        const catalog = readSavedModelCatalog(source, environmentId || this.options.defaultEnvironmentId);
         return {
             ...catalog,
             availability: { status: "ready" },
@@ -32,21 +128,28 @@ export class RuntimeEnvironmentRegistry {
     get(environmentId) {
         this.requireEnvironmentIntakeOpen();
         const normalized = environmentId || this.options.defaultEnvironmentId;
+        this.desiredEnvironmentIds.add(normalized);
         const existing = this.environments.get(normalized);
         if (existing)
             return existing;
-        const config = this.loadConfig(normalized);
+        const environment = this.createEnvironment(normalized);
+        this.environments.set(normalized, environment);
+        return environment;
+    }
+    createEnvironment(environmentId, config = this.loadConfig(environmentId)) {
         const environment = createLocalRuntimeApplication(config, {
             scheduledRequestOptions: this.schedulerBindings.requestOptions,
         });
         if (this.schedulerBindings.publish) {
             environment.subscribeScheduledEvents(this.schedulerBindings.publish);
         }
-        this.environments.set(normalized, environment);
+        environment.subscribeLearningEvents?.((event) => this.schedulerBindings.publishLearning?.(environmentId, event));
         return environment;
     }
     async start(environmentIds) {
         this.requireEnvironmentIntakeOpen();
+        for (const id of environmentIds)
+            this.desiredEnvironmentIds.add(id);
         await Promise.all(environmentIds.map((id) => this.startEnvironment(id)));
     }
     async startEnvironment(id) {
@@ -63,12 +166,25 @@ export class RuntimeEnvironmentRegistry {
         if (this.stopping)
             return this.stopping;
         this.stopped = true;
-        this.stopping = Promise.all([...this.environments.values()].map(async (environment) => environment.stop())).then(() => undefined);
+        this.stopping = this.stopAfterConfigurationApplication();
         return this.stopping;
     }
+    async stopAfterConfigurationApplication() {
+        // Apply checks the stopped fence after every async handoff; teardown owns final closure.
+        await this.applying?.catch(() => undefined);
+        const stops = await Promise.allSettled([...this.environments.values()].map((environment) => environment.stop()));
+        const failed = stops.find((result) => result.status === "rejected");
+        if (failed?.status === "rejected")
+            throw failed.reason;
+    }
+    hasStartedEnvironment() {
+        return [...this.environments.values()].some((environment) => environment.getOwnership() !== undefined);
+    }
     requireEnvironmentIntakeOpen() {
         if (this.stopped)
             throw new Error("web_runtime_stopped");
+        if (this.applying)
+            throw new Error("Configuration is being applied. Try again shortly.");
     }
     profileEnv(environmentId) {
         return {
@@ -76,10 +192,10 @@ export class RuntimeEnvironmentRegistry {
             LLM_RUNTIME_PROFILE: environmentId || this.options.defaultEnvironmentId,
         };
     }
-    loadConfig(environmentId) {
+    loadConfig(environmentId, configPath = this.options.configPath) {
         return loadRuntimeConfig({
             rootDir: this.options.rootDir,
-            configPath: this.options.configPath,
+            configPath,
             profileId: environmentId || this.options.defaultEnvironmentId,
         });
     }

package/dist/src/web-ui/local-runtime/learning-notifications.d.ts

@@ -0,0 +1,2 @@
+import type { RealtimeClientHub } from "./realtime-hub.js";
+export declare function createLearningChangeNotifier(realtime: Pick<RealtimeClientHub, "broadcast">): (environmentId: string, change?: unknown) => void;

package/dist/src/web-ui/local-runtime/learning-notifications.js

@@ -0,0 +1,20 @@
+import { projectLearningChangedEvent } from "../../runtime/local-host/learning-events.js";
+import { createWorkspaceChangeNotifier } from "./workspace-notifications.js";
+export function createLearningChangeNotifier(realtime) {
+    const notifyWorkspace = createWorkspaceChangeNotifier(realtime);
+    return (environmentId, change) => {
+        const event = projectLearningChangedEvent(change);
+        try {
+            realtime.broadcast({
+                type: "learning.changed",
+                environmentId,
+                ...(event ? { event } : {}),
+            });
+        }
+        catch {
+            // Persisted conversations and proposal status are fetched on reconnect.
+        }
+        if (event)
+            notifyWorkspace(environmentId, ["sessions"]);
+    };
+}

package/dist/src/web-ui/local-runtime/learning-routes.d.ts

@@ -0,0 +1,19 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { PassiveLearningManagement } from "../../runtime/local-host/client-learning.js";
+type LearningRouteRequest = Readonly<{
+    method: string;
+    route: string;
+    segments: readonly string[];
+    url: URL;
+    body: Record<string, unknown> | null;
+    environmentId: string;
+    request: IncomingMessage;
+    response: ServerResponse;
+}>;
+export declare class PassiveLearningRoutes {
+    private readonly resolveService;
+    constructor(resolveService: (environmentId: string) => PassiveLearningManagement);
+    handle(input: LearningRouteRequest): Promise<boolean>;
+    private dispatch;
+}
+export {};