@andrew.ng/symbion 0.1.0

package/apps/daemon/dist/rpc/handlers.js

@@ -0,0 +1,694 @@
+import { existsSync, statSync } from "node:fs";
+import { accessSync, constants } from "node:fs";
+import { join } from "node:path";
+import { AUTHOR_REGISTRY, computeDiff as coreComputeDiff, parseClaudeDir, renderArtifacts, renderRunCommand as coreRenderRunCommand, validateAllArtifacts, } from "@symbion/core";
+import { fetchAuthorTemplatesFromGithub } from "../templates/githubFetch.js";
+import { createProjectStore, loadGlobalConfig, loadProjectStore, projectStoreExists, saveGlobalConfig, saveProjectStore, } from "../store/store.js";
+import { appendPublishLogEntry } from "../store/publishLog.js";
+import { gitStatus as coreGitStatus } from "../git/status.js";
+import { browseFolder as nativeBrowseFolder } from "../fs/folderPick.js";
+import { listDir as listDirImpl, makeDir as makeDirImpl } from "../fs/listDir.js";
+import { extractForeignAgentsMdContent, readAgentsMd, readClaudeDirFilemap, readTargetFiles, } from "../fs/readTargetFiles.js";
+import { writeFiles } from "../fs/writeFiles.js";
+import { buildBodyGenerationPrompt } from "@symbion/core";
+import { getProvider, listProviderDescriptors } from "../llm/registry.js";
+import { LlmError } from "../llm/types.js";
+import { checkApiKeyProviderReachable, checkOllamaReachable, resolveOllamaBaseUrlForStatusCheck, } from "../llm/providerStatus.js";
+import { detectHostEnvironment, getOllamaInstallInstructions } from "../llm/installInstructions.js";
+import { clearProviderKey as secretsClearProviderKey, loadProvidersConfig, maskKey, ProviderNotConfiguredError, setActiveProvider as secretsSetActiveProvider, setProviderKey as secretsSetProviderKey, } from "../llm/secrets.js";
+import { RpcError } from "./rpcError.js";
+import { isUncPath } from "./pathStyle.js";
+export { RpcError };
+function randomId() {
+    const hex = () => Math.floor(Math.random() * 16).toString(16);
+    const tpl = "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx";
+    return tpl.replace(/[xy]/g, (c) => c === "y" ? ((Math.floor(Math.random() * 4) + 8) % 16).toString(16) : hex());
+}
+function findProjectPath(projectId) {
+    const config = loadGlobalConfig();
+    const entry = config.projects.find((p) => p.id === projectId);
+    if (!entry) {
+        throw new Error(`Không tìm thấy project: ${projectId}`);
+    }
+    return entry.path;
+}
+/**
+ * Runtime guards for the LLM RPC surface (generateBody/listModels). TypeScript's
+ * `"agent" | "command"` / the 4-id provider unions give zero enforcement once
+ * JSON is parsed off the wire — an unrecognized value must fail cleanly with
+ * RpcError("invalid-params", ...) BEFORE reaching the prompt builder or provider
+ * registry, never fall through to the generic 500/internal-error catch-all (see
+ * docs/loops/auto-generate-body-STATE.md §13, MEDIUM finding).
+ */
+const VALID_KINDS = new Set(["agent", "command"]);
+const VALID_PROVIDER_IDS = new Set(["ollama", "openai", "anthropic", "gemini"]);
+const VALID_API_KEY_PROVIDER_IDS = new Set(["openai", "anthropic", "gemini"]);
+function assertValidKind(kind) {
+    if (typeof kind !== "string" || !VALID_KINDS.has(kind)) {
+        throw new RpcError("invalid-params", `Tham số "kind" không hợp lệ: phải là "agent" hoặc "command".`);
+    }
+}
+function assertValidProviderId(providerId) {
+    if (typeof providerId !== "string" || !VALID_PROVIDER_IDS.has(providerId)) {
+        throw new RpcError("invalid-params", `Tham số "providerId" không hợp lệ: phải là một trong "ollama", "openai", "anthropic", "gemini".`);
+    }
+}
+function assertValidApiKeyProviderId(providerId) {
+    if (typeof providerId !== "string" || !VALID_API_KEY_PROVIDER_IDS.has(providerId)) {
+        throw new RpcError("invalid-params", `Tham số "providerId" không hợp lệ: phải là một trong "openai", "anthropic", "gemini".`);
+    }
+}
+const PROVIDER_LABELS = {
+    ollama: "Ollama",
+    openai: "OpenAI",
+    anthropic: "Anthropic",
+    gemini: "Gemini",
+};
+/**
+ * buildProviderDescriptors — projects the daemon-internal ProvidersConfig
+ * (raw apiKey, never crosses the RPC boundary) into the masked
+ * `ProviderDescriptor[]` shape every provider-settings RPC returns. Single
+ * call site for this projection so `maskKey()` is applied exactly once, in
+ * exactly one place, never as an afterthought filter on an already-built
+ * response object (STATE §3.2's `listProviders` handler note + §9 security note).
+ */
+function buildProviderDescriptors() {
+    const config = loadProvidersConfig();
+    return listProviderDescriptors().map((descriptor) => {
+        if (descriptor.kind === "local") {
+            return {
+                id: descriptor.id,
+                label: descriptor.id === "ollama" ? "Ollama" : PROVIDER_LABELS[descriptor.id],
+                kind: descriptor.kind,
+                configured: true, // ollama needs no key — always "configured" in the sense of "usable"
+                active: config.activeProviderId === descriptor.id,
+            };
+        }
+        const stored = config.providers[descriptor.id];
+        return {
+            id: descriptor.id,
+            label: PROVIDER_LABELS[descriptor.id],
+            kind: descriptor.kind,
+            configured: Boolean(stored),
+            active: config.activeProviderId === descriptor.id,
+            maskedKey: stored ? maskKey(stored.apiKey) : undefined,
+            model: stored?.model,
+        };
+    });
+}
+export const handlers = {
+    ping(_params, ctx) {
+        return { ok: true, version: ctx.version, port: ctx.port };
+    },
+    async browseFolder(params) {
+        const result = await nativeBrowseFolder(params.startPath);
+        if (result.cancelled || !result.path)
+            return { cancelled: true };
+        return { path: result.path };
+    },
+    validatePath(params) {
+        const { path } = params;
+        if (isUncPath(path)) {
+            return {
+                exists: false,
+                isDir: false,
+                isGitRepo: false,
+                hasClaudeDir: false,
+                hasAgentsMd: false,
+                writable: false,
+                reason: "unc-unsupported",
+            };
+        }
+        const exists = existsSync(path);
+        let isDir = false;
+        let writable = false;
+        if (exists) {
+            const stat = statSync(path);
+            isDir = stat.isDirectory();
+            try {
+                accessSync(path, constants.W_OK);
+                writable = true;
+            }
+            catch {
+                writable = false;
+            }
+        }
+        const isGitRepo = exists && isDir && existsSync(join(path, ".git"));
+        const hasClaudeDir = exists && isDir && existsSync(join(path, ".claude"));
+        const hasAgentsMd = exists && isDir && existsSync(join(path, "AGENTS.md"));
+        return { exists, isDir, isGitRepo, hasClaudeDir, hasAgentsMd, writable };
+    },
+    listDir(params) {
+        return listDirImpl(params.path);
+    },
+    makeDir(params) {
+        return makeDirImpl(params.path);
+    },
+    listProjects(_params) {
+        const config = loadGlobalConfig();
+        return { projects: config.projects };
+    },
+    createProject(params) {
+        const { name, path } = params;
+        if (!existsSync(path) || !statSync(path).isDirectory()) {
+            throw new RpcError("invalid-path", "Đường dẫn không tồn tại hoặc không phải thư mục.");
+        }
+        if (projectStoreExists(path)) {
+            throw new RpcError("already-a-project", "Thư mục này đã là một dự án Symbion.");
+        }
+        const id = randomId();
+        const project = createProjectStore(path, name, id);
+        const config = loadGlobalConfig();
+        config.projects.push({ id, name, path });
+        config.lastProjectId = id;
+        saveGlobalConfig(config);
+        return { project };
+    },
+    loadProject(params) {
+        const path = findProjectPath(params.id);
+        return { project: loadProjectStore(path) };
+    },
+    saveArtifact(params) {
+        const path = findProjectPath(params.projectId);
+        const store = loadProjectStore(path);
+        const idx = store.artifacts.findIndex((a) => a.id === params.artifact.id);
+        const now = new Date().toISOString();
+        const artifact = {
+            ...params.artifact,
+            meta: { ...params.artifact.meta, updatedAt: now },
+        };
+        // Server-side validation (defense in depth — never trust the client).
+        // Validate against the *would-be* full artifact set (siblings + this
+        // artifact updated/inserted) so duplicate-name etc. checks are accurate.
+        const candidateSiblings = store.artifacts.filter((a) => a.id !== artifact.id);
+        const issues = validateAllArtifacts([...candidateSiblings, artifact]);
+        const blocking = issues.filter((i) => i.level === "error" && i.artifactId === artifact.id);
+        if (blocking.length > 0) {
+            throw new RpcError("validation-failed", `Không thể lưu — vi phạm lint: ${blocking.map((i) => i.message).join("; ")}`);
+        }
+        if (idx >= 0) {
+            store.artifacts[idx] = artifact;
+        }
+        else {
+            store.artifacts.push(artifact);
+        }
+        saveProjectStore(path, store);
+        return { project: store };
+    },
+    deleteArtifact(params) {
+        const path = findProjectPath(params.projectId);
+        const store = loadProjectStore(path);
+        // v1: removing an artifact in Studio does NOT delete its on-disk file silently
+        // (STATE §7B) — this only removes it from the in-app store.
+        store.artifacts = store.artifacts.filter((a) => a.id !== params.artifactId);
+        saveProjectStore(path, store);
+        return { project: store };
+    },
+    updateSettings(params) {
+        if (params.projectId && params.settings) {
+            const path = findProjectPath(params.projectId);
+            const store = loadProjectStore(path);
+            store.settings = params.settings;
+            saveProjectStore(path, store);
+            return { project: store };
+        }
+        if (params.globalConfig) {
+            const config = loadGlobalConfig();
+            Object.assign(config, params.globalConfig);
+            saveGlobalConfig(config);
+        }
+        return {};
+    },
+    scanClaudeDir(params) {
+        const filemap = readClaudeDirFilemap(params.path);
+        const parsed = parseClaudeDir(filemap);
+        return { parsed };
+    },
+    importArtifacts(params) {
+        const path = findProjectPath(params.projectId);
+        const store = loadProjectStore(path);
+        const selected = params.scanned.filter((a) => params.selectedIds.includes(a.id));
+        // Server-side validation (defense in depth) over the resulting merged
+        // artifact set. Imported artifacts that would create blocking lint
+        // errors (e.g. duplicate name, missing required fields) are rejected
+        // wholesale rather than silently persisted invalid.
+        const existingOthers = store.artifacts.filter((a) => !selected.some((s) => s.id === a.id));
+        const merged = [...existingOthers, ...selected];
+        const issues = validateAllArtifacts(merged);
+        const selectedIds = new Set(selected.map((a) => a.id));
+        const blocking = issues.filter((i) => i.level === "error" && i.artifactId && selectedIds.has(i.artifactId));
+        if (blocking.length > 0) {
+            throw new RpcError("validation-failed", `Không thể nhập — vi phạm lint: ${blocking.map((i) => i.message).join("; ")}`);
+        }
+        for (const artifact of selected) {
+            const idx = store.artifacts.findIndex((a) => a.id === artifact.id);
+            if (idx >= 0) {
+                store.artifacts[idx] = artifact;
+            }
+            else {
+                store.artifacts.push(artifact);
+            }
+        }
+        saveProjectStore(path, store);
+        return { project: store };
+    },
+    /**
+     * applyTemplate — stages one bundled template (apps/web's static gallery)
+     * into a project's store as a new draft artifact, with server-side
+     * auto-suffix collision resolution. See packages/rpc-types's
+     * ApplyTemplateParams doc comment + docs/loops/templates-marketplace-STATE.md
+     * PLAN §0(b)/§2 for the full rationale (new RPC vs. extending
+     * importArtifacts; TOCTOU; never-block-never-overwrite collision policy).
+     *
+     * Defense-in-depth shape re-validation: the daemon never trusts the
+     * client's `template.kind`/`name`/`description` even though this content
+     * originates from the web app's own bundled, build-time-reviewed data
+     * (not arbitrary external input) — same posture as every other mutating
+     * handler in this file (see saveArtifact/importArtifacts comments above).
+     */
+    applyTemplate(params) {
+        const { projectId, template } = params;
+        if (!template || (template.kind !== "agent" && template.kind !== "command")) {
+            throw new RpcError("invalid-kind", "Chỉ Agent/Command hỗ trợ Áp dụng.");
+        }
+        if (typeof template.name !== "string" || template.name.trim().length === 0) {
+            throw new RpcError("invalid-template", "Template thiếu name.");
+        }
+        if (typeof template.description !== "string" || template.description.trim().length === 0) {
+            throw new RpcError("invalid-template", "Template thiếu description.");
+        }
+        if (typeof template.body !== "string" || template.body.trim().length === 0) {
+            throw new RpcError("invalid-template", "Template thiếu nội dung (body).");
+        }
+        if (typeof template.sourceTemplateId !== "string" || template.sourceTemplateId.trim().length === 0) {
+            throw new RpcError("invalid-template", "Template thiếu sourceTemplateId.");
+        }
+        // templates-authors PLAN §P6: server-side defense-in-depth mirror of the
+        // client-side license/attribution acknowledgment gate. The daemon looks
+        // up authorId in AUTHOR_REGISTRY itself (never trusts a client-asserted
+        // boolean about WHETHER the gate applies) — only an unrecognized/absent
+        // authorId or one whose registry entry is kind:"bundled" (Symbion) is
+        // treated as not-third-party, matching "never trust the client" posture.
+        const authorId = template.authorId ?? "symbion";
+        const author = AUTHOR_REGISTRY.find((a) => a.id === authorId);
+        // Conservative default: unknown authorId → treat as third-party (requires
+        // acknowledgment). A known "bundled" (Symbion) entry is the ONLY exempt case.
+        // This ensures "never trust the client about WHETHER the gate applies" even if a
+        // future registry entry is misspelled or a hand-crafted RPC sends an unrecognized id.
+        const isThirdParty = author === undefined || author.kind === "github";
+        if (isThirdParty && template.acknowledgedThirdParty !== true) {
+            throw new RpcError("license-not-acknowledged", "Cần xác nhận đã đọc thông báo về bản quyền nội dung của tác giả khác trước khi áp dụng.");
+        }
+        const path = findProjectPath(projectId);
+        const store = loadProjectStore(path); // fresh read — closes the TOCTOU gap a client-side calc would have
+        // Auto-suffix algorithm (THINK #4): first free "<name>", "<name>-2", "<name>-3", ...
+        // scoped to (kind, name) pairs, matching validate.ts's own duplicate rule
+        // (same kind + same name) so the suffix algorithm and the lint rule it's
+        // dodging stay in lockstep by construction.
+        const existingNames = new Set(store.artifacts.filter((a) => a.kind === template.kind).map((a) => a.name));
+        let finalName = template.name;
+        let n = 2;
+        while (existingNames.has(finalName)) {
+            finalName = `${template.name}-${n}`;
+            n++;
+        }
+        const wasRenamed = finalName !== template.name;
+        const now = new Date().toISOString();
+        const artifact = {
+            id: randomId(),
+            kind: template.kind,
+            name: finalName,
+            description: template.description,
+            tools: template.tools,
+            body: template.body,
+            meta: {
+                version: "draft",
+                status: "draft",
+                createdAt: now,
+                updatedAt: now,
+                sourceTemplateId: template.sourceTemplateId,
+            },
+        };
+        // Defense-in-depth: re-validate the FULL resulting set, same posture as
+        // importArtifacts/saveArtifact. Should never actually fail given the
+        // auto-suffix loop above already guarantees no name collision, but keeps
+        // the same "never trust, always re-check before persist" invariant as
+        // every other write path (a real safety net if e.g. FILENAME_SAFE_RE
+        // rejects a name with a space/slash the bundle author typo'd).
+        const merged = [...store.artifacts, artifact];
+        const issues = validateAllArtifacts(merged);
+        const blocking = issues.filter((i) => i.level === "error" && i.artifactId === artifact.id);
+        if (blocking.length > 0) {
+            throw new RpcError("validation-failed", `Không thể áp dụng — vi phạm lint: ${blocking.map((i) => i.message).join("; ")}`);
+        }
+        store.artifacts.push(artifact);
+        saveProjectStore(path, store);
+        return { project: store, appliedArtifactId: artifact.id, finalName, wasRenamed };
+    },
+    /**
+     * fetchAuthorTemplates — templates-authors v2 extension (PLAN §P2). Looks
+     * up `authorId` in AUTHOR_REGISTRY (packages/core) server-side — never
+     * trusts/reads any client-supplied owner/repo fields, even if a
+     * hand-crafted request sends them (PLAN §P8 SSRF finding #1(a)). An
+     * unknown authorId, or one resolving to a `kind: "bundled"` entry (e.g.
+     * "symbion" — the bundled author can't be routed through the network-fetch
+     * path), is a programming/client-bug error -> thrown RpcError, NOT a
+     * well-formed outcome. A known `kind: "github"` author always resolves
+     * (never throws) to a `FetchAuthorTemplatesOutcome` — every external
+     * failure mode (network/rate-limit/not-found/per-file/parse) is a
+     * well-formed, expected-to-sometimes-fail result, not a daemon bug.
+     */
+    async fetchAuthorTemplates(params) {
+        if (typeof params?.authorId !== "string" || params.authorId.trim().length === 0) {
+            throw new RpcError("invalid-author", "Thiếu authorId.");
+        }
+        const author = AUTHOR_REGISTRY.find((a) => a.id === params.authorId);
+        if (!author || author.kind !== "github") {
+            throw new RpcError("invalid-author", `authorId không hợp lệ hoặc không phải nguồn GitHub: "${params.authorId}".`);
+        }
+        const outcome = await fetchAuthorTemplatesFromGithub(author);
+        return { outcome };
+    },
+    render(params) {
+        const path = findProjectPath(params.projectId);
+        const store = loadProjectStore(path);
+        const files = [];
+        for (const target of params.targets) {
+            const existingForeignContent = target === "codex" ? extractForeignAgentsMdContent(readAgentsMd(path)) : undefined;
+            files.push(...renderArtifacts(store.artifacts, target, { version: params.version, existingForeignContent }));
+        }
+        return { files };
+    },
+    computeDiff(params) {
+        const path = findProjectPath(params.projectId);
+        const store = loadProjectStore(path);
+        const allFiles = [];
+        for (const target of params.targets) {
+            const existingForeignContent = target === "codex" ? extractForeignAgentsMdContent(readAgentsMd(path)) : undefined;
+            const rendered = renderArtifacts(store.artifacts, target, {
+                version: params.version,
+                existingForeignContent,
+            });
+            const mergedTargetRelPaths = target === "codex" ? new Set(rendered.map((f) => f.relPath)) : new Set();
+            const onDisk = readTargetFiles(path, rendered.map((f) => f.relPath), mergedTargetRelPaths);
+            allFiles.push(...coreComputeDiff(rendered, onDisk));
+        }
+        const conflicts = allFiles.filter((f) => f.status === "conflict").length;
+        return { files: allFiles, conflicts };
+    },
+    write(params) {
+        const path = findProjectPath(params.projectId);
+        const store = loadProjectStore(path);
+        const diffResult = handlers.computeDiff({
+            projectId: params.projectId,
+            targets: params.targets,
+            version: params.version,
+        });
+        const selectionByPath = new Map(params.files.map((f) => [f.relPath, f.resolution]));
+        const renderedByPath = new Map();
+        for (const target of params.targets) {
+            const existingForeignContent = target === "codex" ? extractForeignAgentsMdContent(readAgentsMd(path)) : undefined;
+            for (const file of renderArtifacts(store.artifacts, target, {
+                version: params.version,
+                existingForeignContent,
+            })) {
+                renderedByPath.set(file.relPath, file);
+            }
+        }
+        const tasks = [];
+        for (const diffFile of diffResult.files) {
+            if (!selectionByPath.has(diffFile.relPath))
+                continue; // not selected by user -> skip
+            const rendered = renderedByPath.get(diffFile.relPath);
+            if (!rendered)
+                continue;
+            // Determine which target this relPath belongs to (best-effort: Claude paths are
+            // .claude/...; everything else (AGENTS.md) is codex).
+            const target = diffFile.relPath.startsWith(".claude/") ? "claude" : "codex";
+            tasks.push({
+                target,
+                relPath: diffFile.relPath,
+                content: rendered.content,
+                contentHash: rendered.contentHash,
+                artifactId: rendered.artifactIds[0],
+                resolution: selectionByPath.get(diffFile.relPath),
+                isSame: diffFile.status === "same",
+                isUnresolvedConflict: diffFile.status === "conflict",
+            });
+        }
+        const outcome = writeFiles(tasks, {
+            projectRoot: path,
+            version: params.version,
+            backupBeforeWrite: store.settings.backupBeforeWrite,
+        });
+        appendPublishLogEntry(path, {
+            version: params.version,
+            timestamp: new Date().toISOString(),
+            targets: params.targets,
+            results: outcome.results,
+            backupDir: outcome.backupDir,
+        });
+        // update meta.publishedHashes + status for artifacts that were successfully written
+        for (const result of outcome.results) {
+            if (result.action !== "created" && result.action !== "updated")
+                continue;
+            if (!result.artifactId)
+                continue;
+            const artifact = store.artifacts.find((a) => a.id === result.artifactId);
+            if (!artifact)
+                continue;
+            artifact.meta.publishedHashes = {
+                ...artifact.meta.publishedHashes,
+                [result.target]: result.contentHash,
+            };
+            artifact.meta.status = "published";
+            artifact.meta.version = params.version;
+        }
+        saveProjectStore(path, store);
+        return { results: outcome.results, backupDir: outcome.backupDir, logEntryWritten: true };
+    },
+    gitStatus(params) {
+        return coreGitStatus(params.path);
+    },
+    renderRunCommand(params) {
+        return { prompt: coreRenderRunCommand(params) };
+    },
+    /**
+     * listModels — single source of truth for a provider's model list, so apps/web
+     * never hand-duplicates it (resolves STATE §10.7 Risk R1 per the user's
+     * amendment). For the 3 cloud providers this is still a static, hardcoded,
+     * zero-network-call list (unchanged, AC5). For Ollama, this now performs a real
+     * `GET /api/tags` network call against the local Ollama instance (per
+     * docs/loops/ollama-dynamic-models-STATE.md §6.2/§6.4) — bounded by a 3000ms
+     * timeout, never hangs indefinitely (AC6).
+     *
+     * Three resolved outcomes (never a thrown RpcError for these, since both are
+     * well-formed, expected facts about a reachable Ollama, not daemon bugs):
+     * - `{models, outcome:"ok"}` — non-empty list (cloud providers always land here).
+     * - `{models:[], outcome:"empty"}` — Ollama reachable, zero models pulled.
+     * - `{models:[], outcome:"fetch-failed", errorMessage}` — Ollama reachable but
+     *   `/api/tags` itself failed (malformed JSON / non-2xx / missing `models` field).
+     *
+     * `provider-not-running` (Ollama unreachable) is the ONE case that still THROWS
+     * `RpcError("llm-provider-not-running", ...)` — unchanged shape, AC4.
+     */
+    async listModels(params) {
+        assertValidProviderId(params.providerId);
+        const provider = getProvider(params.providerId);
+        try {
+            const models = await provider.listModels();
+            return { models, outcome: models.length === 0 ? "empty" : "ok" };
+        }
+        catch (err) {
+            if (err instanceof LlmError) {
+                if (err.code === "provider-not-running") {
+                    // unchanged existing path — Ollama unreachable still throws, AC4.
+                    throw new RpcError(`llm-${err.code}`, humanMessageForLlmError(err));
+                }
+                // invalid-response (malformed JSON / non-2xx from /api/tags), or any other
+                // LlmError code reaching here — resolve with outcome:"fetch-failed" rather
+                // than throw, so the web layer can render a distinct, non-generic message.
+                return { models: [], outcome: "fetch-failed", errorMessage: humanMessageForLlmError(err) };
+            }
+            throw new RpcError("llm-unknown", "Lỗi không xác định khi lấy danh sách mô hình.");
+        }
+    },
+    /**
+     * generateBody — the first async, slow, externally-fallible RPC handler in the
+     * codebase (STATE §10.1/§10.2). Touches neither disk nor git: pure inference in,
+     * text out. Deliberately does NOT call findProjectPath/loadProjectStore — the
+     * request already carries all needed context inline (STATE §10.2).
+     */
+    async generateBody(params) {
+        // Runtime-validate the two "TS union, zero runtime enforcement" fields BEFORE
+        // touching the prompt builder or provider registry (STATE §13 MEDIUM finding) —
+        // an unrecognized kind/providerId must fail as a clean invalid-params RpcError,
+        // not a bare Error that falls through to the generic 500/internal-error path.
+        assertValidKind(params.kind);
+        assertValidProviderId(params.providerId);
+        // Defensive input-size cap (no daemon crash / runaway prompt on malformed/huge input —
+        // there is no pre-existing size-cap precedent elsewhere in the RPC surface to match,
+        // so this is a new, narrowly-scoped guard for this handler only).
+        const MAX_FIELD_LEN = 50_000;
+        for (const field of ["name", "description", "existingBody"]) {
+            const value = params[field];
+            if (typeof value !== "string" || value.length > MAX_FIELD_LEN) {
+                throw new RpcError("invalid-params", `Trường "${field}" không hợp lệ hoặc quá lớn.`);
+            }
+        }
+        if (typeof params.modelId !== "string" || params.modelId.length === 0 || params.modelId.length > 200) {
+            throw new RpcError("invalid-params", "modelId không hợp lệ.");
+        }
+        const { system, user } = buildBodyGenerationPrompt({
+            kind: params.kind,
+            name: params.name,
+            description: params.description,
+            existingBody: params.existingBody,
+        });
+        try {
+            // getProvider/the provider constructor can itself throw an LlmError (e.g. an
+            // env-var-sourced Ollama base URL that fails the loopback check — STATE §13 HIGH
+            // finding) — kept inside this try so any LlmError, whether thrown at construction
+            // time or during generate(), maps through the same clean RpcError taxonomy below
+            // instead of leaking via the generic 500/internal-error path.
+            const provider = getProvider(params.providerId);
+            const result = await provider.generate({
+                systemPrompt: system,
+                userPrompt: user,
+                model: params.modelId,
+                timeoutMs: 45_000,
+            });
+            return { body: result.text };
+        }
+        catch (err) {
+            if (err instanceof LlmError) {
+                throw new RpcError(`llm-${err.code}`, humanMessageForLlmError(err));
+            }
+            throw new RpcError("llm-unknown", "Lỗi không xác định khi gọi mô hình AI.");
+        }
+    },
+    /**
+     * checkProviderStatus — read-only liveness/auth check, widened per
+     * docs/loops/multi-provider-settings-STATE.md §3.2/§4b from the literal
+     * "ollama" to the 4-id union. Ollama keeps its exact existing path
+     * (checkOllamaReachable, unchanged). The 3 api-key providers: first check
+     * secrets.ts has a stored key (if not, short-circuit to
+     * { reachable:false, errorCode:"not-configured" } with ZERO network calls —
+     * never attempt a guaranteed-auth-failure round-trip); if a key exists,
+     * construct the provider (reads its own key internally) and perform ONE
+     * cheap authenticated call via checkApiKeyProviderReachable. Never throws
+     * on "not reachable" — that is a valid resolved result, not a server error.
+     */
+    async checkProviderStatus(params) {
+        assertValidProviderId(params?.providerId);
+        const { providerId } = params;
+        if (providerId === "ollama") {
+            const baseUrl = resolveOllamaBaseUrlForStatusCheck();
+            const reachable = await checkOllamaReachable(baseUrl, 3000);
+            const install = getOllamaInstallInstructions(detectHostEnvironment());
+            return { reachable, checkedBaseUrl: baseUrl, install, kind: "local" };
+        }
+        const config = loadProvidersConfig();
+        const hasKey = Boolean(config.providers[providerId]);
+        if (!hasKey) {
+            return { reachable: false, errorCode: "not-configured", kind: "api-key" };
+        }
+        const provider = getProvider(providerId);
+        const result = await checkApiKeyProviderReachable(provider, 3000);
+        return { reachable: result.reachable, errorCode: result.errorCode, kind: "api-key" };
+    },
+    /**
+     * listProviders — returns all 4 providers' static descriptor + current
+     * persisted state (masked key, model, configured/active) in one call,
+     * backing the Settings page's initial render and useActiveProvider()'s
+     * one-call-per-mount resolution (STATE §3.2/§4a/§4d).
+     */
+    listProviders(_params) {
+        return { providers: buildProviderDescriptors() };
+    },
+    /**
+     * saveProviderKey — validates providerId against the 3 api-key ids (ollama
+     * never has a stored key) and apiKey under a size cap (mirrors
+     * generateBody's MAX_FIELD_LEN pattern), then upserts via secrets.ts.
+     * Returns the masked descriptors — apiKey is NEVER serialized raw.
+     */
+    saveProviderKey(params) {
+        const providerIdRaw = params?.providerId;
+        assertValidApiKeyProviderId(providerIdRaw);
+        const providerId = providerIdRaw;
+        const model = params.model;
+        const MAX_API_KEY_LEN = 4000;
+        const apiKey = params.apiKey;
+        if (typeof apiKey !== "string" || apiKey.trim().length === 0 || apiKey.length > MAX_API_KEY_LEN) {
+            throw new RpcError("invalid-params", `Tham số "apiKey" không hợp lệ hoặc quá lớn.`);
+        }
+        if (model !== undefined && (typeof model !== "string" || model.length > 200)) {
+            throw new RpcError("invalid-params", `Tham số "model" không hợp lệ.`);
+        }
+        secretsSetProviderKey(providerId, apiKey, model ?? "");
+        return { providers: buildProviderDescriptors() };
+    },
+    /** clearProviderKey — removes one provider's stored key/model. If it was active,
+     * activeProviderId resets to null (no automatic fallback to ollama). */
+    clearProviderKey(params) {
+        const providerIdRaw = params?.providerId;
+        assertValidApiKeyProviderId(providerIdRaw);
+        const providerId = providerIdRaw;
+        secretsClearProviderKey(providerId);
+        return { providers: buildProviderDescriptors() };
+    },
+    /** setActiveProvider — rejects (invalid-params) if the target api-key provider has no
+     * stored key; ollama always succeeds (needs none). Never a silent no-op. */
+    setActiveProvider(params) {
+        assertValidProviderId(params?.providerId);
+        try {
+            secretsSetActiveProvider(params.providerId);
+        }
+        catch (err) {
+            if (err instanceof ProviderNotConfiguredError) {
+                throw new RpcError("invalid-params", "Chưa cấu hình API key cho nhà cung cấp này.");
+            }
+            throw err;
+        }
+        return { providers: buildProviderDescriptors() };
+    },
+};
+/**
+ * EC-4's exact error-code -> human-readable-Vietnamese-message taxonomy (STATE §10.5).
+ *
+ * Per-code fallback strings are used when `err.message` is empty, or for codes
+ * ("provider-not-running" / "timeout" / "auth" / "rate-limit" / "not-configured")
+ * whose throw sites across all 4 provider adapters (ollamaProvider.ts,
+ * openaiProvider.ts, anthropicProvider.ts, geminiProvider.ts) already construct a
+ * message that says exactly what the fallback says (provider name aside) — no extra
+ * detail to preserve there.
+ *
+ * For "invalid-response" and "network", the throw sites DO carry extra,
+ * user-relevant detail the generic fallback would otherwise discard (e.g. a 404
+ * "model not pulled" message naming the missing model) — confirmed root cause of
+ * the Generate Body 404 loop (docs/learnings.md). For those codes (and "unknown"),
+ * prefer the original `err.message` when present.
+ */
+function humanMessageForLlmError(err) {
+    const code = err.code;
+    switch (code) {
+        case "provider-not-running":
+            return "Không thể kết nối tới Ollama — đảm bảo Ollama đang chạy trên máy.";
+        case "timeout":
+            return "Quá thời gian chờ (45s) — thử lại.";
+        case "auth":
+            return "Thiếu hoặc sai cấu hình API key cho nhà cung cấp AI.";
+        case "rate-limit":
+            return "Bị giới hạn tần suất gọi — thử lại sau.";
+        case "not-configured":
+            return "Chưa cấu hình nhà cung cấp AI nào — vào Cài đặt để thêm.";
+        case "invalid-response":
+            return err.message || "Phản hồi không hợp lệ từ mô hình.";
+        case "network":
+        case "unknown":
+        default:
+            return err.message || "Lỗi không xác định, thử lại.";
+    }
+}
+export { validateAllArtifacts };
+//# sourceMappingURL=handlers.js.map