@celestea/studio 2.7.1

package/dist/auth/htpasswd.js

@@ -0,0 +1,61 @@
+/**
+ * W767 — password verification against Studio's OWN password file.
+ *
+ * `htpasswd -vbi` is used deliberately: `-b` takes the password on **stdin**
+ * (never in argv, so it cannot show up in `ps`/audit logs), `-v` verifies, `-i`
+ * reads stdin. The file is read-only input — Studio never writes it, and it is
+ * the only credential source this module knows about.
+ *
+ * The username is restricted to a conservative charset: it travels in argv, and
+ * a leading `-` or a newline must never be able to steer the helper.
+ */
+import { spawnSync } from "node:child_process";
+import { accessSync, constants } from "node:fs";
+/** The verifier binary (net/httpd-tools `htpasswd`). */
+export const HTPASSWD_BIN = "htpasswd";
+/** Accepted username shape (argv-safe, 1..64 chars). */
+export const HTPASSWD_USER_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+/** Bound the helper: a hung/absent binary must not hang a login. */
+const HTPASSWD_TIMEOUT_MS = 5_000;
+export function verifyPassword(file, user, password) {
+    if (password === "" || !HTPASSWD_USER_RE.test(user))
+        return "denied";
+    if (!isReadable(file))
+        return "error";
+    let run = runHelper(file, user, password);
+    // A transient SPAWN failure (EAGAIN/EMFILE while the host is loaded — observed
+    // as an intermittent `error` verdict under a full parallel test run) is not
+    // "the credential store is unusable": retry ONCE before calling it an operator
+    // problem. A genuine timeout is NOT retried — the 5 s bound stays the bound.
+    if (run.error !== undefined && !isTimeout(run.error)) {
+        run = runHelper(file, user, password);
+    }
+    if (run.error !== undefined)
+        return "error";
+    if (run.status === 0)
+        return "ok";
+    // 3 = password mismatch, 6 = user not found (both are "denied"); anything
+    // else (4 = file error, a signal, a timeout) is an operator problem.
+    return run.status === 3 || run.status === 6 ? "denied" : "error";
+}
+/** One `htpasswd -vbi` attempt (the password travels on stdin, never argv). */
+function runHelper(file, user, password) {
+    return spawnSync(HTPASSWD_BIN, ["-vbi", file, user], {
+        input: `${password}\n`,
+        encoding: "utf8",
+        timeout: HTPASSWD_TIMEOUT_MS,
+    });
+}
+/** `spawnSync` hit its own `timeout` — a bound we must not silently double. */
+function isTimeout(error) {
+    return error.code === "ETIMEDOUT";
+}
+function isReadable(file) {
+    try {
+        accessSync(file, constants.R_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/auth/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * W767 — Studio's own login-cookie gate (see `docs/feature-studio-auth.md`).
+ *
+ * token.ts       cookie token format + secret file (0600, Studio's data dir)
+ * htpasswd.ts    password verification against Studio's read-only password file
+ * rate-limit.ts  per-username / per-IP failure limiter (60 s window)
+ * page.ts        the self-contained login page the backend renders
+ * api-token.ts   H: the minimal self-cert token for a non-loopback bind
+ */
+export * from "./token.js";
+export * from "./api-token.js";
+export * from "./htpasswd.js";
+export * from "./rate-limit.js";
+export * from "./page.js";

package/dist/auth/index.js

@@ -0,0 +1,14 @@
+/**
+ * W767 — Studio's own login-cookie gate (see `docs/feature-studio-auth.md`).
+ *
+ * token.ts       cookie token format + secret file (0600, Studio's data dir)
+ * htpasswd.ts    password verification against Studio's read-only password file
+ * rate-limit.ts  per-username / per-IP failure limiter (60 s window)
+ * page.ts        the self-contained login page the backend renders
+ * api-token.ts   H: the minimal self-cert token for a non-loopback bind
+ */
+export * from "./token.js";
+export * from "./api-token.js";
+export * from "./htpasswd.js";
+export * from "./rate-limit.js";
+export * from "./page.js";

package/dist/auth/page.d.ts

@@ -0,0 +1,19 @@
+/**
+ * W767 — Studio's OWN login page, rendered by the Studio backend.
+ *
+ * Self-contained on purpose: inline CSS, no external asset, no dependency on
+ * the Vite build (so the login page keeps working while the SPA is being
+ * rebuilt, and nginx can serve it as the one unauthenticated page).
+ *
+ * The form posts `application/x-www-form-urlencoded`, which every browser and
+ * password manager understands; the JSON body form is accepted too (curl /
+ * API clients). ALL pages returned here are `Cache-Control: no-store`.
+ */
+/** `error === null` = a clean form; otherwise the message is shown above it. */
+export declare function loginPage(error?: string | null): string;
+/**
+ * The 200 answer to a SUCCESSFUL form login. It is a page (never a 302): a
+ * redirect response is allowed to drop `Set-Cookie` on some mobile clients, so
+ * the cookie and the navigation travel in the SAME 200 response.
+ */
+export declare const LOGIN_OK_PAGE = "<!doctype html>\n<html lang=\"zh-CN\"><head><meta charset=\"utf-8\"><meta name=\"robots\" content=\"noindex\">\n<title>\u5DF2\u767B\u5F55 \u00B7 Celestea Studio</title></head>\n<body><p>\u767B\u5F55\u6210\u529F\uFF0C\u6B63\u5728\u8FDB\u5165\u2026</p>\n<script>location.replace(\"/\")</script>\n<noscript><a href=\"/\">\u8FDB\u5165 Celestea Studio</a></noscript>\n</body></html>\n";

package/dist/auth/page.js

@@ -0,0 +1,73 @@
+/**
+ * W767 — Studio's OWN login page, rendered by the Studio backend.
+ *
+ * Self-contained on purpose: inline CSS, no external asset, no dependency on
+ * the Vite build (so the login page keeps working while the SPA is being
+ * rebuilt, and nginx can serve it as the one unauthenticated page).
+ *
+ * The form posts `application/x-www-form-urlencoded`, which every browser and
+ * password manager understands; the JSON body form is accepted too (curl /
+ * API clients). ALL pages returned here are `Cache-Control: no-store`.
+ */
+/** The page itself (the error slot is the only dynamic part). */
+const HEAD = `<!doctype html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="robots" content="noindex">
+<title>Celestea Studio 登录</title>
+<style>
+:root{color-scheme:dark light}
+*{box-sizing:border-box}
+body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;
+  background:#0f1115;color:#e8eaed;font:16px/1.5 system-ui,-apple-system,"Segoe UI",Roboto,"Noto Sans SC",sans-serif}
+main{width:100%;max-width:22rem;padding:2rem 1.5rem}
+h1{margin:0 0 .25rem;font-size:1.35rem;font-weight:600}
+p.sub{margin:0 0 1.5rem;color:#9aa0a6;font-size:.9rem}
+label{display:block;margin:0 0 .35rem;font-size:.85rem;color:#bdc1c6}
+input{width:100%;padding:.65rem .75rem;margin:0 0 1rem;border-radius:.5rem;border:1px solid #3c4043;
+  background:#1a1d21;color:inherit;font-size:1rem}
+input:focus{outline:2px solid #8ab4f8;outline-offset:1px;border-color:#8ab4f8}
+button{width:100%;padding:.7rem;border:0;border-radius:.5rem;background:#8ab4f8;color:#202124;
+  font-size:1rem;font-weight:600;cursor:pointer}
+button:hover{background:#aecbfa}
+.err{margin:0 0 1rem;padding:.6rem .75rem;border-radius:.5rem;background:#3b1d1d;border:1px solid #8c2f2f;
+  color:#f6aea9;font-size:.9rem}
+footer{margin:1.5rem 0 0;color:#5f6368;font-size:.75rem;text-align:center}
+</style>
+</head>
+<body><main>
+<h1>Celestea Studio</h1>
+<p class="sub">请登录后继续</p>
+`;
+/** `error === null` = a clean form; otherwise the message is shown above it. */
+export function loginPage(error = null) {
+    const slot = error === null ? "" : `<p class="err">${escapeHtml(error)}</p>`;
+    return `${HEAD}${slot}<form method="POST" action="/auth/login">
+<label for="u">用户名</label>
+<input id="u" name="username" autocomplete="username" autocapitalize="none" spellcheck="false" required autofocus>
+<label for="p">密码</label>
+<input id="p" name="password" type="password" autocomplete="current-password" required>
+<button type="submit">登录</button>
+</form>
+<footer>celestea-studio · 登录状态保持 30 天</footer>
+</main></body></html>
+`;
+}
+/**
+ * The 200 answer to a SUCCESSFUL form login. It is a page (never a 302): a
+ * redirect response is allowed to drop `Set-Cookie` on some mobile clients, so
+ * the cookie and the navigation travel in the SAME 200 response.
+ */
+export const LOGIN_OK_PAGE = `<!doctype html>
+<html lang="zh-CN"><head><meta charset="utf-8"><meta name="robots" content="noindex">
+<title>已登录 · Celestea Studio</title></head>
+<body><p>登录成功，正在进入…</p>
+<script>location.replace("/")</script>
+<noscript><a href="/">进入 Celestea Studio</a></noscript>
+</body></html>
+`;
+function escapeHtml(text) {
+    return text.replace(/[&<>"']/g, (ch) => `&#${ch.charCodeAt(0)};`);
+}

package/dist/auth/rate-limit.d.ts

@@ -0,0 +1,27 @@
+/**
+ * W767 — login failure limiter (fixed 60 s window).
+ *
+ * Counted per USERNAME and per CLIENT IP separately, so neither "spray one
+ * password over many accounts" nor "spray many passwords at one account" gets a
+ * free run, while a legitimate user behind a shared IP is only slowed after the
+ * same key fails repeatedly. Only FAILURES count; a success clears both keys of
+ * that attempt. In-memory on purpose: Studio is a single process, the window is
+ * one minute, and the counter must not survive a restart as a lockout.
+ */
+/** Window length in ms (the spec's 60 s). */
+export declare const AUTH_WINDOW_MS = 60000;
+/** Failures allowed inside one window before 429. */
+export declare const AUTH_MAX_FAILURES = 5;
+export interface FailureLimiter {
+    /** true = the key already exhausted its window (the caller answers 429). */
+    blocked(key: string): boolean;
+    /** Record one failure for the key (opens/extends its window). */
+    fail(key: string): void;
+    /** Forget the key (a successful login). */
+    clear(key: string): void;
+}
+export declare function createFailureLimiter(opts: {
+    now: () => number;
+    windowMs?: number;
+    maxFailures?: number;
+}): FailureLimiter;

package/dist/auth/rate-limit.js

@@ -0,0 +1,47 @@
+/**
+ * W767 — login failure limiter (fixed 60 s window).
+ *
+ * Counted per USERNAME and per CLIENT IP separately, so neither "spray one
+ * password over many accounts" nor "spray many passwords at one account" gets a
+ * free run, while a legitimate user behind a shared IP is only slowed after the
+ * same key fails repeatedly. Only FAILURES count; a success clears both keys of
+ * that attempt. In-memory on purpose: Studio is a single process, the window is
+ * one minute, and the counter must not survive a restart as a lockout.
+ */
+/** Window length in ms (the spec's 60 s). */
+export const AUTH_WINDOW_MS = 60_000;
+/** Failures allowed inside one window before 429. */
+export const AUTH_MAX_FAILURES = 5;
+/** Ceiling on tracked keys: a spray can never grow the map without bound. */
+const MAX_KEYS = 4_096;
+export function createFailureLimiter(opts) {
+    const windowMs = opts.windowMs ?? AUTH_WINDOW_MS;
+    const maxFailures = opts.maxFailures ?? AUTH_MAX_FAILURES;
+    const hits = new Map();
+    return {
+        blocked(key) {
+            const entry = hits.get(key);
+            return entry !== undefined && entry.resetAt > opts.now() && entry.count >= maxFailures;
+        },
+        fail(key) {
+            const now = opts.now();
+            prune(hits, now);
+            if (hits.size >= MAX_KEYS)
+                hits.clear();
+            const entry = hits.get(key);
+            if (entry === undefined || entry.resetAt <= now)
+                hits.set(key, { count: 1, resetAt: now + windowMs });
+            else
+                entry.count += 1;
+        },
+        clear(key) {
+            hits.delete(key);
+        },
+    };
+}
+function prune(hits, now) {
+    for (const [key, entry] of hits) {
+        if (entry.resetAt <= now)
+            hits.delete(key);
+    }
+}

package/dist/auth/token.d.ts

@@ -0,0 +1,49 @@
+/**
+ * W767 — Studio's OWN login cookie: token minting, verification, secret file.
+ *
+ * The cookie gate belongs to Studio alone: this module knows nothing about any
+ * other service, portal or credential store. The only external input is Studio's
+ * own password file, checked in `htpasswd.ts`.
+ *
+ * Token wire format (four dot-separated parts, all but the expiry base64url):
+ *
+ *     <b64url(user)> . <b64url(rand16)> . <expUnix> . <b64url(HMAC-SHA256)>
+ *
+ * The signature covers the FIRST THREE parts verbatim, so neither the user, the
+ * nonce nor the expiry can be edited without invalidating the cookie. The nonce
+ * makes every issued token unique (no replay of a captured value into a second
+ * browser). The secret is 32 random bytes kept in Studio's own data directory
+ * (mode 0600); it is created on first use and reused afterwards, so a restart
+ * does NOT log every user out.
+ */
+/** Cookie name (also the nginx `auth_request` marker name). */
+export declare const AUTH_COOKIE = "studio_auth";
+/** `<data dir>/studio-auth.secret` — this project's own secret, nothing else's. */
+export declare const AUTH_SECRET_FILE = "studio-auth.secret";
+/** 30 days, in seconds (the cookie's `Max-Age`). */
+export declare const AUTH_TTL_SECONDS = 2592000;
+/** Secret length in bytes (base64url-encoded on disk). */
+export declare const AUTH_SECRET_BYTES = 32;
+export type TokenCheck = {
+    ok: true;
+    user: string;
+} | {
+    ok: false;
+    reason: "malformed" | "bad_signature" | "expired";
+};
+/** base64url, no padding — the only encoding this cookie uses. */
+export declare function b64url(input: Buffer | string): string;
+/** Mint one token for `user`; `nowSeconds` is unix seconds (injectable for tests). */
+export declare function mintToken(user: string, secret: Buffer, nowSeconds: number, ttlSeconds?: number): string;
+/** Verify a token: shape, signature (constant-time) and expiry, in that order. */
+export declare function verifyToken(token: string, secret: Buffer, nowSeconds: number): TokenCheck;
+/** The `Set-Cookie` value: HttpOnly + Secure + SameSite=Lax, 30 days. */
+export declare function authCookie(token: string): string;
+/** One cookie's raw value out of a `Cookie:` header (null when absent). */
+export declare function cookieValue(header: string | undefined, name: string): string | null;
+/**
+ * Read the secret, creating it (32 random bytes, base64url, mode 0600) when the
+ * file is missing or unusable. A short/garbled file is regenerated rather than
+ * silently widening the key space.
+ */
+export declare function loadAuthSecret(path: string): Buffer;

package/dist/auth/token.js

@@ -0,0 +1,112 @@
+/**
+ * W767 — Studio's OWN login cookie: token minting, verification, secret file.
+ *
+ * The cookie gate belongs to Studio alone: this module knows nothing about any
+ * other service, portal or credential store. The only external input is Studio's
+ * own password file, checked in `htpasswd.ts`.
+ *
+ * Token wire format (four dot-separated parts, all but the expiry base64url):
+ *
+ *     <b64url(user)> . <b64url(rand16)> . <expUnix> . <b64url(HMAC-SHA256)>
+ *
+ * The signature covers the FIRST THREE parts verbatim, so neither the user, the
+ * nonce nor the expiry can be edited without invalidating the cookie. The nonce
+ * makes every issued token unique (no replay of a captured value into a second
+ * browser). The secret is 32 random bytes kept in Studio's own data directory
+ * (mode 0600); it is created on first use and reused afterwards, so a restart
+ * does NOT log every user out.
+ */
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { chmodSync, readFileSync, writeFileSync } from "node:fs";
+/** Cookie name (also the nginx `auth_request` marker name). */
+export const AUTH_COOKIE = "studio_auth";
+/** `<data dir>/studio-auth.secret` — this project's own secret, nothing else's. */
+export const AUTH_SECRET_FILE = "studio-auth.secret";
+/** 30 days, in seconds (the cookie's `Max-Age`). */
+export const AUTH_TTL_SECONDS = 2_592_000;
+/** Secret length in bytes (base64url-encoded on disk). */
+export const AUTH_SECRET_BYTES = 32;
+/** Upper bound on a cookie we are willing to decode (a 4-part token is ~120). */
+const MAX_TOKEN_CHARS = 512;
+/** base64url, no padding — the only encoding this cookie uses. */
+export function b64url(input) {
+    return Buffer.from(input).toString("base64url");
+}
+function signature(secret, payload) {
+    return createHmac("sha256", secret).update(payload).digest();
+}
+/** Mint one token for `user`; `nowSeconds` is unix seconds (injectable for tests). */
+export function mintToken(user, secret, nowSeconds, ttlSeconds = AUTH_TTL_SECONDS) {
+    const exp = Math.floor(nowSeconds + ttlSeconds);
+    const head = `${b64url(user)}.${b64url(randomBytes(16))}.${exp}`;
+    return `${head}.${b64url(signature(secret, head))}`;
+}
+/** Verify a token: shape, signature (constant-time) and expiry, in that order. */
+export function verifyToken(token, secret, nowSeconds) {
+    if (token.length === 0 || token.length > MAX_TOKEN_CHARS)
+        return { ok: false, reason: "malformed" };
+    const parts = token.split(".");
+    if (parts.length !== 4)
+        return { ok: false, reason: "malformed" };
+    const [userPart, noncePart, expPart, sigPart] = parts;
+    const expected = signature(secret, `${userPart}.${noncePart}.${expPart}`);
+    const given = Buffer.from(sigPart, "base64url");
+    if (given.length !== expected.length || !timingSafeEqual(given, expected))
+        return { ok: false, reason: "bad_signature" };
+    const exp = Number.parseInt(expPart, 10);
+    if (!Number.isSafeInteger(exp))
+        return { ok: false, reason: "malformed" };
+    if (exp <= Math.floor(nowSeconds))
+        return { ok: false, reason: "expired" };
+    const user = Buffer.from(userPart, "base64url").toString("utf8");
+    return user === "" ? { ok: false, reason: "malformed" } : { ok: true, user };
+}
+/** The `Set-Cookie` value: HttpOnly + Secure + SameSite=Lax, 30 days. */
+export function authCookie(token) {
+    return `${AUTH_COOKIE}=${token}; Path=/; Max-Age=${AUTH_TTL_SECONDS}; HttpOnly; Secure; SameSite=Lax`;
+}
+/** One cookie's raw value out of a `Cookie:` header (null when absent). */
+export function cookieValue(header, name) {
+    if (header === undefined)
+        return null;
+    for (const part of header.split(";")) {
+        const eq = part.indexOf("=");
+        if (eq <= 0)
+            continue;
+        if (part.slice(0, eq).trim() === name)
+            return part.slice(eq + 1).trim();
+    }
+    return null;
+}
+/**
+ * Read the secret, creating it (32 random bytes, base64url, mode 0600) when the
+ * file is missing or unusable. A short/garbled file is regenerated rather than
+ * silently widening the key space.
+ */
+export function loadAuthSecret(path) {
+    const existing = readSecretText(path);
+    if (existing !== null) {
+        const decoded = Buffer.from(existing, "base64url");
+        if (decoded.length >= AUTH_SECRET_BYTES)
+            return decoded;
+    }
+    const secret = randomBytes(AUTH_SECRET_BYTES);
+    writeFileSync(path, `${secret.toString("base64url")}\n`, { mode: 0o600 });
+    // `mode` is masked by the umask at creation; make 0600 unconditional.
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // A filesystem without chmod support still has the creation mode.
+    }
+    return secret;
+}
+function readSecretText(path) {
+    try {
+        const text = readFileSync(path, "utf8").trim();
+        return text === "" ? null : text;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/config.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Studio host configuration (paths + frozen constants).
+ *
+ * Everything here is a *host* decision: where the data files live, which
+ * directory the frontend build is served from, and the compile-time constants
+ * the legacy backend hardcoded (`DEFAULT_BIND`, `STATIC_ROOT`, `FS_ROOTS`).
+ * No engine semantics live here — those belong to the injected RuntimeAdapter.
+ */
+/** `src/main.rs:867` — the DEFAULT bind; the live one is written back at listen time. */
+export declare const DEFAULT_BIND = "127.0.0.1:3777";
+/**
+ * `src/main.rs` STATIC_ROOT: the Vite build, served read-only.
+ *
+ * W782: DERIVED, never written down. `apps/web/dist` lives inside this very
+ * checkout, so the repo root comes from `studioRepoRoot()` (this file's own
+ * location) — the previous literal broke silently every time the checkout moved
+ * or the frontend was relocated (it was `celestea_studio/frontend/dist` before
+ * W781). `STUDIO_STATIC_ROOT` still overrides it for an operator.
+ *
+ * H: an INSTALLED `@celestea/studio` has no checkout, so the frontend build is
+ * staged at `<package>/webdist` by `scripts/build-webdist.mjs` and preferred
+ * when present. A source checkout keeps `apps/web/dist` exactly as before.
+ */
+export declare function defaultStaticRoot(): string;
+/** `src/main.rs:1311` broadcast capacity; slow clients degrade to `lagged`. */
+export declare const BUS_CAPACITY = 512;
+/** `src/workspaces.rs:113` informational roots shown by GET /api/fs/browse. */
+export declare const FS_ROOTS: readonly string[];
+/** `src/workspaces.rs:115` fs browse entry cap. */
+export declare const MAX_DIR_ENTRIES = 200;
+/** `src/api.rs` MIN_STEPS: POST /api/config can only raise max_steps. */
+export declare const MIN_STEPS = 4096;
+/** Contract default context window (statusline fallback). */
+export declare const CONTEXT_WINDOW = 1000000;
+/**
+ * W767: Studio's OWN password file (read-only input to `htpasswd -vbi`). This
+ * is the file this project owns; no other service's credential store is ever
+ * consulted.
+ */
+export declare const DEFAULT_AUTH_HTPASSWD_FILE = "/etc/nginx/.htpasswd-studio";
+export interface StudioPaths {
+    /** CELESTEA_WORKSPACES_FILE ?? <cwd>/workspaces.json (mode 0644). */
+    workspacesFile: string;
+    /** CELESTEA_PROVIDERS_FILE ?? <cwd>/providers.json (mode 0600, secret). */
+    providersFile: string;
+    /** CELESTEA_PROMPTS_FILE ?? <cwd>/prompts.json (mode 0644). */
+    promptsFile: string;
+    /** STUDIO_STATIC_ROOT ?? the Vite build directory. */
+    staticRoot: string;
+    /**
+     * W767: `<data dir>/studio-auth.secret` (0600, created on first use) — the
+     * HMAC key of Studio's own login cookie. `CELESTEA_AUTH_SECRET_FILE` overrides.
+     */
+    authSecretFile: string;
+    /** W767: the read-only password file `CELESTEA_AUTH_HTPASSWD_FILE` overrides. */
+    authHtpasswdFile: string;
+}
+export interface StudioConfig {
+    /** Constant "celestea-studio" in /api/health. */
+    name: string;
+    bind: string;
+    apiKeyEnv: string;
+    /**
+     * H-security: the self-cert bearer token required on every `/api/*` request
+     * except `/api/health`. `null` = no token (loopback / nginx-delegated).
+     */
+    authToken: string | null;
+    paths: StudioPaths;
+}
+export interface StudioConfigInput {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    paths?: Partial<StudioPaths>;
+    /** H-security: explicit token (the `--token` flag); else `CELESTEA_AUTH_TOKEN`. */
+    authToken?: string | null;
+}
+/** Build the host config from the environment; every value is overridable. */
+export declare function loadStudioConfig(input?: StudioConfigInput): StudioConfig;

package/dist/config.js

@@ -0,0 +1,72 @@
+/**
+ * Studio host configuration (paths + frozen constants).
+ *
+ * Everything here is a *host* decision: where the data files live, which
+ * directory the frontend build is served from, and the compile-time constants
+ * the legacy backend hardcoded (`DEFAULT_BIND`, `STATIC_ROOT`, `FS_ROOTS`).
+ * No engine semantics live here — those belong to the injected RuntimeAdapter.
+ */
+import { dirname, join, resolve } from "node:path";
+import { AUTH_SECRET_FILE } from "./auth/token.js";
+import { readAuthToken } from "./auth/api-token.js";
+import { packagedWebDist, studioRepoRoot } from "./deployment.js";
+/** `src/main.rs:867` — the DEFAULT bind; the live one is written back at listen time. */
+export const DEFAULT_BIND = "127.0.0.1:3777";
+/**
+ * `src/main.rs` STATIC_ROOT: the Vite build, served read-only.
+ *
+ * W782: DERIVED, never written down. `apps/web/dist` lives inside this very
+ * checkout, so the repo root comes from `studioRepoRoot()` (this file's own
+ * location) — the previous literal broke silently every time the checkout moved
+ * or the frontend was relocated (it was `celestea_studio/frontend/dist` before
+ * W781). `STUDIO_STATIC_ROOT` still overrides it for an operator.
+ *
+ * H: an INSTALLED `@celestea/studio` has no checkout, so the frontend build is
+ * staged at `<package>/webdist` by `scripts/build-webdist.mjs` and preferred
+ * when present. A source checkout keeps `apps/web/dist` exactly as before.
+ */
+export function defaultStaticRoot() {
+    return packagedWebDist() ?? join(studioRepoRoot(), "apps", "web", "dist");
+}
+/** `src/main.rs:1311` broadcast capacity; slow clients degrade to `lagged`. */
+export const BUS_CAPACITY = 512;
+/** `src/workspaces.rs:113` informational roots shown by GET /api/fs/browse. */
+export const FS_ROOTS = ["/src", "/tmp", "/srv", "/home"];
+/** `src/workspaces.rs:115` fs browse entry cap. */
+export const MAX_DIR_ENTRIES = 200;
+/** `src/api.rs` MIN_STEPS: POST /api/config can only raise max_steps. */
+export const MIN_STEPS = 4096;
+/** Contract default context window (statusline fallback). */
+export const CONTEXT_WINDOW = 1_000_000;
+/**
+ * W767: Studio's OWN password file (read-only input to `htpasswd -vbi`). This
+ * is the file this project owns; no other service's credential store is ever
+ * consulted.
+ */
+export const DEFAULT_AUTH_HTPASSWD_FILE = "/etc/nginx/.htpasswd-studio";
+/** Build the host config from the environment; every value is overridable. */
+export function loadStudioConfig(input = {}) {
+    const env = input.env ?? process.env;
+    const cwd = input.cwd ?? process.cwd();
+    const explicit = input.paths ?? {};
+    const workspacesFile = explicit.workspacesFile ?? env["CELESTEA_WORKSPACES_FILE"] ?? resolve(cwd, "workspaces.json");
+    const paths = {
+        workspacesFile,
+        providersFile: explicit.providersFile ?? env["CELESTEA_PROVIDERS_FILE"] ?? resolve(cwd, "providers.json"),
+        promptsFile: explicit.promptsFile ?? env["CELESTEA_PROMPTS_FILE"] ?? resolve(cwd, "prompts.json"),
+        staticRoot: explicit.staticRoot ?? env["STUDIO_STATIC_ROOT"] ?? defaultStaticRoot(),
+        // W767: the login secret lives in the SAME data dir as workspaces.json —
+        // `createStudioEngine` derives `<data dir>` the same way, so there is one
+        // notion of "Studio's data directory", not two.
+        authSecretFile: explicit.authSecretFile ?? env["CELESTEA_AUTH_SECRET_FILE"] ?? join(dirname(workspacesFile), AUTH_SECRET_FILE),
+        authHtpasswdFile: explicit.authHtpasswdFile ?? env["CELESTEA_AUTH_HTPASSWD_FILE"] ?? DEFAULT_AUTH_HTPASSWD_FILE,
+    };
+    const token = input.authToken ?? readAuthToken(env);
+    return {
+        name: "celestea-studio",
+        bind: DEFAULT_BIND,
+        apiKeyEnv: env["CELESTEA_API_KEY_ENV"] ?? "CELESTEA_API_KEY",
+        authToken: token === null || token.trim() === "" ? null : token.trim(),
+        paths,
+    };
+}