@celestea/studio 2.7.1

package/dist/handlers/auth.js

@@ -0,0 +1,155 @@
+/**
+ * W767 — the three endpoints of Studio's OWN login-cookie gate.
+ *
+ *   GET  /login        the self-contained login page (always reachable)
+ *   POST /auth/login   verify against Studio's password file, then Set-Cookie
+ *   GET  /auth/check   200/401 for nginx `auth_request` (the actual gate)
+ *
+ * nginx asks `/auth/check` for every other path and rewrites a 401 into a
+ * redirect to `/login`; these three are the only paths exempted there. The
+ * backend therefore stays usable from localhost with no cookie (the engine's own
+ * API is unchanged) while the public host is gated by the cookie.
+ *
+ * Hard rules kept here:
+ *   - the password is verified through `htpasswd -vbi` (stdin, never argv);
+ *   - a SUCCESSFUL login answers 200 with `Set-Cookie` AND the navigation in the
+ *     same response (never a 302 — some mobile clients drop the cookie on a
+ *     redirect);
+ *   - the cookie value never reaches a log line, and a wrong password and an
+ *     unknown user are indistinguishable (401 both ways).
+ */
+import { failJson } from "./common.js";
+import { AUTH_COOKIE, AUTH_MAX_FAILURES, AUTH_WINDOW_MS, authCookie, cookieValue, createFailureLimiter, loadAuthSecret, loginPage, LOGIN_OK_PAGE, mintToken, verifyPassword, verifyToken, } from "../auth/index.js";
+const HTML = "text/html; charset=utf-8";
+const NO_STORE = "no-store";
+export function registerAuth(app, deps, table) {
+    const gate = createGate(deps);
+    const page = table.get("get_login");
+    const login = table.get("post_auth_login");
+    const check = table.get("get_auth_check");
+    app.on(page.method, page.honoPath, () => pageResponse(loginPage(), 200));
+    app.on(check.method, check.honoPath, (c) => {
+        const user = cookieUser(c, gate);
+        return user === null
+            ? jsonResponse({ ok: false, error: "unauthorized" }, 401)
+            : jsonResponse({ ok: true, user }, 200);
+    });
+    app.on(login.method, login.honoPath, (c) => loginResponse(c, gate));
+    return [page.id, login.id, check.id];
+}
+function createGate(deps) {
+    const limiter = createFailureLimiter({ now: Date.now, windowMs: AUTH_WINDOW_MS, maxFailures: AUTH_MAX_FAILURES });
+    const htpasswdFile = deps.config.paths.authHtpasswdFile;
+    let secret = null;
+    return {
+        limiter,
+        htpasswdFile,
+        secret: () => (secret ??= loadAuthSecret(deps.config.paths.authSecretFile)),
+    };
+}
+/** The user of a valid cookie, or null (missing / tampered / expired / unknown). */
+function cookieUser(c, gate) {
+    const raw = cookieValue(c.req.header("cookie"), AUTH_COOKIE);
+    if (raw === null)
+        return null;
+    const verdict = verifyToken(raw, gate.secret(), Math.floor(Date.now() / 1000));
+    return verdict.ok ? verdict.user : null;
+}
+/** One failed attempt is counted against BOTH the username and the client IP. */
+function attemptKeys(c, user) {
+    return [`u:${user.toLowerCase()}`, `ip:${clientIp(c)}`];
+}
+async function loginResponse(c, gate) {
+    const wantsJson = prefersJson(c);
+    const creds = await credentialsOf(c);
+    if (creds === null)
+        return denied(c, wantsJson, 401, "invalid username or password", "用户名或密码不正确");
+    const keys = attemptKeys(c, creds.user);
+    if (keys.some((key) => gate.limiter.blocked(key))) {
+        return wantsJson
+            ? failJson(c, 429, "too many failed login attempts", { retry_after: AUTH_WINDOW_MS / 1000 })
+            : pageResponse(loginPage("尝试次数过多，请稍后再试"), 429);
+    }
+    const verdict = verifyPassword(gate.htpasswdFile, creds.user, creds.pass);
+    if (verdict !== "ok") {
+        for (const key of keys)
+            gate.limiter.fail(key);
+        if (verdict === "error") {
+            warn(`password check failed to run (file=${gate.htpasswdFile}) — login denied`);
+            return denied(c, wantsJson, 500, "credential store unavailable", "凭据校验服务不可用，请联系管理员");
+        }
+        return denied(c, wantsJson, 401, "invalid username or password", "用户名或密码不正确");
+    }
+    for (const key of keys)
+        gate.limiter.clear(key);
+    const token = mintToken(creds.user, gate.secret(), Math.floor(Date.now() / 1000));
+    return wantsJson
+        ? jsonResponse({ ok: true, user: creds.user }, 200, { "set-cookie": authCookie(token) })
+        : pageResponse(LOGIN_OK_PAGE, 200, { "set-cookie": authCookie(token) });
+}
+function denied(c, wantsJson, status, error, pageError) {
+    return wantsJson ? failJson(c, status, error) : pageResponse(loginPage(pageError), status);
+}
+/** `{username, password}` out of a form post OR a JSON body; null when absent. */
+async function credentialsOf(c) {
+    let raw;
+    try {
+        raw = await c.req.text();
+    }
+    catch {
+        return null;
+    }
+    if (raw.trim() === "")
+        return null;
+    const type = (c.req.header("content-type") ?? "").toLowerCase();
+    if (type.includes("json")) {
+        try {
+            return pickCredentials(JSON.parse(raw));
+        }
+        catch {
+            return null;
+        }
+    }
+    return pickCredentials(Object.fromEntries(new URLSearchParams(raw)));
+}
+function pickCredentials(body) {
+    const user = body["username"];
+    const pass = body["password"];
+    if (typeof user !== "string" || typeof pass !== "string")
+        return null;
+    return user.trim() === "" || pass === "" ? null : { user: user.trim(), pass };
+}
+/** JSON clients (curl/API) get JSON; a browser form post gets a page back. */
+function prefersJson(c) {
+    const type = (c.req.header("content-type") ?? "").toLowerCase();
+    const accept = (c.req.header("accept") ?? "").toLowerCase();
+    return type.includes("json") || accept.includes("application/json");
+}
+/** The client IP nginx reports, else the (local) caller is one bucket. */
+function clientIp(c) {
+    const real = c.req.header("x-real-ip");
+    if (real !== undefined && real.trim() !== "")
+        return real.trim();
+    const forwarded = c.req.header("x-forwarded-for");
+    if (forwarded !== undefined) {
+        const first = forwarded.split(",")[0]?.trim();
+        if (first !== undefined && first !== "")
+            return first;
+    }
+    return "local";
+}
+function pageResponse(body, status, extra = {}) {
+    return new Response(body, {
+        status,
+        headers: { "content-type": HTML, "cache-control": NO_STORE, ...extra },
+    });
+}
+function jsonResponse(body, status, extra = {}) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { "content-type": "application/json; charset=utf-8", "cache-control": NO_STORE, ...extra },
+    });
+}
+function warn(message) {
+    process.stderr.write(`studio auth: ${message}\n`);
+}

package/dist/handlers/common.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Shared HTTP helpers for the Studio handlers.
+ *
+ * Error bodies follow the frozen convention: `{"ok":false,"error":"<verbatim
+ * source string>"}` (`contracts/endpoints.json` §conventions). Two handlers in
+ * the retired backend return only `{"error":…}` (POST /api/turn's empty-input case
+ * and the static/API 404); those keep their special shape and say so locally.
+ */
+import type { Context } from "hono";
+import { CapacityError } from "../runtime-adapter.js";
+import type { StudioServices } from "../plugins.js";
+import type { StoreResult } from "../store/result.js";
+/** Handler dependencies: the composed studio services. */
+export type Deps = StudioServices;
+export type JsonObject = Record<string, unknown>;
+/** `{ok:false,error}` with the contract status (plus optional extra fields). */
+export declare function failJson(c: Context, status: number, error: string, extra?: JsonObject): Response;
+/**
+ * W513 capacity response: 503 + `Retry-After` (the engine refused to create
+ * another live session or another concurrent turn, and waiting helps).
+ */
+export declare function capacityJson(c: Context, error: CapacityError): Response;
+/** Turn a store failure straight into its contract response. */
+export declare function storeFail(c: Context, failure: Extract<StoreResult<never>, {
+    ok: false;
+}>): Response;
+/** `{error}`-only body (POST /api/turn empty input, static/API 404). */
+export declare function errorOnly(c: Context, status: number, error: string): Response;
+export type BodyRead = {
+    ok: true;
+    body: JsonObject;
+} | {
+    ok: false;
+    response: Response;
+};
+/**
+ * Read a JSON object body. The retired backend's rejections are mirrored:
+ * missing body -> 415, unparsable -> 400, non-object -> 422.
+ */
+export declare function readJsonBody(c: Context, required?: boolean): Promise<BodyRead>;
+export type FieldRead<T> = {
+    ok: true;
+    value: T | undefined;
+} | {
+    ok: false;
+    response: Response;
+};
+/** Optional string field: absent/null -> undefined, wrong type -> 422. */
+export declare function strField(c: Context, body: JsonObject, name: string): FieldRead<string>;
+/** Optional number field (JSON numbers only; no numeric strings). */
+export declare function numField(c: Context, body: JsonObject, name: string): FieldRead<number>;
+/** Optional string[] field. */
+export declare function strArrayField(c: Context, body: JsonObject, name: string): FieldRead<string[]>;
+/** Optional free-form JSON object field. */
+export declare function objectField(c: Context, body: JsonObject, name: string): FieldRead<JsonObject>;
+/** The active session id, or null (used by /api/status, /api/clear, prompts). */
+export declare function activeSession(deps: Deps): string | null;
+/**
+ * W729: the mode of one session (`session.json.mode`; absent/unknown = the
+ * default `standard`, so a session created before this feature reads exactly as
+ * it always behaved). An unresolvable id also reads as the default — the
+ * endpoint that asked owns the 404.
+ */
+export declare function modeOfSession(deps: Deps, session: string | null): string;
+/**
+ * W870: does ONE session carry its OWN `session.json.model` override?
+ *
+ * `/api/status.model` is the session instance's profile model (global base +
+ * this override, see `runtime/session-compose.ts` `profileFor`), so a client
+ * cannot tell "the global default happens to equal this session's model" from
+ * "this session is pinned" by looking at `model` alone. The statusline's model
+ * picker needs exactly that distinction to say 「本会话已固定模型」 instead of
+ * silently switching something the user cannot see. An unresolvable id (and the
+ * detached/absent session) answers false — the endpoint that asked owns the 404.
+ */
+export declare function sessionModelCovered(deps: Deps, session: string | null): boolean;

package/dist/handlers/common.js

@@ -0,0 +1,127 @@
+/**
+ * Shared HTTP helpers for the Studio handlers.
+ *
+ * Error bodies follow the frozen convention: `{"ok":false,"error":"<verbatim
+ * source string>"}` (`contracts/endpoints.json` §conventions). Two handlers in
+ * the retired backend return only `{"error":…}` (POST /api/turn's empty-input case
+ * and the static/API 404); those keep their special shape and say so locally.
+ */
+import { CapacityError } from "../runtime-adapter.js";
+import { effectiveMode } from "../store/mode.js";
+import { readSessionMeta } from "../store/session-meta.js";
+/** `{ok:false,error}` with the contract status (plus optional extra fields). */
+export function failJson(c, status, error, extra) {
+    return c.json(extra === undefined ? { ok: false, error } : { ok: false, error, ...extra }, status);
+}
+/**
+ * W513 capacity response: 503 + `Retry-After` (the engine refused to create
+ * another live session or another concurrent turn, and waiting helps).
+ */
+export function capacityJson(c, error) {
+    const response = failJson(c, 503, error.message);
+    response.headers.set("retry-after", String(error.retryAfterSeconds));
+    return response;
+}
+/** Turn a store failure straight into its contract response. */
+export function storeFail(c, failure) {
+    return failJson(c, failure.status, failure.error, failure.extra);
+}
+/** `{error}`-only body (POST /api/turn empty input, static/API 404). */
+export function errorOnly(c, status, error) {
+    return c.json({ error }, status);
+}
+/**
+ * Read a JSON object body. The retired backend's rejections are mirrored:
+ * missing body -> 415, unparsable -> 400, non-object -> 422.
+ */
+export async function readJsonBody(c, required = true) {
+    const raw = await c.req.text();
+    if (raw.trim() === "") {
+        if (required)
+            return { ok: false, response: failJson(c, 415, "request body required") };
+        return { ok: true, body: {} };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { ok: false, response: failJson(c, 400, "invalid JSON body") };
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return { ok: false, response: failJson(c, 422, "expected a JSON object body") };
+    }
+    return { ok: true, body: parsed };
+}
+/** Optional string field: absent/null -> undefined, wrong type -> 422. */
+export function strField(c, body, name) {
+    const v = body[name];
+    if (v === undefined || v === null)
+        return { ok: true, value: undefined };
+    if (typeof v !== "string")
+        return { ok: false, response: failJson(c, 422, `field '${name}' must be a string`) };
+    return { ok: true, value: v };
+}
+/** Optional number field (JSON numbers only; no numeric strings). */
+export function numField(c, body, name) {
+    const v = body[name];
+    if (v === undefined || v === null)
+        return { ok: true, value: undefined };
+    if (typeof v !== "number" || !Number.isFinite(v))
+        return { ok: false, response: failJson(c, 422, `field '${name}' must be a number`) };
+    return { ok: true, value: v };
+}
+/** Optional string[] field. */
+export function strArrayField(c, body, name) {
+    const v = body[name];
+    if (v === undefined || v === null)
+        return { ok: true, value: undefined };
+    if (!Array.isArray(v) || v.some((x) => typeof x !== "string")) {
+        return { ok: false, response: failJson(c, 422, `field '${name}' must be an array of strings`) };
+    }
+    return { ok: true, value: v };
+}
+/** Optional free-form JSON object field. */
+export function objectField(c, body, name) {
+    const v = body[name];
+    if (v === undefined || v === null)
+        return { ok: true, value: undefined };
+    if (typeof v !== "object" || Array.isArray(v))
+        return { ok: false, response: failJson(c, 422, `field '${name}' must be an object`) };
+    return { ok: true, value: v };
+}
+/** The active session id, or null (used by /api/status, /api/clear, prompts). */
+export function activeSession(deps) {
+    return deps.workspaces.activeSession();
+}
+/**
+ * W729: the mode of one session (`session.json.mode`; absent/unknown = the
+ * default `standard`, so a session created before this feature reads exactly as
+ * it always behaved). An unresolvable id also reads as the default — the
+ * endpoint that asked owns the 404.
+ */
+export function modeOfSession(deps, session) {
+    if (session === null || session === "")
+        return effectiveMode(null);
+    const resolved = deps.sessions.resolve(session);
+    return effectiveMode(resolved.ok ? readSessionMeta(resolved.value.dir)?.mode : null);
+}
+/**
+ * W870: does ONE session carry its OWN `session.json.model` override?
+ *
+ * `/api/status.model` is the session instance's profile model (global base +
+ * this override, see `runtime/session-compose.ts` `profileFor`), so a client
+ * cannot tell "the global default happens to equal this session's model" from
+ * "this session is pinned" by looking at `model` alone. The statusline's model
+ * picker needs exactly that distinction to say 「本会话已固定模型」 instead of
+ * silently switching something the user cannot see. An unresolvable id (and the
+ * detached/absent session) answers false — the endpoint that asked owns the 404.
+ */
+export function sessionModelCovered(deps, session) {
+    if (session === null || session === "")
+        return false;
+    const resolved = deps.sessions.resolve(session);
+    if (!resolved.ok)
+        return false;
+    return (readSessionMeta(resolved.value.dir)?.model ?? "") !== "";
+}

package/dist/handlers/config-shape.d.ts

@@ -0,0 +1,76 @@
+/**
+ * The `/api/config` response shape, assembled from live stores.
+ *
+ * `available.models` is rebuilt on EVERY read from the providers store
+ * (`src/api.rs:61-68`): one row per (provider, model) pair — de-dup is per
+ * provider since W750 — carrying the display name (`provider`), the stable id
+ * (`provider_id`), whether that exact pair is the composed one (`active`) and
+ * `reasoning` = the model row declares at least one effort. `system_prompt` is
+ * either the host override (POST /api/config) or the registry assembly
+ * (`build_gen`).
+ *
+ * S1 (W729): `system_prompt` is the FOCUSED (active) session's assembly. The
+ * engine's own per-session prompt comes from the same function with an explicit
+ * session id, injected into the composer by `app.ts` — one assembly path, two
+ * callers, so the UI and the engine can never disagree about a session's mode.
+ */
+import { type SessionMode } from "../store/mode.js";
+import type { PromptScope } from "../store/prompts.js";
+import { type ResolvedSession } from "../store/sessions.js";
+import type { Deps, JsonObject } from "./common.js";
+export declare const EFFORTS: readonly string[];
+export interface AvailableModel {
+    id: string;
+    name: string;
+    /** Provider DISPLAY name (grouping header); `provider_id` is the stable id. */
+    provider: string;
+    /** W750: the provider's stable id — what a switch must send back. */
+    provider_id: string;
+    /** W750: this exact (provider, model) pair is the one the engine routes to. */
+    active: boolean;
+    reasoning: boolean;
+}
+/** Resolve the active session's directory (null when nothing is active). */
+export declare function activeResolved(deps: Deps): ResolvedSession | null;
+/** Prompt scope of the active session's workspace (global when unknown). */
+export declare function activeScope(deps: Deps): PromptScope;
+/** Prompt scope of one session (global when the session cannot be resolved). */
+export declare function scopeOf(deps: Deps, resolved: ResolvedSession | null): PromptScope;
+/** The session's directory, or null when the id does not resolve here. */
+export declare function resolveIfKnown(deps: Deps, sessionId: string | null): ResolvedSession | null;
+/** `prompt` binding of the active session, if it has one. */
+export declare function activePromptBinding(deps: Deps): string | null;
+/**
+ * The model picker's catalogue, rebuilt from the live providers store.
+ *
+ * W750 (bug fix): de-duplication is PER PROVIDER, never global. The same model
+ * id under two providers is two different choices — the provider is what decides
+ * the endpoint the request goes to — so a global `seen` set silently swallowed
+ * every provider after the first one that shared an id (production: provider
+ * 「基元」 vanished because it also lists `deepseek-flash`). Identical ids
+ * repeated INSIDE one provider are still dropped (a store typo, not a choice).
+ *
+ * `active` marks the single (provider, model) pair the engine would use right
+ * now: same model id AND same endpoint as the composed profile. When nothing
+ * matches the endpoint — a custom base_url override, or a non
+ * `chat_completions` provider whose switch never rewrites the endpoint — the
+ * model id alone is enough ONLY if it is unambiguous; an ambiguous id is left
+ * unmarked rather than marked wrong.
+ */
+export declare function availableModels(deps: Deps): AvailableModel[];
+/**
+ * Registry-assembled (or overridden) system prompt.
+ *
+ * W729 (§5.1 #4/#5, S1/S2): with an explicit `sessionId` the WHOLE assembly is
+ * resolved against THAT session — its workspace scope, its bound prompt, its
+ * `session.json` model, its own tool face and its own mode. That is what makes
+ * "one mode per session" true for a BACKGROUND session and not only for the focused one
+ * (R3); `null` keeps the historical reading (the ACTIVE session's scope, the
+ * process model, the default generation's tools), which is what the startup
+ * priming and `GET /api/config` use.
+ */
+export declare function assembleSystemPromptFor(deps: Deps, sessionId?: string | null, mode?: SessionMode, env?: NodeJS.ProcessEnv): string;
+/** Effective base_url: host override wins over the engine profile. */
+export declare function baseUrlOf(deps: Deps): string;
+/** GET /api/config body (also the POST /api/config response). */
+export declare function configView(deps: Deps): JsonObject;

package/dist/handlers/config-shape.js

@@ -0,0 +1,227 @@
+/**
+ * The `/api/config` response shape, assembled from live stores.
+ *
+ * `available.models` is rebuilt on EVERY read from the providers store
+ * (`src/api.rs:61-68`): one row per (provider, model) pair — de-dup is per
+ * provider since W750 — carrying the display name (`provider`), the stable id
+ * (`provider_id`), whether that exact pair is the composed one (`active`) and
+ * `reasoning` = the model row declares at least one effort. `system_prompt` is
+ * either the host override (POST /api/config) or the registry assembly
+ * (`build_gen`).
+ *
+ * S1 (W729): `system_prompt` is the FOCUSED (active) session's assembly. The
+ * engine's own per-session prompt comes from the same function with an explicit
+ * session id, injected into the composer by `app.ts` — one assembly path, two
+ * callers, so the UI and the engine can never disagree about a session's mode.
+ */
+import { deploymentFacts } from "../deployment.js";
+import { DEFAULT_SESSION_MODE } from "../store/mode.js";
+import { assembleSystemPrompt, resolveActivePrompt, toPromptVars } from "../store/prompts-compose.js";
+import { readSessionMeta } from "../store/session-meta.js";
+import { sessionWorkspaceOf } from "../store/sessions.js";
+import { activeSession } from "./common.js";
+export const EFFORTS = ["low", "high", "max"];
+/** Resolve the active session's directory (null when nothing is active). */
+export function activeResolved(deps) {
+    const id = activeSession(deps);
+    if (id === null)
+        return null;
+    const res = deps.sessions.resolve(id);
+    return res.ok ? res.value : null;
+}
+/** Prompt scope of the active session's workspace (global when unknown). */
+export function activeScope(deps) {
+    return scopeOf(deps, activeResolved(deps));
+}
+/** Prompt scope of one session (global when the session cannot be resolved). */
+export function scopeOf(deps, resolved) {
+    if (resolved === null)
+        return deps.prompts.scopeGlobal();
+    return deps.prompts.scopeWorkspace(resolved.workspace, resolved.wsPath);
+}
+/** The session's directory, or null when the id does not resolve here. */
+export function resolveIfKnown(deps, sessionId) {
+    if (sessionId === null || sessionId === "")
+        return null;
+    const res = deps.sessions.resolve(sessionId);
+    return res.ok ? res.value : null;
+}
+/** `prompt` binding of the active session, if it has one. */
+export function activePromptBinding(deps) {
+    const resolved = activeResolved(deps);
+    if (resolved === null)
+        return null;
+    return readSessionMeta(resolved.dir)?.prompt ?? null;
+}
+/**
+ * Provider display name that lists `model`, else "" (static rows).
+ *
+ * W750: the same model id can live under several providers, so the provider the
+ * engine actually routes to — the one whose `base_url` is the active one — wins;
+ * only when no provider matches the active endpoint does the first lister win
+ * (the historical reading, kept for custom endpoints).
+ */
+function providerOf(deps, model) {
+    const rows = deps.providers.rows();
+    const listed = rows.filter((p) => p.models.some((m) => m.id === model));
+    if (listed.length === 0)
+        return "";
+    const activeBase = trimSlash(baseUrlOf(deps));
+    const exact = listed.find((p) => trimSlash(p.base_url) === activeBase);
+    return (exact ?? listed[0]).name;
+}
+/** Trailing-slash-insensitive compare (providers.json and the profile differ). */
+function trimSlash(url) {
+    return url.replace(/\/+$/, "");
+}
+/**
+ * The model picker's catalogue, rebuilt from the live providers store.
+ *
+ * W750 (bug fix): de-duplication is PER PROVIDER, never global. The same model
+ * id under two providers is two different choices — the provider is what decides
+ * the endpoint the request goes to — so a global `seen` set silently swallowed
+ * every provider after the first one that shared an id (production: provider
+ * 「基元」 vanished because it also lists `deepseek-flash`). Identical ids
+ * repeated INSIDE one provider are still dropped (a store typo, not a choice).
+ *
+ * `active` marks the single (provider, model) pair the engine would use right
+ * now: same model id AND same endpoint as the composed profile. When nothing
+ * matches the endpoint — a custom base_url override, or a non
+ * `chat_completions` provider whose switch never rewrites the endpoint — the
+ * model id alone is enough ONLY if it is unambiguous; an ambiguous id is left
+ * unmarked rather than marked wrong.
+ */
+export function availableModels(deps) {
+    const activeModel = deps.runtime.profile().model;
+    const activeBase = trimSlash(baseUrlOf(deps));
+    const out = [];
+    for (const p of deps.providers.rows()) {
+        const seen = new Set();
+        const base = trimSlash(p.base_url);
+        for (const m of p.models) {
+            if (seen.has(m.id))
+                continue;
+            seen.add(m.id);
+            out.push({
+                id: m.id,
+                name: m.name === "" ? m.id : m.name,
+                provider: p.name,
+                provider_id: p.id,
+                active: m.id === activeModel && base === activeBase,
+                reasoning: m.reasoning_efforts.length > 0,
+            });
+        }
+    }
+    if (!out.some((e) => e.active)) {
+        const same = out.filter((e) => e.id === activeModel);
+        if (same.length === 1)
+            same[0].active = true;
+    }
+    return out;
+}
+/**
+ * W782: the `{{studio_*}}` values, resolved from the live deployment. Kept as a
+ * named helper so the derivation lives in ONE place and a test can pin it.
+ */
+function deploymentVars(deps, env) {
+    const facts = deploymentFacts(deps.config, env);
+    return {
+        studio_repo: facts.repo,
+        studio_frontend_dir: facts.frontendDir,
+        studio_static_root: facts.staticRoot,
+        studio_service: facts.service,
+        studio_bind: facts.bind,
+        studio_site: facts.publicSite,
+    };
+}
+/**
+ * Registry-assembled (or overridden) system prompt.
+ *
+ * W729 (§5.1 #4/#5, S1/S2): with an explicit `sessionId` the WHOLE assembly is
+ * resolved against THAT session — its workspace scope, its bound prompt, its
+ * `session.json` model, its own tool face and its own mode. That is what makes
+ * "one mode per session" true for a BACKGROUND session and not only for the focused one
+ * (R3); `null` keeps the historical reading (the ACTIVE session's scope, the
+ * process model, the default generation's tools), which is what the startup
+ * priming and `GET /api/config` use.
+ */
+export function assembleSystemPromptFor(deps, sessionId = null, mode, env = process.env) {
+    const override = deps.settings.systemPromptOverride();
+    if (override !== null)
+        return override;
+    const profile = deps.runtime.profile();
+    const scoped = sessionId === null ? null : resolveIfKnown(deps, sessionId);
+    const resolved = sessionId === null ? activeResolved(deps) : scoped;
+    const meta = resolved === null ? null : readSessionMeta(resolved.dir);
+    // The session's own model wins for a scoped assembly; the process model stays
+    // the source for the legacy (null) reading, so a no-mode session's prompt is
+    // byte-for-byte what it was before W729 (K8).
+    // TS 6.0 (TS2871, new syntactic nullish check): the inner `?? null` was
+    // redundant anyway — `meta?.model` is `string | undefined` and the outer `??`
+    // already covers both nullish cases, so the result type and behaviour are
+    // unchanged while the `?? null ?? x` pattern the new check rejects is gone.
+    const model = (scoped === null ? null : meta?.model) ?? profile.model;
+    const scope = scopeOf(deps, resolved);
+    // W768: the prompt's workspace NAME and ROOT PATH come from the ONE projector
+    // the composer also uses for the sandbox cwd (`sessionWorkspaceOf`) — a prompt
+    // naming one workspace while the shell starts in another is impossible now.
+    const workspace = sessionWorkspaceOf(resolved);
+    const vars = toPromptVars({
+        model,
+        provider: providerOf(deps, model),
+        base_url: baseUrlOf(deps),
+        workspace: workspace?.name ?? "",
+        workspace_dir: workspace?.path ?? "",
+        session: resolved?.id ?? "",
+        // W791 (P1, S2/M9): the tool face follows the RESOLVED session — for the
+        // legacy (null) reading that is the FOCUSED session, for a scoped one the
+        // session itself. A no-mode session's face is the full registry, so the
+        // rendered value of every pre-P1 session is unchanged.
+        tools: toolsOf(deps, resolved?.id ?? null).map((t) => t.name).join(", "),
+        context_window: profile.context_window,
+        max_output_tokens: profile.max_output_tokens,
+        date: new Date().toISOString().slice(0, 10),
+        // W782: the deployment facts the `environment` section renders. Every one is
+        // derived here (this process's own checkout + the operator's config), so the
+        // template states where the RUNNING service actually is — not where some
+        // hand-edited string once said it was.
+        ...deploymentVars(deps, env),
+    });
+    const binding = scoped === null ? activePromptBinding(deps) : (meta?.prompt ?? null);
+    // `mode` (explicit) wins over the session's own: the BASE generation is primed
+    // with the DEFAULT mode on purpose, so one execution session can never leak
+    // its variant into the prompt every session without a mode inherits (R3).
+    return assembleSystemPrompt(deps.prompts, scope, resolveActivePrompt(deps.prompts, scope, binding), vars, mode ?? meta?.mode ?? DEFAULT_SESSION_MODE);
+}
+/**
+ * The tool face the `{{tools}}` variable renders: the session's own generation
+ * when it has one, else the default generation. W791 (P1): in `execution` mode
+ * the session's generation PROVIDES the folded face, so the rendered list is the
+ * same set `GET /api/tools?session=X` answers (M9) — one source, two readers.
+ */
+function toolsOf(deps, sessionId) {
+    const sessionTools = deps.runtime.sessionTools;
+    if (sessionId === null || sessionTools === undefined)
+        return deps.runtime.tools();
+    return sessionTools.call(deps.runtime, sessionId);
+}
+/** Effective base_url: host override wins over the engine profile. */
+export function baseUrlOf(deps) {
+    return deps.settings.baseUrlOverride() ?? deps.runtime.profile().base_url;
+}
+/** GET /api/config body (also the POST /api/config response). */
+export function configView(deps) {
+    const profile = deps.runtime.profile();
+    return {
+        model: profile.model,
+        base_url: baseUrlOf(deps),
+        max_steps: profile.max_steps,
+        max_parallel_tool_calls: profile.max_parallel_tool_calls,
+        reasoning_effort: profile.reasoning_effort,
+        max_output_tokens: profile.max_output_tokens,
+        context_window: profile.context_window,
+        system_prompt: assembleSystemPromptFor(deps),
+        api_key_env: deps.config.apiKeyEnv,
+        available: { models: availableModels(deps), efforts: [...EFFORTS] },
+    };
+}