@andorra-labs/code 0.0.0-stage → 0.1.4

package/dist/src/config.js

@@ -0,0 +1,663 @@
+import { validateEfficiencyConfig } from './efficiency.js';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { isIP } from 'node:net';
+import { assertProviderCredentials, assertRequestTimeout, assertStreamIdleTimeout, MAX_CODEX_ACCOUNT_KEY_LENGTH, MAX_PROVIDER_NAME_LENGTH, REASONING_EFFORTS } from './providers.js';
+import { validateAnalyticsConfig } from './analytics.js';
+import { isPermissionMode } from './permissions.js';
+import { LIMIT_KEYS } from './limits.js';
+import { acquireSaveLock, SaveLockBusyError } from './save-lock.js';
+/** The longest override the setting accepts: the same bound the workspace guide is clipped to. */
+export const MAX_SYSTEM_PROMPT_OVERRIDE = 16_000;
+export const AUTO_ARCHIVE_MIN_DAYS = 1;
+export const AUTO_ARCHIVE_MAX_DAYS = 30;
+export function configDirectory() {
+    return process.env.ANDORRACODE_HOME || join(homedir(), '.andorracode');
+}
+function privateHttpHost(host) {
+    const address = host.replace(/^\[|\]$/g, '').toLowerCase();
+    if (address === 'localhost' || address === '::1')
+        return true;
+    if (isIP(address) === 4) {
+        const [first, second] = address.split('.').map(Number);
+        return first === 127 || first === 10 || (first === 172 && second >= 16 && second <= 31)
+            || (first === 192 && second === 168) || (first === 100 && second >= 64 && second <= 127);
+    }
+    return isIP(address) === 6 && (/^f[cd]/.test(address) || /^fe[89ab]/.test(address));
+}
+export function validateConfig(value) {
+    const c = value;
+    if (!c || c.version !== 1 || typeof c.provider !== 'string' || !Array.isArray(c.providers)) {
+        throw new Error('Invalid config: expected version 1, provider, and providers array');
+    }
+    if (c.workspacePermissions !== undefined && (!c.workspacePermissions || typeof c.workspacePermissions !== 'object' || Array.isArray(c.workspacePermissions) || Object.entries(c.workspacePermissions).some(([key, mode]) => !/^[a-f0-9]{64}$/.test(key) || !isPermissionMode(mode))))
+        throw new Error('Invalid workspacePermissions configuration');
+    if (c.codeIntel !== undefined)
+        validateCodeIntelConfig(c.codeIntel);
+    if (c.graph !== undefined && (typeof c.graph !== 'string' || !/^[\w-]{1,128}$/.test(c.graph)))
+        throw new Error('Invalid configured graph');
+    if (c.graphSelections !== undefined && (!c.graphSelections || typeof c.graphSelections !== 'object' || Array.isArray(c.graphSelections)
+        || Object.entries(c.graphSelections).some(([subject, graph]) => !/^[A-Za-z0-9-]{1,128}$/.test(subject) || typeof graph !== 'string' || !/^[\w-]{1,128}$/.test(graph))))
+        throw new Error('Invalid account graph selections');
+    if (c.externalSubagent !== undefined && (!c.externalSubagent || typeof c.externalSubagent !== 'object' || Array.isArray(c.externalSubagent)
+        || typeof c.externalSubagent.provider !== 'string' || !/^[\w-]+$/.test(c.externalSubagent.provider)
+        || typeof c.externalSubagent.model !== 'string' || !c.externalSubagent.model.trim() || c.externalSubagent.model.length > 500)) {
+        throw new Error('Invalid externalSubagent configuration');
+    }
+    if (c.decisions !== undefined)
+        validateDecisionConfig(c.decisions);
+    if (c.efficiency !== undefined)
+        validateEfficiencyConfig(c.efficiency);
+    if (c.memory !== undefined)
+        validateMemoryConfig(c.memory);
+    if (c.analytics !== undefined)
+        validateAnalyticsConfig(c.analytics);
+    if (c.jevEnabled !== undefined && typeof c.jevEnabled !== 'boolean')
+        throw new Error('jevEnabled must be a boolean');
+    if (c.commandMemory !== undefined && typeof c.commandMemory !== 'boolean')
+        throw new Error('commandMemory must be a boolean');
+    if (c.systemPromptOverride !== undefined && (typeof c.systemPromptOverride !== 'string' || !c.systemPromptOverride.trim() || c.systemPromptOverride.length > MAX_SYSTEM_PROMPT_OVERRIDE)) {
+        throw new Error(`systemPromptOverride must be nonempty text of up to ${MAX_SYSTEM_PROMPT_OVERRIDE} characters`);
+    }
+    if (c.autoArchiveDays !== undefined && (!Number.isSafeInteger(c.autoArchiveDays) || c.autoArchiveDays < AUTO_ARCHIVE_MIN_DAYS || c.autoArchiveDays > AUTO_ARCHIVE_MAX_DAYS)) {
+        throw new Error(`autoArchiveDays must be a whole number from ${AUTO_ARCHIVE_MIN_DAYS} to ${AUTO_ARCHIVE_MAX_DAYS}`);
+    }
+    if (c.limits !== undefined)
+        validateLimitsConfig(c.limits);
+    if (c.extensions !== undefined) {
+        if (!c.extensions || typeof c.extensions !== 'object' || Array.isArray(c.extensions))
+            throw new Error('Invalid extensions configuration');
+        const validSkillId = (id) => {
+            if (typeof id !== 'string')
+                return false;
+            const [group, ...paths] = id.split(':');
+            if (!/^[\w-]+$/.test(group))
+                return false;
+            if (!paths.length)
+                return true;
+            return paths.length === 1 && paths[0].length <= 1000 && (paths[0] === '.' || !!paths[0] && paths[0].split('/').every(part => !!part && part !== '.' && part !== '..' && !/[\\:\0]/.test(part)));
+        };
+        for (const [entries, valid] of [[c.extensions.disabledSkills, validSkillId], [c.extensions.disabledPlugins, (id) => typeof id === 'string' && /^[\w-]+$/.test(id)]]) {
+            if (entries !== undefined && (!Array.isArray(entries) || entries.some(id => !valid(id))))
+                throw new Error('Invalid disabled extension ids');
+        }
+    }
+    if (c.mcpServers !== undefined) {
+        if (!c.mcpServers || typeof c.mcpServers !== 'object' || Array.isArray(c.mcpServers))
+            throw new Error('Invalid MCP configuration');
+        for (const [id, server] of Object.entries(c.mcpServers)) {
+            if (!/^[\w-]+$/.test(id) || ['__proto__', 'constructor', 'prototype'].includes(id))
+                throw new Error('Invalid MCP server id');
+            validateMcpServer(server);
+        }
+    }
+    if (c.remote !== undefined)
+        validateRemoteConfig(c.remote);
+    if (c.projects !== undefined)
+        validateProjectsConfig(c.projects);
+    // The subagent pair names a provider by id, so a stored selection that outlived the provider
+    // it pointed at must fail at load instead of at the first external run. The check comes before
+    // the empty-provider return: a configuration with no providers holds no pair either, and a pair
+    // that names one of them is not a selection anyone can run.
+    if (c.externalSubagent !== undefined && !c.providers.some(p => p?.id === c.externalSubagent.provider)) {
+        throw new Error('externalSubagent.provider is not a configured provider');
+    }
+    if (!c.providers.length) {
+        if (c.provider !== '')
+            throw new Error('Selected provider is not configured');
+        return c;
+    }
+    const ids = new Set();
+    for (const p of c.providers) {
+        if (!p || typeof p.id !== 'string' || !/^[\w-]+$/.test(p.id) || ids.has(p.id)
+            || !['openai-compatible', 'anthropic', 'codex', 'claude', 'opencode-go'].includes(p.type)
+            || typeof p.model !== 'string' || !p.model.trim() || p.model.length > 500 || typeof p.baseUrl !== 'string'
+            || (p.apiKeyEnv !== undefined && (typeof p.apiKeyEnv !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(p.apiKeyEnv)))) {
+            throw new Error('Invalid provider configuration');
+        }
+        if (p.contextWindow !== undefined && (!Number.isSafeInteger(p.contextWindow) || p.contextWindow <= 0)) {
+            throw new Error('Provider contextWindow must be a positive integer');
+        }
+        // The display name is what lists, pickers, and usage rows read; the id stays the immutable
+        // identity the journals record. A name must be text a row can render, never blank or padding.
+        if (p.name !== undefined && (typeof p.name !== 'string' || !p.name.trim() || p.name.length > MAX_PROVIDER_NAME_LENGTH)) {
+            throw new Error(`Provider name must be nonempty text of up to ${MAX_PROVIDER_NAME_LENGTH} characters`);
+        }
+        if (p.models !== undefined) {
+            if (!Array.isArray(p.models) || !p.models.length || p.models.some(model => typeof model !== 'string' || !model.trim() || model.length > 500)
+                || new Set(p.models).size !== p.models.length) {
+                throw new Error('Provider models must be a nonempty list of unique model ids');
+            }
+            if (!p.models.includes(p.model)) {
+                throw new Error(`The active model must be one of provider ${p.id}'s configured models`);
+            }
+        }
+        if (p.modelContextWindows !== undefined) {
+            if (!p.modelContextWindows || typeof p.modelContextWindows !== 'object' || Array.isArray(p.modelContextWindows)) {
+                throw new Error('Provider modelContextWindows must map model ids to positive integer context windows');
+            }
+            for (const [model, window] of Object.entries(p.modelContextWindows)) {
+                if (!model.trim() || model.length > 500 || ['__proto__', 'constructor', 'prototype'].includes(model)
+                    || !Number.isSafeInteger(window) || window <= 0) {
+                    throw new Error('Provider modelContextWindows must map nonempty model ids to positive integer context windows');
+                }
+            }
+        }
+        if (p.reasoningEffort !== undefined && (!['openai-compatible', 'opencode-go'].includes(p.type) || !REASONING_EFFORTS.includes(p.reasoningEffort))) {
+            throw new Error('Invalid reasoningEffort: use an OpenAI-compatible or OpenCode Go provider and none, minimal, low, medium, high, xhigh, or max');
+        }
+        assertRequestTimeout(p);
+        assertStreamIdleTimeout(p);
+        assertProviderCredentials(p);
+        if (p.type === 'codex' && (p.baseUrl !== 'https://chatgpt.com/backend-api/codex' || p.apiKeyEnv !== undefined)) {
+            throw new Error('Codex providers use the official ChatGPT endpoint and Codex sign-in; API key overrides are not supported');
+        }
+        // A slot key names a directory under the configuration home, so it is held to the same shape as
+        // a provider id; the email is display data recorded at sign-in, bounded and single-addressed.
+        if (p.codexAccount !== undefined && (p.type !== 'codex' || typeof p.codexAccount !== 'string'
+            || !/^[\w-]+$/.test(p.codexAccount) || p.codexAccount.length > MAX_CODEX_ACCOUNT_KEY_LENGTH)) {
+            throw new Error(`codexAccount is a Codex-only account slot key of up to ${MAX_CODEX_ACCOUNT_KEY_LENGTH} word characters and dashes`);
+        }
+        if (p.codexEmail !== undefined && (p.type !== 'codex' || typeof p.codexEmail !== 'string' || p.codexEmail.length > 320 || !/^[^@\s]+@[^@\s]+$/.test(p.codexEmail))) {
+            throw new Error('codexEmail is a Codex-only account email address');
+        }
+        // The Console token is issued for the first-party API only; a gateway would receive it instead.
+        if (p.anthropicAuth === 'console' && p.baseUrl !== 'https://api.anthropic.com/v1') {
+            throw new Error('Claude Console sign-in uses https://api.anthropic.com/v1; custom endpoints are not supported');
+        }
+        if (p.type === 'claude' && p.baseUrl !== 'https://api.anthropic.com') {
+            throw new Error('Claude providers use the installed Claude Code sign-in; custom endpoints are not supported');
+        }
+        if (p.type === 'opencode-go' && p.baseUrl !== 'https://opencode.ai/inference/go') {
+            throw new Error('OpenCode Go providers use https://opencode.ai/inference/go');
+        }
+        const url = new URL(p.baseUrl);
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+            throw new Error('Provider baseUrl must be HTTP(S), without credentials, query, or fragment');
+        }
+        if (url.protocol === 'http:' && !privateHttpHost(url.hostname)) {
+            throw new Error('Public provider endpoints require HTTPS; HTTP is supported for local and private networks');
+        }
+        ids.add(p.id);
+    }
+    // Slot keys name directories, and the filesystems this ships on treat `Codex-Work` and `codex-work`
+    // as one: bindings that differ only by case would silently share a session, and deleting either
+    // would delete the other's credentials too. The same key twice is a shared account by choice.
+    const slots = new Map();
+    for (const p of c.providers) {
+        if (p.codexAccount === undefined)
+            continue;
+        const folded = p.codexAccount.toLowerCase();
+        const bound = slots.get(folded);
+        if (bound !== undefined && bound !== p.codexAccount) {
+            throw new Error(`Codex account slots ${bound} and ${p.codexAccount} name one directory on this platform; give one of those providers a different name`);
+        }
+        slots.set(folded, p.codexAccount);
+    }
+    // A signed-in Anthropic provider keeps its login in a directory named by its id, so ids that differ
+    // only by case would share one login on Windows and macOS, and signing either out would sign out both.
+    const accounts = new Map();
+    for (const p of c.providers) {
+        if (p.anthropicAuth !== 'console')
+            continue;
+        const bound = accounts.get(p.id.toLowerCase());
+        if (bound !== undefined) {
+            throw new Error(`Providers ${bound} and ${p.id} would keep their Claude Console sign-in in one directory on this platform; give one of them a different name`);
+        }
+        accounts.set(p.id.toLowerCase(), p.id);
+    }
+    if (!ids.has(c.provider))
+        throw new Error('Selected provider is not configured');
+    // The subagent pair names a provider by id, so a stored selection that outlived the provider
+    // it pointed at must fail at load instead of at the first external run.
+    if (c.externalSubagent !== undefined) {
+        const provider = c.providers.find(p => p.id === c.externalSubagent.provider);
+        if (!provider)
+            throw new Error('externalSubagent.provider is not a configured provider');
+        if (provider.models !== undefined && !provider.models.includes(c.externalSubagent.model)) {
+            throw new Error(`externalSubagent.model must be one of provider ${provider.id}'s configured models`);
+        }
+    }
+    return c;
+}
+/**
+ * The saved external-subagent pair follows the providers it names.
+ *
+ * A provider that is removed, or a model that is no longer on its list, leaves the pair naming a
+ * model that does not exist, and the configuration would be refused for a setting the reader
+ * never touched. The pair is dropped instead, and the next external run asks its caller for a
+ * pick.
+ */
+export function reconcileSubagentPair(config) {
+    const saved = config.externalSubagent;
+    if (!saved)
+        return config;
+    const provider = config.providers.find(item => item.id === saved.provider);
+    if (provider !== undefined && (provider.models === undefined || provider.models.includes(saved.model)))
+        return config;
+    const reconciled = { ...config };
+    delete reconciled.externalSubagent;
+    return reconciled;
+}
+export function validateMcpServer(value) {
+    const c = value;
+    const record = (v) => v !== null && typeof v === 'object' && !Array.isArray(v) && Object.entries(v).every(([k, x]) => k.length > 0 && typeof x === 'string' && !/[\0\r\n]/.test(k));
+    if (!c || typeof c !== 'object' || Array.isArray(c) || (c.enabled !== undefined && typeof c.enabled !== 'boolean'))
+        throw new Error('Invalid MCP server');
+    if (c.transport === 'stdio') {
+        if (typeof c.command !== 'string' || !c.command.trim() || c.command.includes('\0') || (c.args !== undefined && (!Array.isArray(c.args) || c.args.some(x => typeof x !== 'string' || x.includes('\0')))) || (c.env !== undefined && (!record(c.env) || Object.entries(c.env).some(([k, v]) => !/^[A-Za-z_][A-Za-z0-9_]*$/.test(k) || v.includes('\0')))))
+            throw new Error('Invalid MCP stdio command, arguments, or environment');
+    }
+    else if (c.transport === 'http') {
+        const url = new URL(c.url);
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.hash || (url.protocol === 'http:' && !privateHttpHost(url.hostname)) || (c.headers !== undefined && (!record(c.headers) || Object.values(c.headers).some(x => /[\r\n\0]/.test(x)))))
+            throw new Error('MCP requires HTTPS (or private HTTP), without URL credentials, and valid headers');
+    }
+    else
+        throw new Error('MCP transport must be stdio or http');
+    return c;
+}
+/**
+ * Validate the installation's run bounds.
+ *
+ * A deadline-shaped bound accepts `0` as the explicit spelling of unlimited; every other
+ * value must be a positive safe integer, and a bound the runtime would reject must fail here
+ * instead of at the first run.
+ * @param limits - the configured limits block.
+ */
+export function validateLimitsConfig(limits) {
+    const l = limits;
+    if (!l || typeof l !== 'object' || Array.isArray(l))
+        throw new Error('Invalid limits configuration');
+    for (const key of Object.keys(l)) {
+        if (!LIMIT_KEYS.includes(key))
+            throw new Error(`limits.${key} is not a supported limit`);
+        const value = l[key];
+        if (value === undefined)
+            continue;
+        if (!Number.isSafeInteger(value))
+            throw new Error(`limits.${key} must be an integer`);
+        // Zero is only an unlimited alias for a deadline-shaped bound. For these two it is a real
+        // ceiling — refuse every tool call, or every completion repair — which both executors and
+        // graph validation already accept, so installation config must accept it too.
+        if (key === 'maxToolCalls' || key === 'maxCompletionRepairs') {
+            if (value < 0)
+                throw new Error(`limits.${key} must be zero or greater`);
+            continue;
+        }
+        if (value === 0 && (key === 'wallTimeMs' || key === 'maxIterations'))
+            continue;
+        if (value < 1)
+            throw new Error(`limits.${key} must be a positive integer, or 0 for unlimited`);
+    }
+}
+/**
+ * Read the configured run bounds as effective limits.
+ *
+ * Normalizes the explicit `0` spelling to an absent key, so the runtime only ever has to
+ * answer one question: is a bound set, or is the run unlimited?
+ * @param config - the loaded configuration.
+ * @returns partial limits ready to hand a run, empty when nothing is configured.
+ */
+export function resolveConfiguredLimits(config) {
+    if (config.limits === undefined)
+        return {};
+    validateLimitsConfig(config.limits);
+    const resolved = {};
+    for (const key of LIMIT_KEYS) {
+        const value = config.limits[key];
+        if (value === undefined)
+            continue;
+        if (value === 0 && (key === 'wallTimeMs' || key === 'maxIterations'))
+            continue;
+        resolved[key] = value;
+    }
+    return resolved;
+}
+export function validateMemoryConfig(memory) {
+    const m = memory;
+    if (!m || typeof m !== 'object' || Array.isArray(m))
+        throw new Error('Invalid memory configuration');
+    if (m.enabled !== undefined && typeof m.enabled !== 'boolean')
+        throw new Error('memory.enabled must be a boolean');
+    if (m.provider !== undefined && !['graphiti', 'none'].includes(m.provider))
+        throw new Error('memory.provider must be graphiti or none');
+    if (m.automaticRetrieval !== undefined && typeof m.automaticRetrieval !== 'boolean')
+        throw new Error('memory.automaticRetrieval must be a boolean');
+    if (m.maxRetrievedMemories !== undefined && (!Number.isSafeInteger(m.maxRetrievedMemories) || m.maxRetrievedMemories < 1 || m.maxRetrievedMemories > 20)) {
+        throw new Error('memory.maxRetrievedMemories must be an integer from 1 to 20');
+    }
+    if (m.memoryContextChars !== undefined && (!Number.isSafeInteger(m.memoryContextChars) || m.memoryContextChars < 500 || m.memoryContextChars > 16000)) {
+        throw new Error('memory.memoryContextChars must be an integer from 500 to 16000');
+    }
+    if (m.persistence !== undefined) {
+        const p = m.persistence;
+        if (!p || typeof p !== 'object' || Array.isArray(p)
+            || (p.verifiedOnly !== undefined && typeof p.verifiedOnly !== 'boolean')
+            || (p.distillOnTaskCompletion !== undefined && typeof p.distillOnTaskCompletion !== 'boolean')
+            || (p.distillWithModel !== undefined && typeof p.distillWithModel !== 'boolean')) {
+            throw new Error('Invalid memory.persistence configuration');
+        }
+    }
+    if (m.graphiti !== undefined) {
+        const g = m.graphiti;
+        if (!g || typeof g !== 'object' || Array.isArray(g) || typeof g.endpoint !== 'string')
+            throw new Error('memory.graphiti.endpoint is required');
+        if (g.transport !== undefined && g.transport !== 'http')
+            throw new Error('memory.graphiti.transport must be http');
+        if (g.requestTimeoutMs !== undefined && (!Number.isSafeInteger(g.requestTimeoutMs) || g.requestTimeoutMs < 100 || g.requestTimeoutMs > 60000)) {
+            throw new Error('memory.graphiti.requestTimeoutMs must be an integer from 100 to 60000');
+        }
+        const url = new URL(g.endpoint);
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+            throw new Error('memory.graphiti.endpoint must be HTTP(S), without credentials, query, or fragment');
+        }
+        if (url.protocol === 'http:' && !privateHttpHost(url.hostname)) {
+            throw new Error('Public Graphiti endpoints require HTTPS; HTTP is supported for local and private networks');
+        }
+    }
+}
+/** Environment overrides win over config.json; nothing is persisted back. */
+export function resolveMemoryConfig(config, env = process.env) {
+    const memory = { ...(config.memory ?? {}) };
+    const provider = env.ANDORRA_MEMORY_PROVIDER;
+    if (provider !== undefined) {
+        if (!['graphiti', 'none'].includes(provider))
+            throw new Error('ANDORRA_MEMORY_PROVIDER must be graphiti or none');
+        memory.provider = provider;
+        memory.enabled = provider !== 'none';
+    }
+    const url = env.ANDORRA_GRAPHITI_URL;
+    if (url !== undefined) {
+        memory.graphiti = { ...(memory.graphiti ?? {}), endpoint: url };
+        if (provider === undefined) {
+            memory.provider = 'graphiti';
+            memory.enabled = true;
+        }
+    }
+    validateMemoryConfig(memory);
+    return memory;
+}
+export async function loadConfig(directory = configDirectory()) {
+    try {
+        return validateConfig(JSON.parse(await readFile(join(directory, 'config.json'), 'utf8')));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { version: 1, provider: '', providers: [] };
+        throw error;
+    }
+}
+/**
+ * The anonymous-feedback preference this installation has saved right now.
+ *
+ * The setting belongs to the installation rather than to any one process: the desktop app and
+ * every CLI write the same file, so a process that started before the change holds a snapshot
+ * that no longer says what was saved. A reader that reports or changes the preference asks here
+ * for the file's own answer rather than for the snapshot it loaded at startup.
+ *
+ * Only the block is read, and it is validated on its own: a preference that cannot be stored is
+ * a file the user believes is doing something, and a reader must not answer from it.
+ * @param directory - the installation's configuration directory.
+ * @returns the saved block, or undefined when the file holds none.
+ */
+export async function loadSavedAnalytics(directory = configDirectory()) {
+    let stored;
+    try {
+        stored = await readFile(join(directory, 'config.json'), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+    const parsed = JSON.parse(stored);
+    if (parsed.analytics === undefined)
+        return undefined;
+    validateAnalyticsConfig(parsed.analytics);
+    return parsed.analytics;
+}
+/** Write the configuration and publish it with one rename; the caller owns the lock, or is the only writer. */
+async function writeConfig(config, directory) {
+    validateConfig(config);
+    await mkdir(directory, { recursive: true });
+    const temporary = join(directory, `config-${randomUUID()}.tmp`);
+    await writeFile(temporary, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+    await rename(temporary, join(directory, 'config.json'));
+}
+/** How long a write waits for another process's write before reporting the collision. */
+const LOCK_ATTEMPTS = 6;
+const LOCK_RETRY_MS = 50;
+/**
+ * Run one configuration write under the installation's own lock.
+ *
+ * Every writer of this file — the CLI, the terminal UI, each desktop window's engine — takes the same
+ * lock, which is what makes a write indivisible against another process. Contention is ordinary rather
+ * than exceptional (two surfaces saving at the same moment), so a busy lock is waited on briefly and only
+ * then reported; the wait is bounded, and an owner that died holding it is recovered by the lock itself.
+ */
+async function withConfigLock(directory, run) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            const release = await acquireSaveLock(directory);
+            try {
+                return await run();
+            }
+            finally {
+                await release();
+            }
+        }
+        catch (error) {
+            if (!(error instanceof SaveLockBusyError) || attempt >= LOCK_ATTEMPTS - 1)
+                throw error;
+            await new Promise(resolve => setTimeout(resolve, LOCK_RETRY_MS * (attempt + 1)));
+        }
+    }
+}
+export async function saveConfig(config, directory = configDirectory()) {
+    await withConfigLock(directory, () => writeConfig(config, directory));
+}
+/** Raised when the stored configuration was replaced between a read and the write that followed it. */
+export class ConfigConflictError extends Error {
+    constructor() { super('The configuration changed while this change was being applied. Try again.'); this.name = 'ConfigConflictError'; }
+}
+/**
+ * Change the configuration file under the installation's lock, re-applying the change if it was replaced.
+ *
+ * The lock serializes every writer that honours it; the comparison covers the writers that cannot — an
+ * older installation, or a person editing the file — by re-applying the change to the newer content when
+ * the stored text is not the one this change was computed from. `change` has to be a pure function of the
+ * configuration it is given, which is what makes re-applying it safe.
+ */
+export async function changeConfigFile(directory, change, attempts = 3) {
+    const stored = join(directory, 'config.json');
+    const read = async () => await readFile(stored, 'utf8').catch(() => undefined);
+    return await withConfigLock(directory, async () => {
+        for (let attempt = 0; attempt < attempts; attempt++) {
+            const before = await read();
+            const next = change(await loadConfig(directory));
+            if (await read() !== before)
+                continue;
+            await writeConfig(next, directory);
+            return await loadConfig(directory);
+        }
+        throw new ConfigConflictError();
+    });
+}
+export function validateCodeIntelConfig(codeIntel) {
+    const c = codeIntel;
+    if (!c || typeof c !== 'object' || Array.isArray(c))
+        throw new Error('Invalid codeIntel configuration');
+    if (c.enabled !== undefined && typeof c.enabled !== 'boolean')
+        throw new Error('codeIntel.enabled must be a boolean');
+    if (c.disabledRepos !== undefined && (!Array.isArray(c.disabledRepos) || c.disabledRepos.length > 100 || c.disabledRepos.some(id => typeof id !== 'string' || !id.trim() || id.length > 200))) {
+        throw new Error('codeIntel.disabledRepos must be an array of repository id strings');
+    }
+    if (c.enabledRepos !== undefined && (!Array.isArray(c.enabledRepos) || c.enabledRepos.length > 100 || c.enabledRepos.some(id => typeof id !== 'string' || !id.trim() || id.length > 200))) {
+        throw new Error('codeIntel.enabledRepos must be an array of repository id strings');
+    }
+}
+/** Code intelligence defaults to on; config.json can disable it globally or per repository. */
+export function resolveCodeIntelConfig(config) {
+    const codeIntel = { enabled: true, ...(config.codeIntel ?? {}) };
+    validateCodeIntelConfig(codeIntel);
+    return codeIntel;
+}
+/** Secrets the remote feature stores are all fixed-size random encodings; anything else is corruption. */
+const BASE64URL_32 = /^[A-Za-z0-9_-]{43}$/;
+const HEX_16 = /^[a-f0-9]{16}$/;
+const HEX_32 = /^[a-f0-9]{32}$/;
+const HEX_12 = /^[a-f0-9]{12}$/;
+const ISO_DATE = /^\d{4}-\d{2}-\d{2}T/;
+/** A user-visible name for a device, share, or workspace: printable, bounded, never multi-line. */
+function isDisplayLabel(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= 64 && !/[\0\r\n]/.test(value);
+}
+function isIsoDate(value) {
+    return typeof value === 'string' && ISO_DATE.test(value) && !Number.isNaN(Date.parse(value));
+}
+function isPort(value) {
+    return Number.isSafeInteger(value) && value >= 1 && value <= 65535;
+}
+/**
+ * Validate the Remote Workspace section.
+ *
+ * Device tokens, invitation tokens, and workspace credentials are 256-bit random values; the id
+ * shapes are what the pairing transaction generates. Rejecting anything else here means a
+ * hand-edited or corrupted file fails loudly at load instead of being presented as a live device
+ * or a redeemable invitation. Absolute share paths are deliberately NOT validated against any
+ * allowlist — the host chose them — but they must be plain filesystem paths with no control
+ * characters, because the browse layer treats them as containment roots.
+ */
+export function validateRemoteConfig(remote) {
+    const r = remote;
+    if (!r || typeof r !== 'object' || Array.isArray(r))
+        throw new Error('Invalid remote configuration');
+    if (r.hosting !== undefined) {
+        const h = r.hosting;
+        if (!h || typeof h !== 'object' || Array.isArray(h))
+            throw new Error('Invalid remote hosting configuration');
+        if (h.installId !== undefined && !HEX_32.test(h.installId))
+            throw new Error('remote.hosting.installId must be 32 hex characters');
+        if (h.port !== undefined && !isPort(h.port))
+            throw new Error('remote.hosting.port must be a port number');
+        if (h.transport !== undefined && h.transport !== 'https' && h.transport !== 'http')
+            throw new Error('remote.hosting.transport must be https or http');
+        if (h.invitation !== undefined && h.invitation !== null) {
+            const i = h.invitation;
+            if (!i || typeof i !== 'object' || Array.isArray(i) || !BASE64URL_32.test(i.token) || !isIsoDate(i.createdAt) || !isIsoDate(i.expiresAt)
+                || (i.redeemedAt !== undefined && !isIsoDate(i.redeemedAt))
+                || (i.grant !== undefined && i.grant !== 'browse' && i.grant !== 'full'))
+                throw new Error('Invalid remote invitation');
+        }
+        if (h.devices !== undefined) {
+            if (!Array.isArray(h.devices) || h.devices.length > 32)
+                throw new Error('remote.hosting.devices must be an array of at most 32 devices');
+            const ids = new Set();
+            for (const device of h.devices) {
+                if (!device || typeof device !== 'object' || Array.isArray(device) || !HEX_16.test(device.id) || ids.has(device.id)
+                    || !BASE64URL_32.test(device.token) || !isIsoDate(device.addedAt)
+                    || (device.label !== undefined && !isDisplayLabel(device.label))
+                    || (device.lastSeenAt !== undefined && !isIsoDate(device.lastSeenAt))
+                    || (device.grant !== undefined && device.grant !== 'browse' && device.grant !== 'full'))
+                    throw new Error('Invalid paired remote device');
+                ids.add(device.id);
+            }
+        }
+        if (h.shares !== undefined) {
+            if (!Array.isArray(h.shares) || h.shares.length > 64)
+                throw new Error('remote.hosting.shares must be an array of at most 64 shares');
+            const ids = new Set();
+            for (const share of h.shares) {
+                if (!share || typeof share !== 'object' || Array.isArray(share) || !HEX_12.test(share.id) || ids.has(share.id)
+                    || typeof share.path !== 'string' || !share.path.trim() || share.path.includes('\0')
+                    || (share.label !== undefined && !isDisplayLabel(share.label)))
+                    throw new Error('Invalid remote share');
+                ids.add(share.id);
+            }
+        }
+    }
+    if (r.workspaces !== undefined) {
+        if (!Array.isArray(r.workspaces) || r.workspaces.length > 32)
+            throw new Error('remote.workspaces must be an array of at most 32 workspaces');
+        const ids = new Set();
+        for (const workspace of r.workspaces) {
+            if (!workspace || typeof workspace !== 'object' || Array.isArray(workspace)
+                || !/^ws-[a-f0-9]{12}$/.test(workspace.id) || ids.has(workspace.id)
+                || !isDisplayLabel(workspace.nickname) || !Array.isArray(workspace.hosts) || workspace.hosts.length < 1 || workspace.hosts.length > 8
+                || workspace.hosts.some((host) => typeof host !== 'string' || !host.trim() || host.length > 253 || /[\0\r\n /]/.test(host))
+                || (workspace.host !== undefined && (typeof workspace.host !== 'string' || !workspace.host.trim() || workspace.host.length > 253 || /[\0\r\n /]/.test(workspace.host)))
+                || !isPort(workspace.port) || (workspace.transport !== 'https' && workspace.transport !== 'http')
+                || !BASE64URL_32.test(workspace.fingerprint)
+                // The certificate is the trust anchor only on https. An http workspace — paired under the
+                // explicit plaintext opt-in — stores no certificate at all (''), and requiring one here
+                // would fail its write after the host had already redeemed the single-use invitation.
+                || (workspace.transport === 'https'
+                    ? (typeof workspace.certPem !== 'string' || !workspace.certPem.includes('BEGIN CERTIFICATE'))
+                    : (workspace.certPem !== undefined && typeof workspace.certPem !== 'string'))
+                || !BASE64URL_32.test(workspace.token) || !isIsoDate(workspace.addedAt)
+                || (workspace.hostname !== undefined && (typeof workspace.hostname !== 'string' || !workspace.hostname.trim() || workspace.hostname.length > 128 || /[\0\r\n]/.test(workspace.hostname)))
+                || (workspace.platform !== undefined && (typeof workspace.platform !== 'string' || !workspace.platform.trim() || workspace.platform.length > 64 || /[\0\r\n]/.test(workspace.platform)))
+                || (workspace.version !== undefined && (typeof workspace.version !== 'string' || !workspace.version.trim() || workspace.version.length > 64 || /[\0\r\n]/.test(workspace.version))))
+                throw new Error('Invalid paired remote workspace');
+            ids.add(workspace.id);
+        }
+    }
+}
+/**
+ * Validate the project registry the rail and peers read.
+ *
+ * `path` is the realpath the registry stores (the entry key for idempotent adds), so it must be a
+ * plain absolute-ish filesystem path free of control characters; the name is a display label.
+ */
+export function validateProjectsConfig(projects) {
+    if (!Array.isArray(projects) || projects.length > 256)
+        throw new Error('projects must be an array of at most 256 entries');
+    const seen = new Set();
+    for (const project of projects) {
+        if (!project || typeof project !== 'object' || Array.isArray(project)
+            || typeof project.path !== 'string' || !project.path.trim() || project.path.includes('\0') || seen.has(project.path)
+            || !isIsoDate(project.addedAt)
+            || (project.name !== undefined && (typeof project.name !== 'string' || !project.name.trim() || project.name.length > 100 || /[\0\r\n]/.test(project.name))))
+            throw new Error('Invalid project registry entry');
+        seen.add(project.path);
+    }
+}
+export function validateDecisionConfig(value) {
+    const c = value;
+    if (!c || typeof c !== 'object' || Array.isArray(c))
+        throw new Error('Invalid decisions configuration');
+    if (Object.keys(c).some(key => !['mode', 'provider', 'endpoint', 'model', 'apiKeyEnv', 'requestTimeoutMs', 'features', 'style'].includes(key)))
+        throw new Error('Unsupported decisions configuration field');
+    if (c.style !== undefined && !['facts', 'questions'].includes(c.style))
+        throw new Error('decisions.style must be "facts" or "questions"');
+    if (c.mode !== undefined && !['off', 'shadow', 'active'].includes(c.mode))
+        throw new Error('Invalid decisions.mode');
+    if (c.provider !== undefined && !['none', 'jev', 'laya', 'andorra'].includes(c.provider))
+        throw new Error('Invalid decisions.provider');
+    if (c.provider === 'andorra' && (c.endpoint !== undefined || c.model !== undefined || c.apiKeyEnv !== undefined))
+        throw new Error('Andorra decisions use the managed endpoint and server credentials; remove endpoint, model and apiKeyEnv');
+    if (c.requestTimeoutMs !== undefined && (!Number.isSafeInteger(c.requestTimeoutMs) || c.requestTimeoutMs < 10 || c.requestTimeoutMs > 60000))
+        throw new Error('decisions.requestTimeoutMs must be an integer from 10 to 60000');
+    if (c.model !== undefined && (typeof c.model !== 'string' || !c.model.trim() || c.model.length > 256 || /[\r\n]/.test(c.model)))
+        throw new Error('Invalid decisions.model');
+    if (c.apiKeyEnv !== undefined && (typeof c.apiKeyEnv !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(c.apiKeyEnv)))
+        throw new Error('Invalid decisions.apiKeyEnv');
+    if (c.endpoint !== undefined) {
+        if (typeof c.endpoint !== 'string')
+            throw new Error('Invalid decisions.endpoint');
+        let url;
+        try {
+            url = new URL(c.endpoint);
+        }
+        catch {
+            throw new Error('Invalid decisions.endpoint');
+        }
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || (url.protocol === 'http:' && !privateHttpHost(url.hostname)))
+            throw new Error('decisions.endpoint requires HTTPS or private HTTP without credentials, query or fragment');
+    }
+    if (c.features !== undefined && (!c.features || typeof c.features !== 'object' || Array.isArray(c.features) || Object.entries(c.features).some(([key, v]) => !['toolRouting', 'codeGraphRouting', 'memoryRouting', 'webRouting', 'delegationRouting', 'verificationRouting', 'riskClassification', 'resultRouting'].includes(key) || typeof v !== 'boolean')))
+        throw new Error('Invalid decisions.features');
+}