@action-llama/action-llama 0.10.1 → 0.10.2

package/dist/gateway/rate-limiter.js

@@ -0,0 +1,38 @@
+/**
+ * Simple in-memory sliding-window rate limiter keyed by IP.
+ * Designed for single-process use (local scheduler or cloud scheduler instance).
+ */
+export function rateLimiter(opts) {
+    const hits = new Map();
+    // Periodically clean up old entries to prevent unbounded growth
+    const cleanup = setInterval(() => {
+        const cutoff = Date.now() - opts.windowMs;
+        for (const [key, timestamps] of hits) {
+            const filtered = timestamps.filter((t) => t > cutoff);
+            if (filtered.length === 0) {
+                hits.delete(key);
+            }
+            else {
+                hits.set(key, filtered);
+            }
+        }
+    }, opts.windowMs);
+    if (cleanup.unref)
+        cleanup.unref();
+    return async (c, next) => {
+        const ip = c.req.header("x-forwarded-for")?.split(",")[0]?.trim()
+            || c.req.header("x-real-ip")
+            || "unknown";
+        const now = Date.now();
+        const cutoff = now - opts.windowMs;
+        const timestamps = (hits.get(ip) || []).filter((t) => t > cutoff);
+        if (timestamps.length >= opts.max) {
+            c.header("Retry-After", String(Math.ceil(opts.windowMs / 1000)));
+            return c.json({ error: "too many requests" }, 429);
+        }
+        timestamps.push(now);
+        hits.set(ip, timestamps);
+        await next();
+    };
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/gateway/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../src/gateway/rate-limiter.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEzC,gEAAgE;IAChE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;YACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClB,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAEnC,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;eAC5D,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;eACzB,SAAS,CAAC;QAEf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QACnC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QAElE,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAClC,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACzB,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/gateway/routes/dashboard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard.d.ts","sourceRoot":"","sources":["../../../src/gateway/routes/dashboard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAiB,MAAM,MAAM,CAAC;AAIhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAyDjE,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,IAAI,EACT,aAAa,EAAE,aAAa,EAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,IAAI,CA4IN"}
+{"version":3,"file":"dashboard.d.ts","sourceRoot":"","sources":["../../../src/gateway/routes/dashboard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAiB,MAAM,MAAM,CAAC;AAIhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AA8DjE,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,IAAI,EACT,aAAa,EAAE,aAAa,EAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,IAAI,CAiJN"}

package/dist/gateway/routes/dashboard.js

@@ -7,7 +7,11 @@ import { timingSafeEqual } from "crypto";
 function logsDir(projectPath) {
     return resolve(projectPath, ".al", "logs");
 }
+const SAFE_AGENT_NAME = /^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/;
 function findLogFiles(projectPath, agentName) {
+    // Reject names that could cause path traversal
+    if (!SAFE_AGENT_NAME.test(agentName))
+        return [];
     const dir = logsDir(projectPath);
     try {
         return readdirSync(dir)
@@ -61,6 +65,10 @@ export function registerDashboardRoutes(app, statusTracker, projectPath) {
         app.use("/dashboard/*", basicAuthMiddleware(dashboardSecret));
         app.use("/dashboard", basicAuthMiddleware(dashboardSecret));
     }
+    else {
+        console.warn("[security] Dashboard is running without authentication. " +
+            "Set AL_DASHBOARD_SECRET to require a password.");
+    }
     // Main dashboard page
     app.get("/dashboard", (c) => {
         const agents = statusTracker.getAllAgents();

package/dist/gateway/routes/dashboard.js.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard.js","sourceRoot":"","sources":["../../../src/gateway/routes/dashboard.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAEzC,SAAS,OAAO,CAAC,WAAmB;IAClC,OAAO,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB,EAAE,SAAiB;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aAClE,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,CAAS;IACjD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACzC,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7C,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;gBACxC,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,EAAE,CAAC;oBACb,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,GAAS,EACT,aAA4B,EAC5B,WAAoB;IAEpB,iDAAiD;IACjD,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACxD,IAAI,eAAe,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,sBAAsB;IACtB,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,qBAAqB;IACrB,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5C,OAAO,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,GAAG,EAAE;gBAChB,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,EAAE,CAAC;gBAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;gBAC9C,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;gBACnD,MAAM,CAAC,QAAQ,CAAC;oBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;iBAClE,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,qBAAqB;YACrB,IAAI,EAAE,CAAC;YAEP,qBAAqB;YACrB,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAEjC,iDAAiD;YACjD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;gBACjC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACpD,CAAC,EAAE,KAAK,CAAC,CAAC;YAEV,wBAAwB;YACxB,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;gBAClB,aAAa,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC7C,aAAa,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,uBAAuB;YACvB,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uCAAuC;IACvC,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE;QACjD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEvC,OAAO,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnC,wCAAwC;YACxC,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAC/C,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBAC5C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACrB,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;oBACvD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,kCAAkC;YAClC,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,WAAW,GAAG,EAAE,CAAC;YACrB,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAC5C,IAAI,CAAC;wBACH,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;oBACxC,CAAC;oBAAC,MAAM,CAAC;wBACP,yBAAyB;oBAC3B,CAAC;gBACH,CAAC;YACH,CAAC;YAED,yBAAyB;YACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;gBAChC,IAAI,CAAC,WAAW;oBAAE,OAAO;gBAEzB,mCAAmC;gBACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO;gBAElC,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACjD,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;oBAC/B,WAAW,GAAG,UAAU,CAAC;oBACzB,QAAQ,GAAG,CAAC,CAAC;gBACf,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;oBACnC,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;wBACzB,MAAM,EAAE,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;wBAC9C,MAAM,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;wBACtC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;wBACrB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;wBAChE,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;4BAC5B,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;wBACtD,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,wBAAwB;gBAC1B,CAAC;YACH,CAAC,EAAE,GAAG,CAAC,CAAC;YAER,sDAAsD;YACtD,MAAM,QAAQ,GAAG,GAAG,EAAE;gBACpB,8DAA8D;gBAC9D,wEAAwE;gBACxE,uEAAuE;YACzE,CAAC,CAAC;YAEF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;gBACjC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACpD,CAAC,EAAE,KAAK,CAAC,CAAC;YAEV,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;gBAClB,aAAa,CAAC,QAAQ,CAAC,CAAC;gBACxB,aAAa,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,mBAAmB;YACnB,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"dashboard.js","sourceRoot":"","sources":["../../../src/gateway/routes/dashboard.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAEzC,SAAS,OAAO,CAAC,WAAmB;IAClC,OAAO,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAElE,SAAS,YAAY,CAAC,WAAmB,EAAE,SAAiB;IAC1D,+CAA+C;IAC/C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aAClE,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,CAAS;IACjD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACzC,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7C,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;gBACxC,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,EAAE,CAAC;oBACb,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,GAAS,EACT,aAA4B,EAC5B,WAAoB;IAEpB,iDAAiD;IACjD,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACxD,IAAI,eAAe,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CACV,0DAA0D;YAC1D,gDAAgD,CACjD,CAAC;IACJ,CAAC;IAED,sBAAsB;IACtB,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,qBAAqB;IACrB,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5C,OAAO,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,GAAG,EAAE;gBAChB,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,EAAE,CAAC;gBAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;gBAC9C,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;gBACnD,MAAM,CAAC,QAAQ,CAAC;oBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;iBAClE,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,qBAAqB;YACrB,IAAI,EAAE,CAAC;YAEP,qBAAqB;YACrB,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAEjC,iDAAiD;YACjD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;gBACjC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACpD,CAAC,EAAE,KAAK,CAAC,CAAC;YAEV,wBAAwB;YACxB,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;gBAClB,aAAa,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC7C,aAAa,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,uBAAuB;YACvB,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uCAAuC;IACvC,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE;QACjD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEvC,OAAO,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnC,wCAAwC;YACxC,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAC/C,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBAC5C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACrB,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;oBACvD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,kCAAkC;YAClC,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,WAAW,GAAG,EAAE,CAAC;YACrB,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAC5C,IAAI,CAAC;wBACH,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;oBACxC,CAAC;oBAAC,MAAM,CAAC;wBACP,yBAAyB;oBAC3B,CAAC;gBACH,CAAC;YACH,CAAC;YAED,yBAAyB;YACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;gBAChC,IAAI,CAAC,WAAW;oBAAE,OAAO;gBAEzB,mCAAmC;gBACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO;gBAElC,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACjD,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;oBAC/B,WAAW,GAAG,UAAU,CAAC;oBACzB,QAAQ,GAAG,CAAC,CAAC;gBACf,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;oBACnC,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;wBACzB,MAAM,EAAE,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;wBAC9C,MAAM,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;wBACtC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;wBACrB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;wBAChE,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;4BAC5B,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;wBACtD,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,wBAAwB;gBAC1B,CAAC;YACH,CAAC,EAAE,GAAG,CAAC,CAAC;YAER,sDAAsD;YACtD,MAAM,QAAQ,GAAG,GAAG,EAAE;gBACpB,8DAA8D;gBAC9D,wEAAwE;gBACxE,uEAAuE;YACzE,CAAC,CAAC;YAEF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;gBACjC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACpD,CAAC,EAAE,KAAK,CAAC,CAAC;YAEV,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;gBAClB,aAAa,CAAC,QAAQ,CAAC,CAAC;gBACxB,aAAa,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,mBAAmB;YACnB,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/gateway/routes/locks.d.ts

@@ -2,5 +2,7 @@ import type { Hono } from "hono";
 import type { ContainerRegistration } from "../types.js";
 import type { LockStore } from "../lock-store.js";
 import type { Logger } from "../../shared/logger.js";
-export declare function registerLockRoutes(app: Hono, containerRegistry: Map<string, ContainerRegistration>, lockStore: LockStore, logger: Logger): void;
+export declare function registerLockRoutes(app: Hono, containerRegistry: Map<string, ContainerRegistration>, lockStore: LockStore, logger: Logger, opts?: {
+    skipStatusEndpoint?: boolean;
+}): void;
 //# sourceMappingURL=locks.d.ts.map

package/dist/gateway/routes/locks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"locks.d.ts","sourceRoot":"","sources":["../../../src/gateway/routes/locks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,EACT,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,EACrD,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,GACb,IAAI,CAuIN"}
+{"version":3,"file":"locks.d.ts","sourceRoot":"","sources":["../../../src/gateway/routes/locks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,EACT,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,EACrD,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAE,GACtC,IAAI,CA4IN"}

package/dist/gateway/routes/locks.js

@@ -1,4 +1,4 @@
-export function registerLockRoutes(app, containerRegistry, lockStore, logger) {
+export function registerLockRoutes(app, containerRegistry, lockStore, logger, opts) {
     app.post("/locks/acquire", async (c) => {
         let body;
         try {
@@ -94,19 +94,24 @@ export function registerLockRoutes(app, containerRegistry, lockStore, logger) {
         if (!reg) {
             return c.json({ error: "invalid secret" }, 403);
         }
-        return c.json(lockStore.list());
+        // Only return locks held by the requesting agent's instance
+        return c.json(lockStore.list(reg.instanceId));
     });
-    app.get("/locks/status", (c) => {
-        const locks = lockStore.list().map((lock) => {
-            // Extract agent name from holder (typically "agentName-instanceNumber")
-            const agentName = lock.holder.split("-").slice(0, -1).join("-") || lock.holder;
-            return {
-                resourceKey: lock.resourceKey,
-                agentName,
-                heldSince: lock.heldSince,
-            };
+    // /locks/status is local-only — not registered in cloud mode where the
+    // gateway is publicly reachable and this endpoint has no authentication.
+    if (!opts?.skipStatusEndpoint) {
+        app.get("/locks/status", (c) => {
+            const locks = lockStore.list().map((lock) => {
+                // Extract agent name from holder (typically "agentName-instanceNumber")
+                const agentName = lock.holder.split("-").slice(0, -1).join("-") || lock.holder;
+                return {
+                    resourceKey: lock.resourceKey,
+                    agentName,
+                    heldSince: lock.heldSince,
+                };
+            });
+            return c.json({ locks });
         });
-        return c.json({ locks });
-    });
+    }
 }
 //# sourceMappingURL=locks.js.map

package/dist/gateway/routes/locks.js.map

@@ -1 +1 @@
-{"version":3,"file":"locks.js","sourceRoot":"","sources":["../../../src/gateway/routes/locks.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,kBAAkB,CAChC,GAAS,EACT,iBAAqD,EACrD,SAAoB,EACpB,MAAc;IAEd,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,IAAI,IAA6D,CAAC;QAClE,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAEnE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,eAAe,CAAC,CAAC;YACrE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,iFAAiF;QACjF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YACvF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAC5D,eAAe,CAChB,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EACjE,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,IAAI,IAA+C,CAAC;QACpD,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAE9D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,eAAe,CAAC,CAAC;YACrE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,IAAI,IAA6D,CAAC;QAClE,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAErE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,gBAAgB,CAAC,CAAC;YACtE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC1C,wEAAwE;YACxE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;YAC/E,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS;gBACT,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"locks.js","sourceRoot":"","sources":["../../../src/gateway/routes/locks.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,kBAAkB,CAChC,GAAS,EACT,iBAAqD,EACrD,SAAoB,EACpB,MAAc,EACd,IAAuC;IAEvC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,IAAI,IAA6D,CAAC;QAClE,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAEnE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,eAAe,CAAC,CAAC;YACrE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,iFAAiF;QACjF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YACvF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAC5D,eAAe,CAChB,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EACjE,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,IAAI,IAA+C,CAAC;QACpD,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAE9D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,eAAe,CAAC,CAAC;YACrE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,IAAI,IAA6D,CAAC;QAClE,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAErE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,gBAAgB,CAAC,CAAC;YACtE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,4DAA4D;QAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,yEAAyE;IACzE,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,CAAC;QAC9B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC1C,wEAAwE;gBACxE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;gBAC/E,OAAO;oBACL,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,SAAS;oBACT,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/gateway/routes/webhooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../../src/gateway/routes/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,EACT,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACtD,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,aAAa,GAC5B,IAAI,CAmEN"}
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../../src/gateway/routes/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,EACT,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACtD,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,aAAa,GAC5B,IAAI,CAmFN"}

package/dist/gateway/routes/webhooks.js

@@ -1,4 +1,7 @@
+import { rateLimiter } from "../rate-limiter.js";
 export function registerWebhookRoutes(app, registry, webhookSecrets, logger, statusTracker) {
+    // Rate limit webhook endpoint: 120 requests per minute per IP
+    app.use("/webhooks/*", rateLimiter({ max: 120, windowMs: 60_000 }));
     app.post("/webhooks/:source", async (c) => {
         const source = c.req.param("source");
         logger.debug({ source }, "webhook request received");
@@ -8,6 +11,13 @@ export function registerWebhookRoutes(app, registry, webhookSecrets, logger, sta
             statusTracker?.addLogLine("webhook", `Rejected: unknown source "${source}"`);
             return c.json({ error: `unknown webhook source: ${source}` }, 404);
         }
+        // Reject oversized payloads (10 MB limit)
+        const MAX_BODY_SIZE = 10 * 1024 * 1024;
+        const contentLength = parseInt(c.req.header("content-length") || "0", 10);
+        if (contentLength > MAX_BODY_SIZE) {
+            logger.warn({ source, contentLength }, "webhook rejected: payload too large");
+            return c.json({ error: "payload too large" }, 413);
+        }
         let rawBody;
         try {
             rawBody = await c.req.text();
@@ -17,6 +27,10 @@ export function registerWebhookRoutes(app, registry, webhookSecrets, logger, sta
             statusTracker?.addLogLine("webhook", `Failed to read body from ${source}: ${err.message}`);
             return c.json({ error: "failed to read request body" }, 400);
         }
+        if (rawBody.length > MAX_BODY_SIZE) {
+            logger.warn({ source, bodyLength: rawBody.length }, "webhook rejected: payload too large");
+            return c.json({ error: "payload too large" }, 413);
+        }
         logger.debug({ source, bodyLength: rawBody.length }, "webhook body read ok");
         // Extract headers as a flat map
         const headers = {};

package/dist/gateway/routes/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../../src/gateway/routes/webhooks.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,qBAAqB,CACnC,GAAS,EACT,QAAyB,EACzB,cAAsD,EACtD,MAAc,EACd,aAA6B;IAE7B,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAErD,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAC;YAC5D,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,6BAA6B,MAAM,GAAG,CAAC,CAAC;YAC7E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAC1D,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,4BAA4B,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAE7E,gCAAgC;QAChC,MAAM,OAAO,GAAuC,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;QAED,MAAM,CAAC,KAAK,CACV;YACE,MAAM;YACN,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC;YACpC,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC;YAChC,QAAQ,EAAE,OAAO,CAAC,mBAAmB,CAAC;YACtC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;SAC/C,EACD,iBAAiB,CAClB,CAAC;QAEF,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAEpE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAClF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC;YACzD,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACzC,yBAAyB,CAC1B,CAAC;YACF,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAC5D,oBAAoB,CACrB,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACvB,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,GAAG,MAAM,mBAAmB,MAAM,CAAC,OAAO,SAAS,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7H,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../../src/gateway/routes/webhooks.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,UAAU,qBAAqB,CACnC,GAAS,EACT,QAAyB,EACzB,cAAsD,EACtD,MAAc,EACd,aAA6B;IAE7B,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEpE,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAErD,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAC;YAC5D,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,6BAA6B,MAAM,GAAG,CAAC,CAAC;YAC7E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QAED,0CAA0C;QAC1C,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;QACvC,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,aAAa,GAAG,aAAa,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,qCAAqC,CAAC,CAAC;YAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAC1D,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,4BAA4B,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,qCAAqC,CAAC,CAAC;YAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAE7E,gCAAgC;QAChC,MAAM,OAAO,GAAuC,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;QAED,MAAM,CAAC,KAAK,CACV;YACE,MAAM;YACN,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC;YACpC,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC;YAChC,QAAQ,EAAE,OAAO,CAAC,mBAAmB,CAAC;YACtC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;SAC/C,EACD,iBAAiB,CAClB,CAAC;QAEF,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAEpE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAClF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC;YACzD,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACzC,yBAAyB,CAC1B,CAAC;YACF,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAC5D,oBAAoB,CACrB,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACvB,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,GAAG,MAAM,mBAAmB,MAAM,CAAC,OAAO,SAAS,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7H,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/scheduler/index.d.ts

@@ -1,14 +1,13 @@
 import { Cron } from "croner";
 import type { GlobalConfig } from "../shared/config.js";
 import type { StatusTracker } from "../tui/status-tracker.js";
-import { WebhookRegistry } from "../webhooks/registry.js";
 import type { GatewayServer } from "../gateway/index.js";
 import { RunnerPool } from "./runner-pool.js";
 export declare function startScheduler(projectPath: string, globalConfigOverride?: GlobalConfig, statusTracker?: StatusTracker, cloudMode?: boolean, gatewayEnabled?: boolean, webUI?: boolean): Promise<{
     cronJobs: Cron<undefined>[];
     runnerPools: Record<string, RunnerPool>;
     gateway: GatewayServer | undefined;
-    webhookRegistry: WebhookRegistry | undefined;
+    webhookRegistry: import("../webhooks/registry.js").WebhookRegistry | undefined;
     webhookUrls: string[];
     statusTracker: StatusTracker | undefined;
 }>;

package/dist/scheduler/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scheduler/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAG9B,OAAO,KAAK,EAAE,YAAY,EAAoC,MAAM,qBAAqB,CAAC;AAK1F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAM9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMzD,OAAO,EAAE,UAAU,EAAmB,MAAM,kBAAkB,CAAC;AAsM/D,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO;;;;;;;GAwf3L"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scheduler/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAE9B,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,qBAAqB,CAAC;AAGrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAM9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKzD,OAAO,EAAE,UAAU,EAAmB,MAAM,kBAAkB,CAAC;AAmJ/D,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO;;;;;;;GAyY3L"}

package/dist/scheduler/index.js

@@ -1,74 +1,14 @@
 import { Cron } from "croner";
 import { loadGlobalConfig, loadAgentConfig, discoverAgents, validateAgentConfig } from "../shared/config.js";
-import { requireCredentialRef, loadCredentialField, listCredentialInstances } from "../shared/credentials.js";
+import { requireCredentialRef } from "../shared/credentials.js";
 import { createLogger, createFileOnlyLogger } from "../shared/logger.js";
 import { buildScheduledPrompt, buildWebhookPrompt, buildCalledPrompt, buildScheduledSuffix, buildWebhookSuffix, buildCalledSuffix, } from "../agents/prompt.js";
-import { WebhookRegistry } from "../webhooks/registry.js";
-import { GitHubWebhookProvider } from "../webhooks/providers/github.js";
-import { SentryWebhookProvider } from "../webhooks/providers/sentry.js";
-import { LinearWebhookProvider } from "../webhooks/providers/linear.js";
 import { AWS_CONSTANTS } from "../shared/aws-constants.js";
-import { buildAllImages } from "../cloud/image-builder.js";
+import { ConfigError } from "../shared/errors.js";
 import { WorkQueue } from "./event-queue.js";
 import { RunnerPool } from "./runner-pool.js";
-// Provider type → credential type for loading secrets
-const PROVIDER_TO_CREDENTIAL = {
-    github: "github_webhook_secret",
-    sentry: "sentry_client_secret",
-    linear: "linear_webhook_secret",
-};
-function resolveWebhookSource(sourceName, agentName, webhookSources) {
-    const source = webhookSources[sourceName];
-    if (!source) {
-        const available = Object.keys(webhookSources).join(", ") || "(none)";
-        throw new Error(`Agent "${agentName}" references webhook source "${sourceName}" ` +
-            `which is not defined in config.toml [webhooks]. Available: ${available}`);
-    }
-    return source;
-}
-function buildFilterFromTrigger(trigger, providerType) {
-    if (providerType === "github") {
-        const f = {};
-        if (trigger.events)
-            f.events = trigger.events;
-        if (trigger.actions)
-            f.actions = trigger.actions;
-        if (trigger.repos)
-            f.repos = trigger.repos;
-        if (trigger.labels)
-            f.labels = trigger.labels;
-        if (trigger.assignee)
-            f.assignee = trigger.assignee;
-        if (trigger.author)
-            f.author = trigger.author;
-        if (trigger.branches)
-            f.branches = trigger.branches;
-        return Object.keys(f).length > 0 ? f : undefined;
-    }
-    if (providerType === "sentry") {
-        const f = {};
-        if (trigger.resources)
-            f.resources = trigger.resources;
-        return Object.keys(f).length > 0 ? f : undefined;
-    }
-    if (providerType === "linear") {
-        const f = {};
-        if (trigger.events)
-            f.events = trigger.events;
-        if (trigger.actions)
-            f.actions = trigger.actions;
-        if (trigger.organizations)
-            f.organizations = trigger.organizations;
-        if (trigger.labels)
-            f.labels = trigger.labels;
-        if (trigger.assignee)
-            f.assignee = trigger.assignee;
-        if (trigger.author)
-            f.author = trigger.author;
-        return Object.keys(f).length > 0 ? f : undefined;
-    }
-    return undefined;
-}
+import { createContainerRuntime, buildAgentImages } from "./runtime-factory.js";
+import { resolveWebhookSource, buildFilterFromTrigger, setupWebhookRegistry } from "./webhook-setup.js";
 const DEFAULT_MAX_RERUNS = 10;
 const DEFAULT_MAX_TRIGGER_DEPTH = 3;
 // Prompt helpers: when images have baked-in static files, only pass the dynamic suffix.
@@ -176,7 +116,7 @@ export async function startScheduler(projectPath, globalConfigOverride, statusTr
     // Discover all agents in the project
     const agentNames = discoverAgents(projectPath);
     if (agentNames.length === 0) {
-        throw new Error("No agents found. Run 'al new' to create a project with agents.");
+        throw new ConfigError("No agents found. Run 'al new' to create a project with agents.");
     }
     const agentConfigs = agentNames.map((name) => loadAgentConfig(projectPath, name));
     // Validate each agent has schedule, webhooks, or both
@@ -213,7 +153,7 @@ export async function startScheduler(projectPath, globalConfigOverride, statusTr
     // Validate pi_auth is not used with Docker (containers can't access host auth storage)
     for (const config of activeAgentConfigs) {
         if (config.model.authType === "pi_auth") {
-            throw new Error(`Agent "${config.name}" uses pi_auth which is not supported in container mode. ` +
+            throw new ConfigError(`Agent "${config.name}" uses pi_auth which is not supported in container mode. ` +
                 `Switch to api_key/oauth_token (run 'al doctor').`);
         }
     }
@@ -228,40 +168,12 @@ export async function startScheduler(projectPath, globalConfigOverride, statusTr
         }
     }
     // Set up webhook registry if any agents use webhooks
-    let webhookRegistry;
-    let webhookSecrets = {};
-    if (anyWebhooks) {
-        webhookRegistry = new WebhookRegistry(logger);
-        // Register providers
-        webhookRegistry.registerProvider(new GitHubWebhookProvider());
-        webhookRegistry.registerProvider(new SentryWebhookProvider());
-        webhookRegistry.registerProvider(new LinearWebhookProvider());
-        // Load secrets for each provider type referenced by webhook sources
-        const providerTypes = new Set(Object.values(webhookSources).map(s => s.type));
-        for (const providerType of providerTypes) {
-            const credType = PROVIDER_TO_CREDENTIAL[providerType];
-            if (!credType)
-                continue;
-            const instances = await listCredentialInstances(credType);
-            const secrets = {};
-            for (const inst of instances) {
-                const secret = await loadCredentialField(credType, inst, "secret");
-                if (secret)
-                    secrets[inst] = secret;
-            }
-            if (Object.keys(secrets).length > 0) {
-                webhookSecrets[providerType] = secrets;
-                logger.info({ providerType, count: Object.keys(secrets).length }, "loaded webhook secrets");
-            }
-        }
-    }
-    let runtime;
-    let agentRuntimeOverrides = {};
+    const { registry: webhookRegistry, secrets: webhookSecrets } = anyWebhooks
+        ? await setupWebhookRegistry(globalConfig, logger)
+        : { registry: undefined, secrets: {} };
     let baseImage = AWS_CONSTANTS.DEFAULT_IMAGE;
     const agentImages = {};
-    // Determine runtime type from cloud mode or local
     const useCloudRuntime = cloudMode && globalConfig.cloud;
-    const runtimeType = useCloudRuntime ? globalConfig.cloud.provider : "local";
     // Register agents early so the TUI shows them during image builds
     for (const agentConfig of agentConfigs) {
         statusTracker?.registerAgent(agentConfig.name, agentConfig.scale ?? 1);
@@ -281,15 +193,18 @@ export async function startScheduler(projectPath, globalConfigOverride, statusTr
         const gatewayPort = globalConfig.gateway?.port || 8080;
         gateway = await startGateway({
             port: gatewayPort,
+            hostname: cloudMode ? "0.0.0.0" : "127.0.0.1",
             logger: mkLogger(projectPath, "gateway"),
             killContainer: undefined, // Runtime not ready yet, will handle container ops later
             webhookRegistry,
             webhookSecrets,
             statusTracker,
             projectPath,
-            webUI,
+            webUI: cloudMode ? false : webUI,
             lockTimeout: globalConfig.gateway?.lockTimeout,
-            controlDeps: {
+            // Control routes, dashboard, and lock status are local-only.
+            // In cloud mode, use cloud-native tools (console, CLI) for these operations.
+            controlDeps: cloudMode ? undefined : {
                 statusTracker,
                 killInstance: async (instanceId) => {
                     for (const pool of Object.values(runnerPools)) {
@@ -316,90 +231,19 @@ export async function startScheduler(projectPath, globalConfigOverride, statusTr
         });
         logger.info({ port: gatewayPort }, "Gateway started early to show build progress");
     }
-    logger.info({ runtime: runtimeType }, "Container mode enabled — initializing infrastructure");
     // 1. Create the container runtime
-    if (useCloudRuntime && globalConfig.cloud.provider === "cloud-run") {
-        const { CloudRunJobRuntime } = await import("../docker/cloud-run-runtime.js");
-        const { gcpProject, region, artifactRegistry, serviceAccount, secretPrefix } = globalConfig.cloud;
-        if (!gcpProject || !region || !artifactRegistry || !serviceAccount) {
-            throw new Error("Cloud Run runtime requires cloud.gcpProject, cloud.region, " +
-                "cloud.artifactRegistry, and cloud.serviceAccount in config.toml");
-        }
-        runtime = new CloudRunJobRuntime({ gcpProject, region, artifactRegistry, serviceAccount, secretPrefix });
-        logger.info({ gcpProject, region }, "Using Cloud Run Jobs runtime");
-    }
-    else if (useCloudRuntime && globalConfig.cloud.provider === "ecs") {
-        const { ECSFargateRuntime } = await import("../docker/ecs-runtime.js");
-        const cc = globalConfig.cloud;
-        if (!cc.awsRegion || !cc.ecsCluster || !cc.ecrRepository || !cc.executionRoleArn || !cc.taskRoleArn || !cc.subnets?.length) {
-            throw new Error("ECS runtime requires cloud.awsRegion, cloud.ecsCluster, cloud.ecrRepository, " +
-                "cloud.executionRoleArn, cloud.taskRoleArn, and cloud.subnets in config.toml");
-        }
-        runtime = new ECSFargateRuntime({
-            awsRegion: cc.awsRegion,
-            ecsCluster: cc.ecsCluster,
-            ecrRepository: cc.ecrRepository,
-            executionRoleArn: cc.executionRoleArn,
-            taskRoleArn: cc.taskRoleArn,
-            subnets: cc.subnets,
-            securityGroups: cc.securityGroups,
-            secretPrefix: cc.awsSecretPrefix,
-            buildBucket: cc.buildBucket,
-        });
-        // Create Lambda runtime for short-running agents (timeout <= 900s)
-        const { LambdaRuntime } = await import("../docker/lambda-runtime.js");
-        const lambdaRuntime = new LambdaRuntime({
-            awsRegion: cc.awsRegion,
-            ecrRepository: cc.ecrRepository,
-            secretPrefix: cc.awsSecretPrefix,
-            buildBucket: cc.buildBucket,
-            lambdaRoleArn: cc.lambdaRoleArn,
-            lambdaSubnets: cc.lambdaSubnets,
-            lambdaSecurityGroups: cc.lambdaSecurityGroups,
-        });
-        // Per-agent runtime selection: Lambda for short agents, ECS for long ones
-        agentRuntimeOverrides = {};
-        for (const ac of activeAgentConfigs) {
-            const effectiveTimeout = ac.timeout ?? globalConfig.local?.timeout ?? 900;
-            if (effectiveTimeout <= AWS_CONSTANTS.LAMBDA_MAX_TIMEOUT) {
-                agentRuntimeOverrides[ac.name] = lambdaRuntime;
-                logger.info({ agent: ac.name, timeout: effectiveTimeout }, "Routing to Lambda (timeout <= 900s)");
-            }
-        }
-        logger.info({ region: cc.awsRegion, cluster: cc.ecsCluster }, "Using ECS Fargate runtime");
-    }
-    else {
-        // Local runtime needs Docker running
-        const { execFileSync } = await import("child_process");
-        try {
-            execFileSync("docker", ["info"], { stdio: "pipe", timeout: 10000 });
-        }
-        catch {
-            throw new Error("Docker is not running. Start Docker Desktop (or the Docker daemon) and try again.");
-        }
-        const { LocalDockerRuntime } = await import("../docker/local-runtime.js");
-        runtime = new LocalDockerRuntime();
-        // Local-only: ensure Docker network
-        logger.info("Ensuring Docker network...");
-        const { ensureNetwork } = await import("../docker/network.js");
-        ensureNetwork();
-    }
+    const { runtime, agentRuntimeOverrides, runtimeType } = await createContainerRuntime(globalConfig, activeAgentConfigs, cloudMode, logger);
+    logger.info({ runtime: runtimeType }, "Container mode enabled — initializing infrastructure");
     // 2. Build base + per-agent images via shared image builder
     const buildSkills = { locking: true };
-    const buildResult = await buildAllImages({
-        projectPath,
-        globalConfig,
-        activeAgentConfigs,
-        runtime: runtime,
-        runtimeType,
-        statusTracker,
-        logger,
-        skills: buildSkills,
+    const buildResult = await buildAgentImages({
+        projectPath, globalConfig, activeAgentConfigs,
+        runtime, runtimeType, statusTracker, logger, skills: buildSkills,
     });
     baseImage = buildResult.baseImage;
     Object.assign(agentImages, buildResult.agentImages);
     // Import necessary classes for container runners
-    const ContainerAgentRunnerClass = runtime ? (await import("../agents/container-runner.js")).ContainerAgentRunner : null;
+    const { ContainerAgentRunner: ContainerAgentRunnerClass } = await import("../agents/container-runner.js");
     const gatewayPort = globalConfig.gateway?.port || 8080;
     const gatewayUrl = gatewayEnabled
         ? (process.env.GATEWAY_URL
@@ -422,10 +266,8 @@ export async function startScheduler(projectPath, globalConfigOverride, statusTr
         const runners = [];
         for (let i = 0; i < scale; i++) {
             const instanceId = scale >= 2 ? `${agentConfig.name}(${i + 1})` : agentConfig.name;
-            if (runtime && ContainerAgentRunnerClass) {
-                const agentRuntime = agentRuntimeOverrides[agentConfig.name] || runtime;
-                runners.push(new ContainerAgentRunnerClass(agentRuntime, globalConfig, agentConfig, mkLogger(projectPath, instanceId), registerContainer, unregisterContainer, gatewayUrl, projectPath, agentImages[agentConfig.name] || baseImage, statusTracker, instanceId));
-            }
+            const agentRuntime = agentRuntimeOverrides[agentConfig.name] || runtime;
+            runners.push(new ContainerAgentRunnerClass(agentRuntime, globalConfig, agentConfig, mkLogger(projectPath, instanceId), registerContainer, unregisterContainer, gatewayUrl, projectPath, agentImages[agentConfig.name] || baseImage, statusTracker, instanceId));
         }
         runnerPools[agentConfig.name] = new RunnerPool(runners);
         logger.info({ agent: agentConfig.name, scale }, "Created runner pool");