@aitne/daemon 0.1.7 → 0.1.8

package/dist/api/routes/dashboard/secrets.js

@@ -0,0 +1,307 @@
+import { readJsonBody } from "../../json-body.js";
+import { detectGoogleCredentialType } from "../../../services/google-auth.js";
+export async function getSecretConfigSummary(deps) {
+    const { secretBroker } = deps;
+    const [slackBotToken, slackAppToken, telegramBotToken, discordBotToken, notionApiKey, githubToken, githubWebhookSecret, apiToken, googleCredentialsJson, googleTokenJson,] = await Promise.all([
+        secretBroker.getSlackBotToken(),
+        secretBroker.getSlackAppToken(),
+        secretBroker.getTelegramBotToken(),
+        secretBroker.getDiscordBotToken(),
+        secretBroker.getNotionApiKey(),
+        secretBroker.getGitHubToken(),
+        secretBroker.getGitHubWebhookSecret(),
+        secretBroker.getApiToken(),
+        secretBroker.getGoogleCredentialsJson(),
+        secretBroker.getGoogleTokenJson(),
+    ]);
+    // SETUP-FLOW-REDESIGN-PLAN §6.1 — surface BYOA Outlook client config
+    // presence so the connections page knows when direct-mode Outlook
+    // integrations are resumable. Best-effort: if no blob store is
+    // wired (test harness), report `false` rather than crashing.
+    let outlookClientConfigConfigured = false;
+    try {
+        outlookClientConfigConfigured = deps.blobStore
+            ? await deps.blobStore.exists("mail:outlook:client-config")
+            : false;
+    }
+    catch {
+        outlookClientConfigConfigured = false;
+    }
+    return {
+        slackConfigured: !!(slackBotToken && slackAppToken),
+        telegramConfigured: !!telegramBotToken,
+        discordConfigured: !!discordBotToken,
+        notionConfigured: !!notionApiKey,
+        githubConfigured: !!githubToken,
+        githubWebhookSecretConfigured: !!githubWebhookSecret,
+        apiTokenConfigured: !!apiToken,
+        googleCalendarCredentialsConfigured: !!googleCredentialsJson,
+        googleCalendarTokenConfigured: !!googleTokenJson,
+        outlookClientConfigConfigured,
+        googleCredentialType: detectGoogleCredentialType(googleCredentialsJson),
+    };
+}
+export function registerSecretsRoutes(app, deps) {
+    const { secretBroker } = deps;
+    app.put("/secrets/slack", async (c) => {
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const body = parsedBody.body;
+        const botToken = typeof body?.botToken === "string" ? body.botToken.trim() : "";
+        const appToken = typeof body?.appToken === "string" ? body.appToken.trim() : "";
+        const validationErrors = {};
+        if (!botToken && !appToken) {
+            return c.json({
+                status: "validation_failed",
+                configured: false,
+                requiresRestart: false,
+                validationErrors: {
+                    botToken: "Provide at least one Slack token to save.",
+                    appToken: "Provide at least one Slack token to save.",
+                },
+            }, 400);
+        }
+        if (botToken)
+            await secretBroker.set("slackBotToken", botToken);
+        if (appToken)
+            await secretBroker.set("slackAppToken", appToken);
+        await deps.onSecretChanged?.("slack");
+        return c.json({
+            status: "updated",
+            configured: (await getSecretConfigSummary(deps)).slackConfigured,
+            requiresRestart: false,
+            validationErrors,
+        });
+    });
+    app.put("/secrets/telegram", async (c) => {
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const body = parsedBody.body;
+        const botToken = typeof body?.botToken === "string" ? body.botToken.trim() : "";
+        if (!botToken) {
+            return c.json({
+                status: "validation_failed",
+                configured: false,
+                requiresRestart: false,
+                validationErrors: { botToken: "Telegram bot token is required." },
+            }, 400);
+        }
+        await secretBroker.set("telegramBotToken", botToken);
+        await deps.onSecretChanged?.("telegram");
+        return c.json({
+            status: "updated",
+            configured: (await getSecretConfigSummary(deps)).telegramConfigured,
+            requiresRestart: false,
+            validationErrors: {},
+        });
+    });
+    app.put("/secrets/discord", async (c) => {
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const body = parsedBody.body;
+        const botToken = typeof body?.botToken === "string" ? body.botToken.trim() : "";
+        if (!botToken) {
+            return c.json({
+                status: "validation_failed",
+                configured: false,
+                requiresRestart: false,
+                validationErrors: { botToken: "Discord bot token is required." },
+            }, 400);
+        }
+        await secretBroker.set("discordBotToken", botToken);
+        await deps.onSecretChanged?.("discord");
+        return c.json({
+            status: "updated",
+            configured: (await getSecretConfigSummary(deps)).discordConfigured,
+            requiresRestart: false,
+            validationErrors: {},
+        });
+    });
+    app.put("/secrets/notion", async (c) => {
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const body = parsedBody.body;
+        const apiKey = typeof body?.apiKey === "string" ? body.apiKey.trim() : "";
+        if (!apiKey) {
+            return c.json({
+                status: "validation_failed",
+                configured: false,
+                requiresRestart: false,
+                validationErrors: { apiKey: "Notion API key is required." },
+            }, 400);
+        }
+        await secretBroker.set("notionApiKey", apiKey);
+        await deps.onSecretChanged?.("notion");
+        return c.json({
+            status: "updated",
+            configured: (await getSecretConfigSummary(deps)).notionConfigured,
+            requiresRestart: false,
+            validationErrors: {},
+        });
+    });
+    app.put("/secrets/github", async (c) => {
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const body = parsedBody.body;
+        const token = typeof body?.token === "string" ? body.token.trim() : "";
+        const webhookSecret = typeof body?.webhookSecret === "string" ? body.webhookSecret.trim() : "";
+        if (!token && !webhookSecret) {
+            return c.json({
+                status: "validation_failed",
+                configured: false,
+                requiresRestart: false,
+                validationErrors: {
+                    token: "Provide a GitHub token and/or webhook secret.",
+                    webhookSecret: "Provide a GitHub token and/or webhook secret.",
+                },
+            }, 400);
+        }
+        if (token)
+            await secretBroker.set("githubToken", token);
+        if (webhookSecret)
+            await secretBroker.set("githubWebhookSecret", webhookSecret);
+        await deps.onSecretChanged?.("github");
+        const summary = await getSecretConfigSummary(deps);
+        return c.json({
+            status: "updated",
+            configured: summary.githubConfigured || summary.githubWebhookSecretConfigured,
+            requiresRestart: false,
+            validationErrors: {},
+        });
+    });
+    app.put("/secrets/google/credentials", async (c) => {
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const body = parsedBody.body;
+        const raw = typeof body?.json === "string" ? body.json : "";
+        if (!raw) {
+            return c.json({
+                status: "validation_failed",
+                configured: false,
+                requiresRestart: false,
+                validationErrors: { json: "Credentials JSON is required." },
+            }, 400);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return c.json({
+                status: "validation_failed",
+                configured: false,
+                requiresRestart: false,
+                validationErrors: { json: "Invalid JSON file" },
+            }, 400);
+        }
+        if (!parsed.installed && !parsed.web && parsed.type !== "service_account") {
+            return c.json({
+                status: "validation_failed",
+                configured: false,
+                requiresRestart: false,
+                validationErrors: {
+                    json: "Invalid credentials format. Expected OAuth2 credentials JSON or a service account JSON.",
+                },
+            }, 400);
+        }
+        await secretBroker.set("googleCredentialsJson", raw);
+        if (parsed.type === "service_account") {
+            await secretBroker.delete("googleTokenJson");
+        }
+        await deps.onSecretChanged?.("google");
+        deps.onGoogleServicesReady?.();
+        const summary = await getSecretConfigSummary(deps);
+        return c.json({
+            status: "updated",
+            configured: summary.googleCalendarCredentialsConfigured,
+            requiresRestart: false,
+            validationErrors: {},
+        });
+    });
+    app.put("/secrets/google/token", async (c) => {
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const body = parsedBody.body;
+        const raw = typeof body?.json === "string" ? body.json : "";
+        if (!raw) {
+            return c.json({
+                status: "validation_failed",
+                configured: false,
+                requiresRestart: false,
+                validationErrors: { json: "Token JSON is required." },
+            }, 400);
+        }
+        try {
+            JSON.parse(raw);
+        }
+        catch {
+            return c.json({
+                status: "validation_failed",
+                configured: false,
+                requiresRestart: false,
+                validationErrors: { json: "Invalid JSON file" },
+            }, 400);
+        }
+        await secretBroker.saveGoogleTokenJson(raw);
+        await deps.onSecretChanged?.("google");
+        deps.onGoogleServicesReady?.();
+        const summary = await getSecretConfigSummary(deps);
+        return c.json({
+            status: "updated",
+            configured: summary.googleCalendarTokenConfigured,
+            requiresRestart: false,
+            validationErrors: {},
+        });
+    });
+    app.delete("/secrets/:name", async (c) => {
+        const name = c.req.param("name");
+        if (name === "apiToken") {
+            return c.json({
+                error: "api_token_not_deletable",
+                message: "The daemon API token cannot be deleted from the API. Rotate it explicitly instead.",
+            }, 400);
+        }
+        const secretNameByParam = {
+            slackBotToken: "slackBotToken",
+            slackAppToken: "slackAppToken",
+            telegramBotToken: "telegramBotToken",
+            discordBotToken: "discordBotToken",
+            notionApiKey: "notionApiKey",
+            githubToken: "githubToken",
+            githubWebhookSecret: "githubWebhookSecret",
+            googleCredentialsJson: "googleCredentialsJson",
+            googleTokenJson: "googleTokenJson",
+        };
+        const secretName = secretNameByParam[name];
+        if (!secretName) {
+            return c.json({ error: "unknown_secret" }, 404);
+        }
+        await secretBroker.delete(secretName);
+        const scopeBySecret = {
+            slackBotToken: "slack",
+            slackAppToken: "slack",
+            telegramBotToken: "telegram",
+            discordBotToken: "discord",
+            notionApiKey: "notion",
+            githubToken: "github",
+            githubWebhookSecret: "github",
+            googleCredentialsJson: "google",
+            googleTokenJson: "google",
+        };
+        await deps.onSecretChanged?.(scopeBySecret[secretName]);
+        return c.json({
+            status: "deleted",
+            configured: false,
+            requiresRestart: false,
+            validationErrors: {},
+        });
+    });
+}
+//# sourceMappingURL=secrets.js.map

package/dist/api/routes/dashboard/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../../src/api/routes/dashboard/secrets.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAsB9E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAqB;IAErB,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAC9B,MAAM,CACJ,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,QAAQ,EACR,qBAAqB,EACrB,eAAe,EAChB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,YAAY,CAAC,gBAAgB,EAAE;QAC/B,YAAY,CAAC,gBAAgB,EAAE;QAC/B,YAAY,CAAC,mBAAmB,EAAE;QAClC,YAAY,CAAC,kBAAkB,EAAE;QACjC,YAAY,CAAC,eAAe,EAAE;QAC9B,YAAY,CAAC,cAAc,EAAE;QAC7B,YAAY,CAAC,sBAAsB,EAAE;QACrC,YAAY,CAAC,WAAW,EAAE;QAC1B,YAAY,CAAC,wBAAwB,EAAE;QACvC,YAAY,CAAC,kBAAkB,EAAE;KAClC,CAAC,CAAC;IAEH,qEAAqE;IACrE,kEAAkE;IAClE,+DAA+D;IAC/D,6DAA6D;IAC7D,IAAI,6BAA6B,GAAG,KAAK,CAAC;IAC1C,IAAI,CAAC;QACH,6BAA6B,GAAG,IAAI,CAAC,SAAS;YAC5C,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,4BAA4B,CAAC;YAC3D,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B,GAAG,KAAK,CAAC;IACxC,CAAC;IAED,OAAO;QACL,eAAe,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC;QACnD,kBAAkB,EAAE,CAAC,CAAC,gBAAgB;QACtC,iBAAiB,EAAE,CAAC,CAAC,eAAe;QACpC,gBAAgB,EAAE,CAAC,CAAC,YAAY;QAChC,gBAAgB,EAAE,CAAC,CAAC,WAAW;QAC/B,6BAA6B,EAAE,CAAC,CAAC,mBAAmB;QACpD,kBAAkB,EAAE,CAAC,CAAC,QAAQ;QAC9B,mCAAmC,EAAE,CAAC,CAAC,qBAAqB;QAC5D,6BAA6B,EAAE,CAAC,CAAC,eAAe;QAChD,6BAA6B;QAC7B,oBAAoB,EAAE,0BAA0B,CAAC,qBAAqB,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAS,EAAE,IAAqB;IACpE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAE9B,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAsC,CAAC;QAC/D,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,gBAAgB,GAA2B,EAAE,CAAC;QACpD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,mBAAmB;gBAC3B,UAAU,EAAE,KAAK;gBACjB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE;oBAChB,QAAQ,EAAE,2CAA2C;oBACrD,QAAQ,EAAE,2CAA2C;iBACtD;aACF,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,IAAI,QAAQ;YAAE,MAAM,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,QAAQ;YAAE,MAAM,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;QAEtC,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe;YAChE,eAAe,EAAE,KAAK;YACtB,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAsC,CAAC;QAC/D,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,mBAAmB;gBAC3B,UAAU,EAAE,KAAK;gBACjB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE,QAAQ,EAAE,iCAAiC,EAAE;aAClE,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,MAAM,YAAY,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,UAAU,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB;YACnE,eAAe,EAAE,KAAK;YACtB,gBAAgB,EAAE,EAAE;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAsC,CAAC;QAC/D,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,mBAAmB;gBAC3B,UAAU,EAAE,KAAK;gBACjB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gCAAgC,EAAE;aACjE,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,MAAM,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,CAAC;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB;YAClE,eAAe,EAAE,KAAK;YACtB,gBAAgB,EAAE,EAAE;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAsC,CAAC;QAC/D,MAAM,MAAM,GAAG,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,mBAAmB;gBAC3B,UAAU,EAAE,KAAK;gBACjB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE;aAC5D,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,MAAM,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,CAAC;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB;YACjE,eAAe,EAAE,KAAK;YACtB,gBAAgB,EAAE,EAAE;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAsC,CAAC;QAC/D,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,aAAa,GAAG,OAAO,IAAI,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,mBAAmB;gBAC3B,UAAU,EAAE,KAAK;gBACjB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE;oBAChB,KAAK,EAAE,+CAA+C;oBACtD,aAAa,EAAE,+CAA+C;iBAC/D;aACF,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,IAAI,KAAK;YAAE,MAAM,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,aAAa;YAAE,MAAM,YAAY,CAAC,GAAG,CAAC,qBAAqB,EAAE,aAAa,CAAC,CAAC;QAChF,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,6BAA6B;YAC7E,eAAe,EAAE,KAAK;YACtB,gBAAgB,EAAE,EAAE;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAsC,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,mBAAmB;gBAC3B,UAAU,EAAE,KAAK;gBACjB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE;aAC5D,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,mBAAmB;gBAC3B,UAAU,EAAE,KAAK;gBACjB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE;aAChD,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC1E,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,mBAAmB;gBAC3B,UAAU,EAAE,KAAK;gBACjB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE;oBAChB,IAAI,EAAE,yFAAyF;iBAChG;aACF,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,MAAM,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACtC,MAAM,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,OAAO,CAAC,mCAAmC;YACvD,eAAe,EAAE,KAAK;YACtB,gBAAgB,EAAE,EAAE;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAsC,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,mBAAmB;gBAC3B,UAAU,EAAE,KAAK;gBACjB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE;aACtD,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,mBAAmB;gBAC3B,UAAU,EAAE,KAAK;gBACjB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE;aAChD,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,MAAM,YAAY,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,OAAO,CAAC,6BAA6B;YACjD,eAAe,EAAE,KAAK;YACtB,gBAAgB,EAAE,EAAE;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,OAAO,EAAE,oFAAoF;aAC9F,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QACD,MAAM,iBAAiB,GAAG;YACxB,aAAa,EAAE,eAAe;YAC9B,aAAa,EAAE,eAAe;YAC9B,gBAAgB,EAAE,kBAAkB;YACpC,eAAe,EAAE,iBAAiB;YAClC,YAAY,EAAE,cAAc;YAC5B,WAAW,EAAE,aAAa;YAC1B,mBAAmB,EAAE,qBAAqB;YAC1C,qBAAqB,EAAE,uBAAuB;YAC9C,eAAe,EAAE,iBAAiB;SAC1B,CAAC;QACX,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAsC,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAEtC,MAAM,aAAa,GAAG;YACpB,aAAa,EAAE,OAAO;YACtB,aAAa,EAAE,OAAO;YACtB,gBAAgB,EAAE,UAAU;YAC5B,eAAe,EAAE,SAAS;YAC1B,YAAY,EAAE,QAAQ;YACtB,WAAW,EAAE,QAAQ;YACrB,mBAAmB,EAAE,QAAQ;YAC7B,qBAAqB,EAAE,QAAQ;YAC/B,eAAe,EAAE,QAAQ;SACjB,CAAC;QACX,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;QAExD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,KAAK;YACjB,eAAe,EAAE,KAAK;YACtB,gBAAgB,EAAE,EAAE;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/routes/dashboard/snapshots.d.ts

@@ -0,0 +1,4 @@
+import type { Hono } from "hono";
+import type { ApiDependencies } from "../../server.js";
+export declare function registerSnapshotsRoutes(app: Hono, deps: ApiDependencies): void;
+//# sourceMappingURL=snapshots.d.ts.map

package/dist/api/routes/dashboard/snapshots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshots.d.ts","sourceRoot":"","sources":["../../../../src/api/routes/dashboard/snapshots.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,GAAG,IAAI,CAuC9E"}

package/dist/api/routes/dashboard/snapshots.js

@@ -0,0 +1,33 @@
+export function registerSnapshotsRoutes(app, deps) {
+    const { db } = deps;
+    // ── Snapshots API ──
+    /** GET /snapshots/content/:id — single snapshot content */
+    app.get("/snapshots/content/:id", (c) => {
+        const id = Number(c.req.param("id"));
+        if (!Number.isSafeInteger(id) || id <= 0) {
+            return c.json({ error: "invalid id" }, 400);
+        }
+        const row = db
+            .prepare("SELECT id, file_path, content, trigger, created_at FROM md_file_snapshots WHERE id = ?")
+            .get(id);
+        if (!row)
+            return c.json({ error: "not_found" }, 404);
+        return c.json(row);
+    });
+    /** GET /snapshots/* — snapshot history for a context file */
+    app.get("/snapshots/*", (c) => {
+        const filePath = c.req.path.replace("/api/snapshots/", "");
+        // Validate: reject path traversal and unsafe characters
+        if (!filePath || /\.\./.test(filePath) || !/^[\w./-]+$/.test(filePath)) {
+            return c.json({ error: "invalid file path" }, 400);
+        }
+        const limit = Math.min(Number(c.req.query("limit") ?? "20"), 50);
+        const rows = db
+            .prepare(`SELECT id, file_path, trigger, session_id, created_at
+         FROM md_file_snapshots WHERE file_path = ?
+         ORDER BY created_at DESC LIMIT ?`)
+            .all(filePath, limit);
+        return c.json({ snapshots: rows });
+    });
+}
+//# sourceMappingURL=snapshots.js.map

package/dist/api/routes/dashboard/snapshots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshots.js","sourceRoot":"","sources":["../../../../src/api/routes/dashboard/snapshots.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,uBAAuB,CAAC,GAAS,EAAE,IAAqB;IACtE,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,sBAAsB;IAEtB,2DAA2D;IAC3D,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE;QACtC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,GAAG,GAAG,EAAE;aACX,OAAO,CACN,wFAAwF,CACzF;aACA,GAAG,CAAC,EAAE,CAAC,CAAC;QACX,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAE3D,wDAAwD;QACxD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CACN;;0CAEkC,CACnC;aACA,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/routes/dashboard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard.d.ts","sourceRoot":"","sources":["../../../src/api/routes/dashboard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAoLpD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC,GACD,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAsErE;AA8ID,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAgmEjE"}
+{"version":3,"file":"dashboard.d.ts","sourceRoot":"","sources":["../../../src/api/routes/dashboard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAa5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAoMpD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC,GACD,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAsErE;AA8ID,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CA8lEjE"}

package/dist/api/routes/dashboard.js

@@ -2,7 +2,7 @@ import { Hono } from "hono";
 import { readFileSync, writeFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
-import { APP_NAME, EDITABLE_RUNTIME_KEY_TUPLE, getAgentDayBoundsUtc, normalizeAgentDisplayName, } from "@aitne/shared";
+import { APP_NAME, EDITABLE_RUNTIME_KEY_TUPLE, getAgentDayBoundsUtc, getBackendIds, normalizeAgentDisplayName, } from "@aitne/shared";
 import { applyConfigUpdates } from "../env-writer.js";
 import { runDefaultSchedulesReconciler } from "../../core/context/default-schedules-runner.js";
 import { syncDmSessionTimesToQuietHours } from "../../core/quiet-hours-sync.js";
@@ -58,6 +58,9 @@ const PUBLIC_CONFIG_RUNTIME_KEYS = [
     "claudeExecutionPermissionMode",
     "codexExecutionPermissionMode",
     "geminiExecutionPermissionMode",
+    "opencodeExecutionPermissionMode",
+    "opencodeBaseUrl",
+    "opencodeServerUsername",
     "externalObsidianVaultPath",
     "externalObsidianVaultName",
     // SETUP-FLOW-REDESIGN-PLAN §6.3 — kill switch for the external-vault
@@ -90,6 +93,15 @@ const PUBLIC_CONFIG_RUNTIME_KEYS = [
     "primaryLanguage",
     "vaultMode",
 ];
+const EXECUTION_PERMISSION_CONFIG_KEYS = {
+    claude: "claudeExecutionPermissionMode",
+    codex: "codexExecutionPermissionMode",
+    gemini: "geminiExecutionPermissionMode",
+    opencode: "opencodeExecutionPermissionMode",
+};
+function getExecutionPermissionMode(config, backend) {
+    return config[EXECUTION_PERMISSION_CONFIG_KEYS[backend]];
+}
 const PUBLIC_CONFIG_NULLABLE_STRING_KEYS = new Set([
     "whatsappAuthDir",
     "externalObsidianVaultPath",
@@ -573,11 +585,10 @@ export function createDashboardRoutes(deps) {
         // dedicated `POST /api/setup/mode` is the usual path (it emits its own
         // audit row); this PATCH covers the power-user / env-style API caller
         // who edits the key directly without going through the settings UI.
-        const prevExecMode = {
-            claude: config.claudeExecutionPermissionMode,
-            codex: config.codexExecutionPermissionMode,
-            gemini: config.geminiExecutionPermissionMode,
-        };
+        const prevExecMode = Object.fromEntries(getBackendIds().map((backend) => [
+            backend,
+            getExecutionPermissionMode(config, backend),
+        ]));
         // design/15-character.md §15.6.1 — snapshot character pre-apply so the
         // live-overwrite pass below has a stable "after" value to fan out to
         // every active session workdir.
@@ -686,15 +697,12 @@ export function createDashboardRoutes(deps) {
         // the row shape that `POST /api/setup/mode` writes. Without this the
         // PATCH path would silently bypass audit coverage for a power-user
         // API caller.
-        for (const [backend, key] of [
-            ["claude", "claudeExecutionPermissionMode"],
-            ["codex", "codexExecutionPermissionMode"],
-            ["gemini", "geminiExecutionPermissionMode"],
-        ]) {
+        for (const backend of getBackendIds()) {
+            const key = EXECUTION_PERMISSION_CONFIG_KEYS[backend];
             if (!result.updated.includes(key))
                 continue;
             const before = prevExecMode[backend];
-            const after = config[key];
+            const after = getExecutionPermissionMode(config, backend);
             if (before === after)
                 continue;
             try {